Extracting prog: 2m27.896197924s
Minimizing prog: 56m18.675257629s
Simplifying prog options: 5m3.418154304s
Extracting C: 2m26.032225109s
Simplifying C: 0s


extracting reproducer from 31 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program crashed: INFO: rcu detected stall in worker_thread
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500))
socket$netlink(0x10, 0x3, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
socket(0x11, 0x800000003, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, 0x0, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'team0\x00', <r0=>0x0})
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r0, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, 0x0, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500))
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500))
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500))
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
program crashed: INFO: rcu detected stall in corrupted
a never seen crash title: INFO: rcu detected stall in corrupted, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
a never seen crash title: INFO: rcu detected stall in corrupted, ignore
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program crashed: INFO: rcu detected stall in sys_openat
a never seen crash title: INFO: rcu detected stall in sys_openat, ignore
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program crashed: INFO: rcu detected stall in worker_thread
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
reproducing took 1h14m54.451801381s
repro crashed as (corrupted=true):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (1 ticks this GP) idle=e8dc/1/0x4000000000000000 softirq=11498/11498 fqs=0
rcu: 	(detected by 0, t=10502 jiffies, g=8889, q=565 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5966 Comm: dhcpcd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:advance_sched+0x46d/0xc80 net/sched/sch_taprio.c:973
Code: eb 0f e8 96 45 ef f8 49 bc 00 00 00 00 00 fc ff df 48 8b 5c 24 10 48 8b 44 24 48 42 80 3c 20 00 74 08 48 89 df e8 63 b3 46 f9 <4c> 8b 3b 48 8b 44 24 28 4c 8d 70 28 4c 89 f0 48 c1 e8 03 42 0f b6
RSP: 0000:ffffc900001f0c70 EFLAGS: 00000046
RAX: 1ffff1100b46642a RBX: ffff88805a332150 RCX: dffffc0000000000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 187f0798c82eb142
RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200003e17c R12: dffffc0000000000
R13: ffff8880196f3000 R14: ffff88805a331d28 R15: 187f0798c82eb18f
FS:  00007fbe59720740(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe5991be80 CR3: 000000002ceae000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 __run_hrtimer kernel/time/hrtimer.c:1750 [inline]
 __hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1814
 hrtimer_interrupt+0x3c9/0x9c0 kernel/time/hrtimer.c:1876
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:arch_atomic_inc_and_test arch/x86/include/asm/atomic.h:73 [inline]
RIP: 0010:raw_atomic_inc_and_test include/linux/atomic/atomic-arch-fallback.h:2277 [inline]
RIP: 0010:atomic_inc_and_test include/linux/atomic/atomic-instrumented.h:1394 [inline]
RIP: 0010:folio_add_file_rmap_range+0x13d/0x810 mm/rmap.c:1321
Code: 30 49 c1 ef 03 48 c1 eb 03 48 89 44 24 38 48 c1 e8 03 48 89 44 24 30 4c 89 f7 be 04 00 00 00 e8 99 d1 0e 00 31 f6 f0 41 ff 06 <41> 0f 94 c4 40 0f 94 c6 bf 02 00 00 00 e8 41 64 b7 ff 45 84 e4 0f
RSP: 0000:ffffc900036e79f0 EFLAGS: 00000206
RAX: 1ffffd40009ff901 RBX: 1ffffd40009ff940 RCX: ffffffff81ce2ef7
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffea0004ffca30
RBP: 0000000000000000 R08: ffffea0004ffca33 R09: 1ffffd40009ff946
R10: dffffc0000000000 R11: fffff940009ff947 R12: ffff88802d223c00
R13: 0000000000000000 R14: ffffea0004ffca30 R15: 1ffffd40009ff941
 set_pte_range+0x388/0x6a0 mm/memory.c:4405
 filemap_map_order0_folio mm/filemap.c:3599 [inline]
 filemap_map_pages+0xe9b/0x1950 mm/filemap.c:3660
