syzbot


BUG: soft lockup in sctp_generate_heartbeat_event

Status: closed as invalid on 2018/05/19 09:33
Subsystems: sctp
[Documentation on labels]
First crash: 2393d, last: 2393d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 BUG: soft lockup in sctp_generate_heartbeat_event (2) 1 1353d 1353d 0/1 auto-closed as invalid on 2021/07/22 12:40
linux-4.14 BUG: soft lockup in sctp_generate_heartbeat_event 2 1694d 1739d 0/1 auto-closed as invalid on 2020/08/15 07:16
linux-4.19 BUG: soft lockup in sctp_generate_heartbeat_event C error 14 644d 1310d 0/1 upstream: reported C repro on 2021/05/06 15:10

Sample crash report:
sctp: [Deprecated]: syz-executor6 (pid 12830) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
sctp: [Deprecated]: syz-executor6 (pid 12849) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [kworker/u4:3:169]
Modules linked in:
irq event stamp: 7352033
hardirqs last  enabled at (7352032): [<ffffffff87719c67>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline]
hardirqs last  enabled at (7352032): [<ffffffff87719c67>] _raw_spin_unlock_irq+0x27/0x70 kernel/locking/spinlock.c:192
hardirqs last disabled at (7352033): [<ffffffff87800905>] interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625
softirqs last  enabled at (115216): [<ffffffff87a00778>] __do_softirq+0x778/0xaf5 kernel/softirq.c:311
softirqs last disabled at (115223): [<ffffffff81475241>] invoke_softirq kernel/softirq.c:365 [inline]
softirqs last disabled at (115223): [<ffffffff81475241>] irq_exit+0x1d1/0x200 kernel/softirq.c:405
CPU: 0 PID: 169 Comm: kworker/u4:3 Not tainted 4.17.0-rc4+ #50
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:rep_nop arch/x86/include/asm/processor.h:667 [inline]
RIP: 0010:cpu_relax arch/x86/include/asm/processor.h:672 [inline]
RIP: 0010:virt_spin_lock arch/x86/include/asm/qspinlock.h:69 [inline]
RIP: 0010:native_queued_spin_lock_slowpath+0x204/0xde0 kernel/locking/qspinlock.c:305
RSP: 0018:ffff8801dae07390 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffffed003b5c0e8b RCX: 0000000000000004
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8801957cc088
RBP: ffff8801dae07700 R08: ffffed0032af9812 R09: ffffed0032af9811
R10: ffffed0032af9811 R11: ffff8801957cc08b R12: ffff8801957cc088
R13: ffff8801dae076d8 R14: 0000000000000001 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd31c2c5c0 CR3: 00000001b627b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:674 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:30 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:90 [inline]
 do_raw_spin_lock+0x1a7/0x200 kernel/locking/spinlock_debug.c:113
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0x32/0x40 kernel/locking/spinlock.c:144
 spin_lock include/linux/spinlock.h:310 [inline]
 sctp_generate_heartbeat_event+0xa4/0x450 net/sctp/sm_sideeffect.c:386
 call_timer_fn+0x230/0x940 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0x79e/0xc50 kernel/time/timer.c:1666
 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0x1d1/0x200 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:525 [inline]
 smp_apic_timer_interrupt+0x17e/0x710 arch/x86/kernel/apic/apic.c:1052
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
 </IRQ>
RIP: 0010:bytes_is_nonzero mm/kasan/kasan.c:167 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/kasan.c:184 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/kasan.c:210 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/kasan.c:241 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/kasan.c:257 [inline]
RIP: 0010:check_memory_region+0x117/0x1b0 mm/kasan/kasan.c:267
