syzbot


BUG: soft lockup in rtnl_setlink

Status: auto-obsoleted due to no activity on 2022/09/10 23:34
Reported-by: syzbot+2c3b41a486f9dfd8ced9@syzkaller.appspotmail.com
First crash: 708d, last: 708d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: rcu detected stall in rtnl_setlink origin:lts-only C inconclusive 16 44d 205d 0/3 upstream: reported C repro on 2023/09/28 05:42
upstream INFO: rcu detected stall in rtnl_setlink batman 1 963d 963d 0/26 auto-closed as invalid on 2021/11/30 03:45

Sample crash report:
watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.4:9696]
Modules linked in:
irq event stamp: 2789563
hardirqs last  enabled at (2789562): [<ffffffff87400976>] restore_regs_and_return_to_kernel+0x0/0x2a
hardirqs last disabled at (2789563): [<ffffffff874018ae>] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793
softirqs last  enabled at (3744): [<ffffffff8760068b>] __do_softirq+0x68b/0x9ff kernel/softirq.c:314
softirqs last disabled at (3750): [<ffffffff85c75f01>] neigh_ifdown+0x41/0x360 net/core/neighbour.c:295
CPU: 1 PID: 9696 Comm: syz-executor.4 Not tainted 4.14.278-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88809e7cc080 task.stack: ffff88805c738000
RIP: 0010:__read_once_size include/linux/compiler.h:185 [inline]
RIP: 0010:queued_write_lock_slowpath+0x80/0x1d0 kernel/locking/qrwlock.c:130
RSP: 0018:ffff88805c73eea8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: 00000000000000ff RBX: ffffffff89d962f0 RCX: 0000000000000d1e
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff89d962f0
RBP: ffffffff89d962f4 R08: ffffffff8b9ac3b0 R09: 00000000000401a4
R10: ffff88809e7cc930 R11: ffff88809e7cc080 R12: fffffbfff13b2c5e
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS:  00007efd0847d700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200003c0 CR3: 0000000090cae000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 queued_write_lock include/asm-generic/qrwlock.h:134 [inline]
 do_raw_write_lock+0xc2/0x1d0 kernel/locking/spinlock_debug.c:203
 neigh_ifdown+0x41/0x360 net/core/neighbour.c:295
 addrconf_ifdown.isra.0+0xc8/0x1410 net/ipv6/addrconf.c:3589
 addrconf_notify+0x116/0x1c50 net/ipv6/addrconf.c:3511
 notifier_call_chain+0x108/0x1a0 kernel/notifier.c:93
 call_netdevice_notifiers_info net/core/dev.c:1667 [inline]
 call_netdevice_notifiers_mtu net/core/dev.c:1706 [inline]
 dev_set_mtu+0x23d/0x3c0 net/core/dev.c:6921
 do_setlink+0x4f3/0x2bf0 net/core/rtnetlink.c:2055
 rtnl_setlink+0x1f5/0x2e0 net/core/rtnetlink.c:2324
 rtnetlink_rcv_msg+0x3be/0xb10 net/core/rtnetlink.c:4322
 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2455
 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline]
 netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322
 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 sock_write_iter+0x22c/0x370 net/socket.c:925
 call_write_iter include/linux/fs.h:1780 [inline]
 do_iter_readv_writev+0x4cf/0x5f0 fs/read_write.c:675
 do_iter_write+0x152/0x550 fs/read_write.c:954
 vfs_writev+0x125/0x290 fs/read_write.c:999
 do_writev+0xfc/0x2c0 fs/read_write.c:1034
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7efd09b290e9
RSP: 002b:00007efd0847d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007efd09c3c030 RCX: 00007efd09b290e9
RDX: 0000000000000001 RSI: 00000000200003c0 RDI: 0000000000000011
RBP: 00007efd09b8308d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff0e43fddf R14: 00007efd0847d300 R15: 0000000000022000
Code: 0f 84 d3 00 00 00 49 89 dc 49 89 de 41 bd 01 00 00 00 49 c1 ec 03 41 83 e6 07 48 b8 00 00 00 00 00 fc ff df 49 01 c4 eb 02 f3 90 <41> 0f b6 04 24 44 38 f0 7f 08 84 c0 0f 85 f6 00 00 00 0f b6 03 
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 9674 Comm: syz-executor.0 Not tainted 4.14.278-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88805c4ac1c0 task.stack: ffff88805c4b0000
RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:100
RSP: 0018:ffff8880ba4072f0 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: ffffffff88cca000 RCX: 0000000000000020
RDX: 1ffffffff119941d RSI: 00000000000000f1 RDI: 0000000000000380
RBP: ffff8880ba4282c0 R08: ffff88823fff7018 R09: ffff88823fff700f
R10: ffff88823fff7017 R11: 0000002238b439d7 R12: 00000000000000f1
R13: 0000000000000003 R14: 00000020d1079784 R15: 000000297df39ea8
FS:  00007f1bd4ec8700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffeed1f29a7 CR3: 000000009b678000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 apic_write arch/x86/include/asm/apic.h:385 [inline]
 lapic_next_event+0x53/0x80 arch/x86/kernel/apic/apic.c:468
 clockevents_program_event+0x1f1/0x2d0 kernel/time/clockevents.c:339
 tick_program_event+0x78/0xd0 kernel/time/tick-oneshot.c:47
 hrtimer_interrupt+0x336/0x5e0 kernel/time/hrtimer.c:1334
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline]
 smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1104
 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:__unwind_start+0x0/0x930 arch/x86/kernel/unwind_orc.c:510
