Re: [syzbot] [kvm?] [kvm-x86?] INFO: rcu detected stall in kvm_vcpu_ioctl (4)

[syzbot <syzbot+3d5461510f8dc4adfe30@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

  4.345006][    T1] ceph: loaded (mds proto 32)
[    4.367481][    T1] cryptd: max_cpu_qlen set to 1000
[    4.403262][    T1] NET: Registered PF_ALG protocol family
[    4.405387][    T1] async_tx: api initialized (async)
[    4.407031][    T1] Key type asymmetric registered
[    4.408147][    T1] Asymmetric key parser 'x509' registered
[    4.409548][    T1] Asymmetric key parser 'pkcs8' registered
[    4.411262][    T1] Key type pkcs7_test registered
[    4.413661][    T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[    4.417109][    T1] io scheduler mq-deadline registered
[    4.418835][    T1] io scheduler kyber registered
[    4.420174][    T1] io scheduler bfq registered
[    4.438274][  T153] kworker/u8:3 (153) used greatest stack depth: 26552 bytes left
[    4.444898][    T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
[    4.449932][    T1] ACPI: button: Power Button [PWRF]
[    4.454623][    T1] input: Sleep Button as /devices/platform/LNXSLPBN:00/input/input1
[    4.458312][    T1] ACPI: button: Sleep Button [SLPF]
[    4.483125][    T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[    4.529887][    T1] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[    4.531145][    T1] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[    4.577964][    T1] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[    4.579194][    T1] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[    4.624039][    T1] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[    4.625454][    T1] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[    4.656998][    T1] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[    4.900220][  T348] kworker/u8:4 (348) used greatest stack depth: 26504 bytes left
[    5.424394][    T1] N_HDLC line discipline registered with maxframe=4096
[    5.427436][    T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[    5.447213][    T1] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[    5.475555][    T1] 00:03: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[    5.496265][    T1] 00:04: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[    5.515225][    T1] 00:05: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[    5.548169][    T1] Non-volatile memory driver v1.3
[    5.574910][    T1] usbcore: registered new interface driver xillyusb
[    5.581624][    T1] ACPI: bus type drm_connector registered
[    5.591822][    T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[    5.610935][    T1] [drm] Initialized vkms 1.0.0 for vkms on minor 1
[    5.751709][    T1] Console: switching to colour frame buffer device 128x48
[    5.833339][    T1] faux_driver vkms: [drm] fb0: vkmsdrmfb frame buffer device
[    5.836609][    T1] usbcore: registered new interface driver udl
[    5.844919][    T1] usbcore: registered new interface driver gm12u320
[    5.846877][    T1] usbcore: registered new interface driver gud
[    5.987040][    T1] brd: module loaded
[    6.344073][    T1] loop: module loaded
[    6.607970][  T954] kworker/u8:6 (954) used greatest stack depth: 25896 bytes left
[    6.679111][    T1] zram: Added device: zram0
[    6.706095][    T1] null_blk: disk nullb0 created
[    6.711191][    T1] null_blk: module loaded
[    6.715539][    T1] rnull_mod: Rust null_blk loaded
[    6.725205][    T1] Guest personality initialized and is inactive
[    6.733736][    T1] VMCI host device registered (name=vmci, major=10, minor=266)
[    6.741861][    T1] Initialized host personality
[    6.748191][    T1] usbcore: registered new interface driver rtsx_usb
[    6.760603][    T1] usbcore: registered new interface driver viperboard
[    6.770242][    T1] usbcore: registered new interface driver dln2
[    6.779712][    T1] usbcore: registered new interface driver pn533_usb
[    6.796211][    T1] nfcsim 0.2 initialized
[    6.801484][    T1] usbcore: registered new interface driver port100
[    6.810273][    T1] usbcore: registered new interface driver nfcmrvl
[    6.832841][    T1] Loading iSCSI transport class v2.0-870.
[    6.862030][    T1] virtio_scsi virtio0: 1/0/0 default/read/poll queues
[    6.890608][    T1] scsi host0: Virtio SCSI HBA
[    6.896662][    T1] blk-mq: reduced tag depth to 10240
[    7.107338][    T1] st: Version 20160209, fixed bufsize 32768, s/g segs 256
[    7.127307][   T57] scsi 0:0:1:0: Direct-Access     Google   PersistentDisk   1    PQ: 0 ANSI: 6
[    7.154202][    T1] ------------[ cut here ]------------
[    7.160329][    T1] workqueue: nvme_tcp_wq is using neither WQ_PERCPU or WQ_UNBOUND. Setting WQ_PERCPU.
[    7.170094][    T1] WARNING: kernel/workqueue.c:5856 at __alloc_workqueue+0x1994/0x1cf0, CPU#0: swapper/0/1
[    7.180068][    T1] Modules linked in:
[    7.184027][    T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) 
[    7.193102][    T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[    7.203500][    T1] RIP: 0010:__alloc_workqueue+0x1999/0x1cf0
[    7.209644][    T1] Code: e9 46 ef ff ff e8 c7 16 38 00 e9 9f fc ff ff e8 bd 16 38 00 e9 30 fd ff ff e8 b3 16 38 00 48 8d 3d 1c d8 7d 0e 48 8b 74 24 20 <67> 48 0f b9 3a 41 81 cf 00 01 00 00 e9 f7 e8 ff ff e8 91 16 38 00
[    7.230320][    T1] RSP: 0000:ffffc900000677a8 EFLAGS: 00010293
[    7.236532][    T1] RAX: ffffffff818d2a8d RBX: 0000000000000000 RCX: ffff88801daedd00
[    7.244726][    T1] RDX: 0000000000000000 RSI: ffff8880270b6170 RDI: ffffffff900b02b0
[    7.254397][    T1] RBP: ffffffff8c379240 R08: ffff88801daedd00 R09: 0000000000000002
[    7.262441][    T1] R10: 0000000000000102 R11: 0000000000000000 R12: dffffc0000000000
[    7.270814][    T1] R13: ffffc900000678c0 R14: ffff8880270b6000 R15: 0000000000000058
[    7.279041][    T1] FS:  0000000000000000(0000) GS:ffff8881254f4000(0000) knlGS:0000000000000000
[    7.288031][    T1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    7.294621][    T1] CR2: ffff88823ffff000 CR3: 000000000e53e000 CR4: 00000000003526f0
[    7.302652][    T1] Call Trace:
[    7.305961][    T1]  <TASK>
[    7.308904][    T1]  ? do_raw_spin_lock+0x12b/0x2f0
[    7.313950][    T1]  alloc_workqueue_noprof+0xe3/0x210
[    7.319304][    T1]  ? __pfx_alloc_workqueue_noprof+0x10/0x10
[    7.325207][    T1]  ? add_device_randomness+0xc5/0x110
[    7.331134][    T1]  ? __pfx_add_device_randomness+0x10/0x10
[    7.337091][    T1]  ? __pfx_nvme_fc_init_module+0x10/0x10
[    7.342915][    T1]  ? __pfx_nvme_tcp_init_module+0x10/0x10
[    7.348707][    T1]  nvme_tcp_init_module+0x27/0x100
[    7.353921][    T1]  do_one_initcall+0x250/0x870
[    7.358983][    T1]  ? __pfx_nvme_tcp_init_module+0x10/0x10
[    7.364733][    T1]  ? __pfx_do_one_initcall+0x10/0x10
[    7.370175][    T1]  ? ktime_get+0x45/0x220
[    7.374610][    T1]  ? ktime_get+0x1f5/0x220
[    7.379101][    T1]  ? __pfx___schedule+0x10/0x10
[    7.384151][    T1]  ? clockevents_program_event+0x491/0x630
[    7.390074][    T1]  ? __pfx_clockevents_program_event+0x10/0x10
[    7.396384][    T1]  ? irqentry_exit+0x218/0x760
[    7.401331][    T1]  ? lockdep_hardirqs_on+0x7a/0x110
[    7.406854][    T1]  ? irqentry_exit+0x218/0x760
