syzbot


BUG: soft lockup in mod_timer (2)

Status: upstream: reported syz repro on 2021/04/28 22:26
Reported-by: syzbot+7b205edfc2621f60b9ac@syzkaller.appspotmail.com
First crash: 475d, last: 32d

Fix bisection: failed (bisect log)
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: soft lockup in mod_timer 1 642d 642d 0/1 auto-closed as invalid on 2021/03/13 00:51
linux-4.14 BUG: soft lockup in mod_timer 1 626d 626d 0/1 auto-closed as invalid on 2021/03/28 13:44

Sample crash report:
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.3:7224]
Modules linked in:
irq event stamp: 4453295
hardirqs last  enabled at (4453294): [<ffffffff81003ce4>] trace_hardirqs_on_thunk+0x1a/0x1c
hardirqs last disabled at (4453295): [<ffffffff81003d00>] trace_hardirqs_off_thunk+0x1a/0x1c
softirqs last  enabled at (0): [<ffffffff81371c69>] copy_process.part.0+0x15b9/0x8260 kernel/fork.c:1855
softirqs last disabled at (81): [<ffffffff81393705>] invoke_softirq kernel/softirq.c:372 [inline]
softirqs last disabled at (81): [<ffffffff81393705>] irq_exit+0x215/0x260 kernel/softirq.c:412
CPU: 0 PID: 7224 Comm: syz-executor.3 Not tainted 4.19.206-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:184
Code: 48 c7 c0 c8 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 2f 48 83 3d fc 5e d8 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb b2 e8 3b 19 e7 f8 eb c0 0f 0b 0f 0b 48 c7 c7 c8
RSP: 0018:ffff8880ba007c28 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e3059 RBX: 0000000000000286 RCX: 1ffff110058509a5
RDX: dffffc0000000000 RSI: ffff88802c284d08 RDI: 0000000000000286
RBP: ffff8880ba022b40 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000022b40 R14: 0000000000000000 R15: ffff8880ba022b40
FS:  00007fbdfedfd700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000422330 CR3: 0000000028e76000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __mod_timer kernel/time/timer.c:1071 [inline]
 mod_timer+0x4ea/0x1010 kernel/time/timer.c:1114
 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1696 [inline]
 run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709
 __do_softirq+0x265/0x980 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x215/0x260 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3744
Code: 00 00 e8 2d 42 29 f9 e8 38 7c 4f f9 4c 89 e8 48 c1 e8 03 80 3c 18 00 75 69 48 83 3d 6b 48 d9 01 00 74 5b fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 40 d1 ff ff 48 c7 c0 d0 82 f1 89 48 c1 e8 03 80
RSP: 0018:ffff888025047a60 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e305b RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88802c284d04
RBP: ffffed1005850890 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88802c284480
R13: ffffffff89f182d8 R14: 0000000000000000 R15: 0000000000000000
 retint_kernel+0x1b/0x2d
RIP: 0010:futex_wake+0x138/0x480 kernel/futex.c:1683
Code: 48 89 c7 e8 6a 4d 40 00 48 89 d8 48 c1 e8 03 0f b6 14 28 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f7 02 00 00 8b 2b <31> ff 89 ee e8 3f 8f 0a 00 85 ed 75 5f e8 c6 8d 0a 00 48 8d 7c 24
RSP: 0018:ffff888025047b30 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000003 RBX: ffffc90000c7b980 RCX: ffffffff815804c6
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc90000c7b980
RBP: 0000000000000001 R08: 0000000000000000 R09: fffff5200018f730
R10: ffffc90000c7b983 R11: 0000000000000000 R12: 000000000056c0fc
R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000001
 do_futex+0x2ca/0x1880 kernel/futex.c:3894
 __do_sys_futex kernel/futex.c:3950 [inline]
 __se_sys_futex+0x28f/0x3b0 kernel/futex.c:3918
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbdfedfd218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 000000000056c0f8 RCX: 00000000004665f9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 000000000056c0fc
RBP: 000000000056c0f0 R08: 000000000000000e R09: 0000000000000000
R10: 0000000000000006 R11: 0000000000000246 R12: 000000000056c0fc
R13: 00007ffcfdb44fdf R14: 00007fbdfedfd300 R15: 0000000000022000
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 7216 Comm: syz-executor.0 Not tainted 4.19.206-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:109
Code: 3d 1c 04 3d 0b 01 7f 02 5d c3 89 ef 5d e9 10 cd c9 06 48 c7 c7 00 87 65 8c e8 24 e2 6f 00 eb df 66 90 89 ff 89 b7 00 c0 5f ff <c3> 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb 48
RSP: 0018:ffff8880ba1076d8 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: ffffffff89cfa1a0 RCX: 0000000000000020
RDX: 1ffffffff139f436 RSI: 00000000000000f9 RDI: 0000000000000380
RBP: ffff8880ba11e2c0 R08: ffffffff8c664058 R09: 0000000000000000
R10: 0000000000000007 R11: ffffffff8c66405b R12: 00000000000000f9
R13: 0000000000000000 R14: ffff8880ba124cc0 R15: ffff8880ba124d30
FS:  00007f29fa2e3700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000056c030 CR3: 0000000028db4000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 apic_write arch/x86/include/asm/apic.h:389 [inline]
 lapic_next_event+0x4d/0x80 arch/x86/kernel/apic/apic.c:460
 clockevents_program_event+0x234/0x350 kernel/time/clockevents.c:344
 tick_program_event+0xac/0x140 kernel/time/tick-oneshot.c:48
 hrtimer_interrupt+0x40a/0x9e0 kernel/time/hrtimer.c:1552
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline]
 smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:in_irqentry_text mm/kasan/kasan.c:419 [inline]
RIP: 0010:filter_irq_stacks mm/kasan/kasan.c:431 [inline]
RIP: 0010:save_stack mm/kasan/kasan.c:449 [inline]
RIP: 0010:set_track mm/kasan/kasan.c:460 [inline]
RIP: 0010:kasan_kmalloc+0x141/0x160 mm/kasan/kasan.c:553
Code: c0 89 44 24 08 74 0e 8d 50 ff 48 83 3c d6 ff 75 04 89 54 24 08 48 8d 7c 24 08 44 89 e6 e8 17 47 f0 01 89 45 04 e9 4a ff ff ff <48> 81 fa 00 00 40 88 72 09 48 81 fa 80 09 40 88 72 c0 83 c1 01 39
RSP: 0018:ffff8880ba1078f0 EFLAGS: 00000283 ORIG_RAX: ffffffffffffff13
RAX: 000000000000001f RBX: ffff88804eb692c0 RCX: 0000000000000002
RDX: ffffffff867086be RSI: ffff8880ba107910 RDI: 0000000000000286
RBP: ffff88804eb692c0 R08: 0000000000000000 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000074071 R12: 0000000000490220
R13: 0000000000000000 R14: ffff88813bff0940 R15: 0000000000000200
 slab_post_alloc_hook mm/slab.h:445 [inline]
 slab_alloc_node mm/slab.c:3340 [inline]
 kmem_cache_alloc_node_trace+0x13c/0x3b0 mm/slab.c:3666
 __do_kmalloc_node mm/slab.c:3688 [inline]
 __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3703
 __kmalloc_reserve net/core/skbuff.c:137 [inline]
 __alloc_skb+0xae/0x560 net/core/skbuff.c:205
 skb_copy+0x139/0x2f0 net/core/skbuff.c:1358
 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb8a/0x1330 drivers/net/wireless/mac80211_hwsim.c:1353
 mac80211_hwsim_tx_frame+0x12b/0x210 drivers/net/wireless/mac80211_hwsim.c:1556
 mac80211_hwsim_beacon_tx+0x3f8/0x680 drivers/net/wireless/mac80211_hwsim.c:1595
 __iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614
 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650
 mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615
 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601
 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522
 __do_softirq+0x265/0x980 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x215/0x260 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:free_the_page mm/page_alloc.c:4458 [inline]
RIP: 0010:__free_pages+0x5c/0xa0 mm/page_alloc.c:4467
Code: 89 e0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 53 8b 45 34 85 c0 74 3b be 04 00 00 00 4c 89 e7 e8 1a 64 19 00 f0 ff 4d 34 75 12 <45> 85 ed 75 13 48 89 ef 5d 41 5c 41 5d e9 22 fe ff ff 5d 41 5c 41
RSP: 0018:ffff8880257778b0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: fffff940004a2a87 RBX: ffff8880950b4600 RCX: ffffffff817eee26
RDX: fffff940004a2a87 RSI: 0000000000000004 RDI: ffffea0002515434
RBP: ffffea0002515400 R08: 0000000000000001 R09: fffff940004a2a86
R10: ffffea0002515437 R11: 0000000000000000 R12: ffffea0002515434
R13: 0000000000000003 R14: ffff8880ab08d840 R15: 0000000000000000
 free_thread_stack kernel/fork.c:270 [inline]
 release_task_stack kernel/fork.c:385 [inline]
 put_task_stack+0xd2/0x1f0 kernel/fork.c:396
 finish_task_switch+0x523/0x760 kernel/sched/core.c:2710
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x88f/0x2040 kernel/sched/core.c:3517
 preempt_schedule_irq+0xb0/0x140 kernel/sched/core.c:3744
 retint_kernel+0x1b/0x2d
RIP: 0010:preempt_schedule_common+0x0/0xc0 kernel/sched/core.c:3624
Code: 00 5b 5d c3 e8 f1 2f 80 f9 eb df e8 ea 2f 80 f9 e9 61 ff ff ff e8 70 2c 80 f9 e9 1c ff ff ff e8 b6 2e 80 f9 e9 7b ff ff ff 90 <41> 55 41 54 49 bc 00 00 00 00 00 fc ff df 55 65 48 8b 2c 25 c0 df
RSP: 0018:ffff888025777ae0 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000286 RBX: 1ffff11004aeef6c RCX: ffffffff81588f79
RDX: dffffc0000000000 RSI: ffffffff81589116 RDI: 0000000000000005
RBP: ffff888025777b30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: ffff88802fad82bc
 ___preempt_schedule+0x16/0x18
 smp_call_function_single+0x3bb/0x420 kernel/smp.c:304
 task_function_call+0xe0/0x170 kernel/events/core.c:115
 perf_install_in_context+0x238/0x3c0 kernel/events/core.c:2623
 __do_sys_perf_event_open kernel/events/core.c:10924 [inline]
 __se_sys_perf_event_open+0xe5d/0x2720 kernel/events/core.c:10549
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f29fa2e3188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 000000000056c0f0 RCX: 00000000004665f9
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020003640
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 000000000056c0f0
R13: 00007ffe57e30b8f R14: 00007f29fa2e3300 R15: 0000000000022000
----------------
Code disassembly (best guess):
   0:	48 c7 c0 c8 82 f1 89 	mov    $0xffffffff89f182c8,%rax
   7:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
   e:	fc ff df
  11:	48 c1 e8 03          	shr    $0x3,%rax
  15:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1)
  19:	75 2f                	jne    0x4a
  1b:	48 83 3d fc 5e d8 01 	cmpq   $0x0,0x1d85efc(%rip)        # 0x1d85f1f
  22:	00
  23:	74 15                	je     0x3a
  25:	48 89 df             	mov    %rbx,%rdi
  28:	57                   	push   %rdi
  29:	9d                   	popfq
* 2a:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1) <-- trapping instruction
  2f:	eb b2                	jmp    0xffffffe3
  31:	e8 3b 19 e7 f8       	callq  0xf8e71971
  36:	eb c0                	jmp    0xfffffff8
  38:	0f 0b                	ud2
  3a:	0f 0b                	ud2
  3c:	48                   	rex.W
  3d:	c7                   	.byte 0xc7
  3e:	c7                   	(bad)
  3f:	c8                   	.byte 0xc8

