syzbot

 sign-in | mailing list | source | docs
🐞 Open [1006] ≡ Subsystems 🐞 Fixed [5248] 🐞 Invalid [12552] ⬇ Missing Backports [84] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: rcu detected stall in inet_release (3)

Status: auto-obsoleted due to no activity on 2023/04/07 20:53
Subsystems: net
[Documentation on labels]
First crash: 504d, last: 504d
▶ ▼ Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in inet_release (2) mm kasan 1 816d 816d 0/26 closed as invalid on 2022/02/08 10:10
upstream INFO: rcu detected stall in inet_release (4) net 1 162d 162d 0/26 closed as invalid on 2024/02/01 10:31
upstream INFO: rcu detected stall in inet_release net 1 1699d 1698d 13/26 fixed on 2019/10/09 10:54
linux-4.19 BUG: soft lockup in inet_release 1 765d 765d 0/1 auto-closed as invalid on 2022/07/27 00:21
linux-4.19 BUG: soft lockup in inet_release (2) 1 509d 509d 0/1 auto-obsoleted due to no activity on 2023/04/08 16:55

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (0 ticks this GP) idle=1cf4/1/0x4000000000000000 softirq=63300/63300 fqs=0
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P62/1:b..l
	(detected by 0, t=10502 jiffies, g=88629, q=192 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5328 Comm: syz-executor.1 Not tainted 6.1.0-syzkaller-09941-ge2ca6ba6ba01 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:__raw_callee_save___pv_queued_spin_unlock+0x10/0x16
Code: 41 51 41 52 41 53 e8 eb 14 00 00 41 5b 41 5a 41 59 41 58 5f 5e 5a 59 c3 66 90 f3 0f 1e fa 52 b8 01 00 00 00 31 d2 f0 0f b0 17 <3c> 01 75 02 5a c3 56 0f b6 f0 e8 bd ff ff ff 5e 5a c3 66 2e 0f 1f
RSP: 0018:ffffc900003e8de0 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 0000000000000046 RCX: ffffffff8162d3b4
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880b992b7c0
RBP: ffff8880b992b7c0 R08: 0000000000000000 R09: ffff8880b992b7c3
R10: ffffed10173256f8 R11: 0000000000000000 R12: ffff8880b992b7c8
R13: ffff8880b992b7d0 R14: ffff8880b992b7c0 R15: ffff888079a94340
FS:  0000555555fc6400(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4c701a7cb0 CR3: 0000000032fd3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 pv_queued_spin_unlock arch/x86/include/asm/paravirt.h:596 [inline]
 queued_spin_unlock arch/x86/include/asm/qspinlock.h:57 [inline]
 do_raw_spin_unlock+0x175/0x230 kernel/locking/spinlock_debug.c:141
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:150 [inline]
 _raw_spin_unlock_irqrestore+0x22/0x70 kernel/locking/spinlock.c:194
 __run_hrtimer kernel/time/hrtimer.c:1681 [inline]
 __hrtimer_run_queues+0x578/0xfb0 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x320/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1096 [inline]
 __sysvec_apic_timer_interrupt+0x180/0x640 arch/x86/kernel/apic/apic.c:1113
 sysvec_apic_timer_interrupt+0x92/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__kmem_cache_free+0xfd/0x3b0 mm/slab.c:3588
Code: f2 4c 89 ee 4c 89 e7 e8 81 e7 ff ff 48 85 db 0f 85 95 00 00 00 9c 58 f6 c4 02 0f 85 b9 00 00 00 48 85 db 74 01 fb 48 83 c4 20 <5b> 5d 41 5c 41 5d 41 5e 41 5f c3 f7 c5 ff 0f 00 00 0f 85 60 ff ff
RSP: 0018:ffffc90003667b80 EFLAGS: 00000282
RAX: 0000000000000002 RBX: 0000000000000200 RCX: 1ffffffff226d9c6
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffea0000ae61c0 R08: 0000000000000001 R09: ffffffff9132eae7
R10: 0000000000000001 R11: 0000000000092081 R12: ffff888012440100
