syzbot


INFO: rcu detected stall in cleanup_mnt (2)

Status: closed as invalid on 2022/02/08 10:10
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 346d, last: 346d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in cleanup_mnt 1 877d 877d 0/24 auto-closed as invalid on 2020/09/06 14:28

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
	(detected by 1, t=10502 jiffies, g=28133, q=133)
rcu: All QSes seen, last rcu_preempt kthread activity 10502 (4294979233-4294968731), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 10502 jiffies! g28133 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28568 pid:   14 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881
 rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1955
 rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2128
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 3629 Comm: syz-executor.2 Not tainted 5.16.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:match_held_lock+0x1/0xc0 kernel/locking/lockdep.c:5085
Code: ee 48 c7 c7 60 0e ac 89 e8 9e 24 bd ff 48 c7 c7 c0 0e ac 89 e8 92 24 bd ff e8 f3 e7 cc ff 31 c0 5d c3 0f 1f 80 00 00 00 00 53 <48> 89 fb 48 83 ec 08 48 39 77 10 74 6a 66 f7 47 22 f0 ff 74 5a 48
RSP: 0018:ffffc90000007d00 EFLAGS: 00000093
RAX: 0000000000000005 RBX: 0000000000000001 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8bb83d60 RDI: ffff888076626188
RBP: ffffffff8bb83d60 R08: 0000000000000000 R09: ffffffff8d9154d7
R10: fffffbfff1b22a9a R11: 0000000000000000 R12: ffff888076625700
R13: ffff888076626160 R14: 00000000ffffffff R15: ffff888076626188
FS:  000055555600b400(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2cd22000 CR3: 000000004004d000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __lock_is_held kernel/locking/lockdep.c:5380 [inline]
 lock_is_held_type+0xa7/0x140 kernel/locking/lockdep.c:5680
 lock_is_held include/linux/lockdep.h:283 [inline]
 rcu_read_lock_sched_held+0x3a/0x70 kernel/rcu/update.c:125
 trace_lock_release include/trace/events/lock.h:58 [inline]
 lock_release+0x522/0x720 kernel/locking/lockdep.c:5648
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:149 [inline]
 _raw_spin_unlock_irqrestore+0x16/0x70 kernel/locking/spinlock.c:194
 __run_hrtimer kernel/time/hrtimer.c:1681 [inline]
 __hrtimer_run_queues+0x51a/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:spin_lock_irq include/linux/spinlock.h:374 [inline]
RIP: 0010:delete_from_page_cache_batch+0x126/0xf00 mm/filemap.c:347
Code: df 48 c1 ea 03 80 3c 02 00 0f 85 da 0d 00 00 49 8b 07 48 8d b8 88 00 00 00 e8 e6 40 aa 07 49 8d 47 08 48 89 c7 48 89 44 24 30 <e8> d5 41 aa 07 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03
RSP: 0018:ffffc900028c79f8 EFLAGS: 00000282
RAX: ffff8880110aa048 RBX: 000000000000000f RCX: ffffffff815d26c0
RDX: 1ffff110022153d6 RSI: 0000000000000004 RDI: ffff8880110aa048
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000003
R10: fffff52000518f31 R11: 0000000000000000 R12: ffffc900028c7c18
R13: dffffc0000000000 R14: 000000000000001d R15: ffff8880110aa040
 truncate_inode_pages_range+0x296/0x1020 mm/truncate.c:336
 kill_bdev block/bdev.c:78 [inline]
 blkdev_flush_mapping+0x18f/0x3c0 block/bdev.c:661
 blkdev_put_whole block/bdev.c:692 [inline]
 blkdev_put+0x727/0x980 block/bdev.c:957
 deactivate_locked_super+0x94/0x160 fs/super.c:335
 deactivate_super+0xad/0xd0 fs/super.c:366
 cleanup_mnt+0x3a2/0x540 fs/namespace.c:1137
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f8b1077d307
Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcbd9cabd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8b1077d307
RDX: 00007ffcbd9cacab RSI: 000000000000000a RDI: 00007ffcbd9caca0
RBP: 00007ffcbd9caca0 R08: 00000000ffffffff R09: 00007ffcbd9caa70
R10: 000055555600c8b3 R11: 0000000000000246 R12: 00007f8b107d5172
R13: 00007ffcbd9cbd60 R14: 000055555600c810 R15: 00007ffcbd9cbda0
 </TASK>
----------------
Code disassembly (best guess):
   0:	ee                   	out    %al,(%dx)
   1:	48 c7 c7 60 0e ac 89 	mov    $0xffffffff89ac0e60,%rdi
   8:	e8 9e 24 bd ff       	callq  0xffbd24ab
   d:	48 c7 c7 c0 0e ac 89 	mov    $0xffffffff89ac0ec0,%rdi
  14:	e8 92 24 bd ff       	callq  0xffbd24ab
  19:	e8 f3 e7 cc ff       	callq  0xffcce811
  1e:	31 c0                	xor    %eax,%eax
  20:	5d                   	pop    %rbp
  21:	c3                   	retq
  22:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  29:	53                   	push   %rbx
* 2a:	48 89 fb             	mov    %rdi,%rbx <-- trapping instruction
  2d:	48 83 ec 08          	sub    $0x8,%rsp
  31:	48 39 77 10          	cmp    %rsi,0x10(%rdi)
  35:	74 6a                	je     0xa1
  37:	66 f7 47 22 f0 ff    	testw  $0xfff0,0x22(%rdi)
  3d:	74 5a                	je     0x99
  3f:	48                   	rex.W

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2021/12/22 02:32 upstream 2f47a9a4dfa3 6caa12e4 .config log report info INFO: rcu detected stall in cleanup_mnt
* Struck through repros no longer work on HEAD.