INFO: rcu detected stall in __tasklet_hrtimer_trampoline

Status: auto-closed as invalid on 2021/06/30 20:43
Reported-by: syzbot+8ad05af39a7c32ab44a3@syzkaller.appspotmail.com
First crash: 2074d, last: 2005d
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: soft lockup in __tasklet_hrtimer_trampoline 1 syz, C 257 1274d 2051d 0/1 upstream: reported C repro on 2021/01/16 10:07

Sample crash report:
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	(detected by 1, t=10502 jiffies, g=25401, q=386)
rcu: All QSes seen, last rcu_preempt kthread activity 10501 (4294968755-4294958254), jiffies_till_next_fqs=1, root ->qsmask 0x0
syz-executor.3  R  running task    28000 14003   8130 0x00000008
Call Trace:
 <IRQ>
 sched_show_task.cold+0x332/0x396 kernel/sched/core.c:5337
 print_other_cpu_stall kernel/rcu/tree.c:1430 [inline]
 check_cpu_stall kernel/rcu/tree.c:1557 [inline]
 __rcu_pending kernel/rcu/tree.c:3293 [inline]
 rcu_pending kernel/rcu/tree.c:3336 [inline]
 rcu_check_callbacks.cold+0xb37/0xe19 kernel/rcu/tree.c:2682
 update_process_times+0x2a/0x70 kernel/time/timer.c:1650
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:168
 tick_sched_timer+0xfc/0x290 kernel/time/tick-sched.c:1278
 __run_hrtimer kernel/time/hrtimer.c:1401 [inline]
 __hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1463
 hrtimer_interrupt+0x32a/0x930 kernel/time/hrtimer.c:1521
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline]
 smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:preempt_count_sub+0x63/0x150 kernel/sched/core.c:3274
Code: 75 18 65 8b 05 2e 6f c0 7e 25 ff ff ff 7f 39 c3 7f 1a 81 fb fe 00 00 00 76 6a 65 8b 05 16 6f c0 7e f7 db 65 01 1d 0d 6f c0 7e <5b> c3 e8 16 68 30 02 85 c0 74 f5 48 c7 c0 80 75 36 8d 48 ba 00 00
RSP: 0018:ffff8880ba1077b0 EFLAGS: 00000217 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000104 RBX: 00000000ffffffff RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffff8880ba107750 RDI: 0000000000000001
RBP: ffff8880ba107b90 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000074071 R11: 0000000000000001 R12: ffff8880ba100000
R13: ffff8880ba1078dd R14: ffff8880ba1078e0 R15: ffff8880ba1078a8
 unwind_next_frame+0x10a9/0x1c60 arch/x86/kernel/unwind_orc.c:579
 __save_stack_trace+0xd6/0x190 arch/x86/kernel/stacktrace.c:44
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553
 __do_kmalloc_node mm/slab.c:3689 [inline]
 __kmalloc_node_track_caller+0x4c/0x70 mm/slab.c:3703
 __kmalloc_reserve net/core/skbuff.c:137 [inline]
 __alloc_skb+0xae/0x560 net/core/skbuff.c:205
 skb_copy+0x139/0x2f0 net/core/skbuff.c:1358
 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb8a/0x1330 drivers/net/wireless/mac80211_hwsim.c:1353
 mac80211_hwsim_tx_frame+0x12b/0x210 drivers/net/wireless/mac80211_hwsim.c:1556
 mac80211_hwsim_beacon_tx+0x3f8/0x680 drivers/net/wireless/mac80211_hwsim.c:1595
 __iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614
 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650
 mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615
 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601
 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522
 __do_softirq+0x265/0x980 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x215/0x260 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:535 [inline]
 smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:800 [inline]
