syzbot


BUG: soft lockup in garp_join_timer_arm

Status: closed as invalid on 2024/09/03 15:13
Subsystems: kernel
[Documentation on labels]
First crash: 184d, last: 184d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: soft lockup in garp_join_timer_arm 1 1210d 1210d 0/1 auto-closed as invalid on 2022/02/02 23:13

Sample crash report:
R13: 00007f22a3f06058 R14: 0000000000000003 R15: 0000000000000c03
 </TASK>
watchdog: BUG: soft lockup - CPU#1 stuck for 244s! [syz.5.3410:19888]
Modules linked in:
irq event stamp: 410107
hardirqs last  enabled at (410106): [<ffffffff85027e16>] get_random_u32+0x586/0x7e0 drivers/char/random.c:545
hardirqs last disabled at (410107): [<ffffffff8b1236ae>] sysvec_apic_timer_interrupt+0xe/0xb0 arch/x86/kernel/apic/apic.c:1043
softirqs last  enabled at (5760): [<ffffffff81500b3e>] softirq_handle_end kernel/softirq.c:400 [inline]
softirqs last  enabled at (5760): [<ffffffff81500b3e>] handle_softirqs+0x5be/0x8f0 kernel/softirq.c:582
softirqs last disabled at (5765): [<ffffffff8150186b>] __do_softirq kernel/softirq.c:588 [inline]
softirqs last disabled at (5765): [<ffffffff8150186b>] invoke_softirq kernel/softirq.c:428 [inline]
softirqs last disabled at (5765): [<ffffffff8150186b>] __irq_exit_rcu kernel/softirq.c:637 [inline]
softirqs last disabled at (5765): [<ffffffff8150186b>] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
CPU: 1 UID: 0 PID: 19888 Comm: syz.5.3410 Not tainted 6.10.0-syzkaller-12708-g2f8c4f506285 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:get_random_u32+0x435/0x7e0 drivers/char/random.c:545
Code: fc 4d 85 e4 0f 85 67 01 00 00 e8 d6 5e 89 fc 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 f4 59 89 fc 48 85 db 0f 85 88 01 00 00 <e8> b6 5e 89 fc 8b 5c 24 38 e8 ad 5e 89 fc 48 b8 00 00 00 00 00 fc
RSP: 0018:ffffc90000a18b78 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff85027e28
RDX: ffff88806e940000 RSI: ffffffff85027e36 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000088c18cca R12: 0000000000000200
R13: ffff8880b933ac08 R14: 1ffff92000143172 R15: ffff8880b933ac18
FS:  000055559124e500(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c478d44 CR3: 000000001fcd6000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __get_random_u32_below+0x18/0xa0 drivers/char/random.c:559
 get_random_u32_below include/linux/random.h:63 [inline]
 garp_join_timer_arm+0x1f/0x70 net/802/garp.c:411
 call_timer_fn+0x1a3/0x610 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1843 [inline]
 __run_timers+0x74b/0xaf0 kernel/time/timer.c:2417
 __run_timer_base kernel/time/timer.c:2428 [inline]
 __run_timer_base kernel/time/timer.c:2421 [inline]
 run_timer_base+0x111/0x190 kernel/time/timer.c:2437
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
 handle_softirqs+0x219/0x8f0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__schedule+0xe3f/0x5490 kernel/sched/core.c:6399
Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 ba 3f 00 00 48 8b bd 10 ff ff ff 4d 89 77 10 4c 89 f6 e8 b9 f4 ec f5 48 89 c7 e8 11 f9 48 f6 <48> 8b 8d a0 fe ff ff 48 b8 00 00 00 00 00 fc ff df 48 01 c1 48 c7
RSP: 0018:ffffc90009787980 EFLAGS: 00000202
RAX: 0000000000001683 RBX: ffff88806e940000 RCX: 1ffffffff20266f1
RDX: 0000000000000000 RSI: ffffffff8b4cd7c0 RDI: ffffffff8bb0b940
RBP: ffffc90009787b10 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90137bdf R11: 0000000000000000 R12: ffff8880b933f908
R13: 0000000000000000 R14: ffff88806e940000 R15: ffff8880b933ee00
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6708
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
 class_preempt_destructor include/linux/preempt.h:480 [inline]
 class_preempt_destructor include/linux/preempt.h:480 [inline]
 try_to_wake_up+0xc08/0x13e0 kernel/sched/core.c:4022
 wake_up_process kernel/sched/core.c:4299 [inline]
 wake_up_q+0x91/0x140 kernel/sched/core.c:1029
 futex_wake+0x43e/0x4e0 kernel/futex/waitwake.c:199
 do_futex+0x1e5/0x350 kernel/futex/syscalls.c:107
 __do_sys_futex kernel/futex/syscalls.c:179 [inline]
 __se_sys_futex kernel/futex/syscalls.c:160 [inline]
 __x64_sys_futex+0x1e1/0x4c0 kernel/futex/syscalls.c:160
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f22a3d77299
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd7a7be148 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007f22a3f06058 RCX: 00007f22a3d77299
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f22a3f06060
RBP: 00007f22a3f06064 R08: 00007f22a3f05f80 R09: 00007ffd7a7be42f
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f22a3f06058 R14: 0000000000000003 R15: 0000000000000c03
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
NMI backtrace for cpu 0 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline]
NMI backtrace for cpu 0 skipped: idling at acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:111

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/27 03:58 upstream 2f8c4f506285 46eb10b7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root BUG: soft lockup in garp_join_timer_arm
* Struck through repros no longer work on HEAD.