BUG: soft lockup in sctp_generate_heartbeat

Kernel	Title	Repro	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.14	BUG: soft lockup in sctp_generate_heartbeat_event (2)			1	1122d	1122d	0/1	auto-closed as invalid on 2021/07/22 12:40
linux-4.14	BUG: soft lockup in sctp_generate_heartbeat_event			2	1463d	1508d	0/1	auto-closed as invalid on 2020/08/15 07:16
linux-4.19	BUG: soft lockup in sctp_generate_heartbeat_event	C	error	14	413d	1079d	0/1	upstream: reported C repro on 2021/05/06 15:10

sctp: [Deprecated]: syz-executor6 (pid 12830) Use of int in maxseg socket option. Use struct sctp_assoc_value instead sctp: [Deprecated]: syz-executor6 (pid 12849) Use of int in maxseg socket option. Use struct sctp_assoc_value instead watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [kworker/u4:3:169] Modules linked in: irq event stamp: 7352033 hardirqs last enabled at (7352032): [<ffffffff87719c67>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline] hardirqs last enabled at (7352032): [<ffffffff87719c67>] _raw_spin_unlock_irq+0x27/0x70 kernel/locking/spinlock.c:192 hardirqs last disabled at (7352033): [<ffffffff87800905>] interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625 softirqs last enabled at (115216): [<ffffffff87a00778>] __do_softirq+0x778/0xaf5 kernel/softirq.c:311 softirqs last disabled at (115223): [<ffffffff81475241>] invoke_softirq kernel/softirq.c:365 [inline] softirqs last disabled at (115223): [<ffffffff81475241>] irq_exit+0x1d1/0x200 kernel/softirq.c:405 CPU: 0 PID: 169 Comm: kworker/u4:3 Not tainted 4.17.0-rc4+ #50 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:rep_nop arch/x86/include/asm/processor.h:667 [inline] RIP: 0010:cpu_relax arch/x86/include/asm/processor.h:672 [inline] RIP: 0010:virt_spin_lock arch/x86/include/asm/qspinlock.h:69 [inline] RIP: 0010:native_queued_spin_lock_slowpath+0x204/0xde0 kernel/locking/qspinlock.c:305 RSP: 0018:ffff8801dae07390 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000000 RBX: ffffed003b5c0e8b RCX: 0000000000000004 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8801957cc088 RBP: ffff8801dae07700 R08: ffffed0032af9812 R09: ffffed0032af9811 R10: ffffed0032af9811 R11: ffff8801957cc08b R12: ffff8801957cc088 R13: ffff8801dae076d8 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd31c2c5c0 CR3: 00000001b627b000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:674 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:30 [inline] queued_spin_lock include/asm-generic/qspinlock.h:90 [inline] do_raw_spin_lock+0x1a7/0x200 kernel/locking/spinlock_debug.c:113 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_lock+0x32/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:310 [inline] sctp_generate_heartbeat_event+0xa4/0x450 net/sctp/sm_sideeffect.c:386 call_timer_fn+0x230/0x940 kernel/time/timer.c:1326 expire_timers kernel/time/timer.c:1363 [inline] __run_timers+0x79e/0xc50 kernel/time/timer.c:1666 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285 invoke_softirq kernel/softirq.c:365 [inline] irq_exit+0x1d1/0x200 kernel/softirq.c:405 exiting_irq arch/x86/include/asm/apic.h:525 [inline] smp_apic_timer_interrupt+0x17e/0x710 arch/x86/kernel/apic/apic.c:1052 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863 </IRQ> RIP: 0010:bytes_is_nonzero mm/kasan/kasan.c:167 [inline] RIP: 0010:memory_is_nonzero mm/kasan/kasan.c:184 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/kasan.c:210 [inline] RIP: 0010:memory_is_poisoned mm/kasan/kasan.c:241 [inline] RIP: 0010:check_memory_region_inline mm/kasan/kasan.c:257 [inline] RIP: 