rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P7796/1:b..l P7794/1:b..l P7792/1:b..l P7798/1:b..l rcu: (detected by 0, t=10502 jiffies, g=36449, q=1371 ncpus=2) task:syz.4.647 state:R running task stack:28520 pid:7798 tgid:7792 ppid:5641 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x17b4/0x5680 kernel/sched/core.c:7188 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7512 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline] irqentry_exit+0x14f/0x730 kernel/entry/common.c:164 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__read_once_word_nocheck+0x3/0x10 include/asm-generic/rwonce.h:67 Code: 00 48 ba 00 00 00 00 00 fc ff df e9 88 fc ff ff 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 8b 07 48 14 34 0a cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90003747710 EFLAGS: 00000202 RAX: ffffffff81000130 RBX: ffffc90003747f40 RCX: 1ffff920006e8e01 RDX: ffffffff916c47fe RSI: 0000000000000002 RDI: ffffc90003747f40 RBP: 1ffff920006e8efe R08: 0000000000000001 R09: ffffffff8e95cd60 R10: ffffc90003747838 R11: ffffffff81b0d870 R12: ffffc90003748000 R13: 1ffff920006e8eff R14: ffffc900037477e8 R15: ffffc90003740000 deref_stack_reg arch/x86/kernel/unwind_orc.c:422 [inline] unwind_next_frame+0xed7/0x2550 arch/x86/kernel/unwind_orc.c:614 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 save_stack+0x122/0x230 mm/page_owner.c:165 __reset_page_owner+0x71/0x1f0 mm/page_owner.c:320 reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1402 [inline] __free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2943 __slab_free+0x274/0x2c0 mm/slub.c:5608 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_kmalloc+0x22/0xb0 mm/kasan/common.c:406 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5295 [inline] __kmalloc_noprof+0x35c/0x760 mm/slub.c:5307 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] lsm_blob_alloc security/security.c:218 [inline] lsm_sock_alloc security/security.c:4478 [inline] security_sk_alloc+0x52/0x360 security/security.c:4494 sk_prot_alloc+0x101/0x210 net/core/sock.c:2250 sk_alloc+0x3a/0x390 net/core/sock.c:2303 __netlink_create+0x65/0x260 net/netlink/af_netlink.c:626 netlink_create+0x3ca/0x590 net/netlink/af_netlink.c:684 __sock_create+0x4b2/0x9d0 net/socket.c:1664 sock_create net/socket.c:1722 [inline] __sys_socket_create net/socket.c:1759 [inline] __sys_socket+0xd6/0x1b0 net/socket.c:1806 __do_sys_socket net/socket.c:1820 [inline] __se_sys_socket net/socket.c:1818 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1818 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1a1a99cdd9 RSP: 002b:00007f1a1b813028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 00007f1a1ac16270 RCX: 00007f1a1a99cdd9 RDX: 000000000000000c RSI: 0000000000000003 RDI: 0000000000000010 RBP: 00007f1a1aa32d69 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1a1ac16308 R14: 00007f1a1ac16270 R15: 00007f1a1ad3fa48 task:syz.4.647 state:R running task stack:24408 pid:7792 tgid:7792 ppid:5641 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x17b4/0x5680 kernel/sched/core.c:7188 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7512 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline] irqentry_exit+0x14f/0x730 kernel/entry/common.c:164 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210 Code: 89 fb e8 23 00 00 00 48 8b 3d f4 a3 60 0c 48 89 de 5b e9 b3 ea 5f 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d d8 53 73 11 65 8b 15 f9 53 73 RSP: 0018:ffffc90003807470 EFLAGS: 00000286 RAX: 1ffffffff34976f0 RBX: 0000000000055fd5 RCX: ffff888031991ec0 RDX: 0000000000000000 RSI: 0000000000005fd5 RDI: 0000000000000000 RBP: dffffc0000000000 R08: ffff88801d5df28f R09: 1ffff11003abbe51 R10: dffffc0000000000 R11: ffffed1003abbe52 R12: 0000000000000000 R13: 0000000000055fd5 R14: dffffc0000000000 R15: ffff88801d5df290 __page_table_check_zero+0x28e/0x3e0 mm/page_table_check.c:139 page_table_check_free include/linux/page_table_check.h:46 [inline] __free_pages_prepare mm/page_alloc.c:1403 [inline] __free_frozen_pages+0xbd7/0xd30 mm/page_alloc.c:2943 __slab_free+0x274/0x2c0 mm/slub.c:5608 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4569 [inline] slab_alloc_node mm/slub.c:4898 [inline] kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4905 vm_area_dup+0x2b/0x680 mm/vma_init.c:123 __split_vma+0x1dc/0xa40 mm/vma.c:516 split_vma mm/vma.c:599 [inline] vma_modify+0x88a/0x1e10 mm/vma.c:1691 vma_modify_flags+0x24b/0x330 mm/vma.c:1719 mprotect_fixup+0x62a/0xb60 mm/mprotect.c:789 do_mprotect_pkey+0x8d5/0xd20 mm/mprotect.c:967 __do_sys_mprotect mm/mprotect.c:988 [inline] __se_sys_mprotect mm/mprotect.c:985 [inline] __x64_sys_mprotect+0x80/0x90 mm/mprotect.c:985 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1a1a99cbd7 RSP: 002b:00007f1a1ad3f9e8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a RAX: ffffffffffffffda RBX: 00007f1a1b7f26c0 RCX: 00007f1a1a99cbd7 RDX: 0000000000000003 RSI: 0000000000020000 RDI: 00007f1a1b7d3000 RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000 R10: 0000000000021000 R11: 0000000000000206 R12: 00007f1a1ad3fb40 R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000 task:syz.4.647 state:R running task stack:26984 pid:7794 tgid:7792 ppid:5641 task_flags:0x40044c flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x17b4/0x5680 kernel/sched/core.c:7188 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7512 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline] irqentry_exit+0x14f/0x730 kernel/entry/common.c:164 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:lock_release+0x2d7/0x3c0 kernel/locking/lockdep.c:5893 Code: 73 97 11 00 00 00 00 eb b5 e8 55 63 06 0a f7 c3 00 02 00 00 74 b9 65 48 8b 05 45 2e 97 11 48 3b 44 24 28 75 44 fb 48 83 c4 30 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d c2 2f 92 RSP: 0018:ffffc900037c74c0 EFLAGS: 00000286 RAX: d97b3316e4b23800 RBX: 0000000000000202 RCX: 0000000000000046 RDX: 0000000000000001 RSI: ffffffff8e2189d3 RDI: ffffffff8c28ac60 RBP: ffff888029c3c938 R08: ffffc900037c7a80 R09: 0000000000000000 R10: ffffc900037c7618 R11: fffff520006f8ec5 R12: 0000000000000001 R13: 0000000000000001 R14: ffffffff8e95cd60 R15: ffff888029c3bd80 rcu_lock_release include/linux/rcupdate.h:310 [inline] rcu_read_unlock include/linux/rcupdate.h:869 [inline] class_rcu_destructor include/linux/rcupdate.h:1181 [inline] unwind_next_frame+0x1bba/0x2550 arch/x86/kernel/unwind_orc.c:709 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 save_stack+0x122/0x230 mm/page_owner.c:165 __reset_page_owner+0x71/0x1f0 mm/page_owner.c:320 reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1402 [inline] __free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2943 __slab_free+0x274/0x2c0 mm/slub.c:5608 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4569 [inline] slab_alloc_node mm/slub.c:4898 [inline] kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4905 taskstats_tgid_alloc kernel/taskstats.c:576 [inline] taskstats_exit+0x14a/0xa70 kernel/taskstats.c:615 do_exit+0x682/0x22c0 kernel/exit.c:945 do_group_exit+0x21b/0x2d0 kernel/exit.c:1117 get_signal+0x1284/0x1330 kernel/signal.c:3037 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1a1a99cdd9 RSP: 002b:00007f1a1b855028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: 000000000000000b RBX: 00007f1a1ac16090 RCX: 00007f1a1a99cdd9 RDX: 0000000000000318 RSI: 00002000000bd000 RDI: 0000000000000009 