syzbot


BUG: soft lockup in br_handle_frame

Status: auto-obsoleted due to no activity on 2024/11/16 05:31
Reported-by: syzbot+0b68dd64fa7d5826070e@syzkaller.appspotmail.com
First crash: 120d, last: 115d
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 BUG: soft lockup in br_handle_frame 3 1917d 1920d 0/1 auto-closed as invalid on 2020/01/09 20:54
linux-4.19 INFO: rcu detected stall in br_handle_frame (2) C error 31 677d 1518d 0/1 upstream: reported C repro on 2020/10/14 18:56
upstream INFO: rcu detected stall in br_handle_frame (5) bridge syz 24 31d 60d 28/28 fixed on 2024/11/12 23:31
upstream INFO: rcu detected stall in br_handle_frame (3) bridge 1 1242d 1242d 0/28 auto-closed as invalid on 2021/10/15 13:41
linux-5.15 INFO: rcu detected stall in br_handle_frame origin:lts-only C error 1 306d 306d 0/3 upstream: reported C repro on 2024/02/08 13:52
linux-6.1 INFO: rcu detected stall in br_handle_frame 2 106d 188d 0/3 auto-obsoleted due to no activity on 2024/12/04 21:21
upstream INFO: rcu detected stall in br_handle_frame (4) kernel 1 1081d 1081d 0/28 closed as invalid on 2022/02/08 10:10

Sample crash report:
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
watchdog: BUG: soft lockup - CPU#0 stuck for 226s! [syz.1.2275:7895]
Modules linked in:
CPU: 0 PID: 7895 Comm: syz.1.2275 Tainted: G        W         5.15.153-syzkaller-00623-gda92e689a0c3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:task_stack_page include/linux/sched/task_stack.h:21 [inline]
RIP: 0010:last_frame arch/x86/kernel/unwind_frame.c:82 [inline]
RIP: 0010:is_last_frame arch/x86/kernel/unwind_frame.c:87 [inline]
RIP: 0010:is_last_task_frame arch/x86/kernel/unwind_frame.c:156 [inline]
RIP: 0010:unwind_next_frame+0x104/0x700 arch/x86/kernel/unwind_frame.c:266
Code: c1 e8 03 48 89 45 90 80 3c 10 00 74 12 48 89 df e8 41 ae 7d 00 48 ba 00 00 00 00 00 fc ff df 48 89 5d 88 48 8b 03 48 89 45 98 <48> 8d 58 20 48 89 d8 48 c1 e8 03 80 3c 10 00 74 12 48 89 df e8 13
RSP: 0018:ffffc90000006bd8 EFLAGS: 00000246
RAX: ffff88812a4b62c0 RBX: ffffc90000006c88 RCX: 0000000000006c01
RDX: dffffc0000000000 RSI: ffffffff81b2320a RDI: ffffc90000006c60
RBP: ffffc90000006c50 R08: ffffc90000006d48 R09: 0000000000000004
R10: ffffc90000006d50 R11: dffffc0000000001 R12: 0000000000000000
R13: ffffffff815f65d0 R14: ffffc90000006c60 R15: 1ffff92000000d8c
FS:  00007f8e6a6ed6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff80000000 CR3: 000000012710e000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 save_stack+0xf6/0x1e0 mm/page_owner.c:139
 __set_page_owner+0x28/0x2e0 mm/page_owner.c:200
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2605
 prep_new_page+0x1b/0x110 mm/page_alloc.c:2611
 get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4485
 __alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5777
 allocate_slab mm/slub.c:1932 [inline]
 new_slab+0x9a/0x4e0 mm/slub.c:1995
 ___slab_alloc+0x39e/0x830 mm/slub.c:3028
 __slab_alloc+0x4a/0x90 mm/slub.c:3115
 slab_alloc_node mm/slub.c:3206 [inline]
 slab_alloc mm/slub.c:3248 [inline]
 kmem_cache_alloc+0x134/0x200 mm/slub.c:3253
 skb_clone+0x1d1/0x360 net/core/skbuff.c:1547
 deliver_clone net/bridge/br_forward.c:125 [inline]
 maybe_deliver+0x1a4/0x2a0 net/bridge/br_forward.c:189
 br_flood+0x2e5/0x420 net/bridge/br_forward.c:231
 br_handle_frame_finish+0xf06/0x1270 net/bridge/br_input.c:175
 nf_hook_bridge_pre net/bridge/br_input.c:259 [inline]
 br_handle_frame+0x8ea/0xf30 net/bridge/br_input.c:377
 __netif_receive_skb_core+0x11af/0x3640 net/core/dev.c:5386
 __netif_receive_skb_one_core net/core/dev.c:5490 [inline]
 __netif_receive_skb+0x11c/0x530 net/core/dev.c:5606
 process_backlog+0x31c/0x650 net/core/dev.c:6483
