Extracting prog: 5m36.538275228s
Minimizing prog: 58m15.499783825s
Simplifying prog options: 0s
Extracting C: 3m56.804952178s
Simplifying C: 21m44.422944443s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: BUG: workqueue lockup
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000bbdffc))

program did not crash
testing program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-timer_create-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setscheduler-timer_create-timer_settime
detailed listing:
executing program 0:
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, 0x0)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
timer_create(0x0, 0x0, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, 0x0)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
program crashed: BUG: workqueue lockup
simplifying C reproducer
testing compiled C program (duration=6m19.4570956s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
program crashed: BUG: workqueue lockup
testing compiled C program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
program crashed: BUG: workqueue lockup
testing compiled C program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
program crashed: BUG: workqueue lockup
testing compiled C program (duration=6m19.4570956s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime
program did not crash
reproducing took 1h29m33.265970834s
repro crashed as (corrupted=false):
BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 184s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x0
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
    pending: vmstat_shepherd, psi_avgs_work
workqueue events_unbound: flags=0x2
  pwq 4: cpus=0-1 flags=0x4 nice=0 active=2/512 refcnt=4
    pending: toggle_allocation_gate, flush_memcg_stats_dwork
workqueue events_power_efficient: flags=0x80
  pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=4/256 refcnt=5
    in-flight: 40:gc_worker
    pending: check_lifetime, neigh_managed_work, neigh_periodic_work
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
    pending: neigh_managed_work, neigh_periodic_work
workqueue writeback: flags=0x4a
  pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=3
    pending: wb_workfn
workqueue dm_bufio_cache: flags=0x8
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
    pending: work_fn
workqueue ipv6_addrconf: flags=0x40008
  pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/1 refcnt=2
    pending: addrconf_verify_work
pool 2: cpus=1 node=0 flags=0x0 nice=0 hung=140s workers=2 idle: 24
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P285/2:b..l
	(detected by 0, t=10003 jiffies, g=925, q=2 ncpus=2)
task:syz-executor287 state:R  running task     stack:27872 pid:285   ppid:282    flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5420 [inline]
 __schedule+0xb87/0x14e0 kernel/sched/core.c:6750
 preempt_schedule_irq+0x9b/0x110 kernel/sched/core.c:7062
 raw_irqentry_exit_cond_resched+0x29/0x30 kernel/entry/common.c:396
 irqentry_exit+0x37/0x40 kernel/entry/common.c:439
 sysvec_apic_timer_interrupt+0x64/0xc0 arch/x86/kernel/apic/apic.c:1118
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:do_send_sig_info+0x0/0x210 kernel/signal.c:1305
Code: ff ff e8 23 7e 2b 00 e8 1a 10 bc ff e9 18 fd ff ff 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 eb de 4f 8c <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 89 4d d0 49 89
RSP: 0018:ffffc90000e07cd8 EFLAGS: 00010206
RAX: ffffffff814475fe RBX: 0000000000000001 RCX: 0000000000000001
RDX: ffff88811f992880 RSI: ffffc90000e07e20 RDI: 0000000000000009
RBP: ffffc90000e07da0 R08: 0000000000000004 R09: 0000000000000003
R10: fffff520001c0f6e R11: 1ffff920001c0f6c R12: ffff88811f992880
R13: ffff88811f992880 R14: 0000000000000009 R15: 0000000000000000
 kill_pid_info kernel/signal.c:1501 [inline]
 kill_proc_info+0x50/0x90 kernel/signal.c:1518
 kill_something_info kernel/signal.c:1615 [inline]
 __do_sys_kill kernel/signal.c:3808 [inline]
 __se_sys_kill+0x14a/0x520 kernel/signal.c:3802
 __x64_sys_kill+0x5b/0x70 kernel/signal.c:3802
 x64_sys_call+0x4b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:63
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f83b81681f7
RSP: 002b:00007ffe38918f68 EFLAGS: 00000286 ORIG_RAX: 000000000000003e
RAX: ffffffffffffffda RBX: 0000000000000064 RCX: 00007f83b81681f7
RDX: 000000000003f1b8 RSI: 0000000000000009 RDI: 0000000000000125
RBP: 0000000000000125 R08: 00000000000000a3 R09: 0026693b1f017726