 do_fault_around mm/memory.c:4595 [inline]
 do_read_fault mm/memory.c:4628 [inline]
 do_fault mm/memory.c:4775 [inline]
 do_pte_missing mm/memory.c:3689 [inline]
 handle_pte_fault mm/memory.c:5047 [inline]
 __handle_mm_fault mm/memory.c:5188 [inline]
 handle_mm_fault+0x379b/0x4920 mm/memory.c:5353
 do_user_addr_fault+0xad0/0x12e0 arch/x86/mm/fault.c:1324
 handle_page_fault arch/x86/mm/fault.c:1465 [inline]
 exc_page_fault+0x67/0x110 arch/x86/mm/fault.c:1521
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7fbe5991be80
Code: 10 3b 1d d3 df 01 00 4d 8b 76 40 72 cd 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8d 04 bf 48 8d 15 75 e1 01 00 48 c1 e0 05 48 8b 3c 02 8b 05 97
RSP: 002b:00007ffe74253fc8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 000055f8aedcb4b0 RCX: 0000000000000000
RDX: 00007fbe5971ed58 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 00007ffe742540b0 R08: 0000000000000007 R09: 0000000000000000
R10: 00007ffe74253ee0 R11: 00007ffe74253f80 R12: 00000000ffffffff
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g8889 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=1 timer-softirq=3026
rcu: rcu_preempt kthread starved for 10502 jiffies! g8889 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:27752 pid:17    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 schedule_timeout+0x160/0x280 kernel/time/timer.c:2168
 rcu_gp_fqs_loop+0x302/0x1560 kernel/rcu/tree.c:1667
 rcu_gp_kthread+0x99/0x380 kernel/rcu/tree.c:1866
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5966 Comm: dhcpcd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:85 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:127 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:178 [inline]
RIP: 0010:kasan_check_range+0x89/0x290 mm/kasan/generic.c:187
Code: 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 41 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 <0f> 85 cc 01 00 00 49 ff c3 48 ff c3 75 ee e9 21 01 00 00 44 89 dd
RSP: 0000:ffffc900001f0828 EFLAGS: 00000046
RAX: 0000000000000001 RBX: ffffffffffffffff RCX: ffffffff81671184
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90d94500
RBP: ffffc900001f0aa8 R08: ffffffff90d94507 R09: 1ffffffff21b28a0
R10: dffffc0000000000 R11: fffffbfff21b28a0 R12: 0000000000000001
R13: ffff88802e24da00 R14: fffffbfff21b28a1 R15: 1ffffffff21b28a0
FS:  00007fbe59720740(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe5991be80 CR3: 000000002ceae000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 hlock_class kernel/locking/lockdep.c:228 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3781 [inline]
 validate_chain kernel/locking/lockdep.c:3837 [inline]
 __lock_acquire+0x1334/0x7c80 kernel/locking/lockdep.c:5137
 lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xa8/0xf0 kernel/locking/spinlock.c:162
 debug_object_activate+0x6c/0x4b0 lib/debugobjects.c:709
 debug_hrtimer_activate kernel/time/hrtimer.c:450 [inline]
 debug_activate kernel/time/hrtimer.c:505 [inline]
 enqueue_hrtimer+0x30/0x370 kernel/time/hrtimer.c:1108
 __run_hrtimer kernel/time/hrtimer.c:1767 [inline]
 __hrtimer_run_queues+0x637/0xc40 kernel/time/hrtimer.c:1814
 hrtimer_interrupt+0x3c9/0x9c0 kernel/time/hrtimer.c:1876
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:arch_atomic_inc_and_test arch/x86/include/asm/atomic.h:73 [inline]
RIP: 0010:raw_atomic_inc_and_test include/linux/atomic/atomic-arch-fallback.h:2277 [inline]
RIP: 0010:atomic_inc_and_test include/linux/atomic/atomic-instrumented.h:1394 [inline]
RIP: 0010:folio_add_file_rmap_range+0x13d/0x810 mm/rmap.c:1321
Code: 30 49 c1 ef 03 48 c1 eb 03 48 89 44 24 38 48 c1 e8 03 48 89 44 24 30 4c 89 f7 be 04 00 00 00 e8 99 d1 0e 00 31 f6 f0 41 ff 06 <41> 0f 94 c4 40 0f 94 c6 bf 02 00 00 00 e8 41 64 b7 ff 45 84 e4 0f
RSP: 0000:ffffc900036e79f0 EFLAGS: 00000206
RAX: 1ffffd40009ff901 RBX: 1ffffd40009ff940 RCX: ffffffff81ce2ef7
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffea0004ffca30
