INFO: rcu detected stall in flush_to_ldisc (2)

Status: auto-obsoleted due to no activity on 2026/07/25 21:12
Subsystems: serial
Labels: prio:high
[Documentation on labels]
First crash: 106d, last: 106d
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
d678765f assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ INFO: rcu detected stall in flush_to_ldisc (2) 2026/05/31 01:22 2026/05/31 01:22 2026/05/31 02:16 6b4a8443
804ad078 assessment-security 💥 INFO: rcu detected stall in flush_to_ldisc (2) 2026/05/14 13:30 2026/05/14 13:30 2026/05/14 13:32 6ccb967e
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in flush_to_ldisc serial 1 1 622d 622d 0/29 auto-obsoleted due to no activity on 2025/02/24 06:26

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (2 ticks this GP) idle=f08c/1/0x4000000000000000 softirq=43704/43706 fqs=59
rcu: 	(detected by 0, t=10506 jiffies, g=47441, q=272 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 1104 Comm: kworker/u8:7 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events_unbound flush_to_ldisc
RIP: 0010:hlock_class kernel/locking/lockdep.c:234 [inline]
RIP: 0010:__lock_acquire+0xdad/0x2630 kernel/locking/lockdep.c:5233
Code: ff ff ff ff c7 44 24 08 01 00 00 00 41 b8 ff ff ff ff e9 81 f7 ff ff 0f b7 43 f8 66 25 ff 1f 0f b7 c0 48 0f a3 05 f3 dd 2c 14 <0f> 83 e1 02 00 00 48 8d 04 80 48 8d 04 80 48 8d 04 c5 60 3b 11 96
RSP: 0018:ffffc90000a08c40 EFLAGS: 00000007
RAX: 0000000000000074 RBX: ffff888029e3b1a8 RCX: 0000000000000007
RDX: 000000002cd708a8 RSI: 00000000e2f4bf9d RDI: 00000000c6b821bf
RBP: ffff888029e3a500 R08: 00000000e3c36222 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000007 R15: cc889bfc2cd708a8
FS:  0000000000000000(0000) GS:ffff888124479000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc662824ff8 CR3: 000000001c339000 CR4: 00000000003526f0
DR0: 0000000000000004 DR1: 0000000000000003 DR2: 000000007fffdfff
DR3: 0000800000000005 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x1b1/0x370 kernel/locking/lockdep.c:5825
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
 _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:166
 debug_object_deactivate+0x135/0x3b0 lib/debugobjects.c:890
 debug_hrtimer_deactivate kernel/time/hrtimer.c:490 [inline]
 __run_hrtimer kernel/time/hrtimer.c:1898 [inline]
 __hrtimer_run_queues+0x2f0/0xa00 kernel/time/hrtimer.c:1994
 hrtimer_interrupt+0x3e5/0x940 kernel/time/hrtimer.c:2113
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 __sysvec_apic_timer_interrupt+0x10b/0x460 arch/x86/kernel/apic/apic.c:1067
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: 56 5b 5c 00 48 89 df 5b e9 7d e6 61 00 be 03 00 00 00 5b e9 42 b4 f0 02 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 65 8b 05 05 e1 01 12 48 8b 34 24 65 48 8b 15 e1 e0 01
RSP: 0018:ffffc9000539f690 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81cf10ad
RDX: ffff888029e3a500 RSI: ffffffff81cf10bb RDI: ffff888029e3a500
RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000008
R13: ffff88813fe94000 R14: ffff88802bd79140 R15: ffff8880223e8000
 queue_work_on+0x141/0x1e0 kernel/workqueue.c:2437
 queue_work include/linux/workqueue.h:696 [inline]
 tty_buffer_queue_work drivers/tty/tty_buffer.c:66 [inline]
 tty_insert_flip_string_and_push_buffer+0x183/0x230 drivers/tty/tty_buffer.c:570
 pty_write+0xd2/0x100 drivers/tty/pty.c:116
 tty_put_char+0x130/0x160 drivers/tty/tty_io.c:3154
 do_output_char+0x155/0x850 drivers/tty/n_tty.c:459
 __process_echoes+0x21c/0xb10 drivers/tty/n_tty.c:697
 commit_echoes+0x158/0x230 drivers/tty/n_tty.c:750
 n_tty_receive_char+0x3f5/0x600 drivers/tty/n_tty.c:1413
 n_tty_receive_buf_standard+0x6b2/0x3090 drivers/tty/n_tty.c:1582
 __receive_buf drivers/tty/n_tty.c:1616 [inline]
 n_tty_receive_buf_common+0x3c0/0x1950 drivers/tty/n_tty.c:1715
 tty_ldisc_receive_buf+0xaa/0x1a0 drivers/tty/tty_buffer.c:394
 tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37
 receive_buf drivers/tty/tty_buffer.c:452 [inline]
 flush_to_ldisc+0x26b/0x730 drivers/tty/tty_buffer.c:502
 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
 process_scheduled_works kernel/workqueue.c:3385 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: rcu_preempt kthread starved for 10210 jiffies! g47441 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27992 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5387 [inline]
 __schedule+0x10e9/0x6820 kernel/sched/core.c:7188
 __schedule_loop kernel/sched/core.c:7267 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7282
 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2095
 rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2297
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 5595 Comm: udevd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: 56 5b 5c 00 48 89 df 5b e9 7d e6 61 00 be 03 00 00 00 5b e9 42 b4 f0 02 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 65 8b 05 05 e1 01 12 48 8b 34 24 65 48 8b 15 e1 e0 01
RSP: 0018:ffffc90003daf5e8 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff81fc0f3d
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff88807ad8a500
RBP: ffff8880b8540f40 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003
R13: ffffed10170a81e9 R14: 0000000000000001 R15: ffff8880b843c5c0
FS:  00007fa43b584880(0000) GS:ffff888124379000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ebf53d4f98 CR3: 00000000717c4000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 native_pause arch/x86/include/asm/vdso/processor.h:13 [inline]
 cpu_relax arch/x86/include/asm/vdso/processor.h:18 [inline]
 csd_lock_wait kernel/smp.c:342 [inline]
 smp_call_function_many_cond+0x587/0x1700 kernel/smp.c:892
 on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1057
 __flush_tlb_multi arch/x86/include/asm/paravirt.h:46 [inline]
 flush_tlb_multi arch/x86/mm/tlb.c:1361 [inline]
 flush_tlb_mm_range+0x45f/0x16f0 arch/x86/mm/tlb.c:1451
 tlb_flush arch/x86/include/asm/tlb.h:23 [inline]
 tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:509 [inline]
 tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:499 [inline]
 tlb_flush_mmu mm/mmu_gather.c:423 [inline]
 tlb_finish_mmu+0x3fe/0x810 mm/mmu_gather.c:549
 unmap_region+0x2d9/0x3b0 mm/vma.c:491
 vms_clear_ptes mm/vma.c:1303 [inline]
 vms_complete_munmap_vmas+0xa4b/0xdd0 mm/vma.c:1345
 do_vmi_align_munmap+0x44f/0x5f0 mm/vma.c:1604
 do_vmi_munmap+0x1f8/0x3e0 mm/vma.c:1652
 __vm_munmap+0x196/0x390 mm/vma.c:3284
 __do_sys_munmap mm/mmap.c:1079 [inline]
 __se_sys_munmap mm/mmap.c:1076 [inline]
 __x64_sys_munmap+0x59/0x80 mm/mmap.c:1076
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa43af1e097
Code: 73 01 c3 48 8b 0d 61 2d 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 31 2d 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffcb40ecf98 EFLAGS: 00000206 ORIG_RAX: 000000000000000b
RAX: ffffffffffffffda RBX: 000055ebf53d4f90 RCX: 00007fa43af1e097
RDX: 0000000000000000 RSI: 00000000009480e8 RDI: 00007fa43a200000
RBP: 000055ebf53d22c0 R08: 000055ebf5612660 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000206 R12: 000055ebcc389588
R13: 00007ffcb40ed020 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/26 21:11 upstream 897d54018cc9 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in flush_to_ldisc
* Struck through repros no longer work on HEAD.