------------[ cut here ]------------
WARNING: CPU: 1 PID: 25649 at kernel/rcu/tree_stall.h:1001 rcu_check_gp_start_stall+0x2dc/0x460 kernel/rcu/tree_stall.h:993
Modules linked in:
CPU: 1 PID: 25649 Comm: syz.5.4340 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:rcu_check_gp_start_stall+0x2dc/0x460 kernel/rcu/tree_stall.h:1001
Code: ff ff ff 48 c7 c7 a0 54 31 97 be 04 00 00 00 e8 aa ea 6d 00 48 89 df b8 01 00 00 00 87 05 1c d2 bf 15 85 c0 0f 85 19 ff ff ff <0f> 0b 48 81 ff 80 73 13 8d 74 47 48 c7 c0 dc 84 8b 8e 48 c1 e8 03
RSP: 0018:ffffc900001f0bb8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffffffff8d137380 RCX: ffffffff81718276
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff8d137380
RBP: ffffc900001f0e30 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff2e62a94 R12: 0000000000002904
R13: ffffffff8d137380 R14: 0000000000000a02 R15: dffffc0000000000
FS: 00007fc027a056c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000004200 CR3: 000000002d043000 CR4: 00000000003506e0
Call Trace:
rcu_core+0x635/0x1770 kernel/rcu/tree.c:2462
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__is_kernel_text include/asm-generic/sections.h:208 [inline]
RIP: 0010:is_kernel_text include/linux/kallsyms.h:29 [inline]
RIP: 0010:core_kernel_text kernel/extable.c:68 [inline]
RIP: 0010:kernel_text_address+0x4/0xd0 kernel/extable.c:99
Code: 00 00 00 48 81 fb 00 d0 dd 8f 0f 93 c1 48 81 fb 9b 9b f4 8f 0f 92 c2 20 ca 08 c2 0f b6 c2 5b c3 66 0f 1f 44 00 00 66 0f 1f 00 <55> 41 56 53 48 81 ff 00 00 00 81 0f 93 c0 48 81 ff 00 00 c0 8a 0f
RSP: 0018:ffffc90003cf7488 EFLAGS: 00000246
RAX: ffffffff813b3657 RBX: ffffffff81fc5958 RCX: 0000000000000002
RDX: ffff88802afb3c00 RSI: 0000000000000001 RDI: ffffffff81fc5958
RBP: 0000000000000001 R08: ffff88802afb3c00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000002 R12: ffffffff81fc2bb4
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff9200079eea2
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x5d/0xc0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0x11d/0x190 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc+0xb4/0x230 mm/slab_common.c:1020
kmalloc_array include/linux/slab.h:637 [inline]
kcalloc include/linux/slab.h:668 [inline]
iter_file_splice_write+0x1a4/0xcb0 fs/splice.c:676
do_splice_from fs/splice.c:933 [inline]
direct_splice_actor+0xe8/0x130 fs/splice.c:1142
splice_direct_to_actor+0x304/0x8c0 fs/splice.c:1088
do_splice_direct+0x1d5/0x2f0 fs/splice.c:1194
do_sendfile+0x5f2/0xef0 fs/read_write.c:1254
__do_sys_sendfile64 fs/read_write.c:1322 [inline]
__se_sys_sendfile64+0x145/0x1a0 fs/read_write.c:1308
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc026b9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc027a05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007fc026e15fa0 RCX: 00007fc026b9ce59
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000009
RBP: 00007fc026c32d6f R08: 0000000000000000 R09: 0000000000000000
R10: 000000007fffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc026e16038 R14: 00007fc026e15fa0 R15: 00007fff6e32cb78
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 48 81 add %cl,-0x7f(%rax)
5: fb sti
6: 00 d0 add %dl,%al
8: dd 8f 0f 93 c1 48 fisttpll 0x48c1930f(%rdi)
e: 81 fb 9b 9b f4 8f cmp $0x8ff49b9b,%ebx
14: 0f 92 c2 setb %dl
17: 20 ca and %cl,%dl
19: 08 c2 or %al,%dl
1b: 0f b6 c2 movzbl %dl,%eax
1e: 5b pop %rbx
1f: c3 ret
20: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
26: 66 0f 1f 00 nopw (%rax)
* 2a: 55 push %rbp <-- trapping instruction
2b: 41 56 push %r14
2d: 53 push %rbx
2e: 48 81 ff 00 00 00 81 cmp $0xffffffff81000000,%rdi
35: 0f 93 c0 setae %al
38: 48 81 ff 00 00 c0 8a cmp $0xffffffff8ac00000,%rdi
3f: 0f .byte 0xf