INFO: rcu detected stall in unwind_get_return_address (3)

Status: auto-obsoleted due to no activity on 2026/08/22 11:04
Subsystems: bpf
Labels: prio:low
[Documentation on labels]
First crash: 93d, last: 93d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
aefe0e28 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ INFO: rcu detected stall in unwind_get_return_address (3) 2026/06/02 12:25 2026/06/02 12:25 2026/06/02 13:33 1095583b
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in unwind_get_return_address bpf 1 1 694d 694d 0/29 auto-obsoleted due to no activity on 2024/12/29 10:05
linux-6.1 INFO: rcu detected stall in unwind_get_return_address (2) 1 syz, C 1 1d04h 1d04h 0/3 upstream: reported C repro on 2026/08/24 17:54
linux-5.15 INFO: rcu detected stall in unwind_get_return_address 1 1 244d 244d 0/3 auto-obsoleted due to no activity on 2026/04/03 20:45
linux-6.1 INFO: rcu detected stall in unwind_get_return_address 1 1 186d 186d 0/3 auto-obsoleted due to no activity on 2026/05/31 04:58
linux-5.15 INFO: rcu detected stall in unwind_get_return_address (2) 1 1 22d 22d 0/3 upstream: reported on 2026/08/03 06:35
upstream INFO: rcu detected stall in unwind_get_return_address (2) bpf 1 syz error error 1 256d 252d 0/29 auto-obsoleted due to no activity on 2026/03/22 18:27

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P26567/1:b..l P4985/1:b..l P17304/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=166861, q=1572 ncpus=2)
task:syz-executor    state:R  running task     stack:21752 pid:17304 tgid:17304 ppid:17280  task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7370
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3f/0x50 kernel/locking/spinlock.c:190
 spin_unlock include/linux/spinlock.h:390 [inline]
 copy_pte_range mm/memory.c:1347 [inline]
 copy_pmd_range+0x4f04/0x5970 mm/memory.c:1408
 copy_pud_range mm/memory.c:1445 [inline]
 copy_p4d_range mm/memory.c:1469 [inline]
 copy_page_range+0xbe8/0x11f0 mm/memory.c:1555
 dup_mmap+0xf40/0x1d90 mm/mmap.c:1840
 dup_mm kernel/fork.c:1534 [inline]
 copy_mm+0x13b/0x4a0 kernel/fork.c:1586
 copy_process+0x1f1c/0x4440 kernel/fork.c:2264
 kernel_clone+0x284/0x8f0 kernel/fork.c:2721
 __do_sys_clone kernel/fork.c:2862 [inline]
 __se_sys_clone kernel/fork.c:2846 [inline]
 __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2846
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3979fc58d2
RSP: 002b:00007ffc46117c60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffc46117c60 RCX: 00007f3979fc58d2
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc46117dec R08: 0000000000000000 R09: 0000000000000001
R10: 00005555800647d0 R11: 0000000000000246 R12: 0000000000000001
R13: 0000555580077a00 R14: 0000000000181a9a R15: 00007ffc46117e40
 </TASK>
task:udevd           state:R  running task     stack:23288 pid:4985  tgid:4985  ppid:1      task_flags:0x400140 flags:0x00080800
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7513
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x760 kernel/entry/common.c:164
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x221/0x350 kernel/locking/lockdep.c:5872
Code: ff ff ff e8 f1 bd 07 0a f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 db e8 97 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 ab 99 6e ff cc 48 8d 3d 88 91 92
RSP: 0018:ffffc9000380f8b0 EFLAGS: 00000282
RAX: 381e326362025800 RBX: 0000000000000000 RCX: 0000000000000046
RDX: 000000005a44979c RSI: ffffffff8e220b28 RDI: ffffffff8c28b7e0
RBP: ffffffff81d5ab66 R08: ffffffff81d5ab66 R09: ffffffff8e95cca0
R10: dffffc0000000000 R11: ffffffff81b0e040 R12: 0000000000000002
R13: ffffffff8e95cca0 R14: 0000000000000000 R15: 0000000000000246
 rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 rcu_read_lock include/linux/rcupdate.h:838 [inline]
 is_bpf_text_address+0x47/0x2b0 kernel/bpf/core.c:747
 kernel_text_address+0xa5/0xe0 kernel/extable.c:125
 __kernel_text_address+0xd/0x30 kernel/extable.c:79
 unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:385
 arch_stack_walk+0xfb/0x150 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6251 [inline]
 kmem_cache_free+0x182/0x650 mm/slub.c:6378
 file_free fs/file_table.c:97 [inline]
 __fput+0x6c5/0xa60 fs/file_table.c:523
 fput_close_sync+0x11f/0x240 fs/file_table.c:615
