syz-executor.6: attempt to access beyond end of device loop6: rw=0, sector=0, nr_sectors = 1 limit=0 FAT-fs (loop6): unable to read boot sector loop7: detected capacity change from 0 to 184 isofs_fill_super: get root inode failed rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 1-....: (1 GPs behind) idle=f1a4/1/0x4000000000000000 softirq=424167/424170 fqs=51400 rcu: (detected by 0, t=105002 jiffies, g=445993, q=36100 ncpus=2) Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 7783 Comm: syz-executor.2 Not tainted 6.16.0-rc5-next-20250709 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:native_apic_msr_eoi+0xf/0x20 Code: 01 00 00 00 e9 c2 ea 86 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 31 c0 b9 0b 08 00 00 89 c2 0f 30 9c ea 86 03 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 RSP: 0018:ffff88806cf08e80 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880e56ee000 RCX: 000000000000080b RDX: 0000000000000000 RSI: ffffffff8134a861 RDI: 0000000000000001 RBP: ffff88806cf08ec8 R08: 0000000000000001 R09: ffffed100d9e4751 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f2d39bef700(0000) GS:ffff8880e56ee000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd85bf25fe8 CR3: 000000000b59b000 CR4: 0000000000350ef0 Call Trace: kvm_guest_apic_eoi_write+0x46/0x50 __sysvec_irq_work+0xf/0x360 sysvec_irq_work+0x5f/0xc0 asm_sysvec_irq_work+0x1a/0x20 RIP: 0010:handle_softirqs+0x174/0x770 Code: c8 83 83 3c 0a 00 00 01 c7 44 24 20 0a 00 00 00 48 89 44 24 18 65 66 c7 05 8f c2 47 06 00 00 e8 52 3d 40 00 fb bb ff ff ff ff <48> c7 c5 c0 c0 a0 85 41 0f bc de 83 c3 01 0f 85 9b 00 00 00 e9 8d RSP: 0018:ffff88806cf08f78 EFLAGS: 00000212 RAX: 0000000000000380 RBX: 00000000ffffffff RCX: 0000000000000004 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff813b5dae RBP: ffff88803ee3f6f8 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff86439757 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000200 R15: 0000000000000000 __irq_exit_rcu+0xc4/0x100 irq_exit_rcu+0x9/0x20 sysvec_irq_work+0xa6/0xc0 asm_sysvec_irq_work+0x1a/0x20 RIP: 0010:__rcu_read_unlock+0xc6/0x4f0 Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 77 01 00 00 8b 85 00 04 00 00 85 c0 75 57 <65> 48 8b 1d fa 64 27 06 48 8d bb fc 03 00 00 48 b8 00 00 00 00 00 RSP: 0018:ffff88803ee3f7a8 EFLAGS: 00000206 RAX: 000000000000037d RBX: ffff88806cf37d40 RCX: 0000000000000040 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff815bbc4e RBP: ffffffff85c28d00 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff86439757 R11: 0000000000000001 R12: 0000000000000001 R13: ffff88806cf38000 R14: 0000000000000200 R15: ffff88806cf38080 drain_obj_stock+0x247/0x380 refill_obj_stock+0x1cc/0x910 obj_cgroup_charge_account+0x4e3/0x6e0 __memcg_slab_post_alloc_hook+0x33c/0x9d0 kmem_cache_alloc_noprof+0x3bb/0x470 vm_area_dup+0x25/0x6f0 dup_mmap+0x80d/0x1d10 copy_process+0x62eb/0x73b0 kernel_clone+0xea/0x820 __do_sys_fork+0x94/0xd0 do_syscall_64+0xbf/0x360 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2d3c679b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2d39bef188 EFLAGS: 00000246 ORIG_RAX: 0000000000000039 RAX: ffffffffffffffda RBX: 00007f2d3c78cf60 RCX: 00007f2d3c679b19 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f2d3c6d3f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffb67032df R14: 00007f2d39bef300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 01 00 add %eax,(%rax) 2: 00 00 add %al,(%rax) 4: e9 c2 ea 86 03 jmpq 0x386eacb 9: 66 90 xchg %ax,%ax b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: f3 0f 1e fa endbr64 1f: 31 c0 xor %eax,%eax 21: b9 0b 08 00 00 mov $0x80b,%ecx 26: 89 c2 mov %eax,%edx 28: 0f 30 wrmsr * 2a: e9 9c ea 86 03 jmpq 0x386eacb <-- trapping instruction 2f: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 36: 00 00 00 00 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop