syzbot


INFO: rcu detected stall in sys_fork

Status: auto-closed as invalid on 2019/10/25 08:41
Reported-by: syzbot+13ea9210b3ef67a34528@syzkaller.appspotmail.com
First crash: 2030d, last: 2030d

Sample crash report:
   Free memory is 24752kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (24648) (tgid 24637), adj 1000,
   to free 35972kB on behalf of 'syz-executor.2' (20312) because
   cache 14276kB is below limit 65536kB for oom_score_adj 12
   Free memory is 53904kB above reserved
INFO: rcu_preempt detected stalls on CPUs/tasks:
	Tasks blocked on level-0 rcu_node (CPUs 0-1): P19170
	(detected by 1, t=10504 jiffies, g=27535, c=27534, q=51323)
syz-executor.2  R  running task    26952 19170   2098 0x0000000c
 ffff8801db707c60 ffffffff813fa6fd ffffffff813fa504 ffff8801877a2f80
 ffffffff830cd6c0 0000000000000096 ffff8801877a3360 dffffc0000000000
 ffff8801db707c98 ffffffff81404e39 0000000000006b8e 000000000000c87b
Call Trace:
 <IRQ> 
 [<ffffffff813fa6fd>] sched_show_task.cold.35+0x279/0x31f kernel/sched/core.c:5317
 [<ffffffff81404e39>] rcu_print_detail_task_stall_rnp+0xc2/0xfe kernel/rcu/tree_plugin.h:530
 [<ffffffff81405f5f>] rcu_print_detail_task_stall kernel/rcu/tree_plugin.h:543 [inline]
 [<ffffffff81405f5f>] print_other_cpu_stall kernel/rcu/tree.c:1408 [inline]
 [<ffffffff81405f5f>] check_cpu_stall kernel/rcu/tree.c:1520 [inline]
 [<ffffffff81405f5f>] __rcu_pending kernel/rcu/tree.c:3487 [inline]
 [<ffffffff81405f5f>] rcu_pending kernel/rcu/tree.c:3551 [inline]
 [<ffffffff81405f5f>] rcu_check_callbacks.cold.69+0x757/0xd27 kernel/rcu/tree.c:2880
 [<ffffffff81267470>] update_process_times+0x30/0x70 kernel/time/timer.c:1629
 [<ffffffff8129641a>] tick_sched_handle.isra.5+0x4a/0xf0 kernel/time/tick-sched.c:151
 [<ffffffff81296536>] tick_sched_timer+0x76/0x130 kernel/time/tick-sched.c:1190
 [<ffffffff8126a197>] __run_hrtimer kernel/time/hrtimer.c:1255 [inline]
 [<ffffffff8126a197>] __hrtimer_run_queues+0x357/0xe30 kernel/time/hrtimer.c:1319
 [<ffffffff8126c681>] hrtimer_interrupt+0x1b1/0x430 kernel/time/hrtimer.c:1353
 [<ffffffff810912d4>] local_apic_timer_interrupt+0x74/0xa0 arch/x86/kernel/apic/apic.c:937
 [<ffffffff8281b76c>] smp_apic_timer_interrupt+0x7c/0xb0 arch/x86/kernel/apic/apic.c:961
 [<ffffffff8281902d>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:648
 <EOI> 
 [<ffffffff82818214>] retint_kernel+0x1b/0x2d
 [<ffffffff812270c8>] vprintk_emit+0x448/0x790 kernel/printk/printk.c:1908
 [<ffffffff81227438>] vprintk+0x28/0x30 kernel/printk/printk.c:1918
 [<ffffffff8122745d>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1919
 [<ffffffff81402f9f>] vprintk_func kernel/printk/internal.h:36 [inline]
 [<ffffffff81402f9f>] printk+0xaf/0xd7 kernel/printk/printk.c:1980
 [<ffffffff8222d9e8>] lowmem_scan.cold.1+0x1f9/0x35b drivers/staging/android/lowmemorykiller.c:177
 [<ffffffff81449cc6>] do_shrink_slab mm/vmscan.c:398 [inline]
 [<ffffffff81449cc6>] shrink_slab.part.8+0x3c6/0xa00 mm/vmscan.c:501
 [<ffffffff814557fd>] shrink_slab mm/vmscan.c:465 [inline]
 [<ffffffff814557fd>] shrink_node+0x1ed/0x740 mm/vmscan.c:2602
 [<ffffffff814560c7>] shrink_zones mm/vmscan.c:2749 [inline]
 [<ffffffff814560c7>] do_try_to_free_pages mm/vmscan.c:2791 [inline]
 [<ffffffff814560c7>] try_to_free_pages+0x377/0xb80 mm/vmscan.c:3002
 [<ffffffff81428a01>] __perform_reclaim mm/page_alloc.c:3324 [inline]
 [<ffffffff81428a01>] __alloc_pages_direct_reclaim mm/page_alloc.c:3345 [inline]
 [<ffffffff81428a01>] __alloc_pages_slowpath mm/page_alloc.c:3697 [inline]
 [<ffffffff81428a01>] __alloc_pages_nodemask+0x981/0x1bd0 mm/page_alloc.c:3862
