syzbot

 sign-in | mailing list | source | docs
🐞 Open [530] 🐞 Fixed [32] 🐞 Invalid [294] ⬇ Missing Backports [43] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

possible deadlock in __hrtimer_run_queues

Status: auto-obsoleted due to no activity on 2023/09/06 10:20
Reported-by: syzbot+08baca0b238aba1a0537@syzkaller.appspotmail.com
First crash: 336d, last: 325d
▶ ▼ Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in __hrtimer_run_queues (2) kernel C error 14 3d16h 25d 0/26 upstream: reported C repro on 2024/03/24 21:06
linux-6.1 possible deadlock in __hrtimer_run_queues (2) C 2 9d11h 16d 0/3 upstream: reported C repro on 2024/04/02 19:14
upstream possible deadlock in __hrtimer_run_queues kernel 24 313d 342d 0/26 auto-obsoleted due to no activity on 2023/08/23 09:03
linux-6.1 possible deadlock in __hrtimer_run_queues 1 331d 331d 0/3 auto-obsoleted due to no activity on 2023/08/31 12:31
linux-5.15 possible deadlock in __hrtimer_run_queues (2) 2 17d 21d 0/3 upstream: reported on 2024/03/28 04:51

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
5.15.113-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.3/12421 is trying to acquire lock:
ffff0001fec6fd20 (&pgdat->kcompactd_wait){-...}-{2:2}, at: __wake_up_common_lock kernel/sched/wait.c:137 [inline]
ffff0001fec6fd20 (&pgdat->kcompactd_wait){-...}-{2:2}, at: __wake_up+0xe8/0x1a0 kernel/sched/wait.c:157

but task is already holding lock:
ffff0001b481e618 (hrtimer_bases.lock){-.-.}-{2:2}, at: __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
ffff0001b481e618 (hrtimer_bases.lock){-.-.}-{2:2}, at: __hrtimer_run_queues+0x544/0xca4 kernel/time/hrtimer.c:1749

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #4 (hrtimer_bases.lock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162
       lock_hrtimer_base kernel/time/hrtimer.c:173 [inline]
       hrtimer_start_range_ns+0xe4/0x9b0 kernel/time/hrtimer.c:1296
       hrtimer_start_expires include/linux/hrtimer.h:432 [inline]
       do_start_rt_bandwidth kernel/sched/rt.c:69 [inline]
       start_rt_bandwidth kernel/sched/rt.c:80 [inline]
       inc_rt_group kernel/sched/rt.c:1207 [inline]
       inc_rt_tasks kernel/sched/rt.c:1251 [inline]
       __enqueue_rt_entity kernel/sched/rt.c:1321 [inline]
       enqueue_rt_entity kernel/sched/rt.c:1368 [inline]
       enqueue_task_rt+0x4e0/0x9b0 kernel/sched/rt.c:1398
       enqueue_task kernel/sched/core.c:1977 [inline]
       activate_task+0x144/0x2d0 kernel/sched/core.c:2005
       ttwu_do_activate+0x158/0x264 kernel/sched/core.c:3610
       sched_ttwu_pending+0x1f8/0x400 kernel/sched/core.c:3685
       flush_smp_call_function_queue+0x5f8/0x8c4 kernel/smp.c:678
       generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544
       do_handle_IPI arch/arm64/kernel/smp.c:902 [inline]
       ipi_handler+0x15c/0x7d4 arch/arm64/kernel/smp.c:948
       handle_percpu_devid_irq+0x29c/0x7fc kernel/irq/chip.c:933
       generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
       handle_irq_desc kernel/irq/irqdesc.c:651 [inline]
       handle_domain_irq+0xec/0x178 kernel/irq/irqdesc.c:706
       gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757
       call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:899
       do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
       el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442
       el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458
       el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
       arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
       default_idle_call+0xcc/0x4a8 kernel/sched/idle.c:112
       cpuidle_idle_call kernel/sched/idle.c:194 [inline]
       do_idle+0x1d4/0x4dc kernel/sched/idle.c:306
       cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:403
       secondary_start_kernel+0x240/0x298 arch/arm64/kernel/smp.c:265
       __secondary_switched+0x94/0x98 arch/arm64/kernel/head.S:661

