syzbot


BUG: soft lockup in ip6_dst_lookup_flow

Status: closed as invalid on 2018/05/19 09:33
Subsystems: net
[Documentation on labels]
First crash: 2446d, last: 2446d

Sample crash report:
IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device team0
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ksoftirqd/0:8]
Modules linked in:
irq event stamp: 8153715
hardirqs last  enabled at (8153714): [<ffffffff81473681>] __local_bh_enable_ip+0x161/0x230 kernel/softirq.c:187
hardirqs last disabled at (8153715): [<ffffffff87800905>] interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625
softirqs last  enabled at (149572): [<ffffffff87a00778>] __do_softirq+0x778/0xaf5 kernel/softirq.c:311
softirqs last disabled at (149577): [<ffffffff81474f06>] run_ksoftirqd+0x86/0x100 kernel/softirq.c:646
CPU: 0 PID: 8 Comm: ksoftirqd/0 Not tainted 4.17.0-rc4+ #50
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ip6_dst_lookup_tail+0xb71/0x1da0 net/ipv6/ip6_output.c:994
RSP: 0018:ffff8801d9aae288 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 0000000000000040 RCX: ffffffff867a67b7
RDX: 0000000000000005 RSI: ffffffff867a67cc RDI: ffff8801c3675c15
RBP: ffff8801d9aae4c8 R08: ffff8801d9a9c200 R09: ffffed003b5c46c2
R10: ffffed003b5c46c2 R11: ffff8801dae23613 R12: dffffc0000000000
R13: ffff8801b6ca5b98 R14: ffff8801b6ca5b70 R15: ffffed003b355c7b
FS:  0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffffceea5dc CR3: 00000001ad365000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ip6_dst_lookup_flow+0xc1/0x260 net/ipv6/ip6_output.c:1076
 sctp_v6_get_dst+0x735/0x2120 net/sctp/ipv6.c:274
 sctp_transport_route+0x132/0x360 net/sctp/transport.c:303
 sctp_packet_config+0x926/0xdd0 net/sctp/output.c:118
 sctp_outq_select_transport+0x2bb/0x9c0 net/sctp/outqueue.c:877
 sctp_outq_flush_ctrl.constprop.12+0x2ad/0xe60 net/sctp/outqueue.c:911
 sctp_outq_flush+0x2ef/0x3430 net/sctp/outqueue.c:1203
 sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:776
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
 sctp_do_sm+0x596/0x7160 net/sctp/sm_sideeffect.c:1191
 sctp_generate_heartbeat_event+0x218/0x450 net/sctp/sm_sideeffect.c:406
 call_timer_fn+0x230/0x940 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0x79e/0xc50 kernel/time/timer.c:1666
 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
 run_ksoftirqd+0x86/0x100 kernel/softirq.c:646
 smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
 kthread+0x345/0x410 kernel/kthread.c:238
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Code: 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 56 0d 00 00 0f b6 9b 15 01 00 00 <31> ff 83 e3 de 89 de e8 53 c6 fe fa 84 db 0f 84 dd 08 00 00 e8 
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 17 Comm: ksoftirqd/1 Not tainted 4.17.0-rc4+ #50
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:update_stack_state+0x408/0x670 arch/x86/kernel/unwind_frame.c:280
RSP: 0000:ffff8801d9b3db58 EFLAGS: 00000282
RAX: 0000000000000001 RBX: ffff8801d9b3dc88 RCX: 1ffff1003b367b00
RDX: dffffc0000000000 RSI: ffff8801d9b3fc60 RDI: ffff8801d9b3dcd0
RBP: ffff8801d9b3db60 R08: ffff8801d9b3dcc0 R09: ffff8801d9b32480
R10: ffffed003b367b9b R11: ffff8801d9b3dcdf R12: 1ffff1003b367b73
R13: ffff8801d9b3fc50 R14: 1ffff1003b367b77 R15: ffff8801d9b3dcc8
FS:  0000000000000000(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000400040 CR3: 00000001ad302000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 unwind_next_frame.part.7+0x1a9/0x9c0 arch/x86/kernel/unwind_frame.c:329
 unwind_next_frame+0x3e/0x50 arch/x86/kernel/unwind_frame.c:287
 __save_stack_trace+0x6e/0xd0 arch/x86/kernel/stacktrace.c:44
 save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
 kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
 kmalloc include/linux/slab.h:512 [inline]
 kzalloc include/linux/slab.h:701 [inline]
 sctp_transport_new+0x102/0x860 net/sctp/transport.c:111
 sctp_ootb_pkt_new+0x186/0x390 net/sctp/sm_statefuns.c:6247
 sctp_sf_tabort_8_4_8.isra.35+0x34/0x430 net/sctp/sm_statefuns.c:3374
 sctp_sf_ootb+0x6c1/0x790 net/sctp/sm_statefuns.c:3602
 sctp_do_sm+0x1ab/0x7160 net/sctp/sm_sideeffect.c:1188
 sctp_endpoint_bh_rcv+0x45d/0x950 net/sctp/endpointola.c:456
 sctp_inq_push+0x263/0x320 net/sctp/inqueue.c:95
 sctp_rcv+0x2cf6/0x3a60 net/sctp/input.c:267
 ip_local_deliver_finish+0x2e3/0xd80 net/ipv4/ip_input.c:215
 NF_HOOK include/linux/netfilter.h:288 [inline]
 ip_local_deliver+0x1e1/0x720 net/ipv4/ip_input.c:256
 dst_input include/net/dst.h:450 [inline]
 ip_rcv_finish+0x81b/0x2200 net/ipv4/ip_input.c:396
 NF_HOOK include/linux/netfilter.h:288 [inline]
 ip_rcv+0x9fe/0x125c net/ipv4/ip_input.c:492
 __netif_receive_skb_core+0x2468/0x3650 net/core/dev.c:4646
 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:4711
 process_backlog+0x219/0x760 net/core/dev.c:5391
 napi_poll net/core/dev.c:5789 [inline]
 net_rx_action+0x7b7/0x1930 net/core/dev.c:5855
 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
 run_ksoftirqd+0x86/0x100 kernel/softirq.c:646
 smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
 kthread+0x345/0x410 kernel/kthread.c:238
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Code: 49 01 d4 49 c7 04 24 00 00 00 00 49 c7 44 24 08 00 00 00 00 41 c7 44 24 10 00 00 00 00 48 81 c4 e0 00 00 00 5b 41 5c 41 5d 41 5e <41> 5f 5d c3 48 8b 9d 30 ff ff ff 41 bf 10 00 00 00 48 c7 85 28 
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.002 msecs

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/05/19 05:43 net-next-old 1f7455c3912d 849705db .config console log report syz C ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.