R10: 0000005586b41491 R11: 0000000000000286 R12: 00007ffe389190f4
R13: 00000000000f4240 R14: 00007ffe389190f4 R15: 0000000000000125
 </TASK>
rcu: rcu_preempt kthread starved for 10031 jiffies! g925 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28528 pid:14    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5420 [inline]
 __schedule+0xb87/0x14e0 kernel/sched/core.c:6750
 schedule+0xbd/0x170 kernel/sched/core.c:6826
 schedule_timeout+0x12c/0x2e0 kernel/time/timer.c:1971
 rcu_gp_fqs_loop+0x2d8/0x10a0 kernel/rcu/tree.c:1706
 rcu_gp_kthread+0x95/0x370 kernel/rcu/tree.c:1905
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 PID: 292 Comm: syz-executor287 Not tainted 6.1.134-syzkaller-00039-g3c6d0251e1fb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x48/0x70 kernel/locking/spinlock.c:202
Code: 74 12 48 89 fb 48 c7 c7 40 e4 ed 86 e8 31 93 c4 fc 48 89 df 48 83 3d 46 3d fe 01 00 74 26 e8 93 0c 00 00 90 fb bf 01 00 00 00 <e8> 73 e3 5b fc 65 8b 05 b4 c6 12 7b 85 c0 74 03 5b 5d c3 e8 64 d3
RSP: 0018:ffffc90000e67b90 EFLAGS: 00000246
RAX: 0000000000000001 RBX: 0000000000000021 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc90000e67b98 R08: dffffc0000000000 R09: fffff520001ccfc0
R10: fffff520001ccfc0 R11: 1ffff920001ccfbc R12: dffffc0000000000
R13: 1ffff11021d443cc R14: 000000001c000004 R15: ffff88810ea21e60
FS:  00007f83b81566c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f83b8155e40 CR3: 0000000124c12000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 get_signal+0x12a4/0x1520 kernel/signal.c:2892
 arch_do_signal_or_restart+0xb0/0x1030 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f83b8195697
Code: 14 25 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89
RSP: 002b:00007f83b8156218 EFLAGS: 00000246
RAX: 00000000000000ca RBX: 00007f83b821f308 RCX: 00007f83b8195699
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f83b821f308
RBP: 00007f83b821f300 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000140
R13: 000020000006b000 R14: 0000200000bbdffc R15: 0000200000000240
 </TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	e8 23 7e 2b 00       	call   0x2b7e28
   5:	e8 1a 10 bc ff       	call   0xffbc1024
   a:	e9 18 fd ff ff       	jmp    0xfffffd27
   f:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
  16:	00 00
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	b8 eb de 4f 8c       	mov    $0x8c4fdeeb,%eax
* 28:	55                   	push   %rbp <-- trapping instruction
  29:	48 89 e5             	mov    %rsp,%rbp
  2c:	41 57                	push   %r15
  2e:	41 56                	push   %r14
  30:	41 55                	push   %r13
  32:	41 54                	push   %r12
  34:	53                   	push   %rbx
  35:	48 83 ec 18          	sub    $0x18,%rsp
  39:	89 4d d0             	mov    %ecx,-0x30(%rbp)
  3c:	49                   	rex.WB
  3d:	89                   	.byte 0x89

final repro crashed as (corrupted=false):
BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 184s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x0
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
    pending: vmstat_shepherd, psi_avgs_work
workqueue events_unbound: flags=0x2
  pwq 4: cpus=0-1 flags=0x4 nice=0 active=2/512 refcnt=4
    pending: toggle_allocation_gate, flush_memcg_stats_dwork
workqueue events_power_efficient: flags=0x80
  pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=4/256 refcnt=5
    in-flight: 40:gc_worker
    pending: check_lifetime, neigh_managed_work, neigh_periodic_work
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
    pending: neigh_managed_work, neigh_periodic_work
workqueue writeback: flags=0x4a
  pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=3
    pending: wb_workfn
workqueue dm_bufio_cache: flags=0x8
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
    pending: work_fn
workqueue ipv6_addrconf: flags=0x40008
  pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/1 refcnt=2
    pending: addrconf_verify_work
pool 2: cpus=1 node=0 flags=0x0 nice=0 hung=140s workers=2 idle: 24
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P285/2:b..l
	(detected by 0, t=10003 jiffies, g=925, q=2 ncpus=2)
task:syz-executor287 state:R  running task     stack:27872 pid:285   ppid:282    flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5420 [inline]
 __schedule+0xb87/0x14e0 kernel/sched/core.c:6750
 preempt_schedule_irq+0x9b/0x110 kernel/sched/core.c:7062
 raw_irqentry_exit_cond_resched+0x29/0x30 kernel/entry/common.c:396
 irqentry_exit+0x37/0x40 kernel/entry/common.c:439
 sysvec_apic_timer_interrupt+0x64/0xc0 arch/x86/kernel/apic/apic.c:1118
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:do_send_sig_info+0x0/0x210 kernel/signal.c:1305
Code: ff ff e8 23 7e 2b 00 e8 1a 10 bc ff e9 18 fd ff ff 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 eb de 4f 8c <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 89 4d d0 49 89
RSP: 0018:ffffc90000e07cd8 EFLAGS: 00010206
RAX: ffffffff814475fe RBX: 0000000000000001 RCX: 0000000000000001
RDX: ffff88811f992880 RSI: ffffc90000e07e20 RDI: 0000000000000009
RBP: ffffc90000e07da0 R08: 0000000000000004 R09: 0000000000000003
R10: fffff520001c0f6e R11: 1ffff920001c0f6c R12: ffff88811f992880
R13: ffff88811f992880 R14: 0000000000000009 R15: 0000000000000000
 kill_pid_info kernel/signal.c:1501 [inline]
 kill_proc_info+0x50/0x90 kernel/signal.c:1518
 kill_something_info kernel/signal.c:1615 [inline]
 __do_sys_kill kernel/signal.c:3808 [inline]
 __se_sys_kill+0x14a/0x520 kernel/signal.c:3802
 __x64_sys_kill+0x5b/0x70 kernel/signal.c:3802
 x64_sys_call+0x4b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:63
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f83b81681f7
RSP: 002b:00007ffe38918f68 EFLAGS: 00000286 ORIG_RAX: 000000000000003e
RAX: ffffffffffffffda RBX: 0000000000000064 RCX: 00007f83b81681f7
RDX: 000000000003f1b8 RSI: 0000000000000009 RDI: 0000000000000125
RBP: 0000000000000125 R08: 00000000000000a3 R09: 0026693b1f017726
R10: 0000005586b41491 R11: 0000000000000286 R12: 00007ffe389190f4
R13: 00000000000f4240 R14: 00007ffe389190f4 R15: 0000000000000125
 </TASK>
rcu: rcu_preempt kthread starved for 10031 jiffies! g925 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28528 pid:14    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5420 [inline]
 __schedule+0xb87/0x14e0 kernel/sched/core.c:6750
 schedule+0xbd/0x170 kernel/sched/core.c:6826
 schedule_timeout+0x12c/0x2e0 kernel/time/timer.c:1971
 rcu_gp_fqs_loop+0x2d8/0x10a0 kernel/rcu/tree.c:1706
 rcu_gp_kthread+0x95/0x370 kernel/rcu/tree.c:1905
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 PID: 292 Comm: syz-executor287 Not tainted 6.1.134-syzkaller-00039-g3c6d0251e1fb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x48/0x70 kernel/locking/spinlock.c:202
Code: 74 12 48 89 fb 48 c7 c7 40 e4 ed 86 e8 31 93 c4 fc 48 89 df 48 83 3d 46 3d fe 01 00 74 26 e8 93 0c 00 00 90 fb bf 01 00 00 00 <e8> 73 e3 5b fc 65 8b 05 b4 c6 12 7b 85 c0 74 03 5b 5d c3 e8 64 d3
RSP: 0018:ffffc90000e67b90 EFLAGS: 00000246
RAX: 0000000000000001 RBX: 0000000000000021 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc90000e67b98 R08: dffffc0000000000 R09: fffff520001ccfc0
R10: fffff520001ccfc0 R11: 1ffff920001ccfbc R12: dffffc0000000000
R13: 1ffff11021d443cc R14: 000000001c000004 R15: ffff88810ea21e60
FS:  00007f83b81566c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f83b8155e40 CR3: 0000000124c12000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 get_signal+0x12a4/0x1520 kernel/signal.c:2892
 arch_do_signal_or_restart+0xb0/0x1030 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f83b8195697
Code: 14 25 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89
RSP: 002b:00007f83b8156218 EFLAGS: 00000246
RAX: 00000000000000ca RBX: 00007f83b821f308 RCX: 00007f83b8195699
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f83b821f308
RBP: 00007f83b821f300 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000140
R13: 000020000006b000 R14: 0000200000bbdffc R15: 0000200000000240
 </TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	e8 23 7e 2b 00       	call   0x2b7e28
   5:	e8 1a 10 bc ff       	call   0xffbc1024
   a:	e9 18 fd ff ff       	jmp    0xfffffd27
   f:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
  16:	00 00
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	b8 eb de 4f 8c       	mov    $0x8c4fdeeb,%eax
* 28:	55                   	push   %rbp <-- trapping instruction
  29:	48 89 e5             	mov    %rsp,%rbp
  2c:	41 57                	push   %r15
  2e:	41 56                	push   %r14
  30:	41 55                	push   %r13
  32:	41 54                	push   %r12
  34:	53                   	push   %rbx
  35:	48 83 ec 18          	sub    $0x18,%rsp
  39:	89 4d d0             	mov    %ecx,-0x30(%rbp)
  3c:	49                   	rex.WB
  3d:	89                   	.byte 0x89