GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P5625/1:b..l P8615/1:b..l P10386/1:b..l P5287/1:b..l P12541/1:b..l P12523/1:b..l
rcu: 	(detected by 0, t=10504 jiffies, g=53505, q=1741 ncpus=2)
task:syz.0.1788      state:R  running task     stack:24760 pid:12523 tgid:12523 ppid:5625   task_flags:0x400040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7413
 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
 __local_bh_enable_ip+0xe1/0x130 kernel/softirq.c:457
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 cfg80211_mlme_unregister_socket+0x2c8/0x650 net/wireless/mlme.c:823
 nl80211_netlink_notify+0x35d/0x860 net/wireless/nl80211.c:22951
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
 netlink_release+0x11f8/0x1a80 net/netlink/af_netlink.c:762
 __sock_release net/socket.c:710 [inline]
 sock_close+0xad/0x220 net/socket.c:1501
 __fput+0x418/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1fa/0x730 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8fe819de59
RSP: 002b:00007ffc4d038d18 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f8fe8427da0 RCX: 00007f8fe819de59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f8fe8427da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007f8fe8427cb0 R11: 0000000000000246 R12: 000000000004e0f7
R13: 00007f8fe842627c R14: 000000000004deb6 R15: 00007f8fe8426270
 </TASK>
task:kworker/u8:13   state:R  running task     stack:28280 pid:12541 tgid:12541 ppid:8618   task_flags:0x8040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7556
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x221/0x350 kernel/locking/lockdep.c:5872
Code: ff ff ff e8 61 ef 2c 0a f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 4b 5a ca 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 98 dd b8
RSP: 0018:ffffc90005c377c0 EFLAGS: 00000286
RAX: 7e26e2dc16eab800 RBX: 0000000000000000 RCX: 0000000000000046
RDX: 00000000d9196744 RSI: ffffffff8e4af5f8 RDI: ffffffff8c4bd380
RBP: ffffffff8176f27f R08: ffffffff8176f27f R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000002
R13: ffffffff8eb59c60 R14: 0000000000000000 R15: 0000000000000246
 rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 rcu_read_lock include/linux/rcupdate.h:840 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
 unwind_next_frame+0xac/0x2550 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 save_stack+0x122/0x230 mm/page_owner.c:165
 __reset_page_owner+0x71/0x1f0 mm/page_owner.c:320
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
 __slab_free+0x274/0x2c0 mm/slub.c:5767
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_kmalloc+0x22/0xb0 mm/kasan/common.c:406
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5515
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 alloc_bprm+0x79/0x640 fs/exec.c:1435
 class_bprm_constructor fs/exec.c:1497 [inline]
 kernel_execve+0x85/0x9c0 fs/exec.c:1889
 call_usermodehelper_exec_async+0x20f/0x360 kernel/umh.c:109
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:dhcpcd          state:R  running task     stack:21736 pid:5287  tgid:5287  ppid:5286   task_flags:0x400140 flags:0x00080800
Call Trace:
 <TASK>
 </TASK>
task:kworker/u8:18   state:R  running task     stack:26568 pid:10386 tgid:10386 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: krds_cp_wq#7/5 rds_connect_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7556
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:kasan_byte_accessible+0x0/0x30 mm/kasan/generic.c:204
Code: 04 eb 92 4d 01 f3 49 83 c3 05 eb 89 bb 06 00 00 00 e9 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <0f> 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df 0f b6 04 07
RSP: 0018:ffffc90005f6f3f0 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffffff823ded6b RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff823ded6b RDI: ffffffff8eb59c60
RBP: ffffffff823ded4e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000010 R11: ffffffff81b16a10 R12: 0000000000000002
R13: ffffffff8eb59c60 R14: ffffffff8eb59c60 R15: 0000000000000000
 __kasan_check_byte+0x12/0x40 mm/kasan/common.c:573
 kasan_check_byte include/linux/kasan.h:402 [inline]
 lock_acquire+0x84/0x350 kernel/locking/lockdep.c:5842
 rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 rcu_read_lock include/linux/rcupdate.h:840 [inline]
 __update_page_owner_free_handle+0x4b/0x4a0 mm/page_owner.c:283
 __reset_page_owner+0x85/0x1f0 mm/page_owner.c:321
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
 __slab_free+0x274/0x2c0 mm/slub.c:5767
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 __do_kmalloc_node mm/slub.c:5361 [inline]
 __kmalloc_noprof+0x311/0x720 mm/slub.c:5387
 _kmalloc_noprof include/linux/slab.h:973 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 lsm_blob_alloc security/security.c:218 [inline]
 lsm_sock_alloc security/security.c:4478 [inline]
 security_sk_alloc+0x52/0x360 security/security.c:4494
 sk_prot_alloc+0x101/0x210 net/core/sock.c:2255
 sk_alloc+0x3a/0x390 net/core/sock.c:2308
 inet6_create+0x81a/0x1270 net/ipv6/af_inet6.c:178
 __sock_create+0x4b3/0x9d0 net/socket.c:1651
 rds_tcp_conn_path_connect+0x2d8/0x920 net/rds/tcp_connect.c:-1
 rds_connect_worker+0x1d8/0x290 net/rds/threads.c:176
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:kworker/u8:10   state:R  running task     stack:23728 pid:8615  tgid:8615  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: krds_cp_wq#7/4 rds_connect_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7556