RBP: 00007f1a1aa32d69 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1a1ac16128 R14: 00007f1a1ac16090 R15: 00007f1a1ad3fa48 task:syz.4.647 state:R running task stack:26360 pid:7796 tgid:7792 ppid:5641 task_flags:0x40044c flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x17b4/0x5680 kernel/sched/core.c:7188 preempt_schedule_notrace+0x57/0x90 kernel/sched/core.c:7462 preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13 rcu_is_watching+0x7f/0xb0 kernel/rcu/tree.c:753 rcu_read_lock include/linux/rcupdate.h:839 [inline] class_rcu_constructor include/linux/rcupdate.h:1181 [inline] unwind_next_frame+0xd5/0x2550 arch/x86/kernel/unwind_orc.c:495 __unwind_start+0x5b8/0x760 arch/x86/kernel/unwind_orc.c:787 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xe3/0x150 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 save_stack+0x122/0x230 mm/page_owner.c:165 __reset_page_owner+0x71/0x1f0 mm/page_owner.c:320 reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1402 [inline] __free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2943 __slab_free+0x274/0x2c0 mm/slub.c:5608 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4569 [inline] slab_alloc_node mm/slub.c:4898 [inline] kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4905 taskstats_tgid_alloc kernel/taskstats.c:576 [inline] taskstats_exit+0x14a/0xa70 kernel/taskstats.c:615 do_exit+0x682/0x22c0 kernel/exit.c:945 do_group_exit+0x21b/0x2d0 kernel/exit.c:1117 get_signal+0x1284/0x1330 kernel/signal.c:3037 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1a1a99cdd9 RSP: 002b:00007f1a1b8340e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f1a1ac16188 RCX: 00007f1a1a99cdd9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1a1ac16188 RBP: 00007f1a1ac16180 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1a1ac16218 R14: 00007f1a1ad3f960 R15: 00007f1a1ad3fa48 rcu: rcu_preempt kthread starved for 4424 jiffies! g36449 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:27544 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x17b4/0x5680 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0x164/0x360 kernel/sched/core.c:7282 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x312/0x11d0 kernel/rcu/tree.c:2095 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2297 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:0xffffffffa00037e4 Code: e3 cc 41 ff e3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 41 ff e3 cc <41> ff e3 cc 41 ff e3 cc 41 ff e3 cc 41 ff e3 cc 41 ff e3 cc 41 ff RSP: 0018:ffffc90000a07f60 EFLAGS: 00000286 RAX: ffffffff82259842 RBX: ffffc90000a08020 RCX: 0000000080000100 RDX: 0000000000000001 RSI: ffffffff82259842 RDI: ffffc90000a08020 RBP: ffffc90000a07ff0 R08: ffffc90000a08310 R09: 0000000000000000 R10: ffffc90000a07fb8 R11: ffffffff81b0d870 R12: ffff88801dad8000 R13: 0000000000000000 R14: ffffffff81b0d870 R15: ffffc90000a07f68 FS: 0000000000000000(0000) GS:ffff888125390000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7dd4e41412 CR3: 00000000774f2000 CR4: 00000000003526f0 Call Trace: stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2689 [inline] slab_free mm/slub.c:6246 [inline] kmem_cache_free+0x182/0x650 mm/slub.c:6373 nft_synproxy_eval_v6+0x352/0x4e0 net/netfilter/nft_synproxy.c:92 nft_synproxy_do_eval+0x3ce/0x580 net/netfilter/nft_synproxy.c:146 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x467/0x19f0 net/netfilter/nf_tables_core.c:285 nft_do_chain_inet+0x360/0x4b0 net/netfilter/nft_chain_filter.c:162 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:316 ip6_input+0x16a/0x270 net/ipv6/ip6_input.c:540 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6202 [inline] __netif_receive_skb