[    7.411648][    T1]  ? trace_irq_disable+0x3b/0x140
[    7.416940][    T1]  ? next_arg+0x498/0x5e0
[    7.421299][    T1]  ? parameq+0x14d/0x170
[    7.425559][    T1]  ? parse_args+0x9fc/0xb00
[    7.430132][    T1]  ? trace_kmalloc+0x2a/0xf0
[    7.434829][    T1]  ? rcu_is_watching+0x15/0xb0
[    7.439674][    T1]  do_initcall_level+0x104/0x190
[    7.444644][    T1]  ? kernel_init+0x1d/0x1d0
[    7.449217][    T1]  do_initcalls+0x59/0xa0
[    7.453648][    T1]  kernel_init_freeable+0x2a6/0x3e0
[    7.459860][    T1]  ? __pfx_kernel_init+0x10/0x10
[    7.464820][    T1]  kernel_init+0x1d/0x1d0
[    7.469306][    T1]  ? __pfx_kernel_init+0x10/0x10
[    7.474438][    T1]  ret_from_fork+0x514/0xb70
[    7.479092][    T1]  ? __pfx_ret_from_fork+0x10/0x10
[    7.484220][    T1]  ? __switch_to+0xc79/0x1410
[    7.488968][    T1]  ? __pfx_kernel_init+0x10/0x10
[    7.494014][    T1]  ret_from_fork_asm+0x1a/0x30
[    7.498839][    T1]  </TASK>
[    7.501873][    T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[    7.508790][    T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) 
[    7.508790][    T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[    7.508790][    T1] Call Trace:
[    7.508790][    T1]  <TASK>
[    7.508790][    T1]  vpanic+0x56c/0xa60
[    7.508790][    T1]  ? __pfx__printk+0x10/0x10
[    7.508790][    T1]  ? __pfx_vpanic+0x10/0x10
[    7.508790][    T1]  ? is_bpf_text_address+0x292/0x2b0
[    7.508790][    T1]  ? is_bpf_text_address+0x26/0x2b0
[    7.508790][    T1]  panic+0xc5/0xd0
[    7.508790][    T1]  ? __pfx_panic+0x10/0x10
[    7.508790][    T1]  ? ret_from_fork_asm+0x1a/0x30
[    7.508790][    T1]  __warn+0x315/0x4c0
[    7.508790][    T1]  ? __alloc_workqueue+0x1994/0x1cf0
[    7.508790][    T1]  ? __alloc_workqueue+0x1994/0x1cf0
[    7.508790][    T1]  __report_bug+0x339/0x540
[    7.508790][    T1]  ? kernel_init+0x1d/0x1d0
[    7.508790][    T1]  ? ret_from_fork+0x514/0xb70
[    7.508790][    T1]  ? ret_from_fork_asm+0x1a/0x30
[    7.605760][    T1]  ? __alloc_workqueue+0x1994/0x1cf0
[    7.605760][    T1]  ? __pfx___report_bug+0x10/0x10
[    7.605760][    T1]  report_bug_entry+0x19a/0x290
[    7.605760][    T1]  ? __alloc_workqueue+0x1999/0x1cf0
[    7.605760][    T1]  ? __alloc_workqueue+0x199e/0x1cf0
[    7.605760][    T1]  handle_bug+0xce/0x200
[    7.605760][    T1]  exc_invalid_op+0x1a/0x50
[    7.605760][    T1]  asm_exc_invalid_op+0x1a/0x20
[    7.605760][    T1] RIP: 0010:__alloc_workqueue+0x1999/0x1cf0
[    7.605760][    T1] Code: e9 46 ef ff ff e8 c7 16 38 00 e9 9f fc ff ff e8 bd 16 38 00 e9 30 fd ff ff e8 b3 16 38 00 48 8d 3d 1c d8 7d 0e 48 8b 74 24 20 <67> 48 0f b9 3a 41 81 cf 00 01 00 00 e9 f7 e8 ff ff e8 91 16 38 00
[    7.605760][    T1] RSP: 0000:ffffc900000677a8 EFLAGS: 00010293
[    7.605760][    T1] RAX: ffffffff818d2a8d RBX: 0000000000000000 RCX: ffff88801daedd00
[    7.605760][    T1] RDX: 0000000000000000 RSI: ffff8880270b6170 RDI: ffffffff900b02b0
[    7.605760][    T1] RBP: ffffffff8c379240 R08: ffff88801daedd00 R09: 0000000000000002
