syzbot


INFO: rcu detected stall in ip_list_rcv

Status: upstream: reported on 2024/07/20 04:22
Reported-by: syzbot+1005b28bcc8052edb8ae@syzkaller.appspotmail.com
First crash: 49d, last: 49d
Similar bugs (11)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: soft lockup in ip_list_rcv (2) kvm 8 865d 866d 0/27 auto-closed as invalid on 2022/06/25 08:42
linux-6.1 INFO: rcu detected stall in ip_list_rcv 1 10d 10d 0/3 upstream: reported on 2024/08/28 18:02
upstream INFO: rcu detected stall in ip_list_rcv (6) virt netfilter C done 34 24d 278d 0/27 upstream: reported C repro on 2023/12/04 09:45
upstream INFO: rcu detected stall in ip_list_rcv (5) lsm netfilter 3 422d 480d 0/27 auto-obsoleted due to no activity on 2023/10/11 22:12
upstream INFO: rcu detected stall in ip_list_rcv net C error done 3 1439d 1465d 15/27 fixed on 2020/11/16 12:12
upstream INFO: rcu detected stall in ip_list_rcv (4) netfilter 1 797d 797d 0/27 auto-closed as invalid on 2022/09/01 16:20
upstream INFO: rcu detected stall in ip_list_rcv (2) netfilter 3 1293d 1372d 0/27 auto-closed as invalid on 2021/05/23 12:59
upstream INFO: rcu detected stall in ip_list_rcv (3) net 1 985d 985d 0/27 closed as invalid on 2022/02/08 10:10
android-5-15 BUG: soft lockup in ip_list_rcv 19 12h36m 137d 0/2 premoderation: reported on 2024/04/23 12:02
android-6-1 BUG: soft lockup in ip_list_rcv 2 36d 58d 0/2 premoderation: reported on 2024/07/11 05:20
android-5-10 BUG: soft lockup in ip_list_rcv 1 32d 32d 0/2 premoderation: reported on 2024/08/06 20:21

