syzbot


INFO: rcu detected stall in sys_exit_group (6)

Status: fixed on 2021/03/10 01:48
Reported-by: syzbot+f04854e1c5c9e913cc27@syzkaller.appspotmail.com
Fix commit: c583bcb8f5ed rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled
First crash: 795d, last: 735d
similar bugs (6):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in sys_exit_group (7) C unreliable inconclusive 12 22d 355d 0/24 upstream: reported C repro on 2021/10/15 18:41
upstream INFO: rcu detected stall in sys_exit_group (2) 56 1036d 1038d 0/24 closed as invalid on 2019/12/04 14:14
upstream INFO: rcu detected stall in sys_exit_group (3) 8 1002d 1002d 0/24 closed as invalid on 2020/01/08 05:23
upstream INFO: rcu detected stall in sys_exit_group (4) 13 1001d 1002d 0/24 closed as invalid on 2020/01/09 08:13
upstream INFO: rcu detected stall in sys_exit_group (5) 1 922d 922d 0/24 auto-closed as invalid on 2020/06/25 07:58
upstream INFO: rcu detected stall in sys_exit_group C done 1 1117d 1113d 14/24 fixed on 2019/10/09 10:54

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 25380 at kernel/sched/core.c:3013 rq_unlock kernel/sched/sched.h:1326 [inline]
WARNING: CPU: 0 PID: 25380 at kernel/sched/core.c:3013 try_invoke_on_locked_down_task+0x21d/0x2f0 kernel/sched/core.c:3019
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 25380 Comm: syz-executor815 Not tainted 5.9.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fd lib/dump_stack.c:118
 panic+0x382/0x7fb kernel/panic.c:231
 __warn.cold+0x20/0x4b kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:try_invoke_on_locked_down_task+0x21d/0x2f0 kernel/sched/core.c:3013
Code: 45 31 f6 49 39 c0 74 3a 8b 74 24 38 49 8d 78 18 4c 89 04 24 e8 a4 e7 08 00 4c 8b 04 24 4c 89 c7 e8 28 9b d6 06 e9 20 ff ff ff <0f> 0b e9 7d fe ff ff 4c 89 ee 48 89 ef 41 ff d4 41 89 c6 e9 08 ff
RSP: 0018:ffffc90000007be0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff92000000f7e RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8162da10 RDI: ffff8880934ec100
RBP: ffff8880934ec100 R08: 0000000000000033 R09: ffffffff8a05ae03
R10: 0000000000000631 R11: 0000000000000001 R12: ffffffff8162da10
R13: ffffc90000007d08 R14: ffff8880934ec100 R15: 0000000000000000
 rcu_print_task_stall kernel/rcu/tree_stall.h:267 [inline]
 print_other_cpu_stall kernel/rcu/tree_stall.h:475 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:634 [inline]
 rcu_pending kernel/rcu/tree.c:3639 [inline]
 rcu_sched_clock_irq.cold+0x97e/0xdfd kernel/rcu/tree.c:2521
 update_process_times+0x25/0xa0 kernel/time/timer.c:1710
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:176
 tick_sched_timer+0x1d1/0x2a0 kernel/time/tick-sched.c:1328
 __run_hrtimer kernel/time/hrtimer.c:1524 [inline]
 __hrtimer_run_queues+0x1d5/0xfc0 kernel/time/hrtimer.c:1588
 hrtimer_interrupt+0x334/0x940 kernel/time/hrtimer.c:1650
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1080 [inline]
 __sysvec_apic_timer_interrupt+0x147/0x5f0 arch/x86/kernel/apic/apic.c:1097
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_sysvec_on_irqstack arch/x86/include/asm/irq_stack.h:37 [inline]
 run_sysvec_on_irqstack_cond arch/x86/include/asm/irq_stack.h:89 [inline]
 sysvec_apic_timer_interrupt+0xb2/0xf0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581
RIP: 0010:compound_head include/linux/page-flags.h:184 [inline]
RIP: 0010:PageActive include/linux/page-flags.h:329 [inline]
RIP: 0010:mark_page_accessed+0x3f7/0x1070 mm/swap.c:434
Code: 85 43 0b 00 00 48 8b 1b 48 c7 c7 ff ff ff ff 48 89 de e8 1c 45 da ff 48 83 fb ff 0f 84 c9 06 00 00 e8 8d 48 da ff 4c 8b 75 08 <31> ff 48 89 eb 4d 89 f5 41 83 e5 01 4c 89 ee e8 f5 44 da ff 4d 85
RSP: 0018:ffffc9000a23f9a0 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 00fffe0000002036 RCX: ffffffff819bf5f4
RDX: ffff888094424200 RSI: ffffffff819bf603 RDI: 0000000000000007
RBP: ffffea000228a9c0 R08: 0000000000000000 R09: ffffea000228a9c7
R10: ffffffffffffffff R11: 0000000000000000 R12: ffffea000228a9c8
R13: 0000000000000000 R14: ffffea000228a988 R15: 0000000000000000
 zap_pte_range mm/memory.c:1279 [inline]
 zap_pmd_range mm/memory.c:1386 [inline]
 zap_pud_range mm/memory.c:1415 [inline]
 zap_p4d_range mm/memory.c:1436 [inline]
 unmap_page_range+0xdc6/0x2a30 mm/memory.c:1457
 unmap_single_vma+0x198/0x300 mm/memory.c:1502
 unmap_vmas+0x168/0x2e0 mm/memory.c:1534
 exit_mmap+0x2b1/0x530 mm/mmap.c:3183
 __mmput+0x122/0x470 kernel/fork.c:1077
 mmput+0x53/0x60 kernel/fork.c:1098
 exit_mm kernel/exit.c:483 [inline]
 do_exit+0xa8b/0x29f0 kernel/exit.c:793
 do_group_exit+0x125/0x310 kernel/exit.c:903
 __do_sys_exit_group kernel/exit.c:914 [inline]
 __se_sys_exit_group kernel/exit.c:912 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:912
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x443da8
Code: Bad RIP value.
RSP: 002b:00007ffc8511d758 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443da8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004c3850 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d5180 R14: 0000000000000000 R15: 0000000000000000
Shutting down cpus with NMI
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (4):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2020/09/30 20:03 upstream 02de58b24d2e 8516f6d3 .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/09/23 17:08 upstream 805c6d3c1921 287cd75a .config log report syz C
ci-upstream-kasan-gce 2020/08/24 11:00 upstream cb95712138ec cef5ae68 .config log report
ci-upstream-kasan-gce-root 2020/08/02 01:57 upstream d52daa8620c6 d895b3be .config log report
* Struck through repros no longer work on HEAD.