[    7.605760][    T1] R10: 0000000000000102 R11: 0000000000000000 R12: dffffc0000000000
[    7.705788][    T1] R13: ffffc900000678c0 R14: ffff8880270b6000 R15: 0000000000000058
[    7.705788][    T1]  ? __alloc_workqueue+0x198d/0x1cf0
[    7.705788][    T1]  ? __alloc_workqueue+0x198d/0x1cf0
[    7.705788][    T1]  ? do_raw_spin_lock+0x12b/0x2f0
[    7.705788][    T1]  alloc_workqueue_noprof+0xe3/0x210
[    7.705788][    T1]  ? __pfx_alloc_workqueue_noprof+0x10/0x10
[    7.705788][    T1]  ? add_device_randomness+0xc5/0x110
[    7.705788][    T1]  ? __pfx_add_device_randomness+0x10/0x10
[    7.705788][    T1]  ? __pfx_nvme_fc_init_module+0x10/0x10
[    7.705788][    T1]  ? __pfx_nvme_tcp_init_module+0x10/0x10
[    7.705788][    T1]  nvme_tcp_init_module+0x27/0x100
[    7.705788][    T1]  do_one_initcall+0x250/0x870
[    7.705788][    T1]  ? __pfx_nvme_tcp_init_module+0x10/0x10
[    7.705788][    T1]  ? __pfx_do_one_initcall+0x10/0x10
[    7.705788][    T1]  ? ktime_get+0x45/0x220
[    7.705788][    T1]  ? ktime_get+0x1f5/0x220
[    7.705788][    T1]  ? __pfx___schedule+0x10/0x10
[    7.806065][    T1]  ? clockevents_program_event+0x491/0x630
[    7.806065][    T1]  ? __pfx_clockevents_program_event+0x10/0x10
[    7.806065][    T1]  ? irqentry_exit+0x218/0x760
[    7.806065][    T1]  ? lockdep_hardirqs_on+0x7a/0x110
[    7.806065][    T1]  ? irqentry_exit+0x218/0x760
[    7.806065][    T1]  ? trace_irq_disable+0x3b/0x140
[    7.806065][    T1]  ? next_arg+0x498/0x5e0
[    7.806065][    T1]  ? parameq+0x14d/0x170
[    7.806065][    T1]  ? parse_args+0x9fc/0xb00
[    7.806065][    T1]  ? trace_kmalloc+0x2a/0xf0
[    7.806065][    T1]  ? rcu_is_watching+0x15/0xb0
[    7.806065][    T1]  do_initcall_level+0x104/0x190
[    7.806065][    T1]  ? kernel_init+0x1d/0x1d0
[    7.806065][    T1]  do_initcalls+0x59/0xa0
[    7.806065][    T1]  kernel_init_freeable+0x2a6/0x3e0
[    7.806065][    T1]  ? __pfx_kernel_init+0x10/0x10
[    7.806065][    T1]  kernel_init+0x1d/0x1d0
[    7.806065][    T1]  ? __pfx_kernel_init+0x10/0x10
[    7.806065][    T1]  ret_from_fork+0x514/0xb70
[    7.806065][    T1]  ? __pfx_ret_from_fork+0x10/0x10
[    7.905740][    T1]  ? __switch_to+0xc79/0x1410
[    7.905740][    T1]  ? __pfx_kernel_init+0x10/0x10
[    7.905740][    T1]  ret_from_fork_asm+0x1a/0x30
[    7.905740][    T1]  </TASK>
[    7.905740][    T1] Kernel Offset: disabled
[    7.905740][    T1] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build138220988=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at d6526ea3e6a
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d6526ea3e6ad9081c902859bbb80f9f840377cb4\"
/usr/bin/ld: /tmp/ccWbRLbh.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=130bf3ec580000


Tested on:

commit:         6e845bcb Add linux-next specific files for 20260605
git tree:       linux-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=8112d5f46200717e
dashboard link: https://syzkaller.appspot.com/bug?extid=3d5461510f8dc4adfe30
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1272fdd2580000