syzbot


INFO: rcu detected stall in ip_route_output_key_hash

Status: fixed on 2018/07/09 18:05
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+769a7ccbbb4b5074f125@syzkaller.appspotmail.com
Fix commit: 1d88ba1ebb27 sctp: not allow transport timeout value less than HZ/5 for hb_timer
First crash: 2165d, last: 2162d
Discussions (1)
Title Replies (including bot) Last reply
INFO: rcu detected stall in ip_route_output_key_hash 1 (2) 2018/05/26 15:32

Sample crash report:
dccp_v6_rcv: dropped packet with invalid checksum
dccp_v6_rcv: dropped packet with invalid checksum
openvswitch: netlink: Flow set message rejected, Key attribute missing.
INFO: rcu_sched self-detected stall on CPU
	0-...!: (121636 ticks this GP) idle=b8a/0/3 softirq=348429/348429 fqs=13 
	 (t=125000 jiffies g=180528 c=180527 q=794647)
NMI backtrace for cpu 0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.17.0-rc4+ #52
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold.4+0x19/0xce lib/nmi_backtrace.c:103
 nmi_trigger_cpumask_backtrace+0x151/0x192 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_single_cpu_backtrace include/linux/nmi.h:156 [inline]
 rcu_dump_cpu_stacks+0x175/0x1c2 kernel/rcu/tree.c:1376
 print_cpu_stall kernel/rcu/tree.c:1525 [inline]
 check_cpu_stall.isra.61.cold.80+0x36c/0x59a kernel/rcu/tree.c:1593
 __rcu_pending kernel/rcu/tree.c:3356 [inline]
 rcu_pending kernel/rcu/tree.c:3401 [inline]
 rcu_check_callbacks+0x21b/0xad0 kernel/rcu/tree.c:2763
 update_process_times+0x2d/0x70 kernel/time/timer.c:1636
 tick_sched_handle+0x9f/0x180 kernel/time/tick-sched.c:164
 tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1274
 __run_hrtimer kernel/time/hrtimer.c:1398 [inline]
 __hrtimer_run_queues+0x3e3/0x10a0 kernel/time/hrtimer.c:1460
 hrtimer_interrupt+0x2f3/0x750 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
 smp_apic_timer_interrupt+0x15d/0x710 arch/x86/kernel/apic/apic.c:1050
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x50 kernel/kcov.c:146
RSP: 0018:ffff8801dae06010 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000104 RBX: dffffc0000000000 RCX: ffffffff865ec2d3
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffff8801dae063c0 R08: ffffffff88c75dc0 R09: ffffed003b5c46c2
R10: ffffed003b5c46c2 R11: ffff8801dae23613 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8801bcce46e0
 fib_lookup include/net/ip_fib.h:330 [inline]
 ip_route_output_key_hash_rcu+0x12dc/0x3380 net/ipv4/route.c:2409
 ip_route_output_key_hash+0x23a/0x390 net/ipv4/route.c:2302
 __ip_route_output_key include/net/route.h:124 [inline]
 ip_route_output_flow+0x28/0xc0 net/ipv4/route.c:2557
 ip_route_output_key include/net/route.h:134 [inline]
 sctp_v4_get_dst+0x50e/0x17a0 net/sctp/protocol.c:447
 sctp_transport_pmtu+0x25e/0x4b0 net/sctp/transport.c:241
 sctp_transport_route+0x165/0x360 net/sctp/transport.c:310
 sctp_packet_config+0x926/0xdd0 net/sctp/output.c:118
 sctp_outq_select_transport+0x2bb/0x9c0 net/sctp/outqueue.c:877
 sctp_outq_flush_ctrl.constprop.12+0x2ad/0xe60 net/sctp/outqueue.c:911
 sctp_outq_flush+0x2ef/0x3430 net/sctp/outqueue.c:1203
 sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:776
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
 sctp_do_sm+0x596/0x7160 net/sctp/sm_sideeffect.c:1191
 sctp_generate_heartbeat_event+0x218/0x450 net/sctp/sm_sideeffect.c:406
 call_timer_fn+0x230/0x940 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0x79e/0xc50 kernel/time/timer.c:1666
 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0x1d1/0x200 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:525 [inline]
 smp_apic_timer_interrupt+0x17e/0x710 arch/x86/kernel/apic/apic.c:1052
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
 </IRQ>
RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54
RSP: 0018:ffffffff88c07bc0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 1ffffffff1180f7b RCX: 0000000000000000
RDX: 1ffffffff11a3170 RSI: 0000000000000001 RDI: ffffffff88d18b80
RBP: ffffffff88c07bc0 R08: ffffed003b5c46c3 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff88c07c78 R14: ffffffff897c10e0 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
 default_idle+0xc2/0x440 arch/x86/kernel/process.c:354
 arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:345
 default_idle_call+0x6d/0x90 kernel/sched/idle.c:93
 cpuidle_idle_call kernel/sched/idle.c:153 [inline]
 do_idle+0x395/0x560 kernel/sched/idle.c:262
 cpu_startup_entry+0x104/0x120 kernel/sched/idle.c:368
 rest_init+0xe1/0xe4 init/main.c:441
 start_kernel+0x906/0x92d init/main.c:737
 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:445
 x86_64_start_kernel+0x76/0x79 arch/x86/kernel/head64.c:426
 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:242
BUG: workqueue lockup - pool cpus=0-1 flags=0x4 nice=0 stuck for 125s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x0
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=6/256
    pending: defense_work_handler, defense_work_handler, defense_work_handler, defense_work_handler, vmstat_shepherd, cache_reap
workqueue events_long: flags=0x0
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=4/256
    pending: br_fdb_cleanup, br_fdb_cleanup, br_fdb_cleanup, br_fdb_cleanup
workqueue events_power_efficient: flags=0x80
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256
    pending: gc_worker
workqueue mm_percpu_wq: flags=0x8
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256
    pending: vmstat_update
workqueue writeback: flags=0x4e
  pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256
    in-flight: 468:wb_workfn
workqueue ib_addr: flags=0xa0002
  pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/1
    pending: process_req
workqueue ipv6_addrconf: flags=0x40008
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/1
    pending: addrconf_verify_work
pool 4: cpus=0-1 flags=0x4 nice=0 hung=0s workers=5 idle: 32684 137 12051 22427

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/05/19 18:56 net-next-old eb38401c779d 849705db .config console log report ci-upstream-net-kasan-gce
2018/05/16 14:21 net-next-old 0b7d9978406f 75b2448a .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.