 __do_sys_close fs/open.c:1507 [inline]
 __se_sys_close fs/open.c:1492 [inline]
 __x64_sys_close+0x7e/0x110 fs/open.c:1492
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc6a98a7407
RSP: 002b:00007fff7770efc0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007fc6aa008880 RCX: 00007fc6a98a7407
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000c
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000c
R13: 0000563d26a40100 R14: 0000000000000000 R15: 00007fff7770f200
 </TASK>
task:syz.1.5484      state:R  running task     stack:23008 pid:26567 tgid:26567 ppid:17706  task_flags:0x400040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7370
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3f/0x50 kernel/locking/spinlock.c:190
 spin_unlock include/linux/spinlock.h:390 [inline]
 insert_page+0x2db/0x440 mm/memory.c:2408
 kcov_mmap+0xc9/0x140 kernel/kcov.c:514
 vfs_mmap include/linux/fs.h:2071 [inline]
 mmap_file mm/internal.h:168 [inline]
 __mmap_new_file_vma mm/vma.c:2496 [inline]
 __mmap_new_vma mm/vma.c:2562 [inline]
 __mmap_region mm/vma.c:2771 [inline]
 mmap_region+0x19a3/0x22a0 mm/vma.c:2857
 do_mmap+0xc39/0x10c0 mm/mmap.c:560
 vm_mmap_pgoff+0x2c9/0x4f0 mm/util.c:581
 ksys_mmap_pgoff+0x51e/0x760 mm/mmap.c:606
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8eddb9cbc2
RSP: 002b:00007ffe2db1b5e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f8edb9f6000 RCX: 00007f8eddb9cbc2
RDX: 0000000000000003 RSI: 0000000000400000 RDI: 00007f8edb9f6000
RBP: 0000000000000011 R08: 00000000000000db R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000206 R12: 0000000000000003
R13: 0000000000000003 R14: 0000000000000000 R15: 00007f8edde15fa0
 </TASK>
rcu: rcu_preempt kthread starved for 10603 jiffies! g166861 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27544 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 __schedule_loop kernel/sched/core.c:7268 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7283
 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x312/0x11d0 kernel/rcu/tree.c:2095
 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2297
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 26584 Comm: syz.7.5489 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:37 [inline]
RIP: 0010:fpu_state_size_dynamic arch/x86/include/asm/fpu/xstate.h:125 [inline]
RIP: 0010:xfd_update_state arch/x86/kernel/fpu/xstate.h:191 [inline]
RIP: 0010:fpu__clear_user_states+0x16f/0x410 arch/x86/kernel/fpu/core.c:856
Code: 69 40 49 83 c4 10 4c 89 e0 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df 42 80 3c 28 00 74 08 4c 89 e7 e8 55 a5 c4 00 4d 8b 24 24 <0f> 1f 44 00 00 e8 f7 64 59 00 0f 1f 44 00 00 e8 ed 64 59 00 be ff
RSP: 0018:ffffc900057d7d40 EFLAGS: 00000246
RAX: 1ffff1100594d71a RBX: ffff88802ca69ec0 RCX: 0000000000080000
RDX: ffffc90005fba000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: 0000000000000000 R08: ffffc900057d79cf R09: 1ffff92000afaf39
R10: dffffc0000000000 R11: fffff52000afaf3a R12: ffff88802ca6b900
R13: dffffc0000000000 R14: ffff88802ca69eec R15: 1ffff1100594d3dd
FS:  00007f347bb9e6c0(0000) GS:ffff888125387000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000000 CR3: 000000006463b000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 handle_signal arch/x86/kernel/signal.c:310 [inline]
 arch_do_signal_or_restart+0x4cc/0x840 arch/x86/kernel/signal.c:339
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f347ac50780
Code: 44 24 20 0f 29 44 24 30 0f 29 44 24 40 48 8b 44 24 08 ff d0 48 83 c4 50 31 c0 5b 5d 41 5c 41 5d 41 5e c3 0f 1f 80 00 00 00 00 <c3> 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 c3 66 66 2e 0f 1f
RSP: 002b:00007f347bb9db38 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007f347b015fa8 RCX: 00007f347ad9ce59
RDX: 00007f347bb9db40 RSI: 00007f347bb9dc70 RDI: 0000000000000011
RBP: 00007f347b015fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f347b016038 R14: 00007fff375ba610 R15: 00007fff375ba6f8
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/24 11:00 upstream 4cbfe4502e3d c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: rcu detected stall in unwind_get_return_address
* Struck through repros no longer work on HEAD.