rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 0-...!: (3 ticks this GP) idle=9344/1/0x4000000000000000 softirq=19239/19239 fqs=6
rcu: (detected by 1, t=10502 jiffies, g=16013, q=2314 ncpus=2)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 5970 Comm: kworker/u8:11 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:97 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:115 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:140 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:172 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:191 [inline]
RIP: 0010:kasan_check_range+0x159/0x1e0 mm/kasan/generic.c:200
Code: 90 48 83 c0 01 49 89 d3 48 39 d0 74 0f 80 38 00 74 ef 4e 8d 5c 25 00 48 85 c0 75 9d 48 89 da 4c 89 d8 4c 29 da e9 32 ff ff ff <48> 85 d2 74 98 48 01 ea eb 1a 66 66 2e 0f 1f 84 00 00 00 00 00 66
RSP: 0018:ffffc90000007d30 EFLAGS: 00000083
RAX: ffffed1005470855 RBX: ffffed1005470856 RCX: ffffffff81e64419
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88802a3842a8
RBP: ffffed1005470855 R08: 0000000000000001 R09: ffffed1005470855
R10: ffff88802a3842ab R11: 0000000000000000 R12: 1ffff92000000fab
R13: ffff88802a3842b8 R14: ffff8880b8428540 R15: ffff8880b8428590
FS: 0000000000000000(0000) GS:ffff888123ddc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe476f2fc8 CR3: 000000007e3fe000 CR4: 00000000003526f0
Call Trace:
instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1300 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
do_raw_spin_lock+0x119/0x260 kernel/locking/spinlock_debug.c:116
spin_lock include/linux/spinlock.h:342 [inline]
advance_sched+0xe5/0xd20 net/sched/sch_taprio.c:930
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
hrtimer_interrupt+0x3e5/0x940 kernel/time/hrtimer.c:2215
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
__sysvec_apic_timer_interrupt+0x109/0x470 arch/x86/kernel/apic/apic.c:1068
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872
Code: 05 fb 4d 7e 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 86 85 3c 0f 0f 82 ac 02 00 00 8b 35 4e b9 3c 0f 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 9d 4d 7e 12 0f 85 ec 02 00 00 48 83 c4
RSP: 0018:ffffc9000515edd0 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8e17fc5f RDI: ffffffff8c401580
RBP: ffffffff8ebe8180 R08: 000000001f586c59 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:840 [inline]
class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_flags_noprof+0x371/0x8b0 mm/slub.c:5528
_kmalloc_flags_noprof mm/slab.h:39 [inline]
__alloc_empty_sheaf mm/slub.c:2751 [inline]
alloc_empty_sheaf mm/slub.c:2771 [inline]
__pcs_replace_empty_main+0x41a/0x680 mm/slub.c:4670
alloc_from_pcs mm/slub.c:4773 [inline]
slab_alloc_node mm/slub.c:4905 [inline]
__do_kmalloc_node mm/slub.c:5333 [inline]
__kmalloc_noprof+0x66d/0x820 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
cfg80211_inform_single_bss_data+0x557/0x1dc0 net/wireless/scan.c:2354
cfg80211_inform_bss_data+0x230/0x3b60 net/wireless/scan.c:3241
cfg80211_inform_bss_frame_data+0x245/0x7c0 net/wireless/scan.c:3333
ieee80211_bss_info_update+0x310/0xab0 net/mac80211/scan.c:230
ieee80211_rx_bss_info net/mac80211/ibss.c:1063 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1544 [inline]
ieee80211_ibss_rx_queued_mgmt+0xe04/0x1c70 net/mac80211/ibss.c:1571
ieee80211_iface_process_skb net/mac80211/iface.c:1769 [inline]
ieee80211_iface_work+0xa9a/0x1070 net/mac80211/iface.c:1823
cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: rcu_preempt kthread starved for 10484 jiffies! g16013 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27592 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x125c/0x6730 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7326
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2123
rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2325
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 5608 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline]
RIP: 0010:smp_call_function_many_cond+0x5b2/0x1870 kernel/smp.c:912
Code: 64 99 0c 00 f3 90 41 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 a8 10 00 00 8b 45 08 31 ff 83 e0 01 41 89 c6 89 c6 e8 ae 93 0c 00 <45> 85 f6 75 d0 e8 34 99 0c 00 e8 2f 99 0c 00 83 c3 01 bf 07 00 00
RSP: 0018:ffffc900039bf630 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81fdc702
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff88807c902540
RBP: ffff8880b8443680 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003
R13: ffffed10170886d1 R14: 0000000000000001 R15: ffff8880b853c880
FS: 0000000000000000(0000) GS:ffff888123edc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557c44d65be0 CR3: 000000005d6d6000 CR4: 00000000003526f0
Call Trace:
on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1077
__flush_tlb_multi arch/x86/include/asm/paravirt.h:46 [inline]
flush_tlb_multi arch/x86/mm/tlb.c:1361 [inline]
flush_tlb_mm_range+0x45f/0x16f0 arch/x86/mm/tlb.c:1451
tlb_flush arch/x86/include/asm/tlb.h:23 [inline]
tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:509 [inline]
tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:499 [inline]
tlb_flush_mmu mm/mmu_gather.c:423 [inline]
tlb_finish_mmu+0x3fe/0x810 mm/mmu_gather.c:549
exit_mmap+0x454/0xa00 mm/mmap.c:1313
__mmput+0x12a/0x410 kernel/fork.c:1187
mmput+0x67/0x80 kernel/fork.c:1210
exit_mm kernel/exit.c:615 [inline]
do_exit+0x8b1/0x2ae0 kernel/exit.c:997
do_group_exit+0xd5/0x2a0 kernel/exit.c:1152
get_signal+0x1ec7/0x21e0 kernel/signal.c:3046
arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x139/0x6f0 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f016b75e6ce
Code: Unable to access opcode bytes at 0x7f016b75e6a4.
RSP: 002b:00007ffdcffee648 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6
RAX: 0000000000000000 RBX: 000055558a666500 RCX: 00007f016b75e6ce
RDX: 00007ffdcffee6a0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffdcffee70c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001a
R13: 000000000000003e R14: 000000000001e24f R15: 00007ffdcffee760