-> #3 (&rt_b->rt_runtime_lock){-.-.}-{2:2}:
       __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
       _raw_spin_lock+0xb0/0x10c kernel/locking/spinlock.c:154
       __enable_runtime kernel/sched/rt.c:840 [inline]
       rq_online_rt+0x144/0x328 kernel/sched/rt.c:2327
       set_rq_online kernel/sched/core.c:9036 [inline]
       sched_cpu_activate+0x350/0x470 kernel/sched/core.c:9143
       cpuhp_invoke_callback+0x404/0x704 kernel/cpu.c:191
       cpuhp_thread_fun+0x2e8/0x61c kernel/cpu.c:822
       smpboot_thread_fn+0x4b0/0x920 kernel/smpboot.c:164
       kthread+0x37c/0x45c kernel/kthread.c:319
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

-> #2 (&rq->__lock){-.-.}-{2:2}:
       _raw_spin_lock_nested+0xb4/0x110 kernel/locking/spinlock.c:368
       raw_spin_rq_lock_nested+0x2c/0x44 kernel/sched/core.c:475
       raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
       rq_lock kernel/sched/sched.h:1621 [inline]
       task_fork_fair+0x7c/0x23c kernel/sched/fair.c:11494
       sched_cgroup_fork+0x334/0x3d8 kernel/sched/core.c:4462
       copy_process+0x24d4/0x3750 kernel/fork.c:2312
       kernel_clone+0x1d8/0xa58 kernel/fork.c:2601
       kernel_thread+0x148/0x1bc kernel/fork.c:2653
       rest_init+0x2c/0x38c init/main.c:701
       arch_call_rest_init+0x14/0x20 init/main.c:889
       start_kernel+0x444/0x604 init/main.c:1144
       __primary_switched+0xa8/0xb0 arch/arm64/kernel/head.S:468

-> #1 (&p->pi_lock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162
       try_to_wake_up+0xb0/0xc2c kernel/sched/core.c:4026
       default_wake_function+0x4c/0x60 kernel/sched/core.c:6788
       autoremove_wake_function+0x24/0xf8 kernel/sched/wait.c:416
       __wake_up_common+0x23c/0x3bc kernel/sched/wait.c:108
       __wake_up_common_lock kernel/sched/wait.c:138 [inline]
       __wake_up+0x108/0x1a0 kernel/sched/wait.c:157
       wakeup_kcompactd+0x2e4/0x600 mm/compaction.c:2927
       balance_pgdat+0x18cc/0x1c80 mm/vmscan.c:4065
       kswapd+0x81c/0x1118 mm/vmscan.c:4261
       kthread+0x37c/0x45c kernel/kthread.c:319
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

