syzbot


WARNING in call_rcu (3)

Status: closed as invalid on 2026/06/11 10:27
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+d17177af4afd8c6f804c@syzkaller.appspotmail.com
First crash: 909d, last: 805d
âœĻ AI Patch Versions (1)
Version Stage Reported Report Link Job
1 moderation 2026/05/18 21:04 Discussion 081c2505-21d7-4259-a6ab-cad80355a99b
âœĻ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision Error
29ae2d48-345b-4c7e-8a52-008fa8787743 assessment-security ðŸ’Ĩ WARNING in call_rcu (3) 2026/06/09 17:43 2026/06/09 17:43 2026/06/09 18:11 c36c07f6c1f2230a36374cbd22235f635e8f9284 failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=arm64" "CROSS_COMPILE=aarch64-linux-gnu-" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/6e16ee80b696b43898df67113ed1780f7d1cc41e" "-s" "Image.gz" "compile_commands.json"]: exit status 2 Root cause: drivers/nvme/target/fc.c:151:2: warning: 'counted_by' should not be applied to an array with element of unknown size because 'struct nvmet_fc_fcp_iod' is a struct type with a flexible array member. This will be an error in a future compiler version [-Wbounds-safety-counted-by-elt-type-unknown-size] ld.lld: error: undefined symbol: wcslen * * Restart config... * * * Kernel support for 32-bit EL0 * Kernel support for 32-bit EL0 (COMPAT) [Y/n/?] y Enable kuser helpers page for 32-bit applications (KUSER_HELPERS) [Y/n/?] y Enable vDSO for 32-bit applications (COMPAT_VDSO) [Y/n/?] (NEW) Error in reading or end of file. Compile the 32-bit vDSO for Thumb-2 mode (THUMB2_COMPAT_VDSO) [Y/n/?] (NEW) Error in reading or end of file. Fix up misaligned multi-word loads and stores in user space (COMPAT_ALIGNMENT_FIXUPS) [N/y/?] n * * General architecture-dependent options * Kprobes (KPROBES) [N/y/?] n Optimize very unlikely/likely branches (JUMP_LABEL) [Y/n/?] y Static key selftest (STATIC_KEYS_SELFTEST) [N/y/?] n Enable seccomp to safely execute untrusted bytecode (SECCOMP) [Y/n/?] y Show seccomp filter cache status in /proc/pid/seccomp_cache (SECCOMP_CACHE_DEBUG) [N/y/?] n Stack Protector buffer overflow detection (STACKPROTECTOR) [Y/n/?] y Strong Stack Protector (STACKPROTECTOR_STRONG) [Y/n/?] y Shadow Call Stack (SHADOW_CALL_STACK) [N/y/?] n Link Time Optimization (LTO) > 1. None (LTO_NONE) choice[1]: 1 Use Clang's Control Flow Integrity (CFI) (CFI_CLANG) [N/y/?] (NEW) Error in reading or end of file. Number of bits to use for ASLR of mmap base address (ARCH_MMAP_RND_BITS) [18] 18 Number of bits to use for ASLR of mmap base address for compatible applications (ARCH_MMAP_RND_COMPAT_BITS) [11] 11 Provide system calls for 32-bit time_t (COMPAT_32BIT_TIME) [Y/n/?] y Use a virtually-mapped stack (VMAP_STACK) [Y/n/?] y Support for randomizing kernel stack offset on syscall entry (RANDOMIZE_KSTACK_OFFSET) [Y/n/?] y Default state of kernel stack offset randomization (RANDOMIZE_KSTACK_OFFSET_DEFAULT) [N/y/?] n Locking event counts collection (LOCK_EVENT_COUNTS) [N/y/?] n * * Memory initialization * Initialize kernel stack variables at function entry 1. no automatic stack variable initialization (weakest) (INIT_STACK_NONE) 2. pattern-init everything (strongest) (INIT_STACK_ALL_PATTERN) > 3. zero-init everything (strongest and safest) (INIT_STACK_ALL_ZERO) choice[1-3?]: 3 Enable heap memory zeroing on allocation by default (INIT_ON_ALLOC_DEFAULT_ON) [Y/n/?] y Enable heap memory zeroing on free by default (INIT_ON_FREE_DEFAULT_ON) [N/y/?] n Enable register zeroing on function exit (ZERO_CALL_USED_REGS) [N/y/?] (NEW) Error in reading or end of file. * * Kernel hardening options * Randomize layout of sensitive kernel structures > 1. Disable structure layout randomization (RANDSTRUCT_NONE) 2. Fully randomize structure