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:check_kcov_mode kernel/kcov.c:185 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:246 [inline]
RIP: 0010:__sanitizer_cov_trace_cmp8+0x30/0x90 kernel/kcov.c:294
Code: 04 24 65 48 8b 0d 58 0b a6 11 65 8b 15 79 0b a6 11 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 57 83 b9 24 17 00 00 00 74 4e <8b> 91 f8 16 00 00 83 fa 03 75 43 48 8b 91 00 17 00 00 44 8b 89 fc
RSP: 0018:ffffc9000583f4e8 EFLAGS: 00000246
RAX: ffffffff823fa031 RBX: ffffffff823f9f42 RCX: ffff88802d025d00
RDX: 0000000000000000 RSI: 0000000000001000 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff823f9f42 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000001000
R13: dffffc0000000000 R14: 000000000004a4d3 R15: 0000000000000000
 __nr_to_section include/linux/mmzone.h:2050 [inline]
 __pfn_to_section include/linux/mmzone.h:2187 [inline]
 lookup_page_ext mm/page_ext.c:255 [inline]
 page_ext_get+0x111/0x2e0 mm/page_ext.c:532
 __reset_page_owner+0x28/0x1f0 mm/page_owner.c:306
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
 __slab_free+0x274/0x2c0 mm/slub.c:5767
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 __do_kmalloc_node mm/slub.c:5361 [inline]
 __kmalloc_noprof+0x311/0x720 mm/slub.c:5387
 _kmalloc_noprof include/linux/slab.h:973 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 lsm_blob_alloc security/security.c:218 [inline]
 lsm_sock_alloc security/security.c:4478 [inline]
 security_sk_alloc+0x52/0x360 security/security.c:4494
 sk_prot_alloc+0x101/0x210 net/core/sock.c:2255
 sk_alloc+0x3a/0x390 net/core/sock.c:2308
 inet6_create+0x81a/0x1270 net/ipv6/af_inet6.c:178
 __sock_create+0x4b3/0x9d0 net/socket.c:1651
 rds_tcp_conn_path_connect+0x2d8/0x920 net/rds/tcp_connect.c:-1
 rds_connect_worker+0x1d8/0x290 net/rds/threads.c:176
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:syz-executor    state:R  running task     stack:21952 pid:5625  tgid:5625  ppid:1      task_flags:0x40054c flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7413
 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3f/0x50 kernel/locking/spinlock.c:190
 spin_unlock include/linux/spinlock.h:390 [inline]
 zap_pte_range mm/memory.c:1964 [inline]
 zap_pmd_range mm/memory.c:2020 [inline]
 zap_pud_range mm/memory.c:2048 [inline]
 zap_p4d_range mm/memory.c:2069 [inline]
 __zap_vma_range+0x4084/0x4f10 mm/memory.c:2109
 unmap_vmas+0x390/0x550 mm/memory.c:2178
 exit_mmap+0x293/0x9f0 mm/mmap.c:1300
 __mmput+0x118/0x420 kernel/fork.c:1187
 exit_mm+0x221/0x2d0 kernel/exit.c:610
 do_exit+0x6cd/0x2360 kernel/exit.c:992
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1147
 get_signal+0x121b/0x12c0 kernel/signal.c:3038
 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x104/0x730 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8fe815e68e
RSP: 002b:00007ffc4d038e98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6
RAX: 0000000000000000 RBX: 0000555563015500 RCX: 00007f8fe815e68e
RDX: 00007ffc4d038ef0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffc4d038f5c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388
R13: 00000000000927c0 R14: 000000000004e25f R15: 00007ffc4d038fb0
 </TASK>
rcu: rcu_preempt kthread starved for 7696 jiffies! g53505 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27736 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7326
 schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123
 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 1060 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: krds_cp_wq#7/0 rds_connect_worker
RIP: 0010:lock_acquire+0x6e/0x350 kernel/locking/lockdep.c:5833
Code: 11 83 f8 08 0f 83 83 01 00 00 89 c0 48 0f a3 05 d8 51 b5 0e 73 0d e8 f1 29 09 00 84 c0 0f 84 ca 01 00 00 83 3d d2 84 b5 0e 00 <0f> 84 d3 00 00 00 48 8b b4 24 90 00 00 00 4c 89 ef e8 3c b0 91 00
RSP: 0018:ffffc9000551f4a8 EFLAGS: 00000202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000080000003
RDX: 0000000000000001 RSI: ffffffff8c4bd360 RDI: ffffffff8c4bd320
RBP: ffffffff82254be4 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000aa3e98 R12: 0000000000000000
R13: ffff8880b8741098 R14: 0000000000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888125058000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ee6a075f28 CR3: 000000007bb0e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __raw_spin_trylock include/linux/spinlock_api_smp.h:91 [inline]
 _raw_spin_trylock+0x47/0x80 kernel/locking/spinlock.c:142
 spin_trylock include/linux/spinlock.h:354 [inline]
 __free_frozen_pages+0x7b4/0xd10 mm/page_alloc.c:2975
 __slab_free+0x274/0x2c0 mm/slub.c:5767
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 __do_kmalloc_node mm/slub.c:5361 [inline]
 __kmalloc_noprof+0x311/0x720 mm/slub.c:5387
 _kmalloc_noprof include/linux/slab.h:973 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 lsm_blob_alloc security/security.c:218 [inline]
 lsm_sock_alloc security/security.c:4478 [inline]
 security_sk_alloc+0x52/0x360 security/security.c:4494
 sk_prot_alloc+0x101/0x210 net/core/sock.c:2255
 sk_alloc+0x3a/0x390 net/core/sock.c:2308
 inet6_create+0x81a/0x1270 net/ipv6/af_inet6.c:178
 __sock_create+0x4b3/0x9d0 net/socket.c:1651
 rds_tcp_conn_path_connect+0x2d8/0x920 net/rds/tcp_connect.c:-1
 rds_connect_worker+0x1d8/0x290 net/rds/threads.c:176
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog