INFO: rcu detected stall in kvm_dev_ioctl (7)

Status: auto-obsoleted due to no activity on 2026/09/28 19:30
Subsystems: mm fs
Labels: prio:high
[Documentation on labels]
First crash: 243d, last: 101d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
cbd7d3dd assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ INFO: rcu detected stall in kvm_dev_ioctl (7) 2026/05/25 23:29 2026/05/25 23:29 2026/05/26 00:08 c69befb3
▶ ▼ Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 INFO: rcu detected stall in kvm_dev_ioctl 1 1 838d 838d 0/3 auto-obsoleted due to no activity on 2024/10/01 03:25
upstream INFO: rcu detected stall in kvm_dev_ioctl (2) mm 1 1 2466d 2466d 0/29 closed as invalid on 2020/01/08 05:23
linux-6.1 INFO: rcu detected stall in kvm_dev_ioctl (2) 1 2 239d 272d 0/3 auto-obsoleted due to no activity on 2026/05/23 10:23
linux-6.6 INFO: rcu detected stall in kvm_dev_ioctl 1 1 425d 425d 0/2 auto-obsoleted due to no activity on 2025/11/18 13:11
upstream INFO: rcu detected stall in kvm_dev_ioctl (5) mm 1 9 603d 893d 0/29 auto-obsoleted due to no activity on 2025/05/14 19:07
upstream INFO: rcu detected stall in kvm_dev_ioctl (4) mm 1 1 1412d 1412d 0/29 auto-obsoleted due to no activity on 2023/04/10 15:34
upstream INFO: rcu detected stall in kvm_dev_ioctl (3) mm 1 3 2466d 2466d 0/29 closed as invalid on 2020/01/09 08:13
upstream INFO: rcu detected stall in kvm_dev_ioctl mm 1 4 2502d 2502d 0/29 closed as invalid on 2019/12/04 14:04
upstream INFO: rcu detected stall in kvm_dev_ioctl (6) fs 1 4 351d 500d 0/29 auto-obsoleted due to no activity on 2026/01/21 11:19
linux-4.19 BUG: soft lockup in kvm_dev_ioctl 1 1 1976d 1976d 0/1 auto-closed as invalid on 2021/09/08 20:48
android-5-15 BUG: soft lockup in kvm_dev_ioctl 1 1 874d 874d 0/2 auto-obsoleted due to no activity on 2024/08/16 05:28

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (1 GPs behind) idle=f144/1/0x4000000000000000 softirq=114491/114491 fqs=0
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P20124/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=115981, q=424 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 20129 Comm: syz.7.3157 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline]
RIP: 0010:lock_is_held_type+0xd7/0x140 kernel/locking/lockdep.c:5941
Code: 03 0f 95 c0 44 39 e0 0f 94 c0 0f b6 c0 48 c7 c7 0e 7c 13 8e 89 44 24 04 e8 c6 19 00 00 ba ff ff ff ff 65 0f c1 15 19 75 97 08 <83> fa 01 8b 44 24 04 75 2d 9c 5a 80 e6 02 75 47 41 f7 c5 00 02 00
RSP: 0018:ffffc90000a08da8 EFLAGS: 00000057
RAX: 0000000000000001 RBX: ffff88807ba6f2c0 RCX: 0000000000000001
RDX: 0000000000000001 RSI: ffffffff8e137c0e RDI: ffffffff8c3e9b80
RBP: ffff888020bc8000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 00000000ffffffff
R13: 0000000000000046 R14: ffff888020bc8bf0 R15: 0000000000000002
FS:  00007fe4d37446c0(0000) GS:ffff8881241e0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2f0da5 CR3: 0000000046ac0000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 lock_is_held include/linux/lockdep.h:249 [inline]
 advance_sched+0x838/0xd20 net/sched/sch_taprio.c:933
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
 hrtimer_interrupt+0x3e5/0x940 kernel/time/hrtimer.c:2215
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x109/0x470 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872
Code: 05 bb ef 4e 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 06 a2 16 0f 0f 82 ac 02 00 00 8b 35 ce d5 16 0f 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 5d ef 4e 12 0f 85 ec 02 00 00 48 83 c4
RSP: 0018:ffffc90006ed78d8 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8e137c0e RDI: ffffffff8c3e9b80
RBP: ffffffff8e9e60c0 R08: 0000000069701fbc R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 rcu_read_lock include/linux/rcupdate.h:840 [inline]
 xa_load+0xcd/0x2c0 lib/xarray.c:1617
 memcg_list_lru_allocated mm/list_lru.c:571 [inline]
 memcg_list_lru_alloc+0xbb/0x100 mm/list_lru.c:626
 __memcg_slab_post_alloc_hook+0x28b/0x1160 mm/memcontrol.c:3572
 memcg_slab_post_alloc_hook mm/slub.c:2475 [inline]
 slab_post_alloc_hook mm/slub.c:4631 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 kmem_cache_alloc_lru_noprof+0x583/0x6a0 mm/slub.c:4978
 __d_alloc+0x35/0xa50 fs/dcache.c:1902
 d_alloc+0x4a/0x1e0 fs/dcache.c:1981
 lookup_one_qstr_excl+0x171/0x250 fs/namei.c:1806
 __start_dirop fs/namei.c:2920 [inline]
 start_dirop+0x59/0xb0 fs/namei.c:2942
 simple_start_creating+0xf9/0x110 fs/libfs.c:2305
 debugfs_start_creating.part.0+0x82/0x170 fs/debugfs/inode.c:394
 debugfs_start_creating fs/debugfs/inode.c:371 [inline]
 __debugfs_create_file+0xb3/0x4f0 fs/debugfs/inode.c:428
 debugfs_create_file_full+0x41/0x60 fs/debugfs/inode.c:460
 kvm_create_vm_debugfs virt/kvm/kvm_main.c:1057 [inline]
 kvm_create_vm virt/kvm/kvm_main.c:1196 [inline]
 kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5493 [inline]
 kvm_dev_ioctl+0x16c8/0x1a50 virt/kvm/kvm_main.c:5535
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe4d279ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe4d3744028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fe4d2a15fa0 RCX: 00007fe4d279ce59
RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003
RBP: 00007fe4d2832e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe4d2a16038 R14: 00007fe4d2a15fa0 R15: 00007ffc227b7958
 </TASK>
task:syz.8.3158      state:R  running task     stack:27144 pid:20124 tgid:20124 ppid:11511  task_flags:0x40004c flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x125c/0x6730 kernel/sched/core.c:7234
 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7413
 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:190
 spin_unlock include/linux/spinlock.h:390 [inline]
 zap_pte_range mm/memory.c:1964 [inline]
 zap_pmd_range mm/memory.c:2020 [inline]
 zap_pud_range mm/memory.c:2048 [inline]
 zap_p4d_range mm/memory.c:2069 [inline]
 __zap_vma_range+0x16f7/0x4a30 mm/memory.c:2109
 unmap_vmas+0x299/0x5f0 mm/memory.c:2178
 exit_mmap+0x1ef/0xa00 mm/mmap.c:1300
 __mmput+0x12a/0x410 kernel/fork.c:1182
 mmput+0x67/0x80 kernel/fork.c:1205
 exit_mm kernel/exit.c:610 [inline]
 do_exit+0x8b1/0x2ae0 kernel/exit.c:992
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1147
 __do_sys_exit_group kernel/exit.c:1158 [inline]
 __se_sys_exit_group kernel/exit.c:1156 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1156
 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1bd359ce59
RSP: 002b:00007ffece4611c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1bd359ce59
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffece46122c R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 000000000000014d
R13: 00000000000927c0 R14: 0000000000108417 R15: 00007ffece461280
 </TASK>
rcu: rcu_preempt kthread starved for 10502 jiffies! g115981 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28840 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x125c/0x6730 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7326
 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2123
 rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2325
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 11503 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline]
RIP: 0010:smp_call_function_many_cond+0x589/0x16c0 kernel/smp.c:892
Code: b8 00 00 00 00 00 fc ff df 48 8b 54 24 08 49 89 d5 49 89 d4 49 c1 ed 03 41 83 e4 07 49 01 c5 41 83 c4 03 e8 b9 95 0c 00 f3 90 <41> 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 2c 0f 00 00 8b 45 08 31
RSP: 0018:ffffc90002eaf618 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff81fcea8d
RDX: ffff888026ed4a80 RSI: ffffffff81fcea67 RDI: ffff888026ed4a80
RBP: ffff8880b8541240 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003
R13: ffffed10170a8249 R14: 0000000000000001 R15: ffff8880b843c880
FS:  000055558cd31500(0000) GS:ffff8881240e0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c396062 CR3: 0000000055400000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1057
 __flush_tlb_multi arch/x86/include/asm/paravirt.h:46 [inline]
 flush_tlb_multi arch/x86/mm/tlb.c:1361 [inline]
 flush_tlb_mm_range+0x45f/0x16f0 arch/x86/mm/tlb.c:1451
 dup_mmap+0x1307/0x21b0 mm/mmap.c:1905
 dup_mm kernel/fork.c:1538 [inline]
 copy_mm kernel/fork.c:1590 [inline]
 copy_process+0x4588/0x8030 kernel/fork.c:2288
 kernel_clone+0x176/0x9d0 kernel/fork.c:2747
 __do_sys_clone+0xd9/0x120 kernel/fork.c:2888
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3bcd5c58d2
Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffcc8c17500 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffcc8c17500 RCX: 00007f3bcd5c58d2
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffcc8c1768c R08: 0000000000000000 R09: 0000000000000001
R10: 000055558cd317d0 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 0000000000108518 R15: 00007ffcc8c176e0
 </TASK>

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/30 19:27 upstream dc59e4fea9d8 00e8b0fd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in kvm_dev_ioctl
2026/06/01 04:53 upstream 8d9c51eac648 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: rcu detected stall in kvm_dev_ioctl
2026/03/28 08:13 upstream 7df48e363130 ef441708 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto INFO: rcu detected stall in kvm_dev_ioctl
2026/03/08 18:54 upstream c23719abc330 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in kvm_dev_ioctl
2026/02/08 19:08 upstream e7aa57247700 4c131dc4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in kvm_dev_ioctl
* Struck through repros no longer work on HEAD.