layout (RANDSTRUCT_FULL) (NEW) choice[1-2?]: Error in reading or end of file. * * Compile-time checks and compiler options * Debug information 1. Disable debug information (DEBUG_INFO_NONE) 2. Rely on the toolchain's implicit default DWARF version (DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT) > 3. Generate DWARF Version 4 debuginfo (DEBUG_INFO_DWARF4) 4. Generate DWARF Version 5 debuginfo (DEBUG_INFO_DWARF5) choice[1-4?]: 3 Reduce debugging information (DEBUG_INFO_REDUCED) [N/y/?] n Compressed Debug information > 1. Don't compress debug information (DEBUG_INFO_COMPRESSED_NONE) 2. Compress debugging information with zlib (DEBUG_INFO_COMPRESSED_ZLIB) 3. Compress debugging information with zstd (DEBUG_INFO_COMPRESSED_ZSTD) (NEW) choice[1-3?]: Error in reading or end of file. Produce split debuginfo in .dwo files (DEBUG_INFO_SPLIT) [N/y/?] n Generate BTF typeinfo (DEBUG_INFO_BTF) [
5e968790-67bf-419d-a26c-e2edc2c590a4 assessment-security ðŸ’Ĩ WARNING in call_rcu (3) 2026/06/02 14:45 2026/06/02 14:45 2026/06/02 15:12 62fe15281f5011cd203d8845b8767b10e7443aa5 failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/6e16ee80b696b43898df67113ed1780f7d1cc41e" "-s" "bzImage" "compile_commands.json"]: exit status 2 Root cause: include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small drivers/nvme/target/fc.c:151:2: warning: 'counted_by' should not be applied to an array with element of unknown size because 'struct nvmet_fc_fcp_iod' is a struct type with a flexible array member. This will be an error in a future compiler version [-Wbounds-safety-counted-by-elt-type-unknown-size] * * Restart config... * * * General setup * Compile also drivers which will not load (COMPILE_TEST) [N/y/?] n Compile the kernel with warnings as errors (WERROR) [N/y/?] n Local version - append to kernel release (LOCALVERSION) [] Automatically append version information to the version string (LOCALVERSION_AUTO) [Y/n/?] y Build ID Salt (BUILD_SALT) [] Kernel compression mode > 1. Gzip (KERNEL_GZIP) (NEW) 2. Bzip2 (KERNEL_BZIP2) (NEW) 3. LZMA (KERNEL_LZMA) (NEW) 4. XZ (KERNEL_XZ) (NEW) 5. LZO (KERNEL_LZO) (NEW) 6. LZ4 (KERNEL_LZ4) (NEW) 7. ZSTD (KERNEL_ZSTD) (NEW) choice[1-7?]: Error in reading or end of file. Default init path (DEFAULT_INIT) [] Default hostname (DEFAULT_HOSTNAME) [(none)] (none) System V IPC (SYSVIPC) [Y/n/?] y POSIX Message Queues (POSIX_MQUEUE) [Y/n/?] y General notification queue (WATCH_QUEUE) [Y/n/?] y Enable process_vm_readv/writev syscalls (CROSS_MEMORY_ATTACH) [Y/n/?] y uselib syscall (for libc5 and earlier) (USELIB) [N/y/?] n Auditing support (AUDIT) [Y/n/?] y * * Timers subsystem * Timer tick handling 1. Periodic timer ticks (constant rate, no dynticks) (HZ_PERIODIC) > 2. Idle dynticks system (tickless idle) (NO_HZ_IDLE) 3. Full dynticks system (tickless) (NO_HZ_FULL) choice[1-3?]: 2 Force user context tracking (CONTEXT_TRACKING_USER_FORCE) [N/y/?] n Old Idle dynticks config (NO_HZ) [Y/n/?] y High Resolution Timer Support (HIGH_RES_TIMERS) [Y/n/?] y Clocksource watchdog maximum allowable skew (in Ξs) (CLOCKSOURCE_WATCHDOG_MAX_SKEW_US) [125] (NEW) Error in reading or end of file. Preemption Model 1. No Forced Preemption (Server) (PREEMPT_NONE) 2. Voluntary Kernel Preemption (Desktop) (PREEMPT_VOLUNTARY) > 3. Preemptible Kernel (Low-Latency Desktop) (PREEMPT) choice[1-3?]: 3 Preemption behaviour defined on boot (PREEMPT_DYNAMIC) [N/y/?] n Core Scheduling for SMT (SCHED_CORE) [N/y/?] n CPU isolation (CPU_ISOLATION) [Y/n/?] y Kernel .config support (IKCONFIG) [Y/n/m/?] y Enable access to .config through /proc/config.gz (IKCONFIG_PROC) [Y/n/?] y Enable kernel headers through /sys/kernel/kheaders.tar.xz (IKHEADERS) [N/m/y/?] n Kernel log