[v6.1] INFO: rcu detected stall in mld_ifc_work

Hello,

syzbot found the following issue on:

HEAD commit: 7ec6f9fa3d97 Linux 6.1.114
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1523d230580000
kernel config: https://syzkaller.appspot.com/x/.config?x=344cdb747ab79921
dashboard link: https://syzkaller.appspot.com/bug?extid=5d2de432f44e910fa266
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=118eaca7980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16bc6940580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e7551ab2b38b/disk-7ec6f9fa.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/99ca69a69b01/vmlinux-7ec6f9fa.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0d62742f11c2/Image-7ec6f9fa.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P1516/2:b..l
(detected by 0, t=10502 jiffies, g=4065, q=247 ncpus=2)
task:kworker/0:2 state:R running task stack:0 pid:1516 ppid:2 flags:0x00000008
Workqueue: mld mld_ifc_work
Call trace:
__switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
context_switch kernel/sched/core.c:5241 [inline]
__schedule+0xef4/0x1d44 kernel/sched/core.c:6558
preempt_schedule_irq+0x8c/0x1b8 kernel/sched/core.c:6870
arm64_preempt_schedule_irq arch/arm64/kernel/entry-common.c:265 [inline]
__el1_irq arch/arm64/kernel/entry-common.c:474 [inline]
el1_interrupt+0x4c/0x68 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
nf_conntrack_confirm include/net/netfilter/nf_conntrack_core.h:68 [inline]
ipv6_confirm+0x454/0x594 net/netfilter/nf_conntrack_proto.c:397
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xc8/0x1f4 net/netfilter/core.c:614
nf_hook+0x260/0x3e8 include/linux/netfilter.h:257
NF_HOOK_COND include/linux/netfilter.h:290 [inline]
ip6_output+0x240/0x594 net/ipv6/ip6_output.c:237
dst_output include/net/dst.h:444 [inline]
NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:302
mld_sendpack+0x90c/0x1364 net/ipv6/mcast.c:1820
mld_send_cr net/ipv6/mcast.c:2121 [inline]
mld_ifc_work+0x848/0xc20 net/ipv6/mcast.c:2653
process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292
worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
rcu: rcu_preempt kthread starved for 10500 jiffies! g4065 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:0 pid:16 ppid:2 flags:0x00000008
Call trace:
__switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
context_switch kernel/sched/core.c:5241 [inline]
__schedule+0xef4/0x1d44 kernel/sched/core.c:6558
schedule+0xc4/0x170 kernel/sched/core.c:6634
schedule_timeout+0x1d8/0x344 kernel/time/timer.c:1965
rcu_gp_fqs_loop+0x2cc/0x1538 kernel/rcu/tree.c:1706
rcu_gp_kthread+0xc0/0x308 kernel/rcu/tree.c:1905
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 PID: 4320 Comm: syz-executor625 Not tainted 6.1.114-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
pc : _raw_spin_unlock_irq+0x44/0x90 kernel/locking/spinlock.c:202
lr : __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
lr : _raw_spin_unlock_irq+0x3c/0x90 kernel/locking/spinlock.c:202
sp : ffff800021177500
x29: ffff800021177500 x28: 1fffe00019e9411a x27: 1ffff0000422ef90
x26: 1fffe00019e9411b x25: 1ffff0000422eea8 x24: dfff800000000000
x23: 0000000000000000 x22: ffff0000cf4a0000 x21: ffff0000cf4a08d0
x20: ffff0000cf4a08d8 x19: ffff0000c819dc80 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800008305dfc x15: 0000ffff9f18dab8
x14: 1ffff00002b3a0b0 x13: dfff800000000000 x12: 0000000000000003
x11: 0000000000ff0100 x10: 0000000000000003 x9 : 0000000000000000
x8 : 00000000000000e0 x7 : ffff8000081f47b0 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff800021177420 x1 : ffff8000123ec6e0 x0 : ffff80019e3d5000
Call trace:
arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline]
__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
_raw_spin_unlock_irq+0x44/0x90 kernel/locking/spinlock.c:202
spin_unlock_irq include/linux/spinlock.h:401 [inline]
__set_current_blocked+0x1fc/0x258 kernel/signal.c:3059
set_current_blocked+0x50/0x60 kernel/signal.c:3043
restore_sigframe arch/arm64/kernel/signal.c:643 [inline]
__arm64_sys_rt_sigreturn+0x344/0x2658 arch/arm64/kernel/signal.c:697
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup