syzbot

 sign-in | mailing list | source | docs
🐞 Open [78]
🐞 Fixed [22]
🐞 Invalid [343]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

BUG: soft lockup in NF_HOOK

Status: auto-obsoleted due to no activity on 2024/09/10 19:37
First crash: 343d, last: 343d
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in NF_HOOK (2) netfilter C inconclusive error 83 1d01h 223d 0/28 upstream: reported C repro on 2024/10/10 12:45
upstream INFO: rcu detected stall in NF_HOOK netfilter usb C error 13 321d 335d 0/28 closed as dup on 2024/06/20 17:29
linux-5.15 INFO: rcu detected stall in NF_HOOK 1 440d 440d 0/3 auto-obsoleted due to no activity on 2024/06/15 14:02
linux-5.15 INFO: rcu detected stall in NF_HOOK (3) 2 120d 139d 0/3 auto-obsoleted due to no activity on 2025/05/01 22:51
linux-6.1 INFO: rcu detected stall in NF_HOOK origin:lts-only syz unreliable 19 71d 351d 0/3 upstream: reported syz repro on 2024/06/04 14:31
linux-5.15 INFO: rcu detected stall in NF_HOOK (2) 1 323d 323d 0/3 auto-obsoleted due to no activity on 2024/10/11 06:09

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 123s! [syz-executor.3:9424]
Modules linked in:
CPU: 0 PID: 9424 Comm: syz-executor.3 Not tainted 5.4.274-syzkaller-00002-g6f97bd951d82 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:__sanitizer_cov_trace_switch+0x3f/0xc0 kernel/kcov.c:309
Code: f9 07 0f 87 9b 00 00 00 b8 8b 00 00 00 0f a3 c8 0f 83 8d 00 00 00 4c 8b 1e 4d 85 db 0f 84 81 00 00 00 4c 8b 04 cd 00 73 df 84 <4c> 8b 4c 24 20 65 4c 8b 15 44 4d 9e 7e 31 d2 eb 08 48 ff c2 49 39
RSP: 0018:ffff8881f6e09488 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
RAX: 000000000000008b RBX: ffff8881eeba0f08 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff863bd660 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: ffff8881f6e093e0
R10: 0000000000000000 R11: 0000000000000003 R12: ffff8881f6e09560
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8881eeba0f10
FS:  00007fd4833226c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd483fc8e7f CR3: 0000000005e0e000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 nf_hook_slow+0xc0/0x1e0 net/netfilter/core.c:508
 nf_hook_state_init include/linux/netfilter.h:152 [inline]
 nf_hook include/linux/netfilter.h:255 [inline]
 NF_HOOK+0x1e6/0x2a0 include/linux/netfilter.h:301
 __netif_receive_skb_list_ptype net/core/dev.c:5020 [inline]
 __netif_receive_skb_list_core+0x4e9/0x8f0 net/core/dev.c:5053
 __netif_receive_skb_list net/core/dev.c:5115 [inline]
 netif_receive_skb_list_internal+0x944/0xc90 net/core/dev.c:5210
 gro_normal_list net/core/dev.c:5321 [inline]
 gro_normal_one net/core/dev.c:5334 [inline]
 napi_skb_finish net/core/dev.c:5664 [inline]
 napi_gro_receive+0x49a/0xa60 net/core/dev.c:5696
 receive_buf+0x351c/0x51c0 drivers/net/virtio_net.c:1139
 virtnet_receive drivers/net/virtio_net.c:1403 [inline]
 virtnet_poll+0x5f3/0x1250 drivers/net/virtio_net.c:1512
 napi_poll net/core/dev.c:6367 [inline]
 net_rx_action+0x53f/0x1160 net/core/dev.c:6435
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 do_IRQ+0xd3/0x1e0 arch/x86/kernel/irq.c:263
 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:609
 </IRQ>
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x4d/0x80 kernel/locking/spinlock.c:191
Code: 74 0c 48 c7 c7 90 3b eb 85 e8 ef 12 43 fd 48 83 3d 47 2d 9a 01 00 74 36 48 89 df e8 5d e8 fa fc 66 90 4c 89 34 24 ff 34 24 9d <bf> 01 00 00 00 e8 d9 d4 f3 fc 65 8b 05 1e 7f b1 7b 85 c0 74 08 48
RSP: 0018:ffff8881ecc7efc0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffda
RAX: 0000000000000001 RBX: ffff8881ef3214c0 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff8881ef3214c0
RBP: ffff8881ecc7f030 R08: dffffc0000000000 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff8881f6e57b40
R13: ffff8881d20ecec0 R14: 0000000000000246 R15: ffff8881e3c2eeb8
 finish_task_switch+0x23e/0x590 kernel/sched/core.c:3470
 context_switch kernel/sched/core.c:3611 [inline]
 __schedule+0xb0d/0x1320 kernel/sched/core.c:4307
 preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:4558
 retint_kernel+0x1b/0x1b
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:91 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:108 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:134 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:165 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:181 [inline]
RIP: 0010:check_memory_region+0x6f/0x280 mm/kasan/generic.c:191
Code: 00 00 00 00 fc ff df 4f 8d 34 1a 4c 89 f5 4c 29 cd 48 83 fd 10 7f 26 48 85 ed 0f 84 3a 01 00 00 49 f7 d2 49 01 da 41 80 39 00 <0f> 85 c4 01 00 00 49 ff c1 49 ff c2 75 ee e9 1d 01 00 00 45 89 cf
RSP: 0018:ffff8881ecc7f288 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000001 RBX: 1ffff1103e4c6e79 RCX: ffffffff819895e6
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff8881f26373c8
RBP: 0000000000000001 R08: dffffc0000000000 R09: ffffed103e4c6e79
R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff8881f26373c8
R13: 1ffffffff0bf06a4 R14: ffffed103e4c6e7a R15: 00000000e140013c
 __clear_bit include/asm-generic/bitops-instrumented.h:71 [inline]
 __reset_page_owner+0x86/0x100 mm/page_owner.c:155
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 free_pcp_prepare mm/page_alloc.c:1233 [inline]
 free_unref_page_prepare+0x297/0x380 mm/page_alloc.c:3085
 free_unref_page_list+0x10a/0x590 mm/page_alloc.c:3154
 release_pages+0xad8/0xb20 mm/swap.c:842
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:189 [inline]
 tlb_flush_mmu+0xc8/0x170 mm/mmu_gather.c:196
 zap_pte_range mm/memory.c:1173 [inline]
 zap_pmd_range mm/memory.c:1222 [inline]
 zap_pud_range mm/memory.c:1251 [inline]
 zap_p4d_range mm/memory.c:1272 [inline]
 unmap_page_range+0x1d29/0x2620 mm/memory.c:1293
 unmap_single_vma mm/memory.c:1338 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1370
 exit_mmap+0x2bc/0x520 mm/mmap.c:3191
 __mmput+0x8e/0x2c0 kernel/fork.c:1101
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xdb1/0x1440 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7fd483fc8ea9
Code: Bad RIP value.
RSP: 002b:00007fd483322178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 00007fd484100058 RCX: 00007fd483fc8ea9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd484100058
RBP: 00007fd484100050 R08: 00007fd4833226c0 R09: 00007fd4833226c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd48410005c
R13: 000000000000000b R14: 00007ffe743f57d0 R15: 00007ffe743f58b8
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 1275 Comm: kworker/u4:4 Not tainted 5.4.274-syzkaller-00002-g6f97bd951d82 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:check_kcov_mode kernel/kcov.c:164 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x22/0x50 kernel/kcov.c:187
Code: 90 90 90 90 90 90 90 90 48 8b 04 24 65 48 8b 0d 54 51 9e 7e 65 8b 15 59 51 9e 7e f7 c2 00 01 1f 00 74 01 c3 8b 91 00 0a 00 00 <83> fa 02 75 f4 48 8b 91 08 0a 00 00 48 8b 32 48 8d 7e 01 8b 89 04
RSP: 0018:ffff8881e67c7898 EFLAGS: 00000246
RAX: ffffffff81598f01 RBX: 1ffff1103ccf8f1f RCX: ffff8881e6f82f40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff8881e67c7990 R08: ffffffff81598ed3 R09: ffffed103edcb189
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1103ccf8f18
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcbe894b000 CR3: 0000000005e0e000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 csd_lock_wait kernel/smp.c:109 [inline]
 smp_call_function_single+0x251/0x4a0 kernel/smp.c:311
 smp_call_function_many+0x6fe/0x9b0 kernel/smp.c:451
 smp_call_function kernel/smp.c:509 [inline]
 on_each_cpu+0xa5/0x1a0 kernel/smp.c:616
 text_poke_bp_batch+0x11a/0x2b0 arch/x86/kernel/alternative.c:1051
 arch_jump_label_transform_apply+0x27/0x40 arch/x86/kernel/jump_label.c:167
 static_key_enable_cpuslocked+0x12c/0x240 kernel/jump_label.c:177
 static_key_enable+0x16/0x20 kernel/jump_label.c:190
 toggle_allocation_gate+0xb1/0x240 mm/kfence/core.c:624
 process_one_work+0x765/0xd20 kernel/workqueue.c:2290
 worker_thread+0xaef/0x1470 kernel/workqueue.c:2436
 kthread+0x2da/0x360 kernel/kthread.c:288
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/12 19:32 android12-5.4 6f97bd951d82 f815599d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: soft lockup in NF_HOOK
* Struck through repros no longer work on HEAD.