net/core/dev.c:6315 [inline] process_backlog+0x7dd/0x1950 net/core/dev.c:6666 __napi_poll+0xae/0x340 net/core/dev.c:7730 napi_poll net/core/dev.c:7793 [inline] net_rx_action+0x627/0xf70 net/core/dev.c:7950 handle_softirqs+0x22a/0x840 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:63 Code: 1b 7e 02 e9 93 f6 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 31 21 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffc90000197e20 EFLAGS: 00000242 RAX: 0000000002166a7f RBX: ffffffff819a814a RCX: 0000000080000001 RDX: 0000000000000001 RSI: ffffffff8dfa5add RDI: ffffffff8c28ac60 RBP: ffffc90000197f10 R08: ffff8880b87339db R09: 1ffff110170e673b R10: dffffc0000000000 R11: ffffed10170e673c R12: 0000000000000001 R13: 1ffff11003b5b000 R14: 0000000000000001 R15: 1ffff11003b5b000 arch_safe_halt arch/x86/kernel/process.c:766 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:767 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x36a/0x5f0 kernel/sched/idle.c:352 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:451 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x147 NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 3227 Comm: kworker/R-bat_e Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: bat_events batadv_tt_purge RIP: 0010:check_kcov_mode kernel/kcov.c:183 [inline] RIP: 0010:write_comp_data kernel/kcov.c:246 [inline] RIP: 0010:__sanitizer_cov_trace_const_cmp2+0x17/0x90 kernel/kcov.c:307 Code: 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 65 48 8b 15 38 50 73 11 65 8b 0d 59 50 73 11 <81> e1 00 01 ff 00 74 11 81 f9 00 01 00 00 75 5b 83 ba cc 16 00 00 RSP: 0018:ffffc90000a07b98 EFLAGS: 00000246 RAX: ffffffff897c9f0c RBX: dffffc0000000000 RCX: 0000000080000301 RDX: ffff888032d8dc40 RSI: 000000000000dd86 RDI: 0000000000000000 RBP: 000000000000dd86 R08: ffff888032d8dc40 R09: 0000000000000002 R10: 000000000000a888 R11: 0000000000000100 R12: 000000000000dd86 R13: 0000000000000000 R14: ffff888049245a00 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888125390000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7dd4f6de21 CR3: 000000005f4ac000 CR4: 00000000003526f0 Call Trace: vlan_get_protocol_and_depth include/linux/if_vlan.h:671 [inline] skb_network_protocol+0x19c/0x400 net/core/dev.c:3678 harmonize_features net/core/dev.c:3744 [inline] netif_skb_features+0xceb/0x1480 net/core/dev.c:3873 validate_xmit_skb+0xa0/0x14a0 net/core/dev.c:4027 __dev_queue_xmit+0xb2f/0x3950 net/core/dev.c:4860 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:246 synproxy_send_tcp_ipv6+0x52f/0x6d0 net/netfilter/nf_synproxy_core.c:852 synproxy_send_client_synack_ipv6+0x814/0xcb0 net/netfilter/nf_synproxy_core.c:898 nft_synproxy_eval_v6+0x34a/0x4e0 net/netfilter/nft_synproxy.c:91 nft_synproxy_do_eval+0x3ce/0x580 net/netfilter/nft_synproxy.c:146 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x467/0x19f0 net/netfilter/nf_tables_core.c:285 nft_do_chain_inet+0x360/0x4b0 net/netfilter/nft_chain_filter.c:162 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:316 ip6_input+0x16a/0x270 net/ipv6/ip6_input.c:540 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6202 [inline] __netif_receive_skb net/core/dev.c:6315 [inline] process_backlog+0x7dd/0x1950 net/core/dev.c:6666 __napi_poll+0xae/0x340 net/core/dev.c:7730 napi_poll net/core/dev.c:7793 [inline] net_rx_action+0x627/0xf70 net/core/dev.c:7950 handle_softirqs+0x22a/0x840 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2255 [inline] batadv_tt_purge+0x4d1/0x9e0 net/batman-adv/translation-table.c:3515 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385 rescuer_thread+0x827/0x1130 kernel/workqueue.c:3609 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245