syzbot


INFO: rcu detected stall in kjournald2

Status: auto-closed as invalid on 2022/07/30 15:32
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 218d, last: 218d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: soft lockup in kjournald2 (2) 6 358d 445d 0/24 closed as dup on 2021/09/17 07:37
upstream BUG: soft lockup in kjournald2 28 467d 619d 0/24 closed as dup on 2021/03/27 07:12

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	0-...!: (0 ticks this GP) idle=e8b/1/0x4000000000000000 softirq=104852/104852 fqs=0 
	(detected by 1, t=10506 jiffies, g=147465, q=44)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 2925 Comm: jbd2/sda1-8 Not tainted 5.18.0-rc4-syzkaller-00396-g57ae8a492116 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__this_cpu_preempt_check+0xd/0x20 lib/smp_processor_id.c:66
Code: 00 00 48 c7 c6 20 2e 27 8a 48 c7 c7 60 2e 27 8a e9 78 fe ff ff 0f 1f 84 00 00 00 00 00 55 48 89 fd 0f 1f 44 00 00 48 89 ee 5d <48> c7 c7 a0 2e 27 8a e9 57 fe ff ff cc cc cc cc cc cc cc 0f 1f 44
RSP: 0018:ffffc90000007df8 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff89cc5da0 RDI: ffffffff89cc5da0
RBP: ffff8880b9c2a5d8 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff81683f5c R11: 0000000000000000 R12: ffff88807f575880
R13: 0000000000000001 R14: 00000000ffffffff R15: ffff88807f5762e0
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4f697d8718 CR3: 000000005e1b4000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 lockdep_recursion_finish kernel/locking/lockdep.c:436 [inline]
 lock_is_held_type+0xd7/0x140 kernel/locking/lockdep.c:5685
 lock_is_held include/linux/lockdep.h:283 [inline]
 __run_hrtimer kernel/time/hrtimer.c:1651 [inline]
 __hrtimer_run_queues+0x95a/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:200
Code: 81 e1 00 01 00 00 65 48 8b 14 25 00 70 02 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 a4 15 00 00 85 c0 74 2b 8b 82 80 15 00 00 <83> f8 02 75 20 48 8b 8a 88 15 00 00 8b 92 84 15 00 00 48 8b 01 48
RSP: 0018:ffffc9000b33f988 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88807f575880 RSI: ffffffff81a3978c RDI: 0000000000000003
RBP: ffffea00015d3480 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff81a3977e R11: 0000000000000000 R12: ffffea00015d3480
R13: ffff8880112d2d98 R14: 0000000000036080 R15: ffff8880112d2d98
 arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
 hugetlb_free_vmemmap_enabled include/linux/page-flags.h:199 [inline]
 page_fixed_fake_head include/linux/page-flags.h:221 [inline]
 page_is_fake_head include/linux/page-flags.h:258 [inline]
 PageTail include/linux/page-flags.h:302 [inline]
 folio_flags.constprop.0+0x4c/0x150 include/linux/page-flags.h:329
 folio_test_unevictable include/linux/page-flags.h:568 [inline]
 folio_mark_accessed+0xf7/0xdd0 mm/swap.c:422
 touch_buffer fs/buffer.c:63 [inline]
 __find_get_block+0x2c8/0xe20 fs/buffer.c:1311
 jbd2_clear_buffer_revoked_flags+0x16c/0x2a0 fs/jbd2/revoke.c:498
 jbd2_journal_commit_transaction+0x974/0x6d80 fs/jbd2/commit.c:547
 kjournald2+0x1d0/0x930 fs/jbd2/journal.c:213
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10505 jiffies! g147465 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=0 timer-softirq=91266
rcu: rcu_preempt kthread starved for 10506 jiffies! g147465 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:28544 pid:   16 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5073 [inline]
 __schedule+0xa9a/0x4cc0 kernel/sched/core.c:6388
 schedule+0xd2/0x1f0 kernel/sched/core.c:6460
 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1884
 rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1971
 rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2144
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 2925 Comm: jbd2/sda1-8 Not tainted 5.18.0-rc4-syzkaller-00396-g57ae8a492116 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:pv_queued_spin_unlock arch/x86/include/asm/paravirt.h:596 [inline]