buffer size (16 => 64KB, 17 => 128KB) (LOG_BUF_SHIFT) [18] 18 CPU kernel log buffer size contribution (13 => 8 KB, 17 => 128KB) (LOG_CPU_MAX_BUF_SHIFT) [0] 0 Printk indexing debugfs interface (PRINTK_INDEX) [N/y/?] n Memory placement aware NUMA scheduler (NUMA_BALANCING) [Y/n/?] y Automatically enable NUMA aware memory/task placement (NUMA_BALANCING_DEFAULT_ENABLED) [Y/n/?] y Checkpoint/restore support (CHECKPOINT_RESTORE) [Y/n/?] y Automatic process group scheduling (SCHED_AUTOGROUP) [Y/n/?] y Kernel->user space relay support (formerly relayfs) (RELAY) [N/y/?] n Initial RAM filesystem and RAM disk (initramfs/initrd) support (BLK_DEV_INITRD) [Y/n/?] y Initramfs source file(s) (INITRAMFS_SOURCE) [] Support initial ramdisk/ramfs compressed using gzip (RD_GZIP) [Y/n/?] y Support initial ramdisk/ramfs compressed using bzip2 (RD_BZIP2) [Y/n/?] y Support initial ramdisk/ramfs compressed using LZMA (RD_LZMA) [Y/n/?] y Support initial ramdisk/ramfs compressed using XZ (RD_XZ) [Y/n/?] y Support initial ramdisk/ramfs compressed using LZO (RD_LZO) [Y/n/?] y Support initial ramdisk/ramfs compressed using LZ4 (RD_LZ4) [Y/n/?] y Support initial ramdisk/ramfs compressed using ZSTD (RD_ZSTD) [Y/n/?] y Boot config support (BOOT_
f1d56b9f-f6af-4a91-967d-425de93e4a1a assessment-security ðŸ’Ĩ WARNING in call_rcu (3) 2026/05/25 09:29 2026/05/25 09:29 2026/05/25 09:56 c69befb30ac10e158cc9d1557b508ee3f0eca1de failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/6e16ee80b696b43898df67113ed1780f7d1cc41e" "-s" "bzImage" "compile_commands.json"]: exit status 2 Root cause: include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small drivers/nvme/target/fc.c:151:2: warning: 'counted_by' should not be applied to an array with element of unknown size because 'struct nvmet_fc_fcp_iod' is a struct type with a flexible array member. This will be an error in a future compiler version [-Wbounds-safety-counted-by-elt-type-unknown-size] * * Restart config... * * * General setup * Compile also drivers which will not load (COMPILE_TEST) [N/y/?] n Compile the kernel with warnings as errors (WERROR) [N/y/?] n Local version - append to kernel release (LOCALVERSION) [] Automatically append version information to the version string (LOCALVERSION_AUTO) [Y/n/?] y Build ID Salt (BUILD_SALT) [] Kernel compression mode > 1. Gzip (KERNEL_GZIP) (NEW) 2. Bzip2 (KERNEL_BZIP2) (NEW) 3. LZMA (KERNEL_LZMA) (NEW) 4. XZ (KERNEL_XZ) (NEW) 5. LZO (KERNEL_LZO) (NEW) 6. LZ4 (KERNEL_LZ4) (NEW) 7. ZSTD (KERNEL_ZSTD) (NEW) choice[1-7?]: Error in reading or end of file. Default init path (DEFAULT_INIT) [] Default hostname (DEFAULT_HOSTNAME) [(none)] (none) System V IPC (SYSVIPC) [Y/n/?] y POSIX Message Queues (POSIX_MQUEUE) [Y/n/?] y General notification queue (WATCH_QUEUE) [Y/n/?] y Enable process_vm_readv/writev syscalls (CROSS_MEMORY_ATTACH) [Y/n/?] y uselib syscall (for libc5 and earlier) (USELIB) [N/y/?] n Auditing support (AUDIT) [Y/n/?] y * * Timers subsystem * Timer tick handling 1. Periodic timer ticks (constant rate, no dynticks) (HZ_PERIODIC) > 2. Idle dynticks system (tickless idle) (NO_HZ_IDLE) 3. Full dynticks system (tickless) (NO_HZ_FULL) choice[1-3?]: 2 Force user context tracking (CONTEXT_TRACKING_USER_FORCE) [N/y/?] n Old Idle dynticks config (NO_HZ) [Y/n/?] y High Resolution Timer Support (HIGH_RES_TIMERS) [Y/n/?] y Clocksource watchdog maximum allowable skew (in Ξs) (CLOCKSOURCE_WATCHDOG_MAX_SKEW_US) [125] (NEW) Error in reading or end of file. Preemption Model 1. No Forced Preemption (Server) (PREEMPT_NONE) 2. Voluntary Kernel Preemption (Desktop) (PREEMPT_VOLUNTARY) > 3. Preemptible Kernel (Low-Latency Desktop) (PREEMPT) choice[1-3?]: 3 Preemption behaviour defined on boot (PREEMPT_DYNAMIC) [N/y/?] n Core Scheduling for SMT (SCHED_CORE) [N/y/?] n CPU isolation (CPU_ISOLATION) [Y/n/?] y Kernel .config support (IKCONFIG) [Y/n/m/?] y Enable access to .config through /proc/config.gz (IKCONFIG_PROC) [Y/n/?] y Enable kernel headers through /sys/kernel/kheaders.tar.xz (IKHEADERS) [N/m/y/?] n Kernel log buffer size (16 => 64KB, 17 => 128KB) (LOG_BUF_SHIFT) [18] 18 CPU kernel log buffer size contribution (13 => 8 KB, 17 => 128KB) (LOG_CPU_MAX_BUF_SHIFT) [0] 0 Printk indexing debugfs interface (PRINTK_INDEX) [N/y/?] n Memory placement aware NUMA scheduler (NUMA_BALANCING) [Y/n/?] y Automatically enable NUMA aware memory/task placement (NUMA_BALANCING_DEFAULT_ENABLED) [Y/n/?] y Checkpoint/restore support (CHECKPOINT_RESTORE) [Y/n/?] y Automatic process group scheduling (SCHED_AUTOGROUP) [Y/n/?] y Kernel->user space relay support (formerly relayfs) (RELAY) [N/y/?] n Initial RAM filesystem and RAM disk (initramfs/initrd) support (BLK_DEV_INITRD) [Y/n/?] y Initramfs source file(s) (INITRAMFS_SOURCE) [] Support initial ramdisk/ramfs compressed using gzip (RD_GZIP) [Y/n/?] y Support initial ramdisk/ramfs compressed using bzip2 (RD_BZIP2) [Y/n/?] y Support initial ramdisk/ramfs compressed using LZMA (RD_LZMA) [Y/n/?] y Support initial ramdisk/ramfs compressed using XZ (RD_XZ) [Y/n/?] y Support initial ramdisk/ramfs compressed using LZO (RD_LZO) [Y/n/?] y Support initial ramdisk/ramfs compressed using LZ4 (RD_LZ4) [Y/n/?] y Support initial ramdisk/ramfs compressed using ZSTD (RD_ZSTD) [Y/n/?] y Boot config support (BOOT_
081c2505-21d7-4259-a6ab-cad80355a99b patching ❓ WARNING in call_rcu (3) 2026/05/18 16:40 2026/05/18 17:16 2026/05/18 21:04 9f74d39908454b73546eaf1b8211b48b66e5c0fe
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] WARNING in call_rcu (3) 0 (3) 2026/06/11 10:27
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in call_rcu (2) xfs -1 C 15 1255d 1262d 0/29 auto-obsoleted due to no activity on 2023/04/15 15:13
linux-5.15 WARNING in call_rcu -1 3 1040d 1070d 0/3 auto-obsoleted due to no activity on 2023/11/16 11:10
linux-5.15 WARNING in call_rcu (2) -1 1 887d 886d 0/3 auto-obsoleted due to no activity on 2024/04/17 03:03
upstream WARNING in call_rcu net -1 C done 8 2279d 2286d 15/29 fixed on 2020/05/10 10:41
Last patch testing requests (10)
Created Duration User Patch Repo Result
2026/06/06 22:06 29m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci error
2026/03/28 15:44 3h05m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci error
2026/01/17 13:13 1h41m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2025/11/08 04:52 40m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2025/08/30 04:19 31m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2025/06/22 21:27 1h36m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci OK log
2025/06/20 23:31 19m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2025/04/13 20:49 19m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2025/04/11 22:00 19m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2025/02/02 17:46 29m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log

Sample crash report:
------------[ cut here ]------------
ODEBUG: activate active (active state 1) object: 000000007c840c9e object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:517 debug_print_object lib/debugobjects.c:514 [inline]
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:517 debug_object_activate+0x360/0x4ac lib/debugobjects.c:732
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:514 [inline]
pc : debug_object_activate+0x360/0x4ac lib/debugobjects.c:732
lr : debug_print_object lib/debugobjects.c:514 [inline]
lr : debug_object_activate+0x360/0x4ac lib/debugobjects.c:732
