Message-ID: <696d6a75.a70a0220.34546f.035b.GAE@google.com>
Date: Sun, 18 Jan 2026 15:19:17 -0800
From: syzbot <syzbot+8bb3e2bee8a429cc76dd@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: Private message regarding: [syzbot] [mm?] INFO: rcu
 detected stall in sys_execve (6)

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: Private message regarding: [syzbot] [mm?] INFO: rcu detected stall in sys_execve (6)
Author: kapoorarnav43@...il.com

#syz test

>From e0dd0088f4b871d8c44d5b9ba17dd9eba1f770a0 Mon Sep 17 00:00:00 2001
From: Arnav Kapoor <kapoorarnav43@...il.com>
Date: Mon, 19 Jan 2026 04:48:19 +0530
Subject: [PATCH] netfilter: nf_conntrack: add entry limit and cond_resched 
in
 gc_worker

Further limit the gc_worker to process at most 100 entries per bucket
and add cond_resched() at the start of each entry processing to ensure
frequent yielding and prevent RCU stalls.

Reported-by: syzbot+8bb3e2bee8a429cc76dd@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8bb3e2bee8a429cc76dd
---
 net/netfilter/nf_conntrack_core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/netfilter/nf_conntrack_core.c 
b/net/netfilter/nf_conntrack_core.c
index 8a2cdd172..ff901a2b4 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1552,13 +1552,17 @@ static void gc_worker(struct work_struct *work)
                        break;
                }
 
+                int entry_count = 0;
                hlist_nulls_for_each_entry_rcu(h, n, &ct_hash[i], hnnode) {
                        struct nf_conntrack_net *cnet;
                        struct net *net;
                        long expires;
 
                        tmp = nf_ct_tuplehash_to_ctrack(h);
+                        entry_count++;
 
+                        if (entry_count > 100) break;
+                        cond_resched();
                        if (expired_count > GC_SCAN_EXPIRED_MAX) {
                                rcu_read_unlock();
 
-- 
2.43.0

On Monday, 19 January 2026 at 04:46:07 UTC+5:30 syzbot wrote:

Hello, 

syzbot has tested the proposed patch but the reproducer is still triggering 
an issue: 
INFO: rcu detected stall in corrupted 