 [<ffffffff810bea92>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<ffffffff810bea92>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<ffffffff810bea92>] alloc_pages_node include/linux/gfp.h:460 [inline]
 [<ffffffff810bea92>] pte_alloc_one+0x22/0x100 arch/x86/mm/pgtable.c:29
 [<ffffffff8149d3e6>] __pte_alloc+0x26/0x1e0 mm/memory.c:570
 [<ffffffff814a0737>] copy_pte_range mm/memory.c:929 [inline]
 [<ffffffff814a0737>] copy_pmd_range mm/memory.c:1004 [inline]
 [<ffffffff814a0737>] copy_pud_range mm/memory.c:1026 [inline]
 [<ffffffff814a0737>] copy_page_range+0xff7/0x17a0 mm/memory.c:1088
 [<ffffffff810d7373>] dup_mmap kernel/fork.c:674 [inline]
 [<ffffffff810d7373>] dup_mm kernel/fork.c:1156 [inline]
 [<ffffffff810d7373>] copy_mm kernel/fork.c:1210 [inline]
 [<ffffffff810d7373>] copy_process.part.8+0x44f3/0x6a10 kernel/fork.c:1692
 [<ffffffff810d9d12>] copy_process kernel/fork.c:1505 [inline]
 [<ffffffff810d9d12>] _do_fork+0x1b2/0xd30 kernel/fork.c:1972
 [<ffffffff810da8ef>] sys_fork+0x1f/0x30 kernel/fork.c:2044
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
syz-executor.2  R  running task    26952 19170   2098 0x8000000c
 ffff8801db707c60 ffffffff813fa6fd ffffffff813fa504 ffff8801877a2f80
 ffffffff830cd6c0 0000000000000096 ffff8801877a3360 dffffc0000000000
 ffff8801db707c98 ffffffff81404e39 ffffffff830cda40 000000000000c87b
Call Trace:
 <IRQ> 
 [<ffffffff813fa6fd>] sched_show_task.cold.35+0x279/0x31f kernel/sched/core.c:5317
 [<ffffffff81404e39>] rcu_print_detail_task_stall_rnp+0xc2/0xfe kernel/rcu/tree_plugin.h:530
 [<ffffffff81405fb7>] rcu_print_detail_task_stall kernel/rcu/tree_plugin.h:545 [inline]
 [<ffffffff81405fb7>] print_other_cpu_stall kernel/rcu/tree.c:1408 [inline]
 [<ffffffff81405fb7>] check_cpu_stall kernel/rcu/tree.c:1520 [inline]
 [<ffffffff81405fb7>] __rcu_pending kernel/rcu/tree.c:3487 [inline]
 [<ffffffff81405fb7>] rcu_pending kernel/rcu/tree.c:3551 [inline]
 [<ffffffff81405fb7>] rcu_check_callbacks.cold.69+0x7af/0xd27 kernel/rcu/tree.c:2880
 [<ffffffff81267470>] update_process_times+0x30/0x70 kernel/time/timer.c:1629
 [<ffffffff8129641a>] tick_sched_handle.isra.5+0x4a/0xf0 kernel/time/tick-sched.c:151
 [<ffffffff81296536>] tick_sched_timer+0x76/0x130 kernel/time/tick-sched.c:1190
 [<ffffffff8126a197>] __run_hrtimer kernel/time/hrtimer.c:1255 [inline]
 [<ffffffff8126a197>] __hrtimer_run_queues+0x357/0xe30 kernel/time/hrtimer.c:1319
 [<ffffffff8126c681>] hrtimer_interrupt+0x1b1/0x430 kernel/time/hrtimer.c:1353
 [<ffffffff810912d4>] local_apic_timer_interrupt+0x74/0xa0 arch/x86/kernel/apic/apic.c:937
 [<ffffffff8281b76c>] smp_apic_timer_interrupt+0x7c/0xb0 arch/x86/kernel/apic/apic.c:961
 [<ffffffff8281902d>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:648
 <EOI> 
 [<ffffffff82818214>] retint_kernel+0x1b/0x2d
 [<ffffffff812270c8>] vprintk_emit+0x448/0x790 kernel/printk/printk.c:1908
 [<ffffffff81227438>] vprintk+0x28/0x30 kernel/printk/printk.c:1918
 [<ffffffff8122745d>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1919
 [<ffffffff81402f9f>] vprintk_func kernel/printk/internal.h:36 [inline]
 [<ffffffff81402f9f>] printk+0xaf/0xd7 kernel/printk/printk.c:1980
 [<ffffffff8222d9e8>] lowmem_scan.cold.1+0x1f9/0x35b drivers/staging/android/lowmemorykiller.c:177
 [<ffffffff81449cc6>] do_shrink_slab mm/vmscan.c:398 [inline]
 [<ffffffff81449cc6>] shrink_slab.part.8+0x3c6/0xa00 mm/vmscan.c:501
 [<ffffffff814557fd>] shrink_slab mm/vmscan.c:465 [inline]
 [<ffffffff814557fd>] shrink_node+0x1ed/0x740 mm/vmscan.c:2602
 [<ffffffff814560c7>] shrink_zones mm/vmscan.c:2749 [inline]
 [<ffffffff814560c7>] do_try_to_free_pages mm/vmscan.c:2791 [inline]
 [<ffffffff814560c7>] try_to_free_pages+0x377/0xb80 mm/vmscan.c:3002
 [<ffffffff81428a01>] __perform_reclaim mm/page_alloc.c:3324 [inline]
 [<ffffffff81428a01>] __alloc_pages_direct_reclaim mm/page_alloc.c:3345 [inline]
 [<ffffffff81428a01>] __alloc_pages_slowpath mm/page_alloc.c:3697 [inline]
 [<ffffffff81428a01>] __alloc_pages_nodemask+0x981/0x1bd0 mm/page_alloc.c:3862
 [<ffffffff810bea92>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<ffffffff810bea92>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<ffffffff810bea92>] alloc_pages_node include/linux/gfp.h:460 [inline]
 [<ffffffff810bea92>] pte_alloc_one+0x22/0x100 arch/x86/mm/pgtable.c:29
 [<ffffffff8149d3e6>] __pte_alloc+0x26/0x1e0 mm/memory.c:570
 [<ffffffff814a0737>] copy_pte_range mm/memory.c:929 [inline]
 [<ffffffff814a0737>] copy_pmd_range mm/memory.c:1004 [inline]
 [<ffffffff814a0737>] copy_pud_range mm/memory.c:1026 [inline]
 [<ffffffff814a0737>] copy_page_range+0xff7/0x17a0 mm/memory.c:1088
 [<ffffffff810d7373>] dup_mmap kernel/fork.c:674 [inline]
 [<ffffffff810d7373>] dup_mm kernel/fork.c:1156 [inline]
 [<ffffffff810d7373>] copy_mm kernel/fork.c:1210 [inline]
 [<ffffffff810d7373>] copy_process.part.8+0x44f3/0x6a10 kernel/fork.c:1692
 [<ffffffff810d9d12>] copy_process kernel/fork.c:1505 [inline]
 [<ffffffff810d9d12>] _do_fork+0x1b2/0xd30 kernel/fork.c:1972
 [<ffffffff810da8ef>] sys_fork+0x1f/0x30 kernel/fork.c:2044
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
lowmemorykiller: Killing 'syz-executor.3' (30555) (tgid 30555), adj 1000,
   to free 35612kB on behalf of 'syz-executor.2' (27393) because
   cache 1560kB is below limit 6144kB for oom_score_adj 0
   Free memory is -13284kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (24648) (tgid 24637), adj 1000,
   to free 35528kB on behalf of 'syz-executor.2' (27393) because
   cache 1348kB is below limit 6144kB for oom_score_adj 0
   Free memory is -5608kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (24648) (tgid 24637), adj 1000,
   to free 35500kB on behalf of 'syz-executor.2' (27393) because
   cache 1260kB is below limit 6144kB for oom_score_adj 0
   Free memory is 1600kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (17872) (tgid 17872), adj 1000,
   to free 35468kB on behalf of 'syz-executor.2' (27393) because
   cache 1128kB is below limit 6144kB for oom_score_adj 0
   Free memory is -9116kB above reserved
warn_alloc: 1063 callbacks suppressed
syz-executor.2: 
syz-executor.2: page allocation stalls for 15100ms, order:1, mode:0x26040c0(GFP_KERNEL|__GFP_COMP|__GFP_NOTRACK)
CPU: 0 PID: 26982 Comm: syz-executor.2 Not tainted 4.9.141+ #1
 ffff88013f177848 ffffffff81b42e79 1ffff10027e2ef0b ffff8801a1ec4740
 ffffffff82a97480 0000000000000001 0000000000400000 ffff88013f177990
 ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff814fc7c8>] warn_alloc.cold.31+0x7f/0x9c mm/page_alloc.c:3068
 [<ffffffff814295e6>] __alloc_pages_slowpath mm/page_alloc.c:3721 [inline]
 [<ffffffff814295e6>] __alloc_pages_nodemask+0x1566/0x1bd0 mm/page_alloc.c:3862
 [<ffffffff814eb7e7>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<ffffffff814eb7e7>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<ffffffff814eb7e7>] alloc_slab_page mm/slub.c:1408 [inline]
 [<ffffffff814eb7e7>] allocate_slab mm/slub.c:1557 [inline]
 [<ffffffff814eb7e7>] new_slab+0x367/0x3d0 mm/slub.c:1635
 [<ffffffff814ed97d>] new_slab_objects mm/slub.c:2419 [inline]