0010:check_memory_region+0x117/0x1b0 mm/kasan/kasan.c:267 RSP: 0018:ffff8801d9217260 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: ffffed003b5c46c3 RBX: 1ffff1003b5c46c2 RCX: ffffffff81643fa5 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8801dae23610 RBP: ffff8801d9217278 R08: ffffed003b5c46c3 R09: ffffed003b5c46c2 R10: ffffed003b5c46c2 R11: ffff8801dae23613 R12: ffffed003b5c46c3 R13: ffff8801dae23610 R14: ffff8801d9217300 R15: dffffc0000000000 kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline] rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:349 [inline] rcu_is_watching+0x85/0x140 kernel/rcu/tree.c:1075 rcu_read_lock include/linux/rcupdate.h:633 [inline] inet_twsk_purge+0x692/0x860 net/ipv4/inet_timewait_sock.c:267 dccp_v4_exit_batch+0x1a/0x20 net/dccp/ipv4.c:1028 ops_exit_list.isra.7+0x105/0x160 net/core/net_namespace.c:155 cleanup_net+0x51d/0xb20 net/core/net_namespace.c:523 process_one_work+0xc1e/0x1b50 kernel/workqueue.c:2145 worker_thread+0x1cc/0x1440 kernel/workqueue.c:2279 kthread+0x345/0x410 kernel/kthread.c:238 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412 Code: 5c 00 00 00 00 48 83 e7 f8 49 29 fc 41 8d 4c 24 64 c1 e9 03 f3 48 ab 48 81 c4 48 03 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 f3 90 <e9> 3b ff ff ff 89 f1 81 fe 00 01 00 00 0f 84 9e 03 00 00 41 be Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 17 Comm: ksoftirqd/1 Not tainted 4.17.0-rc4+ #50 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:unwind_next_frame.part.7+0x17/0x9c0 arch/x86/kernel/unwind_frame.c:282 RSP: 0018:ffff8801d9b3ec90 EFLAGS: 00000a06 RAX: 0000000000000000 RBX: ffff8801d9b3ecc8 RCX: ffff8801d9b3ed48 RDX: 1ffff1003b367d7b RSI: ffffffff812c8d1a RDI: ffff8801d9b3ecc8 RBP: ffff8801d9b3eca0 R08: ffff8801d9b3ed00 R09: ffff8801d9b32480 R10: ffffed003b367da3 R11: ffff8801d9b3ed1f R12: 0000000000000000 R13: 0000000000000000 R14: ffff8801d9b32480 R15: ffff8801d9b3ed18 FS: 0000000000000000(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0017031db8 CR3: 0000000008c6a000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: unwind_next_frame+0x3e/0x50 arch/x86/kernel/unwind_frame.c:287 __save_stack_trace+0x6e/0xd0 arch/x86/kernel/stacktrace.c:44 save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60 save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554 kmem_cache_zalloc include/linux/slab.h:691 [inline] sctp_chunkify+0xce/0x400 net/sctp/sm_make_chunk.c:1340 _sctp_make_chunk+0x157/0x280 net/sctp/sm_make_chunk.c:1413 sctp_make_control net/sctp/sm_make_chunk.c:1449 [inline] sctp_make_heartbeat+0x8f/0x430 net/sctp/sm_make_chunk.c:1156 sctp_sf_heartbeat.isra.23+0x26/0x180 net/sctp/sm_statefuns.c:1005 sctp_sf_sendbeat_8_3+0x38e/0x550 net/sctp/sm_statefuns.c:1049 sctp_do_sm+0x1ab/0x7160 net/sctp/sm_sideeffect.c:1188 sctp_generate_heartbeat_event+0x218/0x450 net/sctp/sm_sideeffect.c:406 call_timer_fn+0x230/0x940 kernel/time/timer.c:1326 expire_timers kernel/time/timer.c:1363 [inline] __run_timers+0x79e/0xc50 kernel/time/timer.c:1666 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285 run_ksoftirqd+0x86/0x100 kernel/softirq.c:646 smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164 kthread+0x345/0x410 kernel/kthread.c:238 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412 Code: ff 4c 89 f7 e8 0b 60 81 00 eb 8f 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 4c 8d 7f 50 48 8d 95 38 ff ff ff 41 56 48 c1 ea 03 <41> 55 41 54 49 89 d4 48 ba 00 00 00 00 00 fc ff df 53 49 8d 04 INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.181 msecs