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: 
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6251/3:b..l 
rcu: (detected by 0, t=10502 jiffies, g=16273, q=1513 ncpus=2) 
task:udevd state:R running task stack:25432 pid:6251 tgid:6251 ppid:5199 
task_flags:0x400140 flags:0x00080000 
Call Trace: 
<TASK> 
context_switch kernel/sched/core.c:5256 [inline] 
__schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 
preempt_schedule_common+0x83/0xd0 kernel/sched/core.c:7047 
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12 
__raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] 
_raw_spin_unlock+0x3f/0x50 kernel/locking/spinlock.c:186 
spin_unlock include/linux/spinlock.h:391 [inline] 
filemap_map_pages+0x192d/0x1fd0 mm/filemap.c:3931 
do_fault_around mm/memory.c:5713 [inline] 
do_read_fault mm/memory.c:5746 [inline] 
do_fault mm/memory.c:5889 [inline] 
do_pte_missing+0x20b0/0x3330 mm/memory.c:4401 
handle_pte_fault mm/memory.c:6273 [inline] 
__handle_mm_fault mm/memory.c:6411 [inline] 
handle_mm_fault+0x1b26/0x32b0 mm/memory.c:6580 
do_user_addr_fault+0xa7c/0x1380 arch/x86/mm/fault.c:1336 
handle_page_fault arch/x86/mm/fault.c:1476 [inline] 
exc_page_fault+0x71/0xd0 arch/x86/mm/fault.c:1532 
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 
RIP: 0033:0x7fdbcbf6be80 
RSP: 002b:00007ffc0ad89938 EFLAGS: 00010246 
RAX: 0000000000000006 RBX: 00005588ef53c568 RCX: 0000000000000019 
RDX: 0000000000000191 RSI: 00007fdbcb9f1ca0 RDI: 00005589070c4e70 
RBP: 00005589070a7910 R08: 0000000002000000 R09: 0000000000000003 
R10: 0000000000000000 R11: 0000000000000297 R12: 00005588ef53c588 
R13: 00007ffc0ad899b0 R14: 0000000000000000 R15: 0000000000000000 
</TASK> 
rcu: rcu_preempt kthread starved for 7525 jiffies! g16273 f0x0 
RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now 
expected behavior. 
rcu: RCU grace-period kthread stack dump: 
task:rcu_preempt state:R running task stack:28008 pid:16 tgid:16 ppid:2 
task_flags:0x208040 flags:0x00080000 
Call Trace: 
<TASK> 
context_switch kernel/sched/core.c:5256 [inline] 
__schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 
__schedule_loop kernel/sched/core.c:6945 [inline] 
schedule+0x165/0x360 kernel/sched/core.c:6960 
schedule_timeout+0x12b/0x270 kernel/time/sleep_timeout.c:99 
rcu_gp_fqs_loop+0x301/0x1540 kernel/rcu/tree.c:2083 
rcu_gp_kthread+0x99/0x390 kernel/rcu/tree.c:2285 
kthread+0x711/0x8a0 kernel/kthread.c:463 
ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 
</TASK> 
rcu: Stack dump where RCU GP kthread last ran: 
CPU: 0 UID: 0 PID: 6318 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS 
Google 10/25/2025 
RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline] 
RIP: 0010:smp_call_function_many_cond+0xcce/0x1260 kernel/smp.c:877 
Code: 01 31 ff e8 d4 97 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 
07 e8 7f 93 0b 00 eb 38 f3 90 42 0f b6 04 2b 84 c0 75 11 <41> f7 04 24 01 
00 00 00 74 1e e8 63 93 0b 00 eb e4 44 89 e1 80 e1 
RSP: 0000:ffffc90003d0f820 EFLAGS: 00000246 
RAX: 0000000000000000 RBX: 1ffff110170e8129 RCX: ffff888026fc3d00 
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 
RBP: ffffc90003d0f950 R08: ffffffff8f822e77 R09: 1ffffffff1f045ce 
R10: dffffc0000000000 R11: fffffbfff1f045cf R12: ffff8880b8740948 
R13: dffffc0000000000 R14: ffff8880b863bb00 R15: 0000000000000001 
FS: 00007fdbcbf47880(0000) GS:ffff888125e1e000(0000) knlGS:0000000000000000 
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 
CR2: 00005589070d6f28 CR3: 0000000076b96000 CR4: 00000000003526f0 
Call Trace: 
<TASK> 
on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1043 
__flush_tlb_multi arch/x86/include/asm/paravirt.h:91 [inline] 
flush_tlb_multi arch/x86/mm/tlb.c:1382 [inline] 
flush_tlb_mm_range+0x60a/0x1170 arch/x86/mm/tlb.c:1472 
flush_tlb_page arch/x86/include/asm/tlbflush.h:324 [inline] 
ptep_clear_flush+0x120/0x170 mm/pgtable-generic.c:103 
wp_page_copy mm/memory.c:3785 [inline] 
do_wp_page+0x1bb1/0x5810 mm/memory.c:4180 
handle_pte_fault mm/memory.c:6289 [inline] 
__handle_mm_fault mm/memory.c:6411 [inline] 
handle_mm_fault+0x14c5/0x32b0 mm/memory.c:6580 
do_user_addr_fault+0xa7c/0x1380 arch/x86/mm/fault.c:1336 
handle_page_fault arch/x86/mm/fault.c:1476 [inline] 
exc_page_fault+0x71/0xd0 arch/x86/mm/fault.c:1532 
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 
RIP: 0033:0x7fdbcb8b5b69 
Code: 10 48 81 f9 ff 03 00 00 76 28 48 8b 57 20 48 85 d2 74 1f 48 3b 7a 28 
75 76 48 8b 4f 28 48 3b 79 20 75 6c 48 83 78 20 00 74 17 <48> 89 4a 28 48 
89 51 20 48 83 c4 08 c3 66 2e 0f 1f 84 00 00 00 00 
RSP: 002b:00007ffc0ad89870 EFLAGS: 00010202 
RAX: 00007fdbcb9f2070 RBX: 00000000000009b0 RCX: 00005589070d6f00 
RDX: 00005589070d6f00 RSI: 00007fdbcb9f2070 RDI: 00005589070d6f00 
RBP: 00007fdbcb9f1ac0 R08: 00000000000009b0 R09: 0000000000000000 
R10: 0000000000000000 R11: 0000000000000202 R12: 00005589070d47a0 
R13: 00007fdbcb9f1ac0 R14: 00000000000009b0 R15: 00007fdbcb9f1ac0 
</TASK> 


Tested on: 

commit: f40ddcc0 Revert "nfc/nci: Add the inconsistency check .. 
git tree: net 
console output: https://syzkaller.appspot.com/x/log.txt?x=160153fa580000 
kernel config: https://syzkaller.appspot.com/x/.config?x=323fe5bdde2384a5 
dashboard link: https://syzkaller.appspot.com/bug?extid=8bb3e2bee8a429cc76dd 
compiler: Debian clang version 20.1.8 
(++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 
20.1.8 
patch: https://syzkaller.appspot.com/x/patch.diff?x=118fa852580000 

Powered by blists - more mailing lists