syzbot


INFO: rcu detected stall in inet_twsk_kill

Status: auto-closed as invalid on 2020/12/13 21:12
Reported-by: syzbot+0564175079db19fb04d6@syzkaller.appspotmail.com
First crash: 1660d, last: 1560d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: rcu detected stall in inet_twsk_kill 1 1614d 1614d 0/1 auto-closed as invalid on 2020/10/21 08:34
upstream INFO: rcu detected stall in inet_twsk_kill net 6 1587d 1718d 0/28 auto-closed as invalid on 2020/10/18 02:42
upstream INFO: rcu detected stall in inet_twsk_kill (2) net 6 1362d 1455d 0/28 auto-closed as invalid on 2021/05/30 18:52

Sample crash report:
device veth1_macvtap left promiscuous mode
device macsec0 entered promiscuous mode
bpf: check failed: parse error
bpf: check failed: parse error
bpf: check failed: parse error
INFO: rcu_preempt self-detected stall on CPU
	0-...: (1 GPs behind) idle=f2a/140000000000002/0 softirq=92964/92965 fqs=4957 
	 (t=10500 jiffies g=27067 c=27066 q=125015)
NMI backtrace for cpu 0
CPU: 0 PID: 1998 Comm: syz-executor.3 Not tainted 4.14.193-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x13a/0x17f lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:158 [inline]
 rcu_dump_cpu_stacks+0x15f/0x19c kernel/rcu/tree.c:1396
 print_cpu_stall kernel/rcu/tree.c:1542 [inline]
 check_cpu_stall kernel/rcu/tree.c:1610 [inline]
 __rcu_pending kernel/rcu/tree.c:3390 [inline]
 rcu_pending kernel/rcu/tree.c:3452 [inline]
 rcu_check_callbacks.cold+0x464/0xd99 kernel/rcu/tree.c:2792
 update_process_times+0x28/0xa0 kernel/time/timer.c:1591
 tick_sched_handle+0x7d/0x150 kernel/time/tick-sched.c:165
 tick_sched_timer+0x92/0x200 kernel/time/tick-sched.c:1223
 __run_hrtimer kernel/time/hrtimer.c:1223 [inline]
 __hrtimer_run_queues+0x30b/0xc80 kernel/time/hrtimer.c:1287
 hrtimer_interrupt+0x1e6/0x5e0 kernel/time/hrtimer.c:1321
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline]
 smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1100
 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:kmem_cache_free+0x173/0x2b0 mm/slab.c:3759
RSP: 0018:ffff8880aea07c88 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000007 RBX: ffff8880a8a2c400 RCX: 1ffff110113eb9a1
RDX: 0000000000000000 RSI: ffff888089f5cce8 RDI: 0000000000000286
RBP: ffff888219d1d7c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000286
R13: ffffffff855e0998 R14: ffff8880a8a2c400 R15: 000000000000ffff
 inet_bind_bucket_destroy net/ipv4/inet_hashtables.c:89 [inline]
 inet_bind_bucket_destroy+0xd8/0x110 net/ipv4/inet_hashtables.c:85
 inet_twsk_bind_unhash+0x115/0x180 net/ipv4/inet_timewait_sock.c:38
 inet_twsk_kill+0x2e9/0x3f0 net/ipv4/inet_timewait_sock.c:58
 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280
 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319
 __run_timers kernel/time/timer.c:1644 [inline]
 run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1657
 __do_softirq+0x254/0xa1d kernel/softirq.c:288
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x193/0x240 kernel/softirq.c:409
 exiting_irq arch/x86/include/asm/apic.h:648 [inline]
 smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1102
 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793
 </IRQ>
RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3611
RSP: 0018:ffff88820e86f5b0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10
RAX: 1ffffffff0fa2d23 RBX: dffffc0000000000 RCX: 1ffff110113eb997
RDX: 0000000000000000 RSI: ffff888089f5cc98 RDI: ffff888089f5cc44
RBP: ffffed10113eb878 R08: ffff88821fff7018 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888089f5c3c0
R13: ffffffff87d16918 R14: 0000000000000000 R15: 0000000000000000
 retint_kernel+0x1b/0x2d
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x50 kernel/kcov.c:60
RSP: 0018:ffff88820e86f688 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: ffff8880a4e5a700 RCX: 0000000000000000
RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff88820e86f790 R08: 0000000000000000 R09: 0000000000040056
R10: ffff888089f5cc98 R11: ffff888089f5c3c0 R12: ffff8880a4e5a8c0
R13: ffff8880aa58c500 R14: dffffc0000000000 R15: ffff8880a4e5a700
 __kernfs_remove+0x288/0x8d0 fs/kernfs/dir.c:1301
 kernfs_remove_by_name_ns+0x55/0x90 fs/kernfs/dir.c:1487
 device_remove_class_symlinks+0xbe/0x1c0 drivers/base/core.c:1708
 device_del+0x1ba/0xa80 drivers/base/core.c:2053
 hci_conn_del_sysfs+0xc6/0xf0 net/bluetooth/hci_sysfs.c:78
 hci_conn_cleanup+0x2a8/0x550 net/bluetooth/hci_conn.c:128
 hci_conn_del+0x235/0x620 net/bluetooth/hci_conn.c:611
 hci_conn_hash_flush+0x189/0x220 net/bluetooth/hci_conn.c:1377
 hci_dev_do_close+0x542/0xc50 net/bluetooth/hci_core.c:1620
 hci_unregister_dev+0x170/0x7a0 net/bluetooth/hci_core.c:3191
 vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:354
 __fput+0x25f/0x7a0 fs/file_table.c:210
 task_work_run+0x11f/0x190 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xa08/0x27f0 kernel/exit.c:865
 do_group_exit+0x100/0x2e0 kernel/exit.c:962
 get_signal+0x38d/0x1ca0 kernel/signal.c:2423
 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:814
 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
 do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x46007a
RSP: 002b:00007f1d78acfc58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e4
RAX: 0000000000000000 RBX: 00000000004c3fb4 RCX: 000000000046007a
RDX: 0000000000013b53 RSI: 00007f1d78acfc60 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000e
R13: 00007ffdf15bba8f R14: 000000000118cf40 R15: 000000000118cf4c

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/15 21:11 linux-4.14.y 14b58326976d 5ce13532 .config console log report ci2-linux-4-14
2020/05/07 17:52 linux-4.14.y d71f695ce745 98cbd87b .config console log report ci2-linux-4-14
* Struck through repros no longer work on HEAD.