syzbot


BUG: soft lockup in cpu_stopper_thread (2)

Status: moderation: reported on 2025/12/14 05:22
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+8a24c20967f51cda0a1e@syzkaller.appspotmail.com
First crash: 4d15h, last: 2d17h
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: soft lockup in cpu_stopper_thread kernel 1 1 2672d 2672d 0/29 closed as invalid on 2018/09/05 12:51
upstream INFO: rcu detected stall in cpu_stopper_thread (2) kernel 1 7 494d 544d 0/29 auto-obsoleted due to no activity on 2024/11/05 09:18

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 430s! [migration/0:18]
Modules linked in:
CPU: 0 UID: 0 PID: 18 Comm: migration/0 Not tainted syzkaller #0 PREEMPT 
Hardware name: ARM-Versatile Express
Stopper: multi_cpu_stop+0x0/0x16c kernel/stop_machine.c:198 <- __stop_cpus.constprop.0+0x64/0xa4
PC is at multi_cpu_stop+0xd8/0x16c kernel/stop_machine.c:228
LR is at multi_cpu_stop+0xd8/0x16c kernel/stop_machine.c:227
pc : [<803737ac>]    lr : [<803737ac>]    psr: 60070013
sp : df861ed8  ip : df861ed8  fp : df861f0c
r10: 00000001  r9 : 00000000  r8 : 00000001
r7 : 8280c6d0  r6 : df979cc4  r5 : df979cd8  r4 : 00000001
r3 : 00000001  r2 : 00000000  r1 : 00000008  r0 : 8280c6d0
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 84d30900  DAC: fffffffd
Call trace: 
[<803736d4>] (multi_cpu_stop) from [<803731b4>] (cpu_stopper_thread+0x90/0x130 kernel/stop_machine.c:512)
 r10:df979c8c r9:83215400 r8:dddc7574 r7:dddc756c r6:803736d4 r5:dddc7568
 r4:df979cc4
[<80373124>] (cpu_stopper_thread) from [<80288200>] (smpboot_thread_fn+0x108/0x2f0 kernel/smpboot.c:160)
 r10:00000000 r9:00000000 r8:00000000 r7:00000001 r6:828fd6d0 r5:830c1000
 r4:83215400
[<802880f8>] (smpboot_thread_fn) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463)
 r9:830c1000 r8:802880f8 r7:df819de0 r6:830bf400 r5:83215400 r4:00000001
[<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137)
Exception stack(0xdf861fb0 to 0xdf861ff8)
1fa0:                                     00000000 00000000 00000000 00000000
1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0
 r4:830c1040
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT 
Hardware name: ARM-Versatile Express
PC is at arch_spin_lock arch/arm/include/asm/spinlock.h:73 [inline]
PC is at do_raw_spin_lock include/linux/spinlock.h:187 [inline]
PC is at __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
PC is at _raw_spin_lock+0x4c/0x58 kernel/locking/spinlock.c:154
LR is at __raw_spin_lock include/linux/spinlock_api_smp.h:132 [inline]
LR is at _raw_spin_lock+0x18/0x58 kernel/locking/spinlock.c:154
pc : [<81abc000>]    lr : [<81abbfcc>]    psr: 80000113
sp : df805d68  ip : df805d68  fp : df805d7c
r10: 81c05450  r9 : 840e3e40  r8 : 83e6d688
r7 : 840e3f68  r6 : 00000001  r5 : 00000001  r4 : 840e3f68
r3 : 00002639  r2 : 0000263a  r1 : 00000000  r0 : 00000001
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 84d30900  DAC: 00000000
Call trace: frame pointer underflow
[<81abbfb4>] (_raw_spin_lock) from [<809c7b2c>] (class_raw_spinlock_constructor include/linux/spinlock.h:535 [inline])
[<81abbfb4>] (_raw_spin_lock) from [<809c7b2c>] (gpio_mmio_set+0x44/0x80 drivers/gpio/gpio-mmio.c:234)