sp : ffff800080007ad0
x29: ffff800080007ad0 x28: ffff800093738000 x27: dfff800000000000
x26: ffff80008aef0200 x25: 0000000000000001 x24: ffff0000d010cd00
x23: 0000000000000003 x22: ffff80008b41a2e0 x21: 0000000000000000
x20: ffff80008aef0200 x19: ffff0000d010cd00 x18: ffff800080006fa0
x17: 3963303438633730 x16: ffff80008ad6b09c x15: 0000000000000001
x14: 1fffe00036800002 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000010004 x10: 0000000000ff0100 x9 : 42aaeb85fb1b0600
x8 : 42aaeb85fb1b0600 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000800073b8 x4 : ffff80008ed822c0 x3 : ffff8000805ba130
x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000000
Call trace:
 debug_print_object lib/debugobjects.c:514 [inline]
 debug_object_activate+0x360/0x4ac lib/debugobjects.c:732
 debug_rcu_head_queue kernel/rcu/rcu.h:227 [inline]
 __call_rcu_common kernel/rcu/tree.c:2700 [inline]
 call_rcu+0x48/0xaf4 kernel/rcu/tree.c:2829
 switch_schedules net/sched/sch_taprio.c:210 [inline]
 advance_sched+0x7e0/0xac0 net/sched/sch_taprio.c:984
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x484/0xca0 kernel/time/hrtimer.c:1753
 hrtimer_interrupt+0x2c0/0xb64 kernel/time/hrtimer.c:1815
 timer_handler drivers/clocksource/arm_arch_timer.c:674 [inline]
 arch_timer_handler_virt+0x74/0x88 drivers/clocksource/arm_arch_timer.c:685
 handle_percpu_devid_irq+0x2a4/0x804 kernel/irq/chip.c:942
 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
 handle_irq_desc kernel/irq/irqdesc.c:672 [inline]
 generic_handle_domain_irq+0x7c/0xc4 kernel/irq/irqdesc.c:728
 __gic_handle_irq drivers/irqchip/irq-gic-v3.c:782 [inline]
 __gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:833 [inline]
 gic_handle_irq+0x6c/0x190 drivers/irqchip/irq-gic-v3.c:877
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
 do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:310
 __el1_irq arch/arm64/kernel/entry-common.c:536 [inline]
 el1_interrupt+0x34/0x68 arch/arm64/kernel/entry-common.c:551
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]
 arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49
 cpuidle_idle_call kernel/sched/idle.c:170 [inline]
 do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410
 rest_init+0x2dc/0x2f4 init/main.c:730
 start_kernel+0x0/0x4ec init/main.c:827
 start_kernel+0x3ec/0x4ec init/main.c:1072
 __primary_switched+0x84/0x8c arch/arm64/kernel/head.S:243
irq event stamp: 700776
hardirqs last  enabled at (700775): [<ffff80008ad6bc6c>] default_idle_call+0xf4/0x128 kernel/sched/idle.c:103
hardirqs last disabled at (700776): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
hardirqs last disabled at (700776): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
softirqs last  enabled at (700464): [<ffff80008002189c>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last  enabled at (700464): [<ffff80008002189c>] __do_softirq+0xac8/0xce4 kernel/softirq.c:582
softirqs last disabled at (700459): [<ffff80008002ab48>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ODEBUG: active_state active (active state 1) object: 000000007c840c9e object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:517 debug_print_object lib/debugobjects.c:514 [inline]
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:517 debug_object_active_state+0x2a8/0x37c lib/debugobjects.c:954
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W          6.8.0-rc7-syzkaller-g707081b61156 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:514 [inline]
pc : debug_object_active_state+0x2a8/0x37c lib/debugobjects.c:954
lr : debug_print_object lib/debugobjects.c:514 [inline]
lr : debug_object_active_state+0x2a8/0x37c lib/debugobjects.c:954
sp : ffff800080007ad0