Sample crash report:
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	1-....: (10499 ticks this GP) idle=3e3/1/0x4000000000000000 softirq=17533/17533 fqs=87 
	(t=10501 jiffies g=24737 q=1033)
NMI backtrace for cpu 1
CPU: 1 PID: 4270 Comm: syz.1.69 Not tainted 5.15.163-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x46a/0x4a0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x181/0x2a0 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:166 [inline]
 rcu_dump_cpu_stacks+0x223/0x390 kernel/rcu/tree_stall.h:349
 print_cpu_stall+0x320/0x600 kernel/rcu/tree_stall.h:633
 check_cpu_stall kernel/rcu/tree_stall.h:727 [inline]
 rcu_pending kernel/rcu/tree.c:3932 [inline]
 rcu_sched_clock_irq+0x8d9/0x1150 kernel/rcu/tree.c:2619
 update_process_times+0x196/0x200 kernel/time/timer.c:1818
 tick_sched_handle kernel/time/tick-sched.c:254 [inline]
 tick_sched_timer+0x386/0x550 kernel/time/tick-sched.c:1473
 __run_hrtimer kernel/time/hrtimer.c:1686 [inline]
 __hrtimer_run_queues+0x55b/0xcf0 kernel/time/hrtimer.c:1750
 hrtimer_interrupt+0x392/0x980 kernel/time/hrtimer.c:1812
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1085 [inline]
 __sysvec_apic_timer_interrupt+0x139/0x470 arch/x86/kernel/apic/apic.c:1102
 sysvec_apic_timer_interrupt+0x3e/0xb0 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__list_del_entry include/linux/list.h:132 [inline]
RIP: 0010:skb_list_del_init include/linux/skbuff.h:1604 [inline]
RIP: 0010:ip_sublist_rcv_finish net/ipv4/ip_input.c:576 [inline]
RIP: 0010:ip_list_rcv_finish net/ipv4/ip_input.c:628 [inline]
RIP: 0010:ip_sublist_rcv+0x98d/0xe50 net/ipv4/ip_input.c:636
Code: 4c 8b b4 24 a0 00 00 00 49 39 fe 0f 84 c5 01 00 00 4c 89 f3 48 c1 eb 03 42 80 3c 3b 00 74 08 4c 89 f7 e8 36 96 0f f9 4d 8b 26 <4c> 89 f7 e8 6b ef 52 fb 84 c0 4c 89 64 24 18 0f 84 98 00 00 00 e8
RSP: 0018:ffffc90000dd0200 EFLAGS: 00000246
RAX: ffffffff88ba9c01 RBX: 1ffff1100f7c2078 RCX: ffff888021b0d940
RDX: 0000000000000101 RSI: ffffffff8a8b3ca0 RDI: ffffffff8ad8f700
RBP: ffffc90000dd0370 R08: dffffc0000000000 R09: fffffbfff1bc8ede
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807be10280
R13: ffff88807be10558 R14: ffff88807be103c0 R15: dffffc0000000000
 ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:671
 __netif_receive_skb_list_ptype net/core/dev.c:5528 [inline]
 __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5576
 __netif_receive_skb_list net/core/dev.c:5628 [inline]
 netif_receive_skb_list_internal+0x9ed/0xdf0 net/core/dev.c:5719
 gro_normal_list net/core/dev.c:5873 [inline]
 gro_normal_one net/core/dev.c:5886 [inline]
 napi_skb_finish net/core/dev.c:6223 [inline]
 napi_gro_receive+0x4a2/0xa20 net/core/dev.c:6253
 receive_buf+0x4096/0x64c0 drivers/net/virtio_net.c:1208
 virtnet_receive drivers/net/virtio_net.c:1472 [inline]
 virtnet_poll+0x629/0x1270 drivers/net/virtio_net.c:1585
 __napi_poll+0xc7/0x440 net/core/dev.c:7035
 napi_poll net/core/dev.c:7102 [inline]
 net_rx_action+0x617/0xda0 net/core/dev.c:7192
 handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
 __do_softirq kernel/softirq.c:592 [inline]
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1096
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:static_key_false include/linux/jump_label.h:212 [inline]
RIP: 0010:trace_lock_acquire include/trace/events/lock.h:13 [inline]
RIP: 0010:lock_acquire+0xa0/0x4f0 kernel/locking/lockdep.c:5594
Code: f1 f1 00 f2 f2 f2 4b 89 04 2c 43 c7 44 2c 09 f2 f2 f2 00 43 c7 44 2c 11 f3 f3 f3 f3 66 43 c7 44 2c 15 f3 f3 43 c6 44 2c 17 f3 <0f> 1f 44 00 00 65 8b 1d 9c 68 9f 7e 83 fb 08 0f 83 e2 02 00 00 89
RSP: 0018:ffffc900031371e0 EFLAGS: 00000a06
RAX: f2f2f200f1f1f1f1 RBX: ffff88806114b780 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8c91fb20
RBP: ffffc90003137340 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92000626e44
R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff92000626e7c
 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:312
 rcu_read_lock include/linux/rcupdate.h:739 [inline]
 BPF_PROG_RUN_ARRAY include/linux/bpf.h:1333 [inline]
 trace_call_bpf+0x146/0x660 kernel/trace/bpf_trace.c:127
 perf_trace_run_bpf_submit+0x7b/0x1d0 kernel/events/core.c:9955
 perf_trace_lock+0x37f/0x440 include/trace/events/lock.h:39
 trace_lock_release include/trace/events/lock.h:58 [inline]
 lock_release+0x93c/0x9a0 kernel/locking/lockdep.c:5634
 rcu_read_unlock include/linux/rcupdate.h:772 [inline]
 inet_twsk_purge+0x934/0x9d0 net/ipv4/inet_timewait_sock.c:309
 ops_exit_list net/core/net_namespace.c:177 [inline]
 setup_net+0x81c/0x9e0 net/core/net_namespace.c:355
 copy_net_ns+0x392/0x5d0 net/core/net_namespace.c:476
 create_new_namespaces+0x425/0x7a0 kernel/nsproxy.c:110
 copy_namespaces+0x365/0x3b0 kernel/nsproxy.c:178
 copy_process+0x1841/0x3ef0 kernel/fork.c:2209
 kernel_clone+0x210/0x960 kernel/fork.c:2604
 __do_sys_clone kernel/fork.c:2721 [inline]
 __se_sys_clone kernel/fork.c:2705 [inline]
 __x64_sys_clone+0x23f/0x290 kernel/fork.c:2705
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f765f606b59
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f765e086ff8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f765f796f60 RCX: 00007f765f606b59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000640c7000
RBP: 00007f765f675e5d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 000000000000000b R14: 00007f765f796f60 R15: 00007ffcc715ab38
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/20 04:21 linux-5.15.y 7c6d66f0266f 890ce4f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: rcu detected stall in ip_list_rcv
* Struck through repros no longer work on HEAD.