 r5:00000001 r4:840e3e40
[<809c7ae8>] (gpio_mmio_set) from [<809b82e8>] (gpiochip_set+0x1c/0x44 drivers/gpio/gpiolib.c:2919)
 r7:00000001 r6:00000000 r5:00000000 r4:840cd300
[<809b82cc>] (gpiochip_set) from [<809babb0>] (gpiod_set_raw_value_commit+0x78/0x218 drivers/gpio/gpiolib.c:3662)
[<809bab38>] (gpiod_set_raw_value_commit) from [<809bc450>] (gpiod_set_value_nocheck+0x44/0x58 drivers/gpio/gpiolib.c:3881)
 r10:81c05450 r9:df805ebc r8:00000102 r7:ffffa486 r6:00000007 r5:00000001
 r4:840cd300
[<809bc40c>] (gpiod_set_value_nocheck) from [<809bc4a0>] (gpiod_set_value+0x3c/0x88 drivers/gpio/gpiolib.c:3903)
[<809bc464>] (gpiod_set_value) from [<809ccc3c>] (gpio_led_set+0x5c/0x60 drivers/leds/leds-gpio.c:57)
 r5:84570044 r4:84570044
[<809ccbe0>] (gpio_led_set) from [<809ca4d4>] (__led_set_brightness drivers/leds/led-core.c:52 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca4d4>] (led_set_brightness_nopm drivers/leds/led-core.c:335 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca4d4>] (led_set_brightness_nosleep+0x38/0x44 drivers/leds/led-core.c:369)
 r5:84570044 r4:8329f58c
[<809ca49c>] (led_set_brightness_nosleep) from [<809cd538>] (led_heartbeat_function+0x84/0x144 drivers/leds/trigger/ledtrig-heartbeat.c:90)
[<809cd4b4>] (led_heartbeat_function) from [<80327070>] (call_timer_fn+0x30/0x220 kernel/time/timer.c:1748)
 r7:ffffa486 r6:809cd4b4 r5:8329f58c r4:83216000
[<80327040>] (call_timer_fn) from [<80327524>] (expire_timers kernel/time/timer.c:1799 [inline])
[<80327040>] (call_timer_fn) from [<80327524>] (__run_timers+0x2c4/0x3f8 kernel/time/timer.c:2373)
 r9:df805ebc r8:ffffa486 r7:00000000 r6:809cd4b4 r5:dddd9f00 r4:8329f58c
[<80327260>] (__run_timers) from [<803276c0>] (__run_timer_base kernel/time/timer.c:2385 [inline])
[<80327260>] (__run_timers) from [<803276c0>] (__run_timer_base kernel/time/timer.c:2377 [inline])
[<80327260>] (__run_timers) from [<803276c0>] (run_timer_base+0x68/0x78 kernel/time/timer.c:2394)
 r10:83216000 r9:82804d80 r8:00000102 r7:00000001 r6:00000282 r5:00000002
 r4:dddd9f00
[<80327658>] (run_timer_base) from [<803276ec>] (run_timer_softirq+0x1c/0x34 kernel/time/timer.c:2404)
 r4:82804084
[<803276d0>] (run_timer_softirq) from [<8025b65c>] (handle_softirqs+0x140/0x458 kernel/softirq.c:622)
[<8025b51c>] (handle_softirqs) from [<8025bad0>] (__do_softirq kernel/softirq.c:656 [inline])
[<8025b51c>] (handle_softirqs) from [<8025bad0>] (invoke_softirq kernel/softirq.c:496 [inline])
[<8025b51c>] (handle_softirqs) from [<8025bad0>] (__irq_exit_rcu+0x110/0x1d0 kernel/softirq.c:723)
 r10:00000000 r9:83216000 r8:00000000 r7:df865e08 r6:82443f98 r5:8247f0cc
 r4:83216000
[<8025b9c0>] (__irq_exit_rcu) from [<8025be48>] (irq_exit+0x10/0x18 kernel/softirq.c:751)
 r5:8247f0cc r4:826c3a9c
[<8025be38>] (irq_exit) from [<81aada64>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:295)
[<81aad9e8>] (generic_handle_arch_irq) from [<81a7da0c>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40)
 r9:83216000 r8:83e6d688 r7:df865e3c r6:ffffffff r5:60000013 r4:809c832c
[<81a7d9f0>] (call_with_stack) from [<80200bec>] (__irq_svc+0x8c/0xbc arch/arm/kernel/entry-armv.S:228)
Exception stack(0xdf865e08 to 0xdf865e50)