 [<ffffffff814ed97d>] ___slab_alloc.constprop.33+0x2ed/0x470 mm/slub.c:2576
 [<ffffffff814edb50>] __slab_alloc.isra.25.constprop.32+0x50/0xa0 mm/slub.c:2618
 [<ffffffff814eddb2>] slab_alloc_node mm/slub.c:2681 [inline]
 [<ffffffff814eddb2>] slab_alloc mm/slub.c:2723 [inline]
 [<ffffffff814eddb2>] kmem_cache_alloc+0x212/0x2b0 mm/slub.c:2728
 [<ffffffff8153eca8>] getname_flags+0xc8/0x550 fs/namei.c:137
 [<ffffffff8153fa2f>] user_path_at_empty+0x2f/0x70 fs/namei.c:2578
 [<ffffffff81504470>] user_path_at include/linux/namei.h:55 [inline]
 [<ffffffff81504470>] SYSC_faccessat fs/open.c:395 [inline]
 [<ffffffff81504470>] SyS_faccessat+0x240/0x6e0 fs/open.c:363
 [<ffffffff81504932>] SYSC_access fs/open.c:443 [inline]
 [<ffffffff81504932>] SyS_access+0x22/0x30 fs/open.c:441
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Mem-Info:
active_anon:44484 inactive_anon:2554 isolated_anon:0
 active_file:91 inactive_file:95 isolated_file:110
 unevictable:0 dirty:0 writeback:0 unstable:0
 slab_reclaimable:6016 slab_unreclaimable:175608
 mapped:52444 shmem:4198 pagetables:143233 bounce:0
 free:6509 free_pcp:0 free_cma:0
Node 0 active_anon:177936kB inactive_anon:10216kB active_file:364kB inactive_file:380kB unevictable:0kB isolated(anon):0kB isolated(file):440kB mapped:209776kB dirty:0kB writeback:0kB shmem:16792kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no
DMA32 free:18696kB min:4696kB low:7712kB high:10728kB active_anon:12kB inactive_anon:4kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:7120kB kernel_stack:4768kB pagetables:5400kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
Normal free:7340kB min:5580kB low:9168kB high:12756kB active_anon:177924kB inactive_anon:10212kB active_file:364kB inactive_file:380kB unevictable:0kB writepending:0kB present:4718592kB managed:3589316kB mlocked:0kB slab_reclaimable:24064kB slab_unreclaimable:695312kB kernel_stack:193280kB pagetables:567532kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
DMA32: 16*4kB (UM) 6*8kB (M) 8*16kB (UM) 4*32kB (UM) 3*64kB (UM) 4*128kB (UM) 3*256kB (M) 1*512kB (M) 2*1024kB (M) 1*2048kB (M) 3*4096kB (M) = 18736kB
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap  = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
313617 pages reserved
syz-executor.2: page allocation stalls for 15100ms, order:1, mode:0x26040c0(GFP_KERNEL|__GFP_COMP|__GFP_NOTRACK)
CPU: 1 PID: 26986 Comm: syz-executor.2 Not tainted 4.9.141+ #1
 ffff880126de7848 ffffffff81b42e79 1ffff10024dbcf0b ffff88013fa7af80
 ffffffff82a97480 0000000000000001 0000000000400000 ffff880126de7990
 ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff814fc7c8>] warn_alloc.cold.31+0x7f/0x9c mm/page_alloc.c:3068
 [<ffffffff814295e6>] __alloc_pages_slowpath mm/page_alloc.c:3721 [inline]
 [<ffffffff814295e6>] __alloc_pages_nodemask+0x1566/0x1bd0 mm/page_alloc.c:3862
 [<ffffffff814eb7e7>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<ffffffff814eb7e7>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<ffffffff814eb7e7>] alloc_slab_page mm/slub.c:1408 [inline]
 [<ffffffff814eb7e7>] allocate_slab mm/slub.c:1557 [inline]
 [<ffffffff814eb7e7>] new_slab+0x367/0x3d0 mm/slub.c:1635
 [<ffffffff814ed97d>] new_slab_objects mm/slub.c:2419 [inline]
 [<ffffffff814ed97d>] ___slab_alloc.constprop.33+0x2ed/0x470 mm/slub.c:2576

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/02 07:57 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 7516d9fa .config console log report ci-android-49-kasan-gce
* Struck through repros no longer work on HEAD.