Extracting prog: 26m46.881632613s Minimizing prog: 36m11.559580299s Simplifying prog options: 9m2.268699415s Extracting C: 4m56.175871964s Simplifying C: 0s extracting reproducer from 71 programs testing a last program of every proc single: executing 21 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$BPF_LINK_CREATE_XDP-bpf$MAP_CREATE-syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING-bpf$PROG_LOAD-syz_init_net_socket$nfc_raw-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0x82e, &(0x7f00000005c0)={0x0, 0x20000020, 0x10100, 0x1, 0xfffffffd}, &(0x7f0000000100)=0x0, &(0x7f0000000380)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000000)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x9, 0xe, &(0x7f0000000a40)=ANY=[@ANYBLOB="b70200000d000000bfa300000000000005000000000000007a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400010000050404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf27fb6d2c643db7e2d5fb4b0936cdf827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923dd29c034055b67d5b310efcfa89147a7fb0a93d035f2f206d2ef831ab7ea0c34f17e3ad6eecbb622003b538dfd8e012e79578e51bc53099e90f4580d7be3e8c254a5cba117cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e6a9f65f1328d6704902cbe7bc04b82d2789cb132b8667c214733a18c8b6619f28d996d60a17e3c184b751c51160100000000000080148b9a31ee8dc8b544f3c4a532e60a0ac346dfebd31a08060000000200000000000000334d83239dd20100008000000000d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08a406f99f7b1e1ad828267d4eadd3964663e085354133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0183babc190ae2ebf8aad34732181feb28cb0bae7c34dc5e7c805210600000000000000c3dec04b25df45d4f71ab158c36657b7218baa07a99bd50499ccc421ace5e845885efb5b9964e4beba3da8223fe5308e4e65ee93e107000000f8ddebf70132a4d01776839b8eccf707882042e716df9b57b290c661d4e85031086197bcc5cb0e221a0c34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb0015982730711c599e1c72ffa11ed8be1a6830d7507005154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d1cdac944779dc08a705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe3304000000323e9c707fe81436b024c2574980397bc49d70c060d57bc88fbe3bbaa058b040362ab926150763fb099408885afc2bf9a46a076b7babfcddeff8c35030669ea69f5e4be1b8e0d6697e97186f9ae97d5670dba6623279f73db9dec75070cd9ab0fda6b069ef6d2857ca3e4e6068f1bf710d133d541da86e0477e4a6cc999dc21c3ef408e6b178e7c9f274d7fafc8d757d33dfa35aa2b2ff7f9a7d365e63845f3e1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cadecc13219ba7518aa4f7db34ead13484742067ab743c1d82a5687f2ed690000010000000000000000000000000000000000000099d4fa0000000000003f0ecdc7c82e72919c91d2039afe17e95edef8ba72205beff7771bcb293747b88486cacee403000000a2919a4b09e168e4e4d5ff2ed893f2e314679fa69fc7e0cf761f91b18725704a01c56009a9f748e5aaf30a10bd8c409b1870c1f75e26b45264e3d3f8e0048e55ae289c2f884d0766cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c1540bf3d162dc1c27fa30f0dc60b9f257db5d1c7ed2efce676a93110904d5e055af44664b53c764d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354da8de21eada75d3a3afb2c76ff0700007976694b6a0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d201721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e671282a2d3066ac968c7d7d7db195f255b1b4a85eb9ee0a3b68c9e209756623adf685dd715d68ed1274b4d5502f512493af8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb20407ff7098b7174bef66fa03a99b5c0c20b378065fac4ef9ac2d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x0, r6, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0}}) io_uring_enter(r3, 0x5b43, 0x8200, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$MAP_CREATE-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_dev$loop-socket$inet6_icmp-bind$inet6 detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x1, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) syz_open_dev$loop(0x0, 0x5, 0x103b83) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000280)={0xa, 0x4e24, 0x3ff, @private1, 0x8}, 0x1c) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY detailed listing: executing program 0: r0 = userfaultfd(0x80001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: syz_usb_connect(0x4, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005ceda240d804"], 0x0) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000240)=@ready={0x0, 0x0, 0x8, "a926b0dc", {0x1, 0x0, 0x7, 0x9}}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e15"]) program crashed: INFO: rcu detected stall in vms_gather_munmap_vmas single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: syz_usb_connect(0x4, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005ceda240d804"], 0x0) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000240)=@ready={0x0, 0x0, 0x8, "a926b0dc", {0x1, 0x0, 0x7, 0x9}}) program crashed: INFO: rcu detected stall in sys_newfstatat testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect_ath9k detailed listing: executing program 0: syz_usb_connect(0x4, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005ceda240d804"], 0x0) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: syz_usb_connect(0x4, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005ceda240d804"], 0x0) syz_usb_ep_write$ath9k_ep2(0xffffffffffffffff, 0x83, 0x10, &(0x7f0000000240)=@ready={0x0, 0x0, 0x8, "a926b0dc", {0x1, 0x0, 0x7, 0x9}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000240)=@ready={0x0, 0x0, 0x8, "a926b0dc", {0x1, 0x0, 0x7, 0x9}}) program crashed: INFO: rcu detected stall in schedule_timeout testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000240)=@ready={0x0, 0x0, 0x8, "a926b0dc", {0x1, 0x0, 0x7, 0x9}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 program crashed: INFO: rcu detected stall in worker_thread a never seen crash title: INFO: rcu detected stall in worker_thread, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000240)=@ready={0x0, 0x0, 0x8, "a926b0dc", {0x1, 0x0, 0x7, 0x9}}) program crashed: INFO: rcu detected stall in worker_thread a never seen crash title: INFO: rcu detected stall in worker_thread, ignore testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000240)=@ready={0x0, 0x0, 0x8, "a926b0dc", {0x1, 0x0, 0x7, 0x9}}) program did not crash reproducing took 1h16m56.885806694s repro crashed as (corrupted=false): rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5946/1:b..l rcu: (detected by 0, t=10502 jiffies, g=10141, q=524 ncpus=2) task:udevd state:R running task stack:26016 pid:5946 tgid:5946 ppid:5199 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5369 [inline] __schedule+0x1850/0x4c30 kernel/sched/core.c:6756 preempt_schedule_common+0x84/0xd0 kernel/sched/core.c:6935 preempt_schedule+0xe1/0xf0 kernel/sched/core.c:6959 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] zap_pte_range mm/memory.c:1705 [inline] zap_pmd_range mm/memory.c:1753 [inline] zap_pud_range mm/memory.c:1782 [inline] zap_p4d_range mm/memory.c:1803 [inline] unmap_page_range+0x36c3/0x4040 mm/memory.c:1824 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1914 exit_mmap+0x275/0xc20 mm/mmap.c:1668 __mmput+0x115/0x3c0 kernel/fork.c:1348 exit_mm+0x220/0x310 kernel/exit.c:570 do_exit+0x9ad/0x28e0 kernel/exit.c:925 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1096 x64_sys_call+0x26a8/0x26b0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff85fefca90 RSP: 002b:00007ffc56974c18 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff85fefca90 RDX: 00000000000000e7 RSI: 000000000000003c RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000007 R09: 1d18297dccdc26d6 R10: 00000000ffffffff R11: 0000000000000206 R12: 000055b1a750ec40 R13: 00007ffc56974c58 R14: 0000000000000001 R15: 000055b1a74e9910 rcu: rcu_preempt kthread starved for 7711 jiffies! g10141 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:25976 pid:17 tgid:17 ppid:2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5369 [inline] __schedule+0x1850/0x4c30 kernel/sched/core.c:6756 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7078 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:blk_flush_plug include/linux/blkdev.h:1060 [inline] RIP: 0010:sched_submit_work kernel/sched/core.c:6812 [inline] RIP: 0010:schedule+0x109/0x320 