-> #0 (&pgdat->kcompactd_wait){-...}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3053 [inline]
       check_prevs_add kernel/locking/lockdep.c:3172 [inline]
       validate_chain kernel/locking/lockdep.c:3787 [inline]
       __lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
       lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162
       __wake_up_common_lock kernel/sched/wait.c:137 [inline]
       __wake_up+0xe8/0x1a0 kernel/sched/wait.c:157
       wakeup_kcompactd+0x2e4/0x600 mm/compaction.c:2927
       wakeup_kswapd+0x2e0/0x85c mm/vmscan.c:4315
       wake_all_kswapds mm/page_alloc.c:4678 [inline]
       __alloc_pages_slowpath+0x3fc/0x226c mm/page_alloc.c:4952
       __alloc_pages+0x3a4/0x674 mm/page_alloc.c:5434
       alloc_pages+0x390/0x634
       stack_depot_save+0x364/0x4a0 lib/stackdepot.c:302
       kasan_save_stack mm/kasan/common.c:40 [inline]
       kasan_set_track mm/kasan/common.c:46 [inline]
       set_alloc_info mm/kasan/common.c:434 [inline]
       __kasan_slab_alloc+0xa8/0xcc mm/kasan/common.c:467
       kasan_slab_alloc include/linux/kasan.h:254 [inline]
       slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
       slab_alloc_node mm/slub.c:3220 [inline]
       slab_alloc mm/slub.c:3228 [inline]
       kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
       kmem_cache_zalloc include/linux/slab.h:711 [inline]
       fill_pool lib/debugobjects.c:171 [inline]
       debug_objects_fill_pool+0x5e0/0x814 lib/debugobjects.c:600
       debug_object_activate+0x114/0x790 lib/debugobjects.c:696
       debug_hrtimer_activate kernel/time/hrtimer.c:420 [inline]
       debug_activate kernel/time/hrtimer.c:475 [inline]
       enqueue_hrtimer+0x40/0x414 kernel/time/hrtimer.c:1084
       __run_hrtimer kernel/time/hrtimer.c:1702 [inline]
       __hrtimer_run_queues+0x588/0xca4 kernel/time/hrtimer.c:1749
       hrtimer_interrupt+0x2c0/0xb64 kernel/time/hrtimer.c:1811
       timer_handler drivers/clocksource/arm_arch_timer.c:659 [inline]
       arch_timer_handler_virt+0x74/0x88 drivers/clocksource/arm_arch_timer.c:670
       handle_percpu_devid_irq+0x29c/0x7fc kernel/irq/chip.c:933
       generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
       handle_irq_desc kernel/irq/irqdesc.c:651 [inline]
       handle_domain_irq+0xec/0x178 kernel/irq/irqdesc.c:706
       gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757
       call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:899
       do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
       el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442
       el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458
       el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
       check_kcov_mode kernel/kcov.c:163 [inline]
       write_comp_data kernel/kcov.c:218 [inline]
       __sanitizer_cov_trace_const_cmp8+0x6c/0xb8 kernel/kcov.c:291
       walk_stackframe arch/arm64/kernel/stacktrace.c:148 [inline]
       arch_stack_walk+0x270/0x32c arch/arm64/kernel/stacktrace.c:238
       stack_trace_save+0xfc/0x1a0 kernel/stacktrace.c:122
       kasan_save_stack mm/kasan/common.c:38 [inline]
       kasan_set_track mm/kasan/common.c:46 [inline]
       set_alloc_info mm/kasan/common.c:434 [inline]
       __kasan_slab_alloc+0x8c/0xcc mm/kasan/common.c:467
       kasan_slab_alloc include/linux/kasan.h:254 [inline]
       slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
       slab_alloc_node mm/slub.c:3220 [inline]
       slab_alloc mm/slub.c:3228 [inline]
       kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
       kmem_cache_zalloc include/linux/slab.h:711 [inline]
       fill_pool lib/debugobjects.c:171 [inline]
       debug_objects_fill_pool+0x3a0/0x814 lib/debugobjects.c:600
       debug_object_activate+0x114/0x790 lib/debugobjects.c:696
       debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
       __call_rcu kernel/rcu/tree.c:2978 [inline]
       call_rcu+0x48/0xb40 kernel/rcu/tree.c:3074
       dentry_free+0xac/0x18c
       __dentry_kill+0x470/0x5e4 fs/dcache.c:596
       shrink_dentry_list+0x41c/0x850 fs/dcache.c:1176
       prune_dcache_sb+0x104/0x164 fs/dcache.c:1257
       super_cache_scan+0x2ac/0x3c8 fs/super.c:105
       do_shrink_slab+0x4b4/0x10b0 mm/vmscan.c:758
       shrink_slab_memcg mm/vmscan.c:827 [inline]
       shrink_slab+0x4bc/0x894 mm/vmscan.c:906
       shrink_node_memcgs mm/vmscan.c:2951 [inline]
       shrink_node+0xe00/0x21b4 mm/vmscan.c:3072
       shrink_zones mm/vmscan.c:3275 [inline]
       do_try_to_free_pages+0x538/0x126c mm/vmscan.c:3330
       try_to_free_pages+0x8c0/0x10e0 mm/vmscan.c:3565
       __perform_reclaim mm/page_alloc.c:4624 [inline]
       __alloc_pages_direct_reclaim mm/page_alloc.c:4645 [inline]
       __alloc_pages_slowpath+0xdd0/0x226c mm/page_alloc.c:5051
       __alloc_pages+0x3a4/0x674 mm/page_alloc.c:5434
       alloc_pages+0x390/0x634
       vm_area_alloc_pages mm/vmalloc.c:2864 [inline]
       __vmalloc_area_node mm/vmalloc.c:2920 [inline]
       __vmalloc_node_range+0x538/0x8e0 mm/vmalloc.c:3025
       vmalloc_user+0x138/0x19c mm/vmalloc.c:3161
       vb2_vmalloc_alloc+0xfc/0x2d8 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47
       __vb2_buf_mem_alloc drivers/media/common/videobuf2/videobuf2-core.c:233 [inline]
       __vb2_queue_alloc+0x5e0/0x10bc drivers/media/common/videobuf2/videobuf2-core.c:439
       vb2_core_create_bufs+0x3c8/0x8a8 drivers/media/common/videobuf2/videobuf2-core.c:946
       vb2_create_bufs+0x5dc/0xd1c drivers/media/common/videobuf2/videobuf2-v4l2.c:799
       vb2_ioctl_create_bufs+0x378/0x5c8 drivers/media/common/videobuf2/videobuf2-v4l2.c:1031
       vidioc_create_bufs+0xd8/0x114 drivers/media/test-drivers/vivid/vivid-core.c:718
       v4l_create_bufs+0x19c/0x2d8 drivers/media/v4l2-core/v4l2-ioctl.c:2072
       __video_do_ioctl+0x7f0/0xb64 drivers/media/v4l2-core/v4l2-ioctl.c:2976
       video_usercopy+0x988/0x1160 drivers/media/v4l2-core/v4l2-ioctl.c:3324
       video_ioctl2+0x3c/0x50 drivers/media/v4l2-core/v4l2-ioctl.c:3372
       v4l2_ioctl+0x148/0x18c drivers/media/v4l2-core/v4l2-dev.c:364
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:874 [inline]
       __se_sys_ioctl fs/ioctl.c:860 [inline]
       __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
       do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
       el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
       el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
       el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

other info that might help us debug this:

Chain exists of:
  &pgdat->kcompactd_wait --> &rt_b->rt_runtime_lock --> hrtimer_bases.lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(hrtimer_bases.lock);
                               lock(&rt_b->rt_runtime_lock);
                               lock(hrtimer_bases.lock);
  lock(&pgdat->kcompactd_wait);

 *** DEADLOCK ***

5 locks held by syz-executor.3/12421:
 #0: ffff0000d04d6b98 (&dev->mutex#3){+.+.}-{3:3}, at: __video_do_ioctl+0x424/0xb64 drivers/media/v4l2-core/v4l2-ioctl.c:2944
 #1: ffff800014b65240 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4621 [inline]
 #1: ffff800014b65240 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim mm/page_alloc.c:4645 [inline]
 #1: ffff800014b65240 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath+0xd70/0x226c mm/page_alloc.c:5051
 #2: ffff800014b428b0 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab_memcg mm/vmscan.c:800 [inline]
 #2: ffff800014b428b0 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0x274/0x894 mm/vmscan.c:906
 #3: ffff0000d42ec0e0 (&type->s_umount_key#30){++++}-{3:3}, at: trylock_super fs/super.c:418 [inline]
 #3: ffff0000d42ec0e0 (&type->s_umount_key#30){++++}-{3:3}, at: super_cache_scan+0x80/0x3c8 fs/super.c:80
 #4: ffff0001b481e618 (hrtimer_bases.lock){-.-.}-{2:2}, at: __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 #4: ffff0001b481e618 (hrtimer_bases.lock){-.-.}-{2:2}, at: __hrtimer_run_queues+0x544/0xca4 kernel/time/hrtimer.c:1749