RBP: 0000000000000000 R08: ffffea0004ffca33 R09: 1ffffd40009ff946
R10: dffffc0000000000 R11: fffff940009ff947 R12: ffff88802d223c00
R13: 0000000000000000 R14: ffffea0004ffca30 R15: 1ffffd40009ff941
 set_pte_range+0x388/0x6a0 mm/memory.c:4405
 filemap_map_order0_folio mm/filemap.c:3599 [inline]
 filemap_map_pages+0xe9b/0x1950 mm/filemap.c:3660
 do_fault_around mm/memory.c:4595 [inline]
 do_read_fault mm/memory.c:4628 [inline]
 do_fault mm/memory.c:4775 [inline]
 do_pte_missing mm/memory.c:3689 [inline]
 handle_pte_fault mm/memory.c:5047 [inline]
 __handle_mm_fault mm/memory.c:5188 [inline]
 handle_mm_fault+0x379b/0x4920 mm/memory.c:5353
 do_user_addr_fault+0xad0/0x12e0 arch/x86/mm/fault.c:1324
 handle_page_fault arch/x86/mm/fault.c:1465 [inline]
 exc_page_fault+0x67/0x110 arch/x86/mm/fault.c:1521
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7fbe5991be80
Code: 10 3b 1d d3 df 01 00 4d 8b 76 40 72 cd 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8d 04 bf 48 8d 15 75 e1 01 00 48 c1 e0 05 48 8b 3c 02 8b 05 97
RSP: 002b:00007ffe74253fc8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 000055f8aedcb4b0 RCX: 0000000000000000
RDX: 00007fbe5971ed58 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 00007ffe742540b0 R08: 0000000000000007 R09: 0000000000000000
R10: 00007ffe74253ee0 R11: 00007ffe74253f80 R12: 00000000ffffffff
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

report is corrupted, running repro again
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4d}]}]}]}}]}, 0xac}}, 0x0)

program crashed: INFO: rcu detected stall in worker_thread
final repro crashed as (corrupted=false):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (1 ticks this GP) idle=f22c/1/0x4000000000000000 softirq=13195/13195 fqs=0
rcu: 	(detected by 0, t=10502 jiffies, g=9557, q=448 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 59 Comm: kworker/u4:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:check_region_inline mm/kasan/generic.c:172 [inline]
RIP: 0010:kasan_check_range+0x19/0x290 mm/kasan/generic.c:187
Code: c3 0f 0b b8 ea ff ff ff c3 cc cc cc cc cc cc cc cc 66 0f 1f 00 b0 01 48 85 f6 0f 84 b8 01 00 00 55 41 57 41 56 41 55 41 54 53 <4c> 8d 04 37 49 39 f8 0f 82 5a 02 00 00 49 89 f9 49 c1 e9 2f 41 81
RSP: 0018:ffffc900001f08c8 EFLAGS: 00000002
RAX: 0000000000000001 RBX: 0000000000000077 RCX: ffffffff81670ecd
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90d94508
RBP: ffffc900001f0b48 R08: dffffc0000000000 R09: 1ffffffff21b28a1
R10: dffffc0000000000 R11: fffffbfff21b28a2 R12: 000000003be9ba32
R13: ffff88801dac9e00 R14: 00000000c8301548 R15: ffff88801daca978
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562ab6b76f00 CR3: 000000005d942000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 hlock_class kernel/locking/lockdep.c:228 [inline]
 __lock_acquire+0x107d/0x7c80 kernel/locking/lockdep.c:5133
 lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
 _raw_spin_lock_irq+0xa3/0xe0 kernel/locking/spinlock.c:170
 __run_hrtimer kernel/time/hrtimer.c:1754 [inline]
 __hrtimer_run_queues+0x5e3/0xc40 kernel/time/hrtimer.c:1814
 hrtimer_interrupt+0x3c9/0x9c0 kernel/time/hrtimer.c:1876
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:check_region_inline mm/kasan/generic.c:169 [inline]
RIP: 0010:kasan_check_range+0x12/0x290 mm/kasan/generic.c:187
Code: 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 cc cc cc cc cc cc cc cc 66 0f 1f 00 b0 01 48 85 f6 0f 84 b8 01 00 00 55 41 57 <41> 56 41 55 41 54 53 4c 8d 04 37 49 39 f8 0f 82 5a 02 00 00 49 89
RSP: 0018:ffffc900015a7300 EFLAGS: 00000202
RAX: ffffc900015a7901 RBX: 0000000000000010 RCX: ffffffff813ab988
RDX: 0000000000000001 RSI: 0000000000000010 RDI: ffffc900015a7458
RBP: 0000000000000000 R08: ffff88801dac9e00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc900015a7408
R13: dffffc0000000000 R14: ffffc900015a7458 R15: ffffffff8f542300