kernel/sched/core.c:6847 Code: eb 08 48 89 ef e8 47 b3 9d f5 4c 8d bd 78 12 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 6a 26 3c f6 49 8b 3f <48> 85 ff 74 0a be 01 00 00 00 e8 58 f3 d7 f8 48 c7 c7 a0 53 7f 8e RSP: 0018:ffffc90000167b68 EFLAGS: 00000246 RAX: 1ffff1100395324f RBX: ffff88801ca98000 RCX: ffff88801ca98ad8 RDX: dffffc0000000000 RSI: ffffffff8c0aaae0 RDI: 0000000000000000 RBP: ffff88801ca98000 R08: ffffffff942a4897 R09: 1ffffffff2854912 R10: dffffc0000000000 R11: fffffbfff2854913 R12: dffffc0000000000 R13: 1ffff9200002cf74 R14: ffffffff8bc9b500 R15: ffff88801ca99278 schedule_timeout+0x15a/0x290 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x2df/0x1330 kernel/rcu/tree.c:2045 rcu_gp_kthread+0xa7/0x3b0 kernel/rcu/tree.c:2247 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 6035 Comm: kworker/0:5 Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: wg-crypt-wg1 wg_packet_tx_worker RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194 Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 6e 80 3a f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 13 27 a2 f5 65 8b 05 74 7a 38 74 85 c0 74 43 48 c7 04 24 0e 36 RSP: 0018:ffffc900000078c0 EFLAGS: 00000206 RAX: fb9b9240a3434400 RBX: 1ffff92000000f1c RCX: ffffffff817b279a RDX: dffffc0000000000 RSI: ffffffff8c0a98e0 RDI: 0000000000000001 RBP: ffffc90000007950 R08: ffffffff942a498f R09: 1ffffffff2854931 R10: dffffc0000000000 R11: fffffbfff2854932 R12: dffffc0000000000 R13: 1ffff92000000f18 R14: ffffc900000078e0 R15: 0000000000000246 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b1a7503d88 CR3: 0000000033d72000 CR4: 0000000000350ef0 Call Trace: dummy_timer+0x44d6/0x4620 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x59d/0xd30 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820 handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:srso_alias_safe_ret+0x0/0x7 arch/x86/lib/retpoline.S:171 Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <48> 8d 64 24 08 c3 cc e8 f4 ff ff ff 0f 0b cc cc cc cc cc cc cc cc RSP: 0018:ffffc90003fffb08 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff888011cee4d8 RCX: ffffffff8676a782 RDX: ffff8880302d3c00 RSI: 0000000000000003 RDI: 0000000000000001 RBP: 0000000000000003 R08: ffffffff8676a79c R09: 1ffff1100239dc9b R10: dffffc0000000000 R11: ffffed100239dc9c R12: dffffc0000000000 R13: 1000000000000000 R14: ffff888033929318 R15: ffff888011cee000 srso_alias_return_thunk+0x5/0xfbef5 arch/x86/lib/retpoline.S:181 raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:949 [inline] atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline] __refcount_sub_and_test include/linux/refcount.h:264 [inline] __refcount_dec_and_test include/linux/refcount.h:307 [inline] refcount_dec_and_test include/linux/refcount.h:325 [inline] kref_put include/linux/kref.h:64 [inline] wg_noise_keypair_put+0x5c/0x290 drivers/net/wireguard/noise.c:139 wg_packet_tx_worker+0x5fe/0x810 drivers/net/wireguard/send.c:280 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa68/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 final repro crashed as (corrupted=false): rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5946/1:b..l rcu: (detected by 0, t=10502 jiffies, g=10141, q=524 ncpus=2) task:udevd state:R running task stack:26016 pid:5946 tgid:5946 ppid:5199 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5369 [inline] __schedule+0x1850/0x4c30 kernel/sched/core.c:6756 preempt_schedule_common+0x84/0xd0 kernel/sched/core.c:6935 preempt_schedule+0xe1/0xf0 kernel/sched/core.c:6959 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] zap_pte_range mm/memory.c:1705 [inline] zap_pmd_range mm/memory.c:1753 [inline] zap_pud_range mm/memory.c:1782 [inline] zap_p4d_range mm/memory.c:1803 [inline] unmap_page_range+0x36c3/0x4040 mm/memory.c:1824 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1914 exit_mmap+0x275/0xc20 mm/mmap.c:1668 __mmput+0x115/0x3c0 kernel/fork.c:1348 exit_mm+0x220/0x310 kernel/exit.c:570 do_exit+0x9ad/0x28e0 kernel/exit.c:925 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1096 x64_sys_call+0x26a8/0x26b0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff85fefca90 RSP: 002b:00007ffc56974c18 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff85fefca90 RDX: 00000000000000e7 RSI: 000000000000003c RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000007 R09: 1d18297dccdc26d6 R10: 00000000ffffffff R11: 0000000000000206 R12: 000055b1a750ec40 R13: 00007ffc56974c58 R14: 0000000000000001 R15: 000055b1a74e9910 rcu: rcu_preempt kthread starved for 7711 jiffies! g10141 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:25976 pid:17 tgid:17 ppid:2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5369 [inline] __schedule+0x1850/0x4c30 kernel/sched/core.c:6756 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7078 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:blk_flush_plug include/linux/blkdev.h:1060 [inline] RIP: 0010:sched_submit_work kernel/sched/core.c:6812 [inline] RIP: 0010:schedule+0x109/0x320 kernel/sched/core.c:6847 Code: eb 08 48 89 ef e8 47 b3 9d f5 4c 8d bd 78 12 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 6a 26 3c f6 49 8b 3f <48> 85 ff 74 0a be 01 00 00 00 e8 58 f3 d7 f8 48 c7 c7 a0 53 7f 8e RSP: 0018:ffffc90000167b68 EFLAGS: 00000246 RAX: 1ffff1100395324f RBX: ffff88801ca98000 RCX: ffff88801ca98ad8 RDX: dffffc0000000000 RSI: ffffffff8c0aaae0 RDI: 0000000000000000 RBP: ffff88801ca98000 R08: ffffffff942a4897 R09: 1ffffffff2854912 R10: dffffc0000000000 R11: fffffbfff2854913 R12: dffffc0000000000 R13: 1ffff9200002cf74 R14: ffffffff8bc9b500 R15: ffff88801ca99278 schedule_timeout+0x15a/0x290 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x2df/0x1330 kernel/rcu/tree.c:2045 rcu_gp_kthread+0xa7/0x3b0 kernel/rcu/tree.c:2247 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 6035 Comm: kworker/0:5 Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: wg-crypt-wg1 wg_packet_tx_worker RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194 Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 6e 80 3a f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 13 27 a2 f5 65 8b 05 74 7a 38 74 85 c0 74 43 48 c7 04 24 0e 36 RSP: 0018:ffffc900000078c0 EFLAGS: 00000206 RAX: fb9b9240a3434400 RBX: 1ffff92000000f1c RCX: ffffffff817b279a RDX: dffffc0000000000 RSI: ffffffff8c0a98e0 RDI: 0000000000000001 RBP: ffffc90000007950 R08: ffffffff942a498f R09: 1ffffffff2854931 R10: dffffc0000000000 R11: fffffbfff2854932 R12: dffffc0000000000 R13: 1ffff92000000f18 R14: ffffc900000078e0 R15: 0000000000000246 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b1a7503d88 CR3: 0000000033d72000 CR4: 0000000000350ef0 Call Trace: dummy_timer+0x44d6/0x4620 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x59d/0xd30 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820 handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:srso_alias_safe_ret+0x0/0x7 arch/x86/lib/retpoline.S:171 Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <48> 8d 64 24 08 c3 cc e8 f4 ff ff ff 0f 0b cc cc cc cc cc cc cc cc RSP: 0018:ffffc90003fffb08 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff888011cee4d8 RCX: ffffffff8676a782 RDX: ffff8880302d3c00 RSI: 0000000000000003 RDI: 0000000000000001 RBP: 0000000000000003 R08: ffffffff8676a79c R09: 1ffff1100239dc9b R10: dffffc0000000000 R11: ffffed100239dc9c R12: dffffc0000000000 R13: 1000000000000000 R14: ffff888033929318 R15: ffff888011cee000 srso_alias_return_thunk+0x5/0xfbef5 arch/x86/lib/retpoline.S:181 raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:949 [inline] atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline] __refcount_sub_and_test include/linux/refcount.h:264 [inline] __refcount_dec_and_test include/linux/refcount.h:307 [inline] refcount_dec_and_test include/linux/refcount.h:325 [inline] kref_put include/linux/kref.h:64 [inline] wg_noise_keypair_put+0x5c/0x290 drivers/net/wireguard/noise.c:139 wg_packet_tx_worker+0x5fe/0x810 drivers/net/wireguard/send.c:280 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa68/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244