RIP: 0010:queued_spin_unlock arch/x86/include/asm/qspinlock.h:57 [inline]
RIP: 0010:do_raw_spin_unlock+0x167/0x230 kernel/locking/spinlock_debug.c:141
Code: ab bf 8b c7 45 08 ff ff ff ff 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 b6 00 00 00 48 83 3d 51 8d 61 0a 00 <74> 4b 48 89 ef e8 bf db ff ff 90 5d 41 5c 41 5d c3 48 c7 c6 60 c2
RSP: 0018:ffffc90000007cf0 EFLAGS: 00000086
RAX: 1ffffffff177f569 RBX: 0000000000000012 RCX: ffffffff815e1ce0
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffffff9083d860
RBP: ffffffff9083d860 R08: 0000000000000000 R09: ffffffff9083d863
R10: fffffbfff2107b0c R11: 0000000000000001 R12: ffffffff9083d868
R13: ffffffff9083d870 R14: 1ffff92000000fa7 R15: ffffffff89ce5f20
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4f697d8718 CR3: 000000005e1b4000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:150 [inline]
 _raw_spin_unlock_irqrestore+0x1e/0x70 kernel/locking/spinlock.c:194
 debug_object_activate+0x287/0x3e0 lib/debugobjects.c:689
 debug_hrtimer_activate kernel/time/hrtimer.c:420 [inline]
 debug_activate kernel/time/hrtimer.c:475 [inline]
 enqueue_hrtimer+0x27/0x3e0 kernel/time/hrtimer.c:1084
 __run_hrtimer kernel/time/hrtimer.c:1702 [inline]
 __hrtimer_run_queues+0xb02/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:200
Code: 81 e1 00 01 00 00 65 48 8b 14 25 00 70 02 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 a4 15 00 00 85 c0 74 2b 8b 82 80 15 00 00 <83> f8 02 75 20 48 8b 8a 88 15 00 00 8b 92 84 15 00 00 48 8b 01 48
RSP: 0018:ffffc9000b33f988 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88807f575880 RSI: ffffffff81a3978c RDI: 0000000000000003
RBP: ffffea00015d3480 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff81a3977e R11: 0000000000000000 R12: ffffea00015d3480
R13: ffff8880112d2d98 R14: 0000000000036080 R15: ffff8880112d2d98
 arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
 hugetlb_free_vmemmap_enabled include/linux/page-flags.h:199 [inline]
 page_fixed_fake_head include/linux/page-flags.h:221 [inline]
 page_is_fake_head include/linux/page-flags.h:258 [inline]
 PageTail include/linux/page-flags.h:302 [inline]
 folio_flags.constprop.0+0x4c/0x150 include/linux/page-flags.h:329
 folio_test_unevictable include/linux/page-flags.h:568 [inline]
 folio_mark_accessed+0xf7/0xdd0 mm/swap.c:422
 touch_buffer fs/buffer.c:63 [inline]
 __find_get_block+0x2c8/0xe20 fs/buffer.c:1311
 jbd2_clear_buffer_revoked_flags+0x16c/0x2a0 fs/jbd2/revoke.c:498
 jbd2_journal_commit_transaction+0x974/0x6d80 fs/jbd2/commit.c:547
 kjournald2+0x1d0/0x930 fs/jbd2/journal.c:213
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	48 c7 c6 20 2e 27 8a 	mov    $0xffffffff8a272e20,%rsi
   9:	48 c7 c7 60 2e 27 8a 	mov    $0xffffffff8a272e60,%rdi
  10:	e9 78 fe ff ff       	jmpq   0xfffffe8d
  15:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
  1c:	00
  1d:	55                   	push   %rbp
  1e:	48 89 fd             	mov    %rdi,%rbp
  21:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  26:	48 89 ee             	mov    %rbp,%rsi
  29:	5d                   	pop    %rbp
* 2a:	48 c7 c7 a0 2e 27 8a 	mov    $0xffffffff8a272ea0,%rdi <-- trapping instruction
  31:	e9 57 fe ff ff       	jmpq   0xfffffe8d
  36:	cc                   	int3
  37:	cc                   	int3
  38:	cc                   	int3
  39:	cc                   	int3
  3a:	cc                   	int3
  3b:	cc                   	int3
  3c:	cc                   	int3
  3d:	0f                   	.byte 0xf
  3e:	1f                   	(bad)
  3f:	44                   	rex.R

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2022/05/01 15:29 upstream 57ae8a492116 2df221f6 .config log report info INFO: rcu detected stall in kjournald2
* Struck through repros no longer work on HEAD.