 __asan_memset+0x22/0x40 mm/kasan/shadow.c:84
 unwind_next_frame+0x1648/0x2970 arch/x86/kernel/unwind_orc.c:592
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3495 [inline]
 kmem_cache_alloc_node+0x150/0x330 mm/slub.c:3540
 kmalloc_reserve+0x95/0x240 net/core/skbuff.c:562
 __alloc_skb+0x138/0x2c0 net/core/skbuff.c:653
 alloc_skb include/linux/skbuff.h:1284 [inline]
 ndisc_alloc_skb+0xa6/0x450 net/ipv6/ndisc.c:423
 ndisc_send_rs+0x2a6/0x610 net/ipv6/ndisc.c:707
 addrconf_dad_completed+0x79f/0xd40 net/ipv6/addrconf.c:4324
 addrconf_dad_work+0xc4e/0x14e0 net/ipv6/addrconf.c:-1
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g9557 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=1 timer-softirq=7493
rcu: rcu_preempt kthread starved for 10502 jiffies! g9557 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:27088 pid:17    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 schedule_timeout+0x160/0x280 kernel/time/timer.c:2168
 rcu_gp_fqs_loop+0x302/0x1560 kernel/rcu/tree.c:1667
 rcu_gp_kthread+0x99/0x380 kernel/rcu/tree.c:1866
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 59 Comm: kworker/u4:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:lookup_chain_cache kernel/locking/lockdep.c:3762 [inline]
RIP: 0010:lookup_chain_cache_add kernel/locking/lockdep.c:3782 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3837 [inline]
RIP: 0010:__lock_acquire+0x1393/0x7c80 kernel/locking/lockdep.c:5137
Code: cd 03 00 00 48 b8 eb 83 b5 80 46 86 c8 61 49 0f af c4 48 c1 e8 2d 48 8d 1c c5 40 44 90 90 48 89 d8 48 c1 e8 03 48 89 44 24 38 <42> 80 3c 00 00 74 12 48 89 df e8 be ec 75 00 49 b8 00 00 00 00 00
RSP: 0018:ffffc900001f0860 EFLAGS: 00000806
RAX: 1ffffffff217ce1e RBX: ffffffff90be70f0 RCX: ffffffff81671184
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90d94500
RBP: ffffc900001f0aa8 R08: dffffc0000000000 R09: 1ffffffff21b28a0
R10: dffffc0000000000 R11: fffffbfff21b28a1 R12: d4c9f0e422e098f3
R13: ffff88801dac9e00 R14: 0000000022e098f3 R15: ffff88801daca9a0
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562ab6b76f00 CR3: 000000005d942000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xa8/0xf0 kernel/locking/spinlock.c:162
 debug_object_activate+0x6c/0x4b0 lib/debugobjects.c:709
 debug_hrtimer_activate kernel/time/hrtimer.c:450 [inline]
 debug_activate kernel/time/hrtimer.c:505 [inline]
 enqueue_hrtimer+0x30/0x370 kernel/time/hrtimer.c:1108
 __run_hrtimer kernel/time/hrtimer.c:1767 [inline]
 __hrtimer_run_queues+0x637/0xc40 kernel/time/hrtimer.c:1814
 hrtimer_interrupt+0x3c9/0x9c0 kernel/time/hrtimer.c:1876
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:check_region_inline mm/kasan/generic.c:169 [inline]
RIP: 0010:kasan_check_range+0x12/0x290 mm/kasan/generic.c:187
Code: 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 cc cc cc cc cc cc cc cc 66 0f 1f 00 b0 01 48 85 f6 0f 84 b8 01 00 00 55 41 57 <41> 56 41 55 41 54 53 4c 8d 04 37 49 39 f8 0f 82 5a 02 00 00 49 89
RSP: 0018:ffffc900015a7300 EFLAGS: 00000202
RAX: ffffc900015a7901 RBX: 0000000000000010 RCX: ffffffff813ab988
RDX: 0000000000000001 RSI: 0000000000000010 RDI: ffffc900015a7458
RBP: 0000000000000000 R08: ffff88801dac9e00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc900015a7408
R13: dffffc0000000000 R14: ffffc900015a7458 R15: ffffffff8f542300
 __asan_memset+0x22/0x40 mm/kasan/shadow.c:84
 unwind_next_frame+0x1648/0x2970 arch/x86/kernel/unwind_orc.c:592
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3495 [inline]
 kmem_cache_alloc_node+0x150/0x330 mm/slub.c:3540
 kmalloc_reserve+0x95/0x240 net/core/skbuff.c:562
 __alloc_skb+0x138/0x2c0 net/core/skbuff.c:653
 alloc_skb include/linux/skbuff.h:1284 [inline]
 ndisc_alloc_skb+0xa6/0x450 net/ipv6/ndisc.c:423
 ndisc_send_rs+0x2a6/0x610 net/ipv6/ndisc.c:707
 addrconf_dad_completed+0x79f/0xd40 net/ipv6/addrconf.c:4324
 addrconf_dad_work+0xc4e/0x14e0 net/ipv6/addrconf.c:-1
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>