R13: ffff88802b987200 R14: ffffffff842baa9f R15: ffff88802b987208
 ref_tracker_free+0x36f/0x6b0 lib/ref_tracker.c:153
 __netns_tracker_free include/net/net_namespace.h:348 [inline]
 put_net_track include/net/net_namespace.h:363 [inline]
 __sk_destruct+0x3cb/0x750 net/core/sock.c:2162
 sk_destruct net/core/sock.c:2181 [inline]
 __sk_free+0x175/0x460 net/core/sock.c:2192
 sk_free+0x7c/0xa0 net/core/sock.c:2203
 sock_put include/net/sock.h:1987 [inline]
 tcp_close+0x9c/0xc0 net/ipv4/tcp.c:3034
 inet_release+0x132/0x270 net/ipv4/af_inet.c:428
 __sock_release+0xcd/0x280 net/socket.c:650
 sock_close+0x1c/0x20 net/socket.c:1365
 __fput+0x27c/0xa90 fs/file_table.c:320
 task_work_run+0x16f/0x270 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:203
 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
 syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296
 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f71d983df8b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffd6d724080 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 00007ffd6d724120 RCX: 00007f71d983df8b
RDX: 0000000000000000 RSI: 0000008b93d9c178 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: ffff000000000000
R10: 0000000000000010 R11: 0000000000000293 R12: 0000000000000032
R13: 00000000000e2ec7 R14: 0000000000000002 R15: 00007ffd6d724160
 </TASK>
task:kworker/u4:4    state:R  running task     stack:22336 pid:62    ppid:2      flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0xb8a/0x5450 kernel/sched/core.c:6556
 preempt_schedule_notrace+0x5f/0xe0 kernel/sched/core.c:6818
 preempt_schedule_notrace_thunk+0x1a/0x1c arch/x86/entry/thunk_64.S:35
 rcu_read_unlock_sched_notrace include/linux/rcupdate.h:886 [inline]
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0x516/0x630 kernel/locking/lockdep.c:5639
 rcu_lock_acquire include/linux/rcupdate.h:325 [inline]
 rcu_read_lock include/linux/rcupdate.h:764 [inline]
 inet_twsk_purge+0x132/0x8a0 net/ipv4/inet_timewait_sock.c:268
 ops_exit_list+0x125/0x170 net/core/net_namespace.c:174
 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:606
 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
 worker_thread+0x669/0x1090 kernel/workqueue.c:2436
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g88629 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=1 timer-softirq=46360
rcu: rcu_preempt kthread starved for 10502 jiffies! g88629 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:28824 pid:15    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0xb8a/0x5450 kernel/sched/core.c:6556
 schedule+0xde/0x1b0 kernel/sched/core.c:6632
 schedule_timeout+0x14e/0x2a0 kernel/time/timer.c:2167
 rcu_gp_fqs_loop+0x190/0x910 kernel/rcu/tree.c:1654
 rcu_gp_kthread+0x23a/0x360 kernel/rcu/tree.c:1853
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5328 Comm: syz-executor.1 Not tainted 6.1.0-syzkaller-09941-ge2ca6ba6ba01 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:rcu_lockdep_current_cpu_online kernel/rcu/tree.c:760 [inline]
RIP: 0010:rcu_lockdep_current_cpu_online+0x2c/0x140 kernel/rcu/tree.c:752
Code: 1e fa 65 8b 15 f5 d6 98 7e 81 e2 00 00 f0 00 b8 01 00 00 00 75 0a 8b 15 82 9b 09 0d 85 d2 75 01 c3 55 53 65 ff 05 d4 d6 98 7e <e8> af dc 8d 08 48 c7 c3 80 c4 03 00 83 f8 07 89 c5 0f 87 e9 00 00
RSP: 0018:ffffc900003e8c08 EFLAGS: 00000082
RAX: 0000000000000001 RBX: 1ffff9200007d189 RCX: ffffffff81626fb0
RDX: 0000000000000001 RSI: 0000000000010004 RDI: ffffffff8c122908
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff8e734317
R10: fffffbfff1ce6862 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000000 R14: ffffffff91e27188 R15: 0000000000000000
FS:  0000555555fc6400(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4c701a7cb0 CR3: 0000000032fd3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 rcu_read_lock_held_common kernel/rcu/update.c:112 [inline]
 rcu_read_lock_held_common kernel/rcu/update.c:102 [inline]
 rcu_read_lock_sched_held+0x29/0x70 kernel/rcu/update.c:123
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0x500/0x630 kernel/locking/lockdep.c:5639
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
 debug_object_deactivate lib/debugobjects.c:739 [inline]
 debug_object_deactivate+0x105/0x300 lib/debugobjects.c:727
 debug_hrtimer_deactivate kernel/time/hrtimer.c:425 [inline]
 debug_deactivate kernel/time/hrtimer.c:481 [inline]
 __run_hrtimer kernel/time/hrtimer.c:1653 [inline]
 __hrtimer_run_queues+0x422/0xfb0 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x320/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1096 [inline]
 __sysvec_apic_timer_interrupt+0x180/0x640 arch/x86/kernel/apic/apic.c:1113
 sysvec_apic_timer_interrupt+0x92/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__kmem_cache_free+0xfd/0x3b0 mm/slab.c:3588
Code: f2 4c 89 ee 4c 89 e7 e8 81 e7 ff ff 48 85 db 0f 85 95 00 00 00 9c 58 f6 c4 02 0f 85 b9 00 00 00 48 85 db 74 01 fb 48 83 c4 20 <5b> 5d 41 5c 41 5d 41 5e 41 5f c3 f7 c5 ff 0f 00 00 0f 85 60 ff ff
RSP: 0018:ffffc90003667b80 EFLAGS: 00000282
RAX: 0000000000000002 RBX: 0000000000000200 RCX: 1ffffffff226d9c6
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffea0000ae61c0 R08: 0000000000000001 R09: ffffffff9132eae7
R10: 0000000000000001 R11: 0000000000092081 R12: ffff888012440100
R13: ffff88802b987200 R14: ffffffff842baa9f R15: ffff88802b987208
 ref_tracker_free+0x36f/0x6b0 lib/ref_tracker.c:153
 __netns_tracker_free include/net/net_namespace.h:348 [inline]
 put_net_track include/net/net_namespace.h:363 [inline]
 __sk_destruct+0x3cb/0x750 net/core/sock.c:2162
 sk_destruct net/core/sock.c:2181 [inline]
 __sk_free+0x175/0x460 net/core/sock.c:2192
 sk_free+0x7c/0xa0 net/core/sock.c:2203
 sock_put include/net/sock.h:1987 [inline]
 tcp_close+0x9c/0xc0 net/ipv4/tcp.c:3034
 inet_release+0x132/0x270 net/ipv4/af_inet.c:428
 __sock_release+0xcd/0x280 net/socket.c:650
 sock_close+0x1c/0x20 net/socket.c:1365
 __fput+0x27c/0xa90 fs/file_table.c:320
 task_work_run+0x16f/0x270 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:203
 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
 syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296
 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f71d983df8b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffd6d724080 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 00007ffd6d724120 RCX: 00007f71d983df8b
RDX: 0000000000000000 RSI: 0000008b93d9c178 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: ffff000000000000
R10: 0000000000000010 R11: 0000000000000293 R12: 0000000000000032
R13: 00000000000e2ec7 R14: 0000000000000002 R15: 00007ffd6d724160
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/12/14 16:53 upstream e2ca6ba6ba01 f6511626 .config console log report info ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in inet_release
* Struck through repros no longer work on HEAD.