syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: rcu detected stall in mld_ifc_timer_expire

Status: fixed on 2019/12/07 19:18
Reported-by: syzbot+6116c11e11fcb233ca40@syzkaller.appspotmail.com
Fix commit: a9e91767b921 sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
First crash: 1686d, last: 1673d
Fix bisection: fixed by (bisect log) :
commit a9e91767b921ee196ab693fa13a81b278f53ddac
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date: Sun Sep 8 20:40:51 2019 +0000

  sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero

  
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in mld_ifc_timer_expire C done 152 1677d 1684d 13/26 fixed on 2019/10/09 10:54
upstream INFO: rcu detected stall in mld_ifc_timer_expire (3) net 1 1412d 1412d 0/26 auto-closed as invalid on 2020/09/04 20:48
linux-4.14 INFO: rcu detected stall in mld_ifc_timer_expire C done 9 1676d 1685d 1/1 fixed on 2019/12/06 15:57
upstream INFO: rcu detected stall in mld_ifc_timer_expire (2) bridge 1 1597d 1597d 0/26 closed as invalid on 2019/12/04 14:04

Sample crash report:
IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	0-....: (10500 ticks this GP) idle=b86/0/0x3 softirq=11738/11738 fqs=5250 
rcu: 	 (t=10502 jiffies g=5957 q=179)
NMI backtrace for cpu 0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.73 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x189/0x1d5 kernel/rcu/tree.c:1340
 print_cpu_stall kernel/rcu/tree.c:1478 [inline]
 check_cpu_stall kernel/rcu/tree.c:1550 [inline]
 __rcu_pending kernel/rcu/tree.c:3293 [inline]
 rcu_pending kernel/rcu/tree.c:3336 [inline]
 rcu_check_callbacks.cold+0x5e3/0xd90 kernel/rcu/tree.c:2682
 update_process_times+0x32/0x80 kernel/time/timer.c:1636
 tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:164
 tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1274
 __run_hrtimer kernel/time/hrtimer.c:1398 [inline]
 __hrtimer_run_queues+0x33b/0xdc0 kernel/time/hrtimer.c:1460
 hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline]
 smp_apic_timer_interrupt+0x111/0x550 arch/x86/kernel/apic/apic.c:1092
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
RIP: 0010:__list_del_entry_valid+0x85/0xf5 lib/list_debug.c:51
Code: 0f 84 e1 00 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f 84 e2 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 53 49 8b 14 24 4c 39 f2 0f 85 99 00 00 00 49 8d 7d
RSP: 0018:ffff8880ae807560 EFLAGS: 00000a02 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffff88807f100bf8 RCX: ffffffff858eb8e9
RDX: 1ffff1100fe20192 RSI: ffffffff858ebd9b RDI: ffff88807f100c00
RBP: ffff8880ae807578 R08: ffffffff88679ec0 R09: 0000000000000005
R10: ffffffff8867a808 R11: 00000000c37233a3 R12: ffff88807f100c90
R13: ffff88807f100c90 R14: ffff88807f100bf8 R15: 0000000000000000
 __list_del_entry include/linux/list.h:117 [inline]
 list_move_tail include/linux/list.h:182 [inline]
 hhf_dequeue+0x5aa/0xa00 net/sched/sch_hhf.c:438
 dequeue_skb net/sched/sch_generic.c:277 [inline]
 qdisc_restart net/sched/sch_generic.c:380 [inline]
 __qdisc_run+0x1e7/0x1960 net/sched/sch_generic.c:398
 __dev_xmit_skb net/core/dev.c:3501 [inline]
 __dev_queue_xmit+0x165c/0x2fe0 net/core/dev.c:3811
 dev_queue_xmit+0x18/0x20 net/core/dev.c:3876
 neigh_resolve_output net/core/neighbour.c:1369 [inline]
 neigh_resolve_output+0x5b7/0x980 net/core/neighbour.c:1349
 neigh_output include/net/neighbour.h:501 [inline]
 ip6_finish_output2+0xb7f/0x2550 net/ipv6/ip6_output.c:120
 ip6_finish_output+0x574/0xbe0 net/ipv6/ip6_output.c:154
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip6_output+0x235/0x7c0 net/ipv6/ip6_output.c:171
 dst_output include/net/dst.h:447 [inline]
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 mld_sendpack+0x9d3/0xeb0 net/ipv6/mcast.c:1684
 mld_send_cr net/ipv6/mcast.c:1980 [inline]
 mld_ifc_timer_expire+0x449/0x8a0 net/ipv6/mcast.c:2479
 call_timer_fn+0x18d/0x720 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers kernel/time/timer.c:1682 [inline]
 __run_timers kernel/time/timer.c:1650 [inline]
 run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1695
 __do_softirq+0x25c/0x921 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x180/0x1d0 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
 </IRQ>
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
Code: ff ff 48 89 df e8 72 de ad fa eb 82 e9 07 00 00 00 0f 00 2d 84 c3 53 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 74 c3 53 00 fb f4 <c3> 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 e8 6e c1 65 fa e8 39
RSP: 0018:ffffffff88607ca8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e48c4 RBX: ffffffff88679ec0 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffffffff8867a73c
RBP: ffffffff88607cd8 R08: ffffffff88679ec0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff88724610 R14: 0000000000000000 R15: 0000000000000000
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:556
 default_idle_call+0x36/0x90 kernel/sched/idle.c:93
 cpuidle_idle_call kernel/sched/idle.c:153 [inline]
 do_idle+0x377/0x560 kernel/sched/idle.c:262
 cpu_startup_entry+0xc8/0xe0 kernel/sched/idle.c:368
 rest_init+0x219/0x222 init/main.c:442
 start_kernel+0x88c/0x8c5 init/main.c:738
 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:472
 x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:453
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243

Crashes (33):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/19 06:55 linux-4.19.y db2d0b7c1dde 46c0be24 .config console log report syz C ci2-linux-4-19
2019/09/19 05:24 linux-4.19.y db2d0b7c1dde 46c0be24 .config console log report syz C ci2-linux-4-19
2019/09/18 04:10 linux-4.19.y db2d0b7c1dde 03e0d245 .config console log report syz C ci2-linux-4-19
2019/09/17 19:19 linux-4.19.y db2d0b7c1dde 13dcda9b .config console log report syz C ci2-linux-4-19
2019/09/17 16:37 linux-4.19.y db2d0b7c1dde 13dcda9b .config console log report syz C ci2-linux-4-19
2019/09/17 10:12 linux-4.19.y db2d0b7c1dde 51ca0454 .config console log report syz C ci2-linux-4-19
2019/09/17 08:43 linux-4.19.y db2d0b7c1dde 51ca0454 .config console log report syz C ci2-linux-4-19
2019/09/16 17:56 linux-4.19.y db2d0b7c1dde 55c50e70 .config console log report syz C ci2-linux-4-19
2019/09/16 14:44 linux-4.19.y db2d0b7c1dde 55c50e70 .config console log report syz C ci2-linux-4-19
2019/09/16 03:11 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/15 15:29 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/15 07:04 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/15 03:03 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/14 20:01 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/14 09:16 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/13 21:03 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/13 07:11 linux-4.19.y ee809c7e0895 40fa42bc .config console log report syz C ci2-linux-4-19
2019/09/12 05:13 linux-4.19.y ee809c7e0895 f4e53c10 .config console log report syz C ci2-linux-4-19
2019/09/11 18:41 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/11 15:00 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/11 08:15 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/10 19:16 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/09 23:40 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/08 18:59 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/08 08:38 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/08 02:04 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/07 23:47 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/07 19:52 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/07 09:27 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/07 01:59 linux-4.19.y 0fed55c248d9 acb5b744 .config console log report syz C ci2-linux-4-19
2019/09/13 15:15 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/13 01:34 linux-4.19.y ee809c7e0895 40fa42bc .config console log report ci2-linux-4-19
2019/09/09 08:55 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.