stack backtrace:
CPU: 1 PID: 12421 Comm: syz-executor.3 Not tainted 5.15.113-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011
 check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133
 check_prev_add kernel/locking/lockdep.c:3053 [inline]
 check_prevs_add kernel/locking/lockdep.c:3172 [inline]
 validate_chain kernel/locking/lockdep.c:3787 [inline]
 __lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
 lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162
 __wake_up_common_lock kernel/sched/wait.c:137 [inline]
 __wake_up+0xe8/0x1a0 kernel/sched/wait.c:157
 wakeup_kcompactd+0x2e4/0x600 mm/compaction.c:2927
 wakeup_kswapd+0x2e0/0x85c mm/vmscan.c:4315
 wake_all_kswapds mm/page_alloc.c:4678 [inline]
 __alloc_pages_slowpath+0x3fc/0x226c mm/page_alloc.c:4952
 __alloc_pages+0x3a4/0x674 mm/page_alloc.c:5434
 alloc_pages+0x390/0x634
 stack_depot_save+0x364/0x4a0 lib/stackdepot.c:302
 kasan_save_stack mm/kasan/common.c:40 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0xa8/0xcc mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
 slab_alloc_node mm/slub.c:3220 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
 kmem_cache_zalloc include/linux/slab.h:711 [inline]
 fill_pool lib/debugobjects.c:171 [inline]
 debug_objects_fill_pool+0x5e0/0x814 lib/debugobjects.c:600
 debug_object_activate+0x114/0x790 lib/debugobjects.c:696
 debug_hrtimer_activate kernel/time/hrtimer.c:420 [inline]
 debug_activate kernel/time/hrtimer.c:475 [inline]
 enqueue_hrtimer+0x40/0x414 kernel/time/hrtimer.c:1084
 __run_hrtimer kernel/time/hrtimer.c:1702 [inline]
 __hrtimer_run_queues+0x588/0xca4 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x2c0/0xb64 kernel/time/hrtimer.c:1811
 timer_handler drivers/clocksource/arm_arch_timer.c:659 [inline]
 arch_timer_handler_virt+0x74/0x88 drivers/clocksource/arm_arch_timer.c:670
 handle_percpu_devid_irq+0x29c/0x7fc kernel/irq/chip.c:933
 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
 handle_irq_desc kernel/irq/irqdesc.c:651 [inline]
 handle_domain_irq+0xec/0x178 kernel/irq/irqdesc.c:706
 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:899
 do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
 check_kcov_mode kernel/kcov.c:163 [inline]
 write_comp_data kernel/kcov.c:218 [inline]
 __sanitizer_cov_trace_const_cmp8+0x6c/0xb8 kernel/kcov.c:291
 walk_stackframe arch/arm64/kernel/stacktrace.c:148 [inline]
 arch_stack_walk+0x270/0x32c arch/arm64/kernel/stacktrace.c:238
 stack_trace_save+0xfc/0x1a0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0x8c/0xcc mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
 slab_alloc_node mm/slub.c:3220 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
 kmem_cache_zalloc include/linux/slab.h:711 [inline]
 fill_pool lib/debugobjects.c:171 [inline]
 debug_objects_fill_pool+0x3a0/0x814 lib/debugobjects.c:600
 debug_object_activate+0x114/0x790 lib/debugobjects.c:696
 debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
 __call_rcu kernel/rcu/tree.c:2978 [inline]
 call_rcu+0x48/0xb40 kernel/rcu/tree.c:3074
 dentry_free+0xac/0x18c
 __dentry_kill+0x470/0x5e4 fs/dcache.c:596
 shrink_dentry_list+0x41c/0x850 fs/dcache.c:1176
 prune_dcache_sb+0x104/0x164 fs/dcache.c:1257
 super_cache_scan+0x2ac/0x3c8 fs/super.c:105
 do_shrink_slab+0x4b4/0x10b0 mm/vmscan.c:758
 shrink_slab_memcg mm/vmscan.c:827 [inline]
 shrink_slab+0x4bc/0x894 mm/vmscan.c:906
 shrink_node_memcgs mm/vmscan.c:2951 [inline]
 shrink_node+0xe00/0x21b4 mm/vmscan.c:3072
 shrink_zones mm/vmscan.c:3275 [inline]
 do_try_to_free_pages+0x538/0x126c mm/vmscan.c:3330
 try_to_free_pages+0x8c0/0x10e0 mm/vmscan.c:3565
 __perform_reclaim mm/page_alloc.c:4624 [inline]
 __alloc_pages_direct_reclaim mm/page_alloc.c:4645 [inline]
 __alloc_pages_slowpath+0xdd0/0x226c mm/page_alloc.c:5051
 __alloc_pages+0x3a4/0x674 mm/page_alloc.c:5434
 alloc_pages+0x390/0x634
 vm_area_alloc_pages mm/vmalloc.c:2864 [inline]
 __vmalloc_area_node mm/vmalloc.c:2920 [inline]
 __vmalloc_node_range+0x538/0x8e0 mm/vmalloc.c:3025
 vmalloc_user+0x138/0x19c mm/vmalloc.c:3161
 vb2_vmalloc_alloc+0xfc/0x2d8 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47
 __vb2_buf_mem_alloc drivers/media/common/videobuf2/videobuf2-core.c:233 [inline]
 __vb2_queue_alloc+0x5e0/0x10bc drivers/media/common/videobuf2/videobuf2-core.c:439
 vb2_core_create_bufs+0x3c8/0x8a8 drivers/media/common/videobuf2/videobuf2-core.c:946
 vb2_create_bufs+0x5dc/0xd1c drivers/media/common/videobuf2/videobuf2-v4l2.c:799
 vb2_ioctl_create_bufs+0x378/0x5c8 drivers/media/common/videobuf2/videobuf2-v4l2.c:1031
 vidioc_create_bufs+0xd8/0x114 drivers/media/test-drivers/vivid/vivid-core.c:718
 v4l_create_bufs+0x19c/0x2d8 drivers/media/v4l2-core/v4l2-ioctl.c:2072
 __video_do_ioctl+0x7f0/0xb64 drivers/media/v4l2-core/v4l2-ioctl.c:2976
 video_usercopy+0x988/0x1160 drivers/media/v4l2-core/v4l2-ioctl.c:3324
 video_ioctl2+0x3c/0x50 drivers/media/v4l2-core/v4l2-ioctl.c:3372
 v4l2_ioctl+0x148/0x18c drivers/media/v4l2-core/v4l2-dev.c:364
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/05/29 10:20 linux-5.15.y 1fe619a7d252 cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in __hrtimer_run_queues
2023/05/29 05:25 linux-5.15.y 1fe619a7d252 cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in __hrtimer_run_queues
2023/05/18 18:34 linux-5.15.y 9d6bde853685 3bb7af1d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in __hrtimer_run_queues
* Struck through repros no longer work on HEAD.