RSP: 0018:ffff8801d9217260 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffffed003b5c46c3 RBX: 1ffff1003b5c46c2 RCX: ffffffff81643fa5
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8801dae23610
RBP: ffff8801d9217278 R08: ffffed003b5c46c3 R09: ffffed003b5c46c2
R10: ffffed003b5c46c2 R11: ffff8801dae23613 R12: ffffed003b5c46c3
R13: ffff8801dae23610 R14: ffff8801d9217300 R15: dffffc0000000000
 kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
 rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:349 [inline]
 rcu_is_watching+0x85/0x140 kernel/rcu/tree.c:1075
 rcu_read_lock include/linux/rcupdate.h:633 [inline]
 inet_twsk_purge+0x692/0x860 net/ipv4/inet_timewait_sock.c:267
 dccp_v4_exit_batch+0x1a/0x20 net/dccp/ipv4.c:1028
 ops_exit_list.isra.7+0x105/0x160 net/core/net_namespace.c:155
 cleanup_net+0x51d/0xb20 net/core/net_namespace.c:523
 process_one_work+0xc1e/0x1b50 kernel/workqueue.c:2145
 worker_thread+0x1cc/0x1440 kernel/workqueue.c:2279
 kthread+0x345/0x410 kernel/kthread.c:238
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Code: 5c 00 00 00 00 48 83 e7 f8 49 29 fc 41 8d 4c 24 64 c1 e9 03 f3 48 ab 48 81 c4 48 03 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 f3 90 <e9> 3b ff ff ff 89 f1 81 fe 00 01 00 00 0f 84 9e 03 00 00 41 be 
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 17 Comm: ksoftirqd/1 Not tainted 4.17.0-rc4+ #50
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:unwind_next_frame.part.7+0x17/0x9c0 arch/x86/kernel/unwind_frame.c:282
RSP: 0018:ffff8801d9b3ec90 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: ffff8801d9b3ecc8 RCX: ffff8801d9b3ed48
RDX: 1ffff1003b367d7b RSI: ffffffff812c8d1a RDI: ffff8801d9b3ecc8
RBP: ffff8801d9b3eca0 R08: ffff8801d9b3ed00 R09: ffff8801d9b32480
R10: ffffed003b367da3 R11: ffff8801d9b3ed1f R12: 0000000000000000
R13: 0000000000000000 R14: ffff8801d9b32480 R15: ffff8801d9b3ed18
FS:  0000000000000000(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0017031db8 CR3: 0000000008c6a000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 unwind_next_frame+0x3e/0x50 arch/x86/kernel/unwind_frame.c:287
 __save_stack_trace+0x6e/0xd0 arch/x86/kernel/stacktrace.c:44
 save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554
 kmem_cache_zalloc include/linux/slab.h:691 [inline]
 sctp_chunkify+0xce/0x400 net/sctp/sm_make_chunk.c:1340
 _sctp_make_chunk+0x157/0x280 net/sctp/sm_make_chunk.c:1413
 sctp_make_control net/sctp/sm_make_chunk.c:1449 [inline]
 sctp_make_heartbeat+0x8f/0x430 net/sctp/sm_make_chunk.c:1156
 sctp_sf_heartbeat.isra.23+0x26/0x180 net/sctp/sm_statefuns.c:1005
 sctp_sf_sendbeat_8_3+0x38e/0x550 net/sctp/sm_statefuns.c:1049
 sctp_do_sm+0x1ab/0x7160 net/sctp/sm_sideeffect.c:1188
 sctp_generate_heartbeat_event+0x218/0x450 net/sctp/sm_sideeffect.c:406
 call_timer_fn+0x230/0x940 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0x79e/0xc50 kernel/time/timer.c:1666
 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
 run_ksoftirqd+0x86/0x100 kernel/softirq.c:646
 smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
 kthread+0x345/0x410 kernel/kthread.c:238
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Code: ff 4c 89 f7 e8 0b 60 81 00 eb 8f 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 4c 8d 7f 50 48 8d 95 38 ff ff ff 41 56 48 c1 ea 03 <41> 55 41 54 49 89 d4 48 ba 00 00 00 00 00 fc ff df 53 49 8d 04 
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.181 msecs

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/05/19 02:04 net-next-old 1f7455c3912d 849705db .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.