5e00:                   e04b6008 0000000c 00002639 00000000 e04b6008 0000000c
5e20: 00000001 840e3f68 83e6d688 840e3e40 00000000 df865e6c df865e58 df865e58
5e40: 809c8328 809c832c 60000013 ffffffff
[<809c830c>] (gpio_mmio_write32) from [<809c7b4c>] (gpio_mmio_set+0x64/0x80 drivers/gpio/gpio-mmio.c:241)
 r5:00000008 r4:840e3e40
[<809c7ae8>] (gpio_mmio_set) from [<809b82e8>] (gpiochip_set+0x1c/0x44 drivers/gpio/gpiolib.c:2919)
 r7:00000001 r6:00000000 r5:00000003 r4:840cd33c
[<809b82cc>] (gpiochip_set) from [<809babb0>] (gpiod_set_raw_value_commit+0x78/0x218 drivers/gpio/gpiolib.c:3662)
[<809bab38>] (gpiod_set_raw_value_commit) from [<809bc450>] (gpiod_set_value_nocheck+0x44/0x58 drivers/gpio/gpiolib.c:3881)
 r10:00000000 r9:00000000 r8:00000001 r7:ddde24c0 r6:8339ead8 r5:00000001
 r4:840cd33c
[<809bc40c>] (gpiod_set_value_nocheck) from [<809bc4a0>] (gpiod_set_value+0x3c/0x88 drivers/gpio/gpiolib.c:3903)
[<809bc464>] (gpiod_set_value) from [<809ccc3c>] (gpio_led_set+0x5c/0x60 drivers/leds/leds-gpio.c:57)
 r5:000000ff r4:84570314
[<809ccbe0>] (gpio_led_set) from [<809ca564>] (__led_set_brightness drivers/leds/led-core.c:52 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca564>] (led_set_brightness_nopm drivers/leds/led-core.c:335 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca564>] (led_set_brightness_nosleep drivers/leds/led-core.c:369 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca564>] (led_set_brightness+0x84/0x90 drivers/leds/led-core.c:328)
 r5:000000ff r4:84570314
[<809ca4e0>] (led_set_brightness) from [<809cc0e4>] (led_trigger_event drivers/leds/led-triggers.c:420 [inline])
[<809ca4e0>] (led_set_brightness) from [<809cc0e4>] (led_trigger_event+0x40/0x58 drivers/leds/led-triggers.c:408)
 r5:000000ff r4:84570314
[<809cc0a4>] (led_trigger_event) from [<809cd740>] (ledtrig_cpu+0xac/0xf4 drivers/leds/trigger/ledtrig-cpu.c:86)
 r7:ddde24c0 r6:00000002 r5:82b15cd8 r4:000001fd
[<809cd694>] (ledtrig_cpu) from [<80227a38>] (arch_cpu_idle_exit+0x14/0x18 arch/arm/kernel/process.c:98)
 r9:00000000 r8:00000001 r7:8280c710 r6:83216000 r5:8280c6d0 r4:00000001
[<80227a24>] (arch_cpu_idle_exit) from [<802b168c>] (do_idle+0x5c/0x2d8 kernel/sched/idle.c:334)
[<802b1630>] (do_idle) from [<802b1c38>] (cpu_startup_entry+0x30/0x34 kernel/sched/idle.c:430)
 r10:00000000 r9:414fc0f0 r8:80003000 r7:82a7b4a4 r6:83216000 r5:00000001
 r4:00000092
[<802b1c08>] (cpu_startup_entry) from [<8022f360>] (secondary_start_kernel+0x128/0x194 arch/arm/kernel/smp.c:478)
[<8022f238>] (secondary_start_kernel) from [<80220094>] (__enable_mmu+0x0/0xc arch/arm/kernel/head.S:446)
 r7:82a7b4a4 r6:30c0387d r5:00000000 r4:830b7bc0

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/12 02:46 upstream d358e5254674 a066d2bc .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: soft lockup in cpu_stopper_thread
2025/12/10 12:24 upstream c9b47175e913 48b27acc .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: soft lockup in cpu_stopper_thread
2025/12/10 05:20 upstream cb015814f8b6 fc20f974 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: soft lockup in cpu_stopper_thread
* Struck through repros no longer work on HEAD.