------------[ cut here ]------------
WARNING: kernel/rcu/tree_stall.h:1049 at rcu_check_gp_start_stall+0x2e4/0x470 kernel/rcu/tree_stall.h:1049, CPU#1: syz.3.219/6714
Modules linked in:
CPU: 1 UID: 0 PID: 6714 Comm: syz.3.219 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:rcu_check_gp_start_stall+0x2e4/0x470 kernel/rcu/tree_stall.h:1049
Code: ff ff 48 c7 c7 a0 85 8f 99 be 04 00 00 00 e8 03 8e 7f 00 4c 89 f7 b8 01 00 00 00 87 05 05 f9 e7 17 85 c0 0f 85 17 ff ff ff 90 <0f> 0b 90 48 81 ff 80 6e f4 8d 74 47 48 c7 c0 a0 52 82 8f 48 c1 e8
RSP: 0018:ffffc90000a08d98 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff81a78c8d
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff8df46e80
RBP: ffffc90000a08f30 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff331f0b4 R12: 0000000000002904
R13: 1ffff110170e771a R14: ffffffff8df46e80 R15: dffffc0000000000
FS:  00007faef34906c0(0000) GS:ffff888125f1f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faef27e5fa8 CR3: 0000000030e99000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 rcu_core+0x5f5/0x1720 kernel/rcu/tree.c:2852
 handle_softirqs+0x22b/0x7c0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x60/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:37 [inline]
RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:139 [inline]
RIP: 0010:wrmsrq arch/x86/include/asm/msr.h:199 [inline]
RIP: 0010:native_apic_msr_write+0x39/0x50 arch/x86/include/asm/apic.h:212
Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 e9 7b c2 9d ff cc f3 0f 1e fa 89 f6 31 d2 e9 42 0c 55 03 66
RSP: 0018:ffffc9001e02fb28 EFLAGS: 00000246
RAX: 00000000000000f6 RBX: 0000000000000200 RCX: 000000000000083f
RDX: 0000000000000000 RSI: 00000000000000f6 RDI: 000000000000083f
RBP: ffffc9001e02fc00 R08: ffffc9001e02fb87 R09: 1ffff92003c05f70
R10: dffffc0000000000 R11: fffff52003c05f71 R12: ffff8880b8731c01
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8880b8731c70
 __apic_send_IPI_self arch/x86/include/asm/apic.h:459 [inline]
 arch_irq_work_raise+0x6d/0x80 arch/x86/kernel/irq_work.c:31
 irq_work_raise kernel/irq_work.c:84 [inline]
 __irq_work_queue_local+0x1d7/0x530 kernel/irq_work.c:112
 irq_work_queue+0x99/0x140 kernel/irq_work.c:124
 bpf_send_signal_common+0x39d/0x530 kernel/trace/bpf_trace.c:871
 ____bpf_send_signal kernel/trace/bpf_trace.c:880 [inline]
 bpf_send_signal+0x1d/0x30 kernel/trace/bpf_trace.c:878
 bpf_prog_948316cddd0b7b1c+0x41/0x49
 bpf_dispatcher_nop_func include/linux/bpf.h:1378 [inline]
 __bpf_prog_run include/linux/filter.h:723 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline]
 bpf_trace_run2+0x284/0x4c0 kernel/trace/bpf_trace.c:2116
 __bpf_trace_sys_enter+0x38/0x60 include/trace/events/syscalls.h:18
 __do_trace_sys_enter include/trace/events/syscalls.h:18 [inline]
 trace_sys_enter+0x9a/0xf0 include/trace/events/syscalls.h:18
 syscall_trace_enter+0xf9/0x160 kernel/entry/syscall-common.c:53
 syscall_enter_from_user_mode_work include/linux/entry-common.h:78 [inline]
 syscall_enter_from_user_mode include/linux/entry-common.h:109 [inline]
 do_syscall_64+0xc5/0xf80 arch/x86/entry/syscall_64.c:90
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faef252b829
Code: 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 04 25
RSP: 002b:00007faef348fb40 EFLAGS: 00000246 ORIG_RAX: 000000000000000f
RAX: ffffffffffffffda RBX: 00007faef27e5fa8 RCX: 00007faef252b829
RDX: 00007faef348fb40 RSI: 00007faef348fc70 RDI: 0000000000000011
RBP: 00007faef27e5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007faef27e6038 R14: 00007ffd8d0a7620 R15: 00007ffd8d0a7708
 </TASK>
----------------
Code disassembly (best guess):
   0:	74 2a                	je     0x2c
   2:	83 ff 30             	cmp    $0x30,%edi
   5:	74 25                	je     0x2c
   7:	eb 10                	jmp    0x19
   9:	81 ff d0 00 00 00    	cmp    $0xd0,%edi
   f:	74 1b                	je     0x2c
  11:	81 ff e0 00 00 00    	cmp    $0xe0,%edi
  17:	74 13                	je     0x2c
  19:	c1 ef 04             	shr    $0x4,%edi
  1c:	81 c7 00 08 00 00    	add    $0x800,%edi
  22:	89 f9                	mov    %edi,%ecx
  24:	89 f0                	mov    %esi,%eax
  26:	31 d2                	xor    %edx,%edx
  28:	0f 30                	wrmsr
* 2a:	66 90                	xchg   %ax,%ax <-- trapping instruction
  2c:	e9 7b c2 9d ff       	jmp    0xff9dc2ac
  31:	cc                   	int3
  32:	f3 0f 1e fa          	endbr64
  36:	89 f6                	mov    %esi,%esi
  38:	31 d2                	xor    %edx,%edx
  3a:	e9 42 0c 55 03       	jmp    0x3550c81
  3f:	66                   	data16