 __napi_poll+0xc4/0x5a0 net/core/dev.c:7042
 napi_poll net/core/dev.c:7109 [inline]
 net_rx_action+0x47d/0xc50 net/core/dev.c:7199
 __do_softirq+0x26d/0x5bf kernel/softirq.c:565
 invoke_softirq kernel/softirq.c:425 [inline]
 __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:648
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:660
 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1096
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:csd_lock_wait kernel/smp.c:440 [inline]
RIP: 0010:smp_call_function_many_cond+0x843/0x9b0 kernel/smp.c:969
Code: 45 8b 7d 00 44 89 fe 83 e6 01 31 ff e8 f6 a8 0a 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 07 e8 31 a5 0a 00 eb 38 f3 90 <42> 0f b6 04 3b 84 c0 75 11 41 f7 45 00 01 00 00 00 74 1e e8 15 a5
RSP: 0018:ffffc900009f7200 EFLAGS: 00000246
RAX: ffffffff8165a5cb RBX: 1ffff1103ee2784d RCX: 0000000000040000
RDX: ffffc90003961000 RSI: 000000000003ffff RDI: 0000000000040000
RBP: ffffc900009f7308 R08: ffffffff8165a59a R09: ffffc900009f7140
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: ffff8881f713c268 R14: ffff8881f7038e80 R15: dffffc0000000000
 on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1135
 on_each_cpu include/linux/smp.h:71 [inline]
 flush_tlb_kernel_range+0x49/0x210 arch/x86/mm/tlb.c:1026
 __purge_vmap_area_lazy+0x230/0x1690 mm/vmalloc.c:1694
 _vm_unmap_aliases+0x339/0x3b0 mm/vmalloc.c:2118
 vm_unmap_aliases+0x19/0x20 mm/vmalloc.c:2141
 change_page_attr_set_clr+0x308/0x1050 arch/x86/mm/pat/set_memory.c:1740
 change_page_attr_clear arch/x86/mm/pat/set_memory.c:1797 [inline]
 set_memory_ro+0xa1/0xe0 arch/x86/mm/pat/set_memory.c:1943
 bpf_jit_binary_lock_ro include/linux/filter.h:891 [inline]
 bpf_int_jit_compile+0xbf42/0xc6d0 arch/x86/net/bpf_jit_comp.c:2372
 bpf_prog_select_runtime+0x706/0x9e0 kernel/bpf/core.c:1930
 bpf_prog_load+0x1315/0x1b50 kernel/bpf/syscall.c:2337
 __sys_bpf+0x4bc/0x760 kernel/bpf/syscall.c:4633
 __do_sys_bpf kernel/bpf/syscall.c:4737 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4735 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:4735
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f8e6ba6fe79
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8e6a6ed038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f8e6bc0bf80 RCX: 00007f8e6ba6fe79
RDX: 0000000000000090 RSI: 0000000020000680 RDI: 0000000000000005
RBP: 00007f8e6badd916 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f8e6bc0bf80 R15: 00007ffe894ba928
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 14 Comm: rcu_preempt Tainted: G        W         5.15.153-syzkaller-00623-gda92e689a0c3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:native_halt arch/x86/include/asm/irqflags.h:57 [inline]
RIP: 0010:halt arch/x86/include/asm/irqflags.h:98 [inline]
RIP: 0010:kvm_wait+0x117/0x180 arch/x86/kernel/kvm.c:912
Code: 48 c1 e8 03 42 0f b6 04 20 84 c0 44 8b 74 24 1c 75 53 41 0f b6 45 00 44 38 f0 0f 85 63 ff ff ff 66 90 0f 00 2d ea fc 12 04 f4 <e9> 54 ff ff ff fa 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 84 c0 44 8b
RSP: 0018:ffffc900001cf980 EFLAGS: 00000046
RAX: 0000000000000003 RBX: 1ffff92000039f34 RCX: ffffffff81550ddf
RDX: dffffc0000000000 RSI: 0000000000000003 RDI: ffff8881f7127900
RBP: ffffc900001cfa30 R08: dffffc0000000000 R09: ffffed103ee24f21
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881f7127900 R14: 0000000000000003 R15: 1ffff92000039f38
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff80000000 CR3: 000000012710e000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 pv_wait arch/x86/include/asm/paravirt.h:597 [inline]
 pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:470 [inline]
 __pv_queued_spin_lock_slowpath+0x6bc/0xc40 kernel/locking/qspinlock.c:508
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:585 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0x139/0x1b0 kernel/locking/spinlock.c:154
 __mod_timer+0x56e/0xcf0 kernel/time/timer.c:1049
 mod_timer+0x1f/0x30 kernel/time/timer.c:1119
 sk_reset_timer+0x22/0xb0 net/core/sock.c:3152
 inet_csk_reset_xmit_timer include/net/inet_connection_sock.h:237 [inline]
 tcp_reset_xmit_timer include/net/tcp.h:1324 [inline]
 tcp_rearm_rto+0x2d6/0x390 net/ipv4/tcp_input.c:3190
 tcp_event_new_data_sent+0x242/0x3f0 net/ipv4/tcp_output.c:81
 tcp_write_xmit+0x146d/0x5e80 net/ipv4/tcp_output.c:2712
 __tcp_push_pending_frames+0x98/0x2f0 net/ipv4/tcp_output.c:2890
 tcp_push_pending_frames include/net/tcp.h:1915 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5495 [inline]
 tcp_rcv_established+0xd4a/0x1ac0 net/ipv4/tcp_input.c:5906
 tcp_v4_do_rcv+0x3d7/0xa00 net/ipv4/tcp_ipv4.c:1722
 tcp_v4_rcv+0x23dd/0x2a70 net/ipv4/tcp_ipv4.c:2125
 ip_protocol_deliver_rcu+0x32f/0x710 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ip_local_deliver+0x2c6/0x590 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:454 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:577 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:628 [inline]
 ip_sublist_rcv+0x7e2/0x980 net/ipv4/ip_input.c:636
 ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:671
 __netif_receive_skb_list_ptype net/core/dev.c:5535 [inline]
 __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5583
 __netif_receive_skb_list net/core/dev.c:5635 [inline]
 netif_receive_skb_list_internal+0x967/0xcc0 net/core/dev.c:5726
 gro_normal_list net/core/dev.c:5880 [inline]
 napi_complete_done+0x344/0x770 net/core/dev.c:6618
 virtqueue_napi_complete drivers/net/virtio_net.c:357 [inline]
 virtnet_poll+0xbee/0x1260 drivers/net/virtio_net.c:1592
 __napi_poll+0xc4/0x5a0 net/core/dev.c:7042
 napi_poll net/core/dev.c:7109 [inline]
 net_rx_action+0x47d/0xc50 net/core/dev.c:7199
 __do_softirq+0x26d/0x5bf kernel/softirq.c:565
 do_softirq+0xf6/0x150 kernel/softirq.c:452
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x75/0x80 kernel/softirq.c:379
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
 _raw_spin_unlock_bh+0x51/0x60 kernel/locking/spinlock.c:210
 __sock_map_delete net/core/sock_map.c:426 [inline]
 sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
 bpf_prog_2c29ac5cdc6b1842+0x3a/0xd8
 bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
 bpf_trace_run3+0x11e/0x250 kernel/trace/bpf_trace.c:1918
 __bpf_trace_timer_start+0x2b/0x40 include/trace/events/timer.h:52
 __traceiter_timer_start+0x7f/0xd0 include/trace/events/timer.h:52
 trace_timer_start include/trace/events/timer.h:52 [inline]
 enqueue_timer+0x351/0x4c0 kernel/time/timer.c:592
 internal_add_timer kernel/time/timer.c:617 [inline]
 __mod_timer+0x8d3/0xcf0 kernel/time/timer.c:1068
 schedule_timeout+0x187/0x370 kernel/time/timer.c:1919
 rcu_gp_fqs_loop+0x2af/0xf80 kernel/rcu/tree.c:1972
 rcu_gp_kthread+0xa4/0x350 kernel/rcu/tree.c:2145
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299
 </TASK>
net_ratelimit: 8399 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
net_ratelimit: 9397 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/18 05:29 android13-5.15-lts da92e689a0c3 dbc93b08 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-15-perf BUG: soft lockup in br_handle_frame
2024/08/12 10:15 android13-5.15-lts 70e1a731d986 842184b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-15-perf BUG: soft lockup in br_handle_frame
* Struck through repros no longer work on HEAD.