[syzbot] [mm?] INFO: rcu detected stall in __mmap_complete

[syzbot <syzbot+e4aa91d7f20c34417d4e@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    c8ebd433459b Merge tag 'nfsd-6.19-2' of git://git.kernel.o..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1205b222580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a94030c847137a18
dashboard link: https://syzkaller.appspot.com/bug?extid=e4aa91d7f20c34417d4e
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11e5cafc580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/499025e81349/disk-c8ebd433.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9eacf2e4acfd/vmlinux-c8ebd433.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4650397775c2/bzImage-c8ebd433.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e4aa91d7f20c34417d4e@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	0-...!: (3 ticks this GP) idle=233c/1/0x4000000000000000 softirq=15929/15929 fqs=0
rcu: 	(detected by 1, t=10502 jiffies, g=10825, q=798 ncpus=2)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6083 Comm: rm Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
RIP: 0010:_raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:162
Code: a6 9a 6c f6 bf 01 00 00 00 e8 5c 85 34 f6 49 8d 7e 18 31 f6 31 d2 31 c9 41 b8 01 00 00 00 45 31 c9 ff 74 24 10 e8 c0 c7 41 f6 <48> 83 c4 08 4c 89 f7 e8 44 68 42 f6 48 89 d8 5b 41 5e e9 89 49 00
RSP: 0018:ffffc90000007ca0 EFLAGS: 00000082
RAX: f6300cf39c3c4f00 RBX: 0000000000000092 RCX: 0000000000010002
RDX: 0000000016fc2300 RSI: ffffffff8d975f94 RDI: ffffffff8bc083e0
RBP: ffffc90000007e90 R08: ffffffff8497cbfd R09: ffffffff99b67028
R10: ffff888035774300 R11: ffffed1006aee863 R12: ffff888035774300
R13: ffffffff99b67008 R14: ffffffff99b67010 R15: ffff888035774300
FS:  0000000000000000(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1fb067feb8 CR3: 0000000072afc000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 debug_object_deactivate+0x6d/0x360 lib/debugobjects.c:873
 debug_hrtimer_deactivate kernel/time/hrtimer.c:443 [inline]
 debug_deactivate+0x1d/0x1e0 kernel/time/hrtimer.c:483
 __run_hrtimer kernel/time/hrtimer.c:1745 [inline]
 __hrtimer_run_queues+0x2b0/0xc30 kernel/time/hrtimer.c:1841
 hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1903
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x3e0 arch/x86/kernel/apic/apic.c:1062
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:deref_stack_reg+0x1a7/0x230 arch/x86/kernel/unwind_orc.c:422
Code: 46 49 8d 40 08 48 39 d8 0f 97 c1 4c 39 f0 0f 96 c0 20 c8 3c 01 75 30 4c 89 c7 49 89 f7 e8 11 08 00 00 49 89 c6 48 8b 5c 24 18 <48> 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 13 f4 b2 00
RSP: 0018:ffffc900031f70e0 EFLAGS: 00000202
RAX: ffffc900031f7568 RBX: ffffc900031f7248 RCX: 0000000000000001
RDX: ffffc900031f7248 RSI: dffffc0000000000 RDI: ffffc900031f7330
RBP: 1ffff9200063ee41 R08: ffffc900031f7330 R09: 0000000000000000
R10: ffffc900031f7258 R11: fffff5200063ee4d R12: 1ffff9200063ee42
R13: 1ffff9200063ee43 R14: ffffc900031f7568 R15: dffffc0000000000
 unwind_next_frame+0x18cc/0x23d0 arch/x86/kernel/unwind_orc.c:-1
 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
 slab_free_hook mm/slub.c:2501 [inline]
 slab_free mm/slub.c:6670 [inline]
 kmem_cache_free+0x475/0x620 mm/slub.c:6781
 remove_vma mm/vma.c:462 [inline]
 vms_complete_munmap_vmas+0x626/0x8a0 mm/vma.c:1296
 __mmap_complete+0x7b/0x610 mm/vma.c:2540
 __mmap_region mm/vma.c:2717 [inline]
 mmap_region+0x11e3/0x1d10 mm/vma.c:2786
 do_mmap+0xc45/0x10d0 mm/mmap.c:558
 vm_mmap_pgoff+0x2a6/0x4d0 mm/util.c:581
 ksys_mmap_pgoff+0x51f/0x760 mm/mmap.c:604
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1fb096a242
Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00
RSP: 002b:00007ffe403d8a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f1fb0667000 RCX: 00007f1fb096a242
RDX: 0000000000000001 RSI: 0000000000008000 RDI: 00007f1fb0667000
RBP: 0000000000000812 R08: 0000000000000003 R09: 0000000000024000
R10: 0000000000000812 R11: 0000000000000206 R12: 00007ffe403d8af0
R13: 00007f1fb093fab0 R14: 00007ffe403d8ee0 R15: 00000fffc807b150
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g10825 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=0 timer-softirq=3502
rcu: rcu_preempt kthread starved for 10502 jiffies! g10825 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:28008 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6960
 schedule_timeout+0x12b/0x270 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x301/0x1540 kernel/rcu/tree.c:2083
 rcu_gp_kthread+0x99/0x390 kernel/rcu/tree.c:2285
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup