[REGRESSION] sched/core merge 1c3b68f0d55b: futex_waitv lost wakeup hangs RE Engine games and PID 1 init

[Mikhail Gavrilov]

Hi,

I've bisected a user-visible regression to the sched/core merge for the
post-7.0 merge window. Resident Evil 2/3/4/9 running under Proton hang
deterministically during level load on any kernel built from a tree
that includes this merge, and recover on its first parent. The same
lost-wakeup signature also appears at PID 1 startup on intermediate
bisect steps, preventing boot entirely in some cases.

The bug reproduces on two independent workstations (ASUS and ASRock
B650 boards, both Ryzen 9 7950X + RX 7900 XTX + 64 GB DDR5), so it is
not board-specific and not a one-machine environmental issue.

## Summary

- First bad: 1c3b68f0d55b ("Merge tag 'sched-core-2026-04-13' of
  git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip")
- Parent 1 (33c66eb5e984, master before merge): good
- Parent 2 (78cde54ea5f0, tip of sched/core): good
- Merge: bad

Both parents are good in isolation; only the merge result exhibits the
bug. Linear bisection inside the sched/core branch (v7.0..78cde54ea5f0)
yields no first-bad commit, which is consistent with a semantic
conflict introduced by the merge itself rather than by any single
commit in the pulled branch.

The bisect was run twice with different bookkeeping for inconclusive
steps (first treating boot-hang merges as 'skip', second re-testing
them and marking one — 88b29f3f — as 'bad' after observing the same
lost-wakeup signature during early init). Both runs converged on the
same first-bad commit 1c3b68f0. The 'good' steps inside
78cde54ea5f0..1c3b68f0^ therefore reflect the tip-of-master state with
all the non-sched pull requests already merged but without the
sched/core pull, and they reproducibly pass the game test.

Reproducibility is ~100% in both directions: every tested build that
includes the merge hangs on the first level-load attempt; every tested
build with parent 1 as the tip completes a full level playthrough and
a save-resume in both RE2 and RE9 without issue.

## Symptoms (in-game)

The game freezes mid level-load. No kernel messages, no GPU hang, no
OOM, no lockdep splats. sysrq-t shows the main re2.exe thread parked
in futex_waitv(2) waiting for a wake-up that never arrives:

    task:re2.exe         state:S stack:23656 pid:13204 tgid:13204
    Call Trace:
     <TASK>
     __schedule+0x1204/0x2700
     ? __pfx___schedule+0x10/0x10
     ? local_clock+0x15/0x30
     schedule+0xd4/0x260
     futex_wait_multiple+0x2e2/0x360
     ? __pfx_futex_wait_multiple+0x10/0x10
     ? rcu_is_watching+0x15/0xe0
     ? __kmalloc_noprof+0x605/0x9f0
     ? trace_hardirqs_on_prepare+0x101/0x1a0
     __do_sys_futex_waitv+0x203/0x250
     ? __pfx___do_sys_futex_waitv+0x10/0x10
     do_syscall_64+0x11c/0x1480
     entry_SYSCALL_64_after_hwframe+0x76/0x7e
    RIP: 0033:0x7faae9251e1d
    RSP: 002b:00000001000fe648 EFLAGS: 00000246 ORIG_RAX: 00000000000001c1
    RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007faae9251e1d
    RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000001000febe0
    RBP: 00000001000ff230 R08: 0000000000000000 R09: 00000001000fe680
    R10: 0000000000000000 R11: 0000000000000246 R12: 00000001000febe0
    R13: 0000000000000000 R14: 00007faae77fe2d4 R15: 0000000000000001
     </TASK>

ORIG_RAX 0x1c1 = 449 = SYS_futex_waitv.

All other re2.exe threads are in S state on the same futex_wait_multiple
path; wineserver (pid 13106) is running normally in its epoll loop
(state:R, in vfs_poll/do_epoll_wait). No task is in D state anywhere in
the system except one kworker in the unrelated hub_port_wait_reset ->
msleep USB routine. Nothing is stuck on a kernel mutex. This is the
signature of a lost wake-up, not a deadlock or GPU-side hang.

## Symptoms (early boot, on 88b29f3f during bisect)

On intermediate commits the same class of bug manifests at PID 1
bootstrap instead of mid-game. init never starts; NMI watchdog fires
and shows the BSP still sitting in the boot-time idle loop roughly
two minutes after boot, with the original x86_64 startup chain still
on the stack:

    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.0.0-08-88b29f3f...
    Hardware name: ASRock B650I Lightning WiFi, BIOS 4.10 02/09/2026
    RIP: 0010:poll_idle+0x55/0xb0
    Call Trace:
     <TASK>
     cpuidle_enter_state+0xaa/0x4c0
     cpuidle_enter+0x4e/0xb0
     cpuidle_idle_call+0x1f9/0x320
     ? __pfx_cpuidle_idle_call+0x10/0x10
     ? __pfx_tsc_verify_tsc_adjust+0x10/0x10
     ? rcu_is_watching+0x15/0xe0
     ? lockdep_hardirqs_on_prepare.part.0+0x92/0x170
     ? trace_hardirqs_on+0x18/0x1b0
     ? rcu_is_watching+0x15/0xe0
     do_idle+0x10f/0x1d0
     cpu_startup_entry+0x53/0x70
     rest_init+0x1d2/0x1e0
     start_kernel+0x3e4/0x3f0
     x86_64_start_reservations+0x24/0x30
     x86_64_start_kernel+0x134/0x140
     common_startup_64+0x13e/0x141
     </TASK>

That is, init_task was created but never ran long enough to execve
/sbin/init — the BSP returned to poll_idle() and stayed there. Given
how heavily early init (especially systemd and udev) uses futex_waitv,
this is consistent with the same lost-wakeup class, just caught at the
PID-1 bootstrap rather than mid-game.

## What's been ruled out

- Proxy execution: CONFIG_SCHED_PROXY_EXEC=n in my config, confirmed
  via dmesg ("CONFIG_SCHED_PROXY_EXEC=n, so it cannot be enabled or
  disabled at boot time"). The bug reproduces regardless, so the new
  proxy-exec runtime path is not involved. Any sched/core change that
  is unconditional (task::blocked_lock addition in task_struct, EEVDF
  weight/lag changes, mutex.c refactors, topology rework, etc.) remains
  in scope.

- GPU: no amdgpu messages around the hang, GPU recovery disabled
  (amdgpu.gpu_recovery=0), the render thread is in an S-state futex
  wait like the rest.

- Userspace drift: not the cause — parent 1 and merge were tested
  against identical userspace (same Proton, Mesa, Wine build) with
  identical game save state.

- Hardware / board specifics: not the cause — reproduces identically on
  two independent workstations with different motherboards (ASUS vs
  ASRock B650) but otherwise matching configurations.

- Flaky bisect results: ruled out by re-running the bisect with a
  stricter test (level-load completion + save-resume in both RE2 and
  RE9) and by re-testing all four 'skip' markers from the first run.
  Two skips had distinct unrelated failure modes (a clocksource
  watchdog TSC-unstable trip on ee60c510, and an early black-screen
  hang with no printk output on e997ac58 and 3203a08c —
  indistinguishable without earlycon). One skip (88b29f3f) exhibited
  the same lost-wakeup signature at PID 1 stage and was re-marked as
  'bad'. Both bisect runs converged on 1c3b68f0 regardless.

