Extracting prog: 4m20.683227359s
Minimizing prog: 24m32.241285477s
Simplifying prog options: 0s
Extracting C: 2m20.128712463s
Simplifying C: 35m22.345699853s
extracting reproducer from 35 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendto(r0, &(0x7f0000000000)="68000000300001050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000100008000300640000000c000700e803000000000099", 0x68, 0x20000040, 0x0, 0x0)
program crashed: INFO: rcu detected stall in corrupted
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink
detailed listing:
executing program 0:
socket$netlink(0x10, 0x3, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendto
detailed listing:
executing program 0:
sendto(0xffffffffffffffff, &(0x7f0000000000)="68000000300001050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000100008000300640000000c000700e803000000000099", 0x68, 0x20000040, 0x0, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendto(r0, 0x0, 0x0, 0x20000040, 0x0, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendto(r0, &(0x7f0000000000), 0x0, 0x20000040, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in corrupted
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: BUG: soft lockup in __hrtimer_run_queues
a never seen crash title: BUG: soft lockup in __hrtimer_run_queues, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in exit_to_user_mode_loop
a never seen crash title: INFO: rcu detected stall in exit_to_user_mode_loop, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in exit_to_user_mode_loop
a never seen crash title: INFO: rcu detected stall in exit_to_user_mode_loop, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in do_idle
a never seen crash title: INFO: rcu detected stall in do_idle, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in exit_to_user_mode_loop
a never seen crash title: INFO: rcu detected stall in exit_to_user_mode_loop, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in exit_to_user_mode_loop
a never seen crash title: INFO: rcu detected stall in exit_to_user_mode_loop, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in exit_to_user_mode_loop
a never seen crash title: INFO: rcu detected stall in exit_to_user_mode_loop, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in exit_to_user_mode_loop
a never seen crash title: INFO: rcu detected stall in exit_to_user_mode_loop, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in x64_sys_call
a never seen crash title: INFO: rcu detected stall in x64_sys_call, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in netlink_sendmsg
a never seen crash title: INFO: rcu detected stall in netlink_sendmsg, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in tc_ctl_action
a never seen crash title: INFO: rcu detected stall in tc_ctl_action, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in do_idle
a never seen crash title: INFO: rcu detected stall in do_idle, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
program crashed: INFO: rcu detected stall in exit_to_user_mode_loop
a never seen crash title: INFO: rcu detected stall in exit_to_user_mode_loop, ignore
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendto(r0, &(0x7f0000000000)="68000000300001050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000100008000300640000000c000700e803000000000099", 0x68, 0x20000040, 0x0, 0x0)
program crashed: INFO: rcu detected stall in x64_sys_call
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendto(r0, &(0x7f0000000000)="68000000300001050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000100008000300640000000c000700e803000000000099", 0x68, 0x20000040, 0x0, 0x0)
program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendto(r0, &(0x7f0000000000)="68000000300001050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000100008000300640000000c000700e803000000000099", 0x68, 0x20000040, 0x0, 0x0)
program crashed: INFO: rcu detected stall in x64_sys_call
validation run: crashed=true
reproducing took 1h14m1.099880469s
repro crashed as (corrupted=false):
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 1-...!: (1 GPs behind) idle=8c7c/1/0x4000000000000000 softirq=16203/16203 fqs=1
rcu: (t=10501 jiffies g=14569 q=474 ncpus=2)
rcu: rcu_preempt kthread timer wakeup didn't happen for 10499 jiffies! g14569 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=0 timer-softirq=3598
rcu: rcu_preempt kthread starved for 10502 jiffies! g14569 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27736 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7326
schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123
rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 5890 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__raw_callee_save___pv_queued_spin_unlock+0x5/0x18
Code: 41 58 5f 5e 5a 59 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 52 01 00 00 00 31 d2 f0 0f b0 17 75 06 5a e9 08 3e 00 00 56 0f b6
RSP: 0018:ffffc90000007d78 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888026eac880 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888026eac880
RBP: 1ffff11004dd5911 R08: ffff888026eac883 R09: 1ffff11004dd5910
R10: dffffc0000000000 R11: ffffed1004dd5911 R12: dffffc0000000000
R13: 1ffff11004dd5912 R14: ffff888026eac890 R15: ffff888026eac888
FS: 000055557f51e500(0000) GS:ffff888124f58000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000000 CR3: 000000007542e000 CR4: 00000000003526f0
Call Trace:
pv_queued_spin_unlock arch/x86/include/asm/paravirt-spinlock.h:40 [inline]
queued_spin_unlock arch/x86/include/asm/paravirt-spinlock.h:72 [inline]
do_raw_spin_unlock+0xf5/0x210 kernel/locking/spinlock_debug.c:142
__raw_spin_unlock include/linux/spinlock_api_smp.h:168 [inline]
_raw_spin_unlock+0x1e/0x50 kernel/locking/spinlock.c:190
spin_unlock include/linux/spinlock.h:390 [inline]
gate_timer_func+0x33e/0x450 net/sched/act_gate.c:117
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:188 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:206
Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 4a 07 d0 f5 48 89 df e8 a2 7c d0 f5 e8 7d 5d fc f5 fb bf 01 00 00 00 52 90 c1 f5 65 8b 05 4b a0 99 07 85 c0 74 07 5b c3 cc cc cc cc
RSP: 0018:ffffc90002edfe80 EFLAGS: 00000206
RAX: 00000000000002dd RBX: ffff88802f1065c0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8e227dfc RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffffffff90573637 R09: 1ffffffff20ae6c6
R10: dffffc0000000000 R11: fffffbfff20ae6c7 R12: 1ffff110051061e5
R13: ffff8880323d0000 R14: ffff888028830f18 R15: ffff888028830f2c
spin_unlock_irq include/linux/spinlock.h:402 [inline]
do_group_exit+0x21d/0x2f0 kernel/exit.c:1149
__do_sys_exit_group kernel/exit.c:1163 [inline]
__se_sys_exit_group kernel/exit.c:1161 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1161
x64_sys_call+0x221a/0x2240 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff02d19e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe3c2dae28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff02d19e0d9
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffe3c2dae8c R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 000000000001930b R15: 00007ffe3c2daee0
CPU: 1 UID: 0 PID: 4977 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:198
Code: f7 e8 2d 7d d0 f5 f7 c3 00 02 00 00 74 05 e8 00 5e fc f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 c4 90 c1 f5 65 8b 05 bd a0 99 07 85 c0 74 18 5b 41 5e c3 cc cc
RSP: 0018:ffffc90000a08e08 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000000000102
RDX: 0000000000000003 RSI: ffffffff8e227dfc RDI: 0000000000000001
RBP: ffff88807ea1a538 R08: ffffffff90573637 R09: 1ffffffff20ae6c6
R10: dffffc0000000000 R11: fffffbfff20ae6c7 R12: ffff8880b87281c0
R13: ffffffff89cd5e00 R14: ffff8880b87281c0 R15: 1ffff110170e50c2
FS: 00007f76e4173880(0000) GS:ffff888125058000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000000 CR3: 000000007ef50000 CR4: 00000000003526f0
Call Trace:
__run_hrtimer kernel/time/hrtimer.c:2028 [inline]
__hrtimer_run_queues+0x2bf/0xa10 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x5a/0xb0 kernel/rcu/tree.c:752
Code: f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 fc ba 88 00 48 c7 c3 d8 b8 6d 93 49 03 1e 48 89 d8 48 c1 e8 03 42 0f b6 04 38 <84> c0 75 34 8b 03 65 ff 0d 49 9f c0 11 74 11 83 e0 04 c1 e8 02 5b
RSP: 0018:ffffc90003d8f520 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: ffff8880b87338d8 RCX: 0000000080000001
RDX: 00000000b9596be7 RSI: ffffffff8c4bba60 RDI: ffffffff8c4bba20
RBP: 0000000000000000 R08: ffffffff81b06f9d R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffff88807ce05d00
R13: ffffffff8228db0d R14: ffffffff8e4f57d8 R15: dffffc0000000000
rcu_read_unlock include/linux/rcupdate.h:869 [inline]
class_rcu_destructor include/linux/rcupdate.h:1183 [inline]
is_module_text_address+0x147/0x1e0 kernel/module/main.c:3923
kernel_text_address+0x94/0xe0 kernel/extable.c:119
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:385
arch_stack_walk+0xfb/0x150 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_noprof+0x375/0x720 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
tomoyo_realpath_from_path+0xef/0x640 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x283/0x560 security/tomoyo/file.c:827
tomoyo_path_unlink+0xaa/0xf0 security/tomoyo/tomoyo.c:162
security_path_unlink+0x15f/0x330 security/security.c:1483
filename_unlinkat+0x349/0x610 fs/namei.c:5582
__do_sys_unlink fs/namei.c:5620 [inline]
__se_sys_unlink+0x2e/0x140 fs/namei.c:5617
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f76e3b15937
Code: 00 00 e9 a9 fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 5f 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 91 b4 0d 00 f7 d8 64 89 02 b8
RSP: 002b:00007fff37382f58 EFLAGS: 00000202 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000bb8 RCX: 00007f76e3b15937
RDX: ffffffffffffffff RSI: 000000000000000b RDI: 000056087ec9202e
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 000056087ecad100 R14: 0000000000000000 R15: 0000000000000000
final repro crashed as (corrupted=false):
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 1-...!: (1 GPs behind) idle=8c7c/1/0x4000000000000000 softirq=16203/16203 fqs=1
rcu: (t=10501 jiffies g=14569 q=474 ncpus=2)
rcu: rcu_preempt kthread timer wakeup didn't happen for 10499 jiffies! g14569 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=0 timer-softirq=3598
rcu: rcu_preempt kthread starved for 10502 jiffies! g14569 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27736 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7326
schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123
rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 5890 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__raw_callee_save___pv_queued_spin_unlock+0x5/0x18
Code: 41 58 5f 5e 5a 59 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 52 01 00 00 00 31 d2 f0 0f b0 17 75 06 5a e9 08 3e 00 00 56 0f b6
RSP: 0018:ffffc90000007d78 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888026eac880 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888026eac880
RBP: 1ffff11004dd5911 R08: ffff888026eac883 R09: 1ffff11004dd5910
R10: dffffc0000000000 R11: ffffed1004dd5911 R12: dffffc0000000000
R13: 1ffff11004dd5912 R14: ffff888026eac890 R15: ffff888026eac888
FS: 000055557f51e500(0000) GS:ffff888124f58000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000000 CR3: 000000007542e000 CR4: 00000000003526f0
Call Trace:
pv_queued_spin_unlock arch/x86/include/asm/paravirt-spinlock.h:40 [inline]
queued_spin_unlock arch/x86/include/asm/paravirt-spinlock.h:72 [inline]
do_raw_spin_unlock+0xf5/0x210 kernel/locking/spinlock_debug.c:142
__raw_spin_unlock include/linux/spinlock_api_smp.h:168 [inline]
_raw_spin_unlock+0x1e/0x50 kernel/locking/spinlock.c:190
spin_unlock include/linux/spinlock.h:390 [inline]
gate_timer_func+0x33e/0x450 net/sched/act_gate.c:117
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:188 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:206
Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 4a 07 d0 f5 48 89 df e8 a2 7c d0 f5 e8 7d 5d fc f5 fb bf 01 00 00 00 52 90 c1 f5 65 8b 05 4b a0 99 07 85 c0 74 07 5b c3 cc cc cc cc
RSP: 0018:ffffc90002edfe80 EFLAGS: 00000206
RAX: 00000000000002dd RBX: ffff88802f1065c0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8e227dfc RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffffffff90573637 R09: 1ffffffff20ae6c6
R10: dffffc0000000000 R11: fffffbfff20ae6c7 R12: 1ffff110051061e5
R13: ffff8880323d0000 R14: ffff888028830f18 R15: ffff888028830f2c
spin_unlock_irq include/linux/spinlock.h:402 [inline]
do_group_exit+0x21d/0x2f0 kernel/exit.c:1149
__do_sys_exit_group kernel/exit.c:1163 [inline]
__se_sys_exit_group kernel/exit.c:1161 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1161
x64_sys_call+0x221a/0x2240 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff02d19e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe3c2dae28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff02d19e0d9
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffe3c2dae8c R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 000000000001930b R15: 00007ffe3c2daee0
CPU: 1 UID: 0 PID: 4977 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:198
Code: f7 e8 2d 7d d0 f5 f7 c3 00 02 00 00 74 05 e8 00 5e fc f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 c4 90 c1 f5 65 8b 05 bd a0 99 07 85 c0 74 18 5b 41 5e c3 cc cc
RSP: 0018:ffffc90000a08e08 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000000000102
RDX: 0000000000000003 RSI: ffffffff8e227dfc RDI: 0000000000000001
RBP: ffff88807ea1a538 R08: ffffffff90573637 R09: 1ffffffff20ae6c6
R10: dffffc0000000000 R11: fffffbfff20ae6c7 R12: ffff8880b87281c0
R13: ffffffff89cd5e00 R14: ffff8880b87281c0 R15: 1ffff110170e50c2
FS: 00007f76e4173880(0000) GS:ffff888125058000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000000 CR3: 000000007ef50000 CR4: 00000000003526f0
Call Trace:
__run_hrtimer kernel/time/hrtimer.c:2028 [inline]
__hrtimer_run_queues+0x2bf/0xa10 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x5a/0xb0 kernel/rcu/tree.c:752
Code: f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 fc ba 88 00 48 c7 c3 d8 b8 6d 93 49 03 1e 48 89 d8 48 c1 e8 03 42 0f b6 04 38 <84> c0 75 34 8b 03 65 ff 0d 49 9f c0 11 74 11 83 e0 04 c1 e8 02 5b
RSP: 0018:ffffc90003d8f520 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: ffff8880b87338d8 RCX: 0000000080000001
RDX: 00000000b9596be7 RSI: ffffffff8c4bba60 RDI: ffffffff8c4bba20
RBP: 0000000000000000 R08: ffffffff81b06f9d R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffff88807ce05d00
R13: ffffffff8228db0d R14: ffffffff8e4f57d8 R15: dffffc0000000000
rcu_read_unlock include/linux/rcupdate.h:869 [inline]
class_rcu_destructor include/linux/rcupdate.h:1183 [inline]
is_module_text_address+0x147/0x1e0 kernel/module/main.c:3923
kernel_text_address+0x94/0xe0 kernel/extable.c:119
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:385
arch_stack_walk+0xfb/0x150 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_noprof+0x375/0x720 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
tomoyo_realpath_from_path+0xef/0x640 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x283/0x560 security/tomoyo/file.c:827
tomoyo_path_unlink+0xaa/0xf0 security/tomoyo/tomoyo.c:162
security_path_unlink+0x15f/0x330 security/security.c:1483
filename_unlinkat+0x349/0x610 fs/namei.c:5582
__do_sys_unlink fs/namei.c:5620 [inline]
__se_sys_unlink+0x2e/0x140 fs/namei.c:5617
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f76e3b15937
Code: 00 00 e9 a9 fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 5f 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 91 b4 0d 00 f7 d8 64 89 02 b8
RSP: 002b:00007fff37382f58 EFLAGS: 00000202 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000bb8 RCX: 00007f76e3b15937
RDX: ffffffffffffffff RSI: 000000000000000b RDI: 000056087ec9202e
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 000056087ecad100 R14: 0000000000000000 R15: 0000000000000000