rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 1-....: (3 ticks this GP) idle=af54/1/0x4000000000000000 softirq=107925/107925 fqs=5 rcu: hardirqs softirqs csw/system rcu: number: 5 51 5 rcu: cputime: 0 11 10 ==> 48720(ms) rcu: (detected by 0, t=10505 jiffies, g=158881, q=425 ncpus=2) Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 35 Comm: kworker/u8:2 Not tainted 6.10.0-rc6-syzkaller-00163-g661e504db04c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:__raw_callee_save___pv_queued_spin_unlock+0x0/0x18 Code: 5b 41 5a 41 59 41 58 5f 5e 5a 59 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 52 b8 01 00 00 00 31 d2 f0 0f b0 17 75 06 5a c3 cc cc RSP: 0018:ffffc90000a18d48 EFLAGS: 00000082 RAX: 1ffffffff1b43335 RBX: ffff8880631132e8 RCX: ffffffff816c4a53 RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8880631132e8 RBP: ffff8880631132f0 R08: 0000000000000000 R09: ffffed100c62265d R10: ffff8880631132eb R11: 0000000000000005 R12: ffff8880631132f8 R13: ffff88801e7c1000 R14: ffff888063113340 R15: ffff88823bd16e00 FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdd36304030 CR3: 000000000d97a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pv_queued_spin_unlock arch/x86/include/asm/paravirt.h:589 [inline] queued_spin_unlock arch/x86/include/asm/qspinlock.h:57 [inline] do_raw_spin_unlock+0x172/0x230 kernel/locking/spinlock_debug.c:142 __raw_spin_unlock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_unlock+0x1e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] advance_sched+0x611/0xc60 net/sched/sch_taprio.c:981 __run_hrtimer kernel/time/hrtimer.c:1689 [inline] __hrtimer_run_queues+0x20c/0xcc0 kernel/time/hrtimer.c:1753 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1815 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x10f/0x450 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:preempt_count_sub+0x29/0x160 kernel/sched/core.c:5897 Code: 90 f3 0f 1e fa 48 c7 c0 e0 5b b4 94 53 89 fb 48 ba 00 00 00 00 00 fc ff df 48 89 c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 <38> d0 7c 08 84 d2 0f 85 df 00 00 00 8b 0d 75 cf 56 13 85 c9 75 1b RSP: 0018:ffffc90000ab6af8 EFLAGS: 00000206 RAX: 0000000000000003 RBX: 0000000000000001 RCX: 1ffffffff2968b7c RDX: 0000000000000004 RSI: ffffffff813ce8e5 RDI: 0000000000000001 RBP: ffffc90000ab7f30 R08: 0000000000000006 R09: ffffc90000ab7ef0 R10: ffffc90000ab7f30 R11: 0000000000000004 R12: ffffc90000ab0000 R13: ffffc90000ab8000 R14: ffffc90000ab7f38 R15: ffffc90000ab7ef0 unwind_next_frame+0x11ef/0x23a0 arch/x86/kernel/unwind_orc.c:672 arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3940 [inline] slab_alloc_node mm/slub.c:4002 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4009 fill_pool+0x26b/0x5d0 lib/debugobjects.c:168 debug_objects_fill_pool lib/debugobjects.c:615 [inline] debug_object_activate+0x151/0x540 lib/debugobjects.c:704 debug_rcu_head_queue kernel/rcu/rcu.h:227 [inline] kvfree_call_rcu+0x30/0xbe0 kernel/rcu/tree.c:3772 cfg80211_update_known_bss+0x39f/0x1150 net/wireless/scan.c:1862 __cfg80211_bss_update+0x1aa/0x24c0 net/wireless/scan.c:1908 cfg80211_inform_single_bss_data+0x743/0x2080 net/wireless/scan.c:2289 cfg80211_inform_bss_data+0x205/0x39d0 net/wireless/scan.c:3117 cfg80211_inform_bss_frame_data+0x271/0x7c0 net/wireless/scan.c:3207 ieee80211_bss_info_update+0x311/0xab0 net/mac80211/scan.c:226 ieee80211_rx_bss_info net/mac80211/ibss.c:1099 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1578 [inline] ieee80211_ibss_rx_queued_mgmt+0x1898/0x2f40 net/mac80211/ibss.c:1605 ieee80211_iface_process_skb net/mac80211/iface.c:1603 [inline] ieee80211_iface_work+0xc07/0xf00 net/mac80211/iface.c:1657 cfg80211_wiphy_work+0x255/0x330 net/wireless/core.c:437 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3248 process_scheduled_works kernel/workqueue.c:3329 [inline] worker_thread+0x6c8/0xf30 kernel/workqueue.c:3409 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 rcu: rcu_preempt kthread timer wakeup didn't happen for 4858 jiffies! g158881 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 rcu: Possible timer handling issue on cpu=0 timer-softirq=128187 rcu: rcu_preempt kthread starved for 4859 jiffies! g158881 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:I stack:27584 pid:17 tgid:17 ppid:2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5408 [inline] __schedule+0xf15/0x5d00 kernel/sched/core.c:6745 __schedule_loop kernel/sched/core.c:6822 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6837 schedule_timeout+0x136/0x2a0 kernel/time/timer.c:2581 rcu_gp_fqs_loop+0x1eb/0xb00 kernel/rcu/tree.c:2000 rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2202 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 rcu: Stack dump where RCU GP kthread last ran: CPU: 0 PID: 24487 Comm: dhcpcd Not tainted 6.10.0-rc6-syzkaller-00163-g661e504db04c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 RIP: 0010:kvm_wait+0x146/0x180 arch/x86/kernel/kvm.c:1064 Code: 5b 5d 41 5c 41 5d e9 89 af 51 00 e8 84 af 51 00 e8 bf f6 58 00 66 90 e8 78 af 51 00 0f 00 2d c1 78 ed 09 e8 6c af 51 00 fb f4 <5b> 5d 41 5c 41 5d e9 5f af 51 00 e8 5a af 51 00 e8 c5 f4 58 00 e9 RSP: 0000:ffffc90000007348 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 1ffffffff28568d0 RDX: ffff888060813c00 RSI: ffffffff813c3524 RDI: ffffffff8b8ff680 RBP: ffff8880232f0150 R08: 0000000000000001 R09: fffffbfff284ce70 R10: ffffffff94267387 R11: 0000000000000003 R12: 0000000000000003 R13: 0000000000000003 R14: ffff8880b923fa40 R15: ffffed100465e02a FS: 00007f3460982740(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3460981020 CR3: 000000004bda6000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pv_wait arch/x86/include/asm/paravirt.h:596 [inline] pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:466 [inline] __pv_queued_spin_lock_slowpath+0x4de/0xcc0 kernel/locking/qspinlock.c:508 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x210/0x2c0 kernel/locking/spinlock_debug.c:116 spin_lock_bh include/linux/spinlock.h:356 [inline] cfg80211_inform_single_bss_data+0x725/0x2080 net/wireless/scan.c:2288 cfg80211_inform_bss_data+0x205/0x39d0 net/wireless/scan.c:3117 cfg80211_inform_bss_frame_data+0x271/0x7c0 net/wireless/scan.c:3207 ieee80211_bss_info_update+0x311/0xab0 net/mac80211/scan.c:226 ieee80211_scan_rx+0x47c/0xad0 net/mac80211/scan.c:340 __ieee80211_rx_handle_packet net/mac80211/rx.c:5222 [inline] ieee80211_rx_list+0x1be1/0x2e90 net/mac80211/rx.c:5459 ieee80211_rx_napi+0xdd/0x400 net/mac80211/rx.c:5482 ieee80211_rx include/net/mac80211.h:5093 [inline] ieee80211_handle_queued_frames+0xd5/0x130 net/mac80211/main.c:438 tasklet_action_common.constprop.0+0x24c/0x3e0 kernel/softirq.c:785 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194 Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 e6 c7 80 f6 48 89 df e8 ce 44 81 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 e5 86 72 f6 65 8b 05 b6 d3 18 75 85 c0 74 16 5b RSP: 0000:ffffc90003bd75a8 EFLAGS: 00000246 RAX: 0000000000000006 RBX: ffff88813fffad40 RCX: 1ffffffff284d2d0 RDX: 0000000000000000 RSI: ffffffff8b2caf00 RDI: ffffffff8b8ff680 RBP: 0000000000000202 R08: 0000000000000001 R09: fffffbfff284ce58 R10: ffffffff942672c7 R11: 0000000000000002 R12: dffffc0000000000 R13: ffff8880b9244b00 R14: 000000000000003f R15: 0000000000000000 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] rmqueue_bulk mm/page_alloc.c:2261 [inline] __rmqueue_pcplist+0xc62/0x1550 mm/page_alloc.c:2934 rmqueue_pcplist mm/page_alloc.c:2976 [inline] rmqueue mm/page_alloc.c:3013 [inline] get_page_from_freelist+0x7d1/0x2e50 mm/page_alloc.c:3422 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4683 alloc_pages_mpol_noprof+0x275/0x610 mm/mempolicy.c:2265 vma_alloc_folio_noprof+0xad/0x1f0 mm/mempolicy.c:2304 folio_prealloc mm/memory.c:1050 [inline] wp_page_copy mm/memory.c:3285 [inline] do_wp_page+0x1acd/0x3340 mm/memory.c:3677 handle_pte_fault mm/memory.c:5397 [inline] __handle_mm_fault+0x2311/0x5430 mm/memory.c:5524 handle_mm_fault+0x476/0xa00 mm/memory.c:5689 do_user_addr_fault+0x426/0xe50 arch/x86/mm/fault.c:1338 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7f346097e27f Code: c3 f3 0f 1e fa e9 4b ff ff ff 31 c0 48 83 3d b7 2d 00 00 00 0f 95 c0 c3 52 48 8b 3d ab 2d 00 00 48 85 ff 74 10 e8 c1 fe ff ff <48> c7 05 96 2d 00 00 00 00 00 00 48 8b 3d 97 2d 00 00 48 85 ff 74 RSP: 002b:00007ffd42568630 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00007ffd425686c8 RCX: 000000000000001f RDX: 0000556a2076c37a RSI: 0000556f767f2010 RDI: 0000556f7681a660 RBP: 00007ffd425686c8 R08: 0000000000000001 R09: efe42c8a1525674f R10: 0000000000000140 R11: 0000000000000007 R12: 0000556f767f3930 R13: 00007ffd42568c98 R14: 0000000000000003 R15: 0000000000000000