## Environment

- CPU:    AMD Ryzen 9 7950X (Zen4, family 25 model 97 stepping 2),
          microcode 0xa60120c
- GPU:    AMD Radeon RX 7900 XTX (Navi 31, PCI 1002:744c),
          Sapphire PULSE, amdgpu driver
- Board:  tested on both ASUS and ASRock B650 (ASRock B650I Lightning
          WiFi, BIOS 4.10 02/09/2026, on the capture machine)
- RAM:    64 GB DDR5
- Distro: Fedora Rawhide
- Mesa:   26.2.0-devel (RADV)
- Proton: Experimental (experimental-10.0-20260407, build 1775583929)
- Session: Wayland (GNOME 50 / Mutter)
- Toolchain: gcc 16.0.1, binutils 2.46.50.20260325, glibc 2.43.9000
- .config: derived from Fedora Rawhide config with debugging options
  enabled (LOCKDEP, PROVE_LOCKING, KASAN, DMA-API debug,
  DEBUG_MUTEXES, DEBUG_PREEMPT, KMEMLEAK). Attached.
- Kernel cmdline for the hang capture:
    sysrq_always_enabled=1 nmi_watchdog=1 amdgpu.gpu_recovery=0
    spectre_v2_user=on spec_rstack_overflow=microcode printk.devkmsg=on

## Reproducer

1. Boot master at or after 1c3b68f0d55b on AMD Zen4 with RDNA3 GPU.
2. Launch Resident Evil 2 via Steam/Proton.
3. Start a new game or load any save that triggers a level transition.
4. Observe hang: window freezes, no progress, main thread in
   futex_waitv per sysrq-t.

Games 3/4/9 (all RE Engine titles) reproduce the same way. Non-RE-Engine
titles I've tried are unaffected.

I'm happy to run traces, apply diagnostic patches, test candidate
fixes, or narrow the reproducer further. bpftrace on
tracepoint:syscalls:sys_{enter,exit}_futex* is straightforward to add
if it would help identify whether FUTEX_WAKE events are being
delivered to the waiting address.

Attachments:
  - bisect-log-first-run.txt   (original, 4 skips)
  - bisect-log-second-run.txt  (with 88b29f3f re-marked bad)
  - config.txt                 (full .config)

Full dmesg from the hang (with sysrq-t) and a photo transcript of the
88b29f3f boot-time splat are available on request.

#regzbot introduced: 1c3b68f0d55b5932eb38eda602a61aec6d6f5e5e
#regzbot title: RE Engine games and PID 1 init hang in futex_waitv
after sched/core merge

-- 
Best Regards,
Mike Gavrilov.
git bisect start
# status: waiting for both good and bad commits
# good: [028ef9c96e96197026887c0f092424679298aae8] Linux 7.0
git bisect good 028ef9c96e96197026887c0f092424679298aae8
# bad: [1f5ffc672165ff851063a5fd044b727ab2517ae3] Fix mismerge of the arm64 / timer-core interrupt handling changes
git bisect bad 1f5ffc672165ff851063a5fd044b727ab2517ae3
# skip: [ee60c510fb3468ec6fab98419218c4e7b37e2ca3] Merge tag 'nolibc-20260412-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc
git bisect skip ee60c510fb3468ec6fab98419218c4e7b37e2ca3
# good: [1f9017d19db38ad2cb9bedb5b078f6f4f60afa94] wifi: mt76: mt7996: fix queue pause after scan due to wrong channel switch reason
git bisect good 1f9017d19db38ad2cb9bedb5b078f6f4f60afa94
# good: [33c66eb5e9844429911bf5478c96c60f9f8af9d0] Merge tag 'perf-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect good 33c66eb5e9844429911bf5478c96c60f9f8af9d0
# good: [e9dc62f25ba63773a62a1a5cacd7a487ae3185ee] Merge tag 'for-net-next-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
git bisect good e9dc62f25ba63773a62a1a5cacd7a487ae3185ee
# skip: [e997ac58ad0b47141c62c79cde8356fe5633287a] Merge tag 'linux_kselftest-next-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
git bisect skip e997ac58ad0b47141c62c79cde8356fe5633287a
# good: [9cd2b522be2cc64fab179d75537d2e8df38d26a6] arm_mpam: resctrl: Implement helpers to update configuration
git bisect good 9cd2b522be2cc64fab179d75537d2e8df38d26a6
# good: [6dd780f973816133f189efec04118c1e6b1b443d] Merge branch 'optimize-kprobe-session-attachment-for-exact-function-names'
git bisect good 6dd780f973816133f189efec04118c1e6b1b443d
# skip: [88b29f3f579987fff0d2bd726d5fa95a53f857fa] Merge tag 'modules-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux
git bisect skip 88b29f3f579987fff0d2bd726d5fa95a53f857fa
# good: [a0d06cf102e4f088781b7df6f20ce8ef694e1deb] bpf: Consolidate sleepable checks in check_helper_call()
git bisect good a0d06cf102e4f088781b7df6f20ce8ef694e1deb
# good: [7f5b0a60a8b925db0cde62d87f1031dc04acbeb2] selftests/bpf: move trampoline_count to dedicated bpf_testmod target
git bisect good 7f5b0a60a8b925db0cde62d87f1031dc04acbeb2
# good: [ad4999496e73923adb524b24c2f448c9498476b5] mount: always duplicate mount
git bisect good ad4999496e73923adb524b24c2f448c9498476b5
# good: [a32325c0e623d594992c4e4616fa685c0e765a33] powerpc64/bpf: Add support for indirect jump
git bisect good a32325c0e623d594992c4e4616fa685c0e765a33
# good: [f5caf26fd6c71294d0fb254404ed66f8cff6f7f7] perf/arm_cspmu: nvidia: Add Tegra410 UCF PMU
git bisect good f5caf26fd6c71294d0fb254404ed66f8cff6f7f7
# good: [93a1f0e61329f538cfc7122d7fa0e7a1803e326d] ASoC: Intel: avs: Check maximum valid CPUID leaf
git bisect good 93a1f0e61329f538cfc7122d7fa0e7a1803e326d
# good: [f8a8faceab9953ed074cd4125b31cc6a562237d8] bpf: Move check_cfg() into cfg.c
git bisect good f8a8faceab9953ed074cd4125b31cc6a562237d8
# skip: [3203a08c1266689c204fb8f10d6bb5186921fce2] Merge tag 'powerpc-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
git bisect skip 3203a08c1266689c204fb8f10d6bb5186921fce2
# bad: [0972ba5605a0a0cd8a9e74558b97a9c9626adfb5] Merge tag 'x86-platform-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad 0972ba5605a0a0cd8a9e74558b97a9c9626adfb5
# good: [48fda62de67a1e88fc8bada12caf0fc9b45116df] sched: Add logic to zap balance callbacks if we pick again
git bisect good 48fda62de67a1e88fc8bada12caf0fc9b45116df
# bad: [2ee08a89634caf79bffc515f8e163988f83b7398] Merge tag 'x86-asm-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad 2ee08a89634caf79bffc515f8e163988f83b7398
# good: [78cde54ea5f03398f1cf6656de2472068f6da966] sched/eevdf: Clear buddies for preempt_short
git bisect good 78cde54ea5f03398f1cf6656de2472068f6da966
# good: [47d2f007615ace34c5ec9026cd5f286833c62c1b] x86/elf: Use savesegment() for segment register reads in ELF core dump
git bisect good 47d2f007615ace34c5ec9026cd5f286833c62c1b
