syzbot


INFO: rcu detected stall in sendmsg

Status: auto-closed as invalid on 2022/01/03 17:11
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 428d, last: 428d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in sendmsg (2) 1 298d 298d 0/24 auto-closed as invalid on 2022/05/13 12:25

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (1 GPs behind) idle=37d/1/0x4000000000000000 softirq=110104/110105 fqs=22 
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P16630/1:b..l
	(detected by 0, t=10502 jiffies, g=188281, q=136)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 1 Comm: systemd Not tainted 5.15.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:check_preemption_disabled+0x27/0x1c0 lib/smp_processor_id.c:14
Code: 00 00 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 10 49 89 f6 49 89 ff 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 0f 1f 44 00 00 <65> 8b 1d d2 6b 08 76 65 8b 2d 43 c6 08 76 89 ee 81 e6 ff ff ff 7f
RSP: 0018:ffffc90000dc0a78 EFLAGS: 00000086
RAX: 70d13d8d9e399600 RBX: 1ffff920001b816e RCX: 0000000080010004
RDX: 0000000000000000 RSI: ffffffff8a4efaa0 RDI: ffffffff8ab421c0
RBP: ffffc90000dc0bf0 R08: dffffc0000000000 R09: ffffed10173a64a2
R10: ffffed10173a64a2 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff920001b8164 R14: ffffffff8a4efaa0 R15: ffffffff8ab421c0
FS:  00007f0f55f15500(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558d6dd25ff9 CR3: 000000007ea10000 CR4: 00000000003526e0
Call Trace:
 <IRQ>
 lockdep_recursion_inc kernel/locking/lockdep.c:433 [inline]
 lock_release+0x141/0x810 kernel/locking/lockdep.c:5644
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:158 [inline]
 _raw_spin_unlock_irqrestore+0x75/0x130 kernel/locking/spinlock.c:194
 debug_object_activate+0x282/0x6a0 lib/debugobjects.c:689
 debug_hrtimer_activate kernel/time/hrtimer.c:420 [inline]
 debug_activate kernel/time/hrtimer.c:475 [inline]
 enqueue_hrtimer kernel/time/hrtimer.c:1084 [inline]
 __run_hrtimer kernel/time/hrtimer.c:1702 [inline]
 __hrtimer_run_queues+0x594/0xa60 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x3b3/0x1040 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0xf9/0x270 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8c/0xb0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd4/0x130 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 d2 22 d2 f7 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 07 91 5d f7 65 8b 05 c8 32 06 76 85 c0 74 3f 48 c7 04 24 0e 36
RSP: 0018:ffffc90000c67720 EFLAGS: 00000206
RAX: 70d13d8d9e399600 RBX: 1ffff9200018cee8 RCX: ffffffff90931803
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffffc90000c677b0 R08: ffffffff8188ef50 R09: ffffed10040c1849
R10: ffffed10040c1849 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff9200018cee4 R14: ffffc90000c67740 R15: 0000000000000246
 spin_unlock_irqrestore include/linux/spinlock.h:418 [inline]
 __wake_up_common_lock kernel/sched/wait.c:140 [inline]
 __wake_up_sync_key+0x124/0x1c0 kernel/sched/wait.c:205
 sock_def_readable+0x106/0x200 net/core/sock.c:3054
 unix_dgram_sendmsg+0x19cc/0x2a50 net/unix/af_unix.c:1941
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 ____sys_sendmsg+0x5b9/0x910 net/socket.c:2409
 ___sys_sendmsg net/socket.c:2463 [inline]
 __sys_sendmsg+0x36f/0x450 net/socket.c:2492
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f0f547b2eb0
Code: 40 00 41 54 55 41 89 d4 53 48 89 f5 89 fb 48 83 ec 10 e8 d3 ef ff ff 48 63 fb 41 89 c0 49 63 d4 48 89 ee b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 1b 44 89 c7 48 89 44 24 08 e8 0b f0 ff ff 48
RSP: 002b:00007fff82f0b000 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000025 RCX: 00007f0f547b2eb0
RDX: 0000000000004000 RSI: 00007fff82f0b080 RDI: 0000000000000025
RBP: 00007fff82f0b080 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000078 R11: 0000000000000293 R12: 0000000000004000
R13: 0000558d6cdbdd88 R14: 0000000000000000 R15: 00007f0f55f152f8
task:syz-executor.4  state:R  running task     stack:28304 pid:16630 ppid: 13540 flags:0x00004000
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0xc8d/0x1270 kernel/sched/core.c:6287
 preempt_schedule_common kernel/sched/core.c:6459 [inline]
 preempt_schedule+0x14d/0x190 kernel/sched/core.c:6484
 preempt_schedule_thunk+0x16/0x18
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
 _raw_spin_unlock_irqrestore+0x128/0x130 kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:418 [inline]
 timerfd_clock_was_set+0x1d3/0x2b0 fs/timerfd.c:113
 clock_was_set+0x8a0/0x940 kernel/time/hrtimer.c:980
 do_settimeofday64+0x618/0x7a0 kernel/time/timekeeping.c:1327
 __do_sys_clock_settime kernel/time/posix-timers.c:1079 [inline]
 __se_sys_clock_settime kernel/time/posix-timers.c:1067 [inline]
 __x64_sys_clock_settime+0x23d/0x280 kernel/time/posix-timers.c:1067
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f63bf2a58d9
RSP: 002b:00007f63bc7fb188 EFLAGS: 00000246 ORIG_RAX: 00000000000000e3
RAX: ffffffffffffffda RBX: 00007f63bf3aa020 RCX: 00007f63bf2a58d9
RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000000
RBP: 00007f63bf2ffcb4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffec94e9baf R14: 00007f63bc7fb300 R15: 0000000000022000
rcu: rcu_preempt kthread starved for 10454 jiffies! g188281 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:26768 pid:   14 ppid:     2 flags:0x00004000
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0xc8d/0x1270 kernel/sched/core.c:6287
 schedule+0x14b/0x210 kernel/sched/core.c:6366
 schedule_timeout+0x1b9/0x300 kernel/time/timer.c:1881
 rcu_gp_fqs_loop+0x1fd/0x770 kernel/rcu/tree.c:1957
 rcu_gp_kthread+0xa5/0x350 kernel/rcu/tree.c:2130
 kthread+0x453/0x480 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 0
CPU: 0 PID: 16628 Comm: syz-executor.4 Not tainted 5.15.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x45f/0x490 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x16a/0x280 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_check_gp_kthread_starvation+0x1ff/0x270 kernel/rcu/tree_stall.h:481
 print_other_cpu_stall kernel/rcu/tree_stall.h:586 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:729 [inline]
 rcu_pending kernel/rcu/tree.c:3880 [inline]
 rcu_sched_clock_irq+0x23d5/0x2bc0 kernel/rcu/tree.c:2599
 update_process_times+0x197/0x200 kernel/time/timer.c:1785
 tick_sched_handle kernel/time/tick-sched.c:226 [inline]
 tick_sched_timer+0x27d/0x420 kernel/time/tick-sched.c:1421
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x4cb/0xa60 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x3b3/0x1040 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0xf9/0x270 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8c/0xb0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20
RIP: 0010:csd_lock_wait kernel/smp.c:440 [inline]
RIP: 0010:smp_call_function_many_cond+0xbb7/0xda0 kernel/smp.c:969
Code: e8 ae 9f 0b 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 0e e8 89 9b 0b 00 eb 4c 0f 1f 80 00 00 00 00 f3 90 42 0f b6 04 3b <84> c0 75 11 41 f7 45 00 01 00 00 00 74 2b e8 66 9b 0b 00 eb e4 44
RSP: 0018:ffffc90009bcf260 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 1ffff110173a6e4d RCX: 0000000000040000
RDX: ffffc90018b89000 RSI: 000000000003ffff RDI: 0000000000040000
RBP: ffffc90009bcf390 R08: ffffffff8176d702 R09: ffffffff843540e0
R10: 0000000000000009 R11: ffff888082c75580 R12: 0000000000000001
R13: ffff8880b9d37268 R14: ffff8880b9c325c0 R15: dffffc0000000000
 on_each_cpu_cond_mask+0x3b/0x80 kernel/smp.c:1135
 on_each_cpu include/linux/smp.h:71 [inline]
 flush_tlb_kernel_range+0x192/0x220 arch/x86/mm/tlb.c:1060
 __purge_vmap_area_lazy+0xcca/0x18e0 mm/vmalloc.c:1704
 _vm_unmap_aliases+0x474/0x500 mm/vmalloc.c:2107
 change_page_attr_set_clr+0x2ae/0x6a0 arch/x86/mm/pat/set_memory.c:1740
 change_page_attr_clear arch/x86/mm/pat/set_memory.c:1797 [inline]
 set_memory_ro+0xa4/0xe0 arch/x86/mm/pat/set_memory.c:1943
 bpf_jit_binary_lock_ro include/linux/filter.h:890 [inline]
 bpf_int_jit_compile+0xad91/0xb2d0 arch/x86/net/bpf_jit_comp.c:2368
 bpf_prog_select_runtime+0x65d/0x970 kernel/bpf/core.c:1914
 bpf_migrate_filter net/core/filter.c:1295 [inline]
 bpf_prepare_filter+0x10db/0x1400 net/core/filter.c:1343
 bpf_prog_create_from_user+0x2a1/0x3d0 net/core/filter.c:1437
 seccomp_prepare_filter kernel/seccomp.c:666 [inline]
 seccomp_prepare_user_filter kernel/seccomp.c:703 [inline]
 seccomp_set_mode_filter kernel/seccomp.c:1824 [inline]
 do_seccomp+0x90f/0x24b0 kernel/seccomp.c:1944
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f63bf2a58d9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f63bc81c188 EFLAGS: 00000246 ORIG_RAX: 000000000000013d
RAX: ffffffffffffffda RBX: 00007f63bf3a9f60 RCX: 00007f63bf2a58d9
RDX: 0000000020000040 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 00007f63bf2ffcb4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffec94e9baf R14: 00007f63bc81c300 R15: 0000000000022000
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	90                   	nop
   3:	55                   	push   %rbp
   4:	41 57                	push   %r15
   6:	41 56                	push   %r14
   8:	41 55                	push   %r13
   a:	41 54                	push   %r12
   c:	53                   	push   %rbx
   d:	48 83 ec 10          	sub    $0x10,%rsp
  11:	49 89 f6             	mov    %rsi,%r14
  14:	49 89 ff             	mov    %rdi,%r15
  17:	65 48 8b 04 25 28 00 	mov    %gs:0x28,%rax
  1e:	00 00
  20:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
  25:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
* 2a:	65 8b 1d d2 6b 08 76 	mov    %gs:0x76086bd2(%rip),%ebx        # 0x76086c03 <-- trapping instruction
  31:	65 8b 2d 43 c6 08 76 	mov    %gs:0x7608c643(%rip),%ebp        # 0x7608c67b
  38:	89 ee                	mov    %ebp,%esi
  3a:	81 e6 ff ff ff 7f    	and    $0x7fffffff,%esi

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2021/10/05 17:09 upstream f6274b06e326 0a63fd36 .config log report info INFO: rcu detected stall in sendmsg
* Struck through repros no longer work on HEAD.