x29: ffff800080007ad0 x28: 00000000000000c0 x27: dfff800000000000
x26: 1fffe0001a95d34b x25: 0000000000000003 x24: ffff800093738000
x23: 0000000000000001 x22: ffff80008aef0200 x21: ffff0000d010cd00
x20: ffff80008b41a2e0 x19: 0000000000000000 x18: ffff800080006fa0
x17: 3863373030303030 x16: ffff80008ad6b09c x15: 0000000000000001
x14: 1fffe00036800002 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000010004 x10: 0000000000ff0100 x9 : 42aaeb85fb1b0600
x8 : 42aaeb85fb1b0600 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000800073b8 x4 : ffff80008ed822c0 x3 : ffff8000805ba130
x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000000
Call trace:
 debug_print_object lib/debugobjects.c:514 [inline]
 debug_object_active_state+0x2a8/0x37c lib/debugobjects.c:954
 debug_rcu_head_queue kernel/rcu/rcu.h:228 [inline]
 __call_rcu_common kernel/rcu/tree.c:2700 [inline]
 call_rcu+0x60/0xaf4 kernel/rcu/tree.c:2829
 switch_schedules net/sched/sch_taprio.c:210 [inline]
 advance_sched+0x7e0/0xac0 net/sched/sch_taprio.c:984
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x484/0xca0 kernel/time/hrtimer.c:1753
 hrtimer_interrupt+0x2c0/0xb64 kernel/time/hrtimer.c:1815
 timer_handler drivers/clocksource/arm_arch_timer.c:674 [inline]
 arch_timer_handler_virt+0x74/0x88 drivers/clocksource/arm_arch_timer.c:685
 handle_percpu_devid_irq+0x2a4/0x804 kernel/irq/chip.c:942
 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
 handle_irq_desc kernel/irq/irqdesc.c:672 [inline]
 generic_handle_domain_irq+0x7c/0xc4 kernel/irq/irqdesc.c:728
 __gic_handle_irq drivers/irqchip/irq-gic-v3.c:782 [inline]
 __gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:833 [inline]
 gic_handle_irq+0x6c/0x190 drivers/irqchip/irq-gic-v3.c:877
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
 do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:310
 __el1_irq arch/arm64/kernel/entry-common.c:536 [inline]
 el1_interrupt+0x34/0x68 arch/arm64/kernel/entry-common.c:551
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]
 arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49
 cpuidle_idle_call kernel/sched/idle.c:170 [inline]
 do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410
 rest_init+0x2dc/0x2f4 init/main.c:730
 start_kernel+0x0/0x4ec init/main.c:827
 start_kernel+0x3ec/0x4ec init/main.c:1072
 __primary_switched+0x84/0x8c arch/arm64/kernel/head.S:243
irq event stamp: 700776
hardirqs last  enabled at (700775): [<ffff80008ad6bc6c>] default_idle_call+0xf4/0x128 kernel/sched/idle.c:103
hardirqs last disabled at (700776): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
hardirqs last disabled at (700776): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
softirqs last  enabled at (700464): [<ffff80008002189c>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last  enabled at (700464): [<ffff80008002189c>] __do_softirq+0xac8/0xce4 kernel/softirq.c:582
softirqs last disabled at (700459): [<ffff80008002ab48>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81
---[ end trace 0000000000000000 ]---
rcu: __call_rcu_common(): Double-freed CB 000000007c840c9e->taprio_free_sched_cb+0x0/0x178()!!!   slab kmalloc-512 start ffff0000d010cc00 pointer offset 256 size 512

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/24 23:14 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 0ea90952 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2024/03/30 01:15 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 c52bcb23 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/12/17 07:53 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d5b235ec8eab 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
* Struck through repros no longer work on HEAD.