syzbot


INFO: rcu detected stall in sys_utimensat (2)

Status: closed as invalid on 2022/02/08 10:00
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 353d, last: 353d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in sys_utimensat 1 1091d 1091d 0/24 closed as invalid on 2019/12/04 14:14

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P3950/1:b..l
	(detected by 0, t=10502 jiffies, g=25109, q=170)
task:udevd           state:R  running task     stack:26928 pid: 3950 ppid:  2971 flags:0x00000000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6668
 irqentry_exit+0x31/0x80 kernel/entry/common.c:425
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__follow_mount_rcu fs/namei.c:1429 [inline]
RIP: 0010:handle_mounts fs/namei.c:1486 [inline]
RIP: 0010:step_into+0x109/0x1c80 fs/namei.c:1800
Code: 7b 38 31 ff 45 89 fe 41 83 e6 40 44 89 f6 e8 9e e4 aa ff 45 85 f6 0f 84 c3 03 00 00 e8 70 e2 aa ff 4d 85 ed 0f 84 01 0a 00 00 <e8> 62 e2 aa ff 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03
RSP: 0018:ffffc900051ff8b8 EFLAGS: 00000286
RAX: 0000000000000000 RBX: ffffc900051ffc08 RCX: 0000000000000000
RDX: ffff88801aa29d00 RSI: ffffffff81ccc880 RDI: 0000000000000003
RBP: ffffc900051ff9b0 R08: 0000000000000000 R09: ffff8880167e2c30
R10: ffffffff81ccc872 R11: 0000000000000000 R12: ffff8880167e2bc0
R13: ffff88823bcbc928 R14: 0000000000000040 R15: 0000000000000051
 walk_component+0x171/0x6a0 fs/namei.c:1976
 link_path_walk.part.0+0x757/0xd00 fs/namei.c:2297
 link_path_walk fs/namei.c:2221 [inline]
 path_lookupat+0xc8/0x860 fs/namei.c:2448
 filename_lookup+0x1c6/0x590 fs/namei.c:2478
 user_path_at_empty+0x42/0x60 fs/namei.c:2801
 user_path_at include/linux/namei.h:57 [inline]
 do_utimes_path+0xdc/0x1a0 fs/utimes.c:94
 do_utimes+0x31/0xf0 fs/utimes.c:144
 __do_sys_utimensat fs/utimes.c:163 [inline]
 __se_sys_utimensat fs/utimes.c:147 [inline]
 __x64_sys_utimensat+0x190/0x250 fs/utimes.c:147
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f399c72efef
RSP: 002b:00007ffcb503e0b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000118
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f399c72efef
RDX: 0000000000000000 RSI: 000055d48fad8220 RDI: 00000000ffffff9c
RBP: 000055d48fae40c0 R08: 0000000000000000 R09: 000055d48fad8680
R10: 0000000000000000 R11: 0000000000000202 R12: 000055d48fad8220
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000006180
 </TASK>
rcu: rcu_preempt kthread starved for 10500 jiffies! g25109 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28688 pid:   14 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881
 rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1955
 rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2128
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 0
CPU: 0 PID: 7666 Comm: syz-executor.1 Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_check_gp_kthread_starvation.cold+0x1fb/0x200 kernel/rcu/tree_stall.h:481
 print_other_cpu_stall kernel/rcu/tree_stall.h:586 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:729 [inline]
 rcu_pending kernel/rcu/tree.c:3878 [inline]
 rcu_sched_clock_irq+0x2125/0x2200 kernel/rcu/tree.c:2597
 update_process_times+0x16d/0x200 kernel/time/timer.c:1785
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
 tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1428
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:434 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x3ba/0xb40 kernel/locking/qspinlock.c:508
Code: eb c6 45 01 01 41 bc 00 80 00 00 48 c1 e9 03 83 e3 07 41 be 01 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8d 2c 01 eb 0c f3 90 <41> 83 ec 01 0f 84 72 04 00 00 41 0f b6 45 00 38 d8 7f 08 84 c0 0f
RSP: 0018:ffffc9000ef9f8b0 EFLAGS: 00000206
RAX: 0000000000000003 RBX: 0000000000000000 RCX: 1ffff11002df0012
RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff888016f80090 R08: 0000000000000001 R09: ffffffff8ff73a0f
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000002a91
R13: ffffed1002df0012 R14: 0000000000000001 R15: ffff8880b9c3a880
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock+0x200/0x2b0 kernel/locking/spinlock_debug.c:115
 spin_lock include/linux/spinlock.h:349 [inline]
 lockref_get_not_dead+0x14/0x80 lib/lockref.c:211
 __legitimize_path+0x7f/0x1c0 fs/namei.c:698
 legitimize_path fs/namei.c:708 [inline]
 try_to_unlazy+0x10a/0x3b0 fs/namei.c:777
 complete_walk+0x10d/0x320 fs/namei.c:883
 do_open fs/namei.c:3392 [inline]
 path_openat+0x1395/0x2750 fs/namei.c:3559
 do_filp_open+0x1aa/0x400 fs/namei.c:3586
 do_sys_openat2+0x16d/0x4d0 fs/open.c:1212
 do_sys_open fs/open.c:1228 [inline]
 __do_sys_openat fs/open.c:1244 [inline]
 __se_sys_openat fs/open.c:1239 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1239
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f7305cd1a64
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44
RSP: 002b:00007f7304893cc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f7305e31f60 RCX: 00007f7305cd1a64
RDX: 0000000000000002 RSI: 00007f7304893d60 RDI: 00000000ffffff9c
RBP: 00007f7304893d60 R08: 0000000000000000 R09: 000000000000000d
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002
R13: 00007f7306365b2f R14: 00007f7304894300 R15: 0000000000022000
 </TASK>
----------------
Code disassembly (best guess):
   0:	7b 38                	jnp    0x3a
   2:	31 ff                	xor    %edi,%edi
   4:	45 89 fe             	mov    %r15d,%r14d
   7:	41 83 e6 40          	and    $0x40,%r14d
   b:	44 89 f6             	mov    %r14d,%esi
   e:	e8 9e e4 aa ff       	callq  0xffaae4b1
  13:	45 85 f6             	test   %r14d,%r14d
  16:	0f 84 c3 03 00 00    	je     0x3df
  1c:	e8 70 e2 aa ff       	callq  0xffaae291
  21:	4d 85 ed             	test   %r13,%r13
  24:	0f 84 01 0a 00 00    	je     0xa2b
* 2a:	e8 62 e2 aa ff       	callq  0xffaae291 <-- trapping instruction
  2f:	4c 89 e2             	mov    %r12,%rdx
  32:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  39:	fc ff df
  3c:	48 c1 ea 03          	shr    $0x3,%rdx

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce 2021/12/10 06:06 upstream c741e49150db 4d4ce9bc .config log report info INFO: rcu detected stall in sys_utimensat
* Struck through repros no longer work on HEAD.