RSP: 0018:ffff8880ba4074e0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: ffff88805c4ac1c0 RBX: ffff88809ab911c0 RCX: ffff8880ba407568
RDX: 0000000000000000 RSI: ffff88805c4ac1c0 RDI: ffff8880ba4074f8
RBP: ffff8880ba407568 R08: ffffed10135721b8 R09: ffffed1013572238
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ba407580
R13: 0000000000000000 R14: ffff88813fe74ac0 R15: 0000000000000400
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 __save_stack_trace+0x63/0x160 arch/x86/kernel/stacktrace.c:43
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc mm/slab.c:3390 [inline]
 __do_kmalloc mm/slab.c:3718 [inline]
 __kmalloc+0x144/0x400 mm/slab.c:3729
 kmalloc include/linux/slab.h:493 [inline]
 kzalloc include/linux/slab.h:661 [inline]
 neigh_alloc net/core/neighbour.c:324 [inline]
 __neigh_create+0x1db/0x19c0 net/core/neighbour.c:499
 ip6_finish_output2+0x802/0x1f10 net/ipv6/ip6_output.c:117
 ip6_finish_output+0x5c6/0xd50 net/ipv6/ip6_output.c:192
 NF_HOOK_COND include/linux/netfilter.h:239 [inline]
 ip6_output+0x1c5/0x660 net/ipv6/ip6_output.c:209
 dst_output include/net/dst.h:470 [inline]
 NF_HOOK include/linux/netfilter.h:250 [inline]
 ndisc_send_skb+0x82a/0x1390 net/ipv6/ndisc.c:483
 ndisc_send_rs+0x125/0x630 net/ipv6/ndisc.c:677
 addrconf_rs_timer+0x2bb/0x5a0 net/ipv6/addrconf.c:3773
 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280
 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319
 __run_timers kernel/time/timer.c:1637 [inline]
 run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650
 __do_softirq+0x24d/0x9ff kernel/softirq.c:288
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x193/0x240 kernel/softirq.c:409
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106
 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793
 </IRQ>
RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3614
RSP: 0018:ffff88805c4b7950 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10
RAX: 1ffffffff11e1313 RBX: dffffc0000000000 RCX: 1ffff1100b89594d
RDX: 0000000000000000 RSI: ffff88805c4aca48 RDI: ffff88805c4aca44
RBP: ffffed100b895838 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805c4ac1c0
R13: ffffffff88f09898 R14: 0000000000000000 R15: 0000000000000000
 retint_kernel+0x1b/0x2d
RIP: 0010:mem_cgroup_uncharge+0x0/0xd0 mm/memcontrol.c:5800
RSP: 0018:ffff88805c4b7a28 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff02
RAX: 0000000000040000 RBX: ffffea000272c1dc RCX: ffffc900067f6000
RDX: 0000000000040000 RSI: ffffffff816c30be RDI: ffffea000272c1c0
RBP: ffffea000272c1c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88809bdb56a8 R14: ffff88805c4b7b28 R15: ffff88809aa48080
 __put_single_page mm/swap.c:78 [inline]
 __put_page+0x9b/0x2f0 mm/swap.c:113
 put_page include/linux/mm.h:875 [inline]
 generic_pipe_buf_release+0x16c/0x1e0 fs/pipe.c:245
 pipe_buf_release include/linux/pipe_fs_i.h:138 [inline]
 splice_from_pipe_feed fs/splice.c:515 [inline]
 __splice_from_pipe+0x43d/0x7a0 fs/splice.c:626
 splice_from_pipe fs/splice.c:661 [inline]
 default_file_splice_write+0xc5/0x150 fs/splice.c:809
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x115/0x160 fs/splice.c:1018
 splice_direct_to_actor+0x27c/0x730 fs/splice.c:973
 do_splice_direct+0x164/0x210 fs/splice.c:1061
 do_sendfile+0x47f/0xb30 fs/read_write.c:1441
 SYSC_sendfile64 fs/read_write.c:1502 [inline]
 SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f1bd65530e9
RSP: 002b:00007f1bd4ec8168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f1bd6665f60 RCX: 00007f1bd65530e9
RDX: 0000000000000000 RSI: 0000000000000010 RDI: 0000000000000006
RBP: 00007f1bd65ad08d R08: 0000000000000000 R09: 0000000000000000
R10: 0000800000000035 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc3839b78f R14: 00007f1bd4ec8300 R15: 0000000000022000
Code: 83 3d ec 1a 0c 0a 01 7f 02 5d c3 89 ef 5d e9 e2 51 df 05 48 c7 c7 c0 a3 2e 8b e8 64 75 5c 00 eb df 66 90 89 ff 89 b7 00 c0 5f ff <c3> 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb 
----------------
Code disassembly (best guess):
   0:	0f 84 d3 00 00 00    	je     0xd9
   6:	49 89 dc             	mov    %rbx,%r12
   9:	49 89 de             	mov    %rbx,%r14
   c:	41 bd 01 00 00 00    	mov    $0x1,%r13d
  12:	49 c1 ec 03          	shr    $0x3,%r12
  16:	41 83 e6 07          	and    $0x7,%r14d
  1a:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  21:	fc ff df
  24:	49 01 c4             	add    %rax,%r12
  27:	eb 02                	jmp    0x2b
  29:	f3 90                	pause
* 2b:	41 0f b6 04 24       	movzbl (%r12),%eax <-- trapping instruction
  30:	44 38 f0             	cmp    %r14b,%al
  33:	7f 08                	jg     0x3d
  35:	84 c0                	test   %al,%al
  37:	0f 85 f6 00 00 00    	jne    0x133
  3d:	0f b6 03             	movzbl (%rbx),%eax

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/05/13 23:33 linux-4.14.y 569d1abf9402 107f6434 .config console log report info ci2-linux-4-14 BUG: soft lockup in rtnl_setlink
* Struck through repros no longer work on HEAD.