syzbot
INFO: rcu detected stall in sys_newfstatat (2)
Status:
upstream: reported on 2026/05/10 20:40
Reported-by: syzbot+e56fb7f0a6923e2175ba@syzkaller.appspotmail.com
First crash: 91d, last: 1d17h
Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P18521/1:b..l P19069/1:b..l
rcu: (detected by 1, t=10502 jiffies, g=144625, q=161 ncpus=2)
task:syz.5.3382 state:R running task stack:27272 pid:19069 ppid:13014 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6868
preempt_schedule+0xc0/0xd0 kernel/sched/core.c:6892
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
__down_read_trylock kernel/locking/rwsem.c:1293 [inline]
down_read_trylock+0x27c/0x3b0 kernel/locking/rwsem.c:1559
vma_start_read include/linux/mm.h:669 [inline]
lock_vma_under_rcu+0x249/0x660 mm/memory.c:5509
do_user_addr_fault+0x31c/0x12d0 arch/x86/mm/fault.c:1314
handle_page_fault arch/x86/mm/fault.c:1463 [inline]
exc_page_fault+0x64/0x100 arch/x86/mm/fault.c:1516
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7fb65605524e
RSP: 002b:00007fb6570cf470 EFLAGS: 00010206
RAX: 00000000011aa001 RBX: 00007fb6570cf530 RCX: 00000000000000f2
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007fb6570cf5d0
RBP: 0000000000000102 R08: 00007fb64bff7000 R09: 00000000011aa000
R10: 0000000000000000 R11: 00007fb6570cf540 R12: 0000000000000001
R13: 00007fb656254fa0 R14: 0000000000000000 R15: 00007fb6570cf5d0
</TASK>
task:udevd state:R running task stack:24488 pid:18521 ppid:5140 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
preempt_schedule_irq+0xbf/0x150 kernel/sched/core.c:7011
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:step_into+0x387/0xee0 fs/namei.c:1858
Code: 89 ff e8 1c 38 04 00 e9 92 00 00 00 49 83 c5 08 4c 8d 7b 44 4c 89 f8 48 c1 e8 03 49 bc 00 00 00 00 00 fc ff df 42 0f b6 04 20 <84> c0 0f 85 ca 09 00 00 45 8b 3f 4c 89 e8 48 c1 e8 03 42 0f b6 04
RSP: 0018:ffffc90004abf7e0 EFLAGS: 00000a07
RAX: 0000000000000000 RBX: ffffc90004abfac0 RCX: 0000000000000000
RDX: ffff88802499bc00 RSI: 0000000000000040 RDI: 0000000000000000
RBP: ffffc90004abf8d0 R08: ffff88802fc3d970 R09: 1ffff11005f87b2e
R10: dffffc0000000000 R11: ffffed1005f87b2f R12: dffffc0000000000
R13: ffff88802fc3d900 R14: ffff888078913e20 R15: ffffc90004abfb04
walk_component fs/namei.c:2016 [inline]
link_path_walk+0x748/0xe40 fs/namei.c:2337
path_lookupat+0x83/0x420 fs/namei.c:2490
filename_lookup+0x22d/0x580 fs/namei.c:2520
vfs_statx+0x112/0x680 fs/stat.c:244
vfs_fstatat+0x12a/0x1b0 fs/stat.c:299
__do_sys_newfstatat fs/stat.c:463 [inline]
__se_sys_newfstatat fs/stat.c:457 [inline]
__x64_sys_newfstatat+0x149/0x1f0 fs/stat.c:457
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1305911b0a
RSP: 002b:00007fff156cf2f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 000055e57afd58e0 RCX: 00007f1305911b0a
RDX: 00007fff156cf320 RSI: 000055e57afd58e0 RDI: 00000000ffffff9c
RBP: 000055e57afd58f9 R08: 0000000000013c80 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007fff156d0445
R13: 00007fff156cf3b0 R14: 000055e54e8f96d7 R15: 00007fff156d0440
</TASK>
rcu: rcu_preempt kthread starved for 10553 jiffies! g144625 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:25960 pid:17 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_timeout+0x188/0x2d0 kernel/time/timer.c:2168
rcu_gp_fqs_loop+0x30d/0x1590 kernel/rcu/tree.c:1667
rcu_gp_kthread+0x9d/0x3b0 kernel/rcu/tree.c:1866
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:pv_native_safe_halt+0xf/0x10 arch/x86/kernel/paravirt.c:148
Code: 4e 1c 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d a3 5a 3b 00 fb f4 <c3> 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9
RSP: 0018:ffffc90000187de0 EFLAGS: 000002c2
RAX: 5d24e72566f50c00 RBX: ffffffff81630c41 RCX: 5d24e72566f50c00
RDX: 0000000000000001 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d0ca0
RBP: ffffc90000187f20 R08: ffff8880b8f36bab R09: 1ffff110171e6d75
R10: dffffc0000000000 R11: ffffed10171e6d76 R12: 1ffff92000030fc8
R13: dffffc0000000000 R14: 1ffff110038c9780 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f99d925bff0 CR3: 000000007bde7000 CR4: 00000000003506e0
DR0: 000000000000006d DR1: 000000007fffffff DR2: 0000000000150000
DR3: 0000000000000009 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:753
default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
cpuidle_idle_call kernel/sched/idle.c:178 [inline]
do_idle+0x221/0x5c0 kernel/sched/idle.c:302
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:401
start_secondary+0xee/0xf0 arch/x86/kernel/smpboot.c:323
secondary_startup_64_no_verify+0x179/0x17b
</TASK>
* Struck through repros no longer work on HEAD.