# good: [3b19e22cffe61bcdf10ee5e7584cfa3c1c54dc92] x86/tls: Clean up 'sel' variable usage in do_set_thread_area()
git bisect good 3b19e22cffe61bcdf10ee5e7584cfa3c1c54dc92
# bad: [1c3b68f0d55b5932eb38eda602a61aec6d6f5e5e] Merge tag 'sched-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad 1c3b68f0d55b5932eb38eda602a61aec6d6f5e5e
# first bad commit: [1c3b68f0d55b5932eb38eda602a61aec6d6f5e5e] Merge tag 'sched-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect start
# status: waiting for both good and bad commits
# good: [028ef9c96e96197026887c0f092424679298aae8] Linux 7.0
git bisect good 028ef9c96e96197026887c0f092424679298aae8
# bad: [1f5ffc672165ff851063a5fd044b727ab2517ae3] Fix mismerge of the arm64 / timer-core interrupt handling changes
git bisect bad 1f5ffc672165ff851063a5fd044b727ab2517ae3
# skip: [ee60c510fb3468ec6fab98419218c4e7b37e2ca3] Merge tag 'nolibc-20260412-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc
git bisect skip ee60c510fb3468ec6fab98419218c4e7b37e2ca3
# good: [1f9017d19db38ad2cb9bedb5b078f6f4f60afa94] wifi: mt76: mt7996: fix queue pause after scan due to wrong channel switch reason
git bisect good 1f9017d19db38ad2cb9bedb5b078f6f4f60afa94
# good: [33c66eb5e9844429911bf5478c96c60f9f8af9d0] Merge tag 'perf-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect good 33c66eb5e9844429911bf5478c96c60f9f8af9d0
# good: [e9dc62f25ba63773a62a1a5cacd7a487ae3185ee] Merge tag 'for-net-next-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
git bisect good e9dc62f25ba63773a62a1a5cacd7a487ae3185ee
# skip: [e997ac58ad0b47141c62c79cde8356fe5633287a] Merge tag 'linux_kselftest-next-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
git bisect skip e997ac58ad0b47141c62c79cde8356fe5633287a
# good: [9cd2b522be2cc64fab179d75537d2e8df38d26a6] arm_mpam: resctrl: Implement helpers to update configuration
git bisect good 9cd2b522be2cc64fab179d75537d2e8df38d26a6
# good: [6dd780f973816133f189efec04118c1e6b1b443d] Merge branch 'optimize-kprobe-session-attachment-for-exact-function-names'
git bisect good 6dd780f973816133f189efec04118c1e6b1b443d
# bad: [88b29f3f579987fff0d2bd726d5fa95a53f857fa] Merge tag 'modules-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux
git bisect bad 88b29f3f579987fff0d2bd726d5fa95a53f857fa
# bad: [508fed6795411f5ab277fd1edc0d7adca4946f23] Merge tag 'ras_core_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad 508fed6795411f5ab277fd1edc0d7adca4946f23
# bad: [49b30f3e9cde3403b8719dfcddc923bce572b69c] Merge tag 'x86-vdso-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad 49b30f3e9cde3403b8719dfcddc923bce572b69c
# good: [dec9554dc036183c715d02e9cfe48986d453427a] sched: Move attach_one_task and attach_task helpers to sched.h
git bisect good dec9554dc036183c715d02e9cfe48986d453427a
# bad: [2ee08a89634caf79bffc515f8e163988f83b7398] Merge tag 'x86-asm-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad 2ee08a89634caf79bffc515f8e163988f83b7398
# bad: [1c3b68f0d55b5932eb38eda602a61aec6d6f5e5e] Merge tag 'sched-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad 1c3b68f0d55b5932eb38eda602a61aec6d6f5e5e
# good: [556146ce5e9476db234134c46ddf0e154ca17028] sched/fair: Avoid overflow in enqueue_entity()
git bisect good 556146ce5e9476db234134c46ddf0e154ca17028
# good: [4f70a0456d090303d5a6c915dd7d9db9da56cb16] sched/rt: Move group schedulability check to sched_rt_global_validate()
git bisect good 4f70a0456d090303d5a6c915dd7d9db9da56cb16
# good: [78cde54ea5f03398f1cf6656de2472068f6da966] sched/eevdf: Clear buddies for preempt_short
git bisect good 78cde54ea5f03398f1cf6656de2472068f6da966
# first bad commit: [1c3b68f0d55b5932eb38eda602a61aec6d6f5e5e] Merge tag 'sched-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Attachment: .config
Description: Binary data