RIP: 0010:flush_tlb_mm_range+0x2ad/0x320 arch/x86/mm/tlb.c:724
Code: c0 18 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 4f 48 83 3d 74 ed c5 08 00 74 2d fb 66 0f 1f 44 00 00 <e9> 43 fe ff ff e8 63 a8 d4 ff e9 d8 fe ff ff 0f 0b 48 c7 c7 74 b9
RSP: 0018:ffff888096d973a0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e3043 RBX: ffff88805b5a6ac0 RCX: 1ffff110156c453f
RDX: dffffc0000000000 RSI: ffff8880ab6229d8 RDI: ffff8880ab622984
RBP: 0000000020077000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff11012db2e74
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000020076000
 flush_tlb_page arch/x86/include/asm/tlbflush.h:576 [inline]
 ptep_clear_flush+0x123/0x160 mm/pgtable-generic.c:87
 try_to_unmap_one+0x649/0x2900 mm/rmap.c:1506
 rmap_walk_anon+0x435/0xb90 mm/rmap.c:1833
 rmap_walk_locked+0x12a/0x190 mm/rmap.c:1914
 try_to_unmap+0x1ce/0x380 mm/rmap.c:1722
 unmap_page mm/huge_memory.c:2430 [inline]
 split_huge_page_to_list+0x6a2/0x2fa0 mm/huge_memory.c:2751
 split_huge_page include/linux/huge_mm.h:146 [inline]
 madvise_free_pte_range+0x955/0x2250 mm/madvise.c:375
 walk_pmd_range mm/pagewalk.c:51 [inline]
 walk_pud_range mm/pagewalk.c:109 [inline]
 walk_p4d_range mm/pagewalk.c:135 [inline]
 walk_pgd_range+0x8fe/0x1150 mm/pagewalk.c:161
 __walk_page_range mm/pagewalk.c:254 [inline]
 walk_page_range+0x1a5/0x490 mm/pagewalk.c:335
 madvise_free_page_range.isra.0+0xae/0xf0 mm/madvise.c:454
 madvise_free_single_vma+0x31c/0x4a0 mm/madvise.c:481
 madvise_dontneed_free mm/madvise.c:565 [inline]
 madvise_vma mm/madvise.c:698 [inline]
 __do_sys_madvise mm/madvise.c:873 [inline]
 __se_sys_madvise+0x75c/0x1c10 mm/madvise.c:801
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x465ef9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc75b828188 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000465ef9
RDX: 0000000000000008 RSI: 000000000060fe01 RDI: 0000000020000000
RBP: 00000000004bfa0c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008
R13: 00007ffcd7a806bf R14: 00007fc75b828300 R15: 0000000000022000
rcu: rcu_preempt kthread starved for 10570 jiffies! g25401 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: RCU grace-period kthread stack dump:
rcu_preempt     R  running task    29208    10      2 0x80000000
Call Trace:
 context_switch kernel/sched/core.c:2828 [inline]
 __schedule+0x887/0x2040 kernel/sched/core.c:3517
 schedule+0x8d/0x1b0 kernel/sched/core.c:3561
 schedule_timeout+0x4cf/0xfe0 kernel/time/timer.c:1818
 rcu_gp_kthread+0xdad/0x21c0 kernel/rcu/tree.c:2202
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/03/02 20:43 linux-4.19.y 2d19be4653f5 e5b64d68 .config console log report info ci2-linux-4-19 INFO: rcu detected stall in __tasklet_hrtimer_trampoline
2021/03/01 05:30 linux-4.19.y 2d19be4653f5 4c37c133 .config console log report info ci2-linux-4-19 INFO: rcu detected stall in __tasklet_hrtimer_trampoline
2021/01/18 05:10 linux-4.19.y c110fed0e606 fd103621 .config console log report info ci2-linux-4-19 INFO: rcu detected stall in __tasklet_hrtimer_trampoline
2020/12/28 03:45 linux-4.19.y 13d2ce42de8c 2242f77f .config console log report info ci2-linux-4-19
2020/12/23 19:18 linux-4.19.y 13d2ce42de8c c2c1d1dd .config console log report info ci2-linux-4-19
* Struck through repros no longer work on HEAD.