Crashes (24):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2021/09/06 04:34 linux-4.19.y b172b44fcb17 d236a457 .config log report syz BUG: soft lockup in mod_timer
ci2-linux-4-19 2022/07/15 18:56 linux-4.19.y 3f8a27f9e27b 5d921b08 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2022/06/29 16:32 linux-4.19.y 3f8a27f9e27b 1434eec0 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2022/05/02 09:43 linux-4.19.y 3f8a27f9e27b 2df221f6 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2022/04/16 02:48 linux-4.19.y 3f8a27f9e27b 8bcc32a6 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2022/04/12 11:23 linux-4.19.y 3f8a27f9e27b af01ee7d .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2022/04/09 05:17 linux-4.19.y 3f8a27f9e27b e22c3da3 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2022/04/01 06:02 linux-4.19.y 3f8a27f9e27b 68fc921a .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2022/01/15 20:33 linux-4.19.y 3f8a27f9e27b 723cfaf0 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/12/11 19:49 linux-4.19.y 3f8a27f9e27b 49ca1f59 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/11/28 21:22 linux-4.19.y 3f8a27f9e27b 63eeac02 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/11/11 13:41 linux-4.19.y 3f8a27f9e27b 75b04091 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/10/19 05:25 linux-4.19.y 3f8a27f9e27b 24dc29db .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/10/14 17:14 linux-4.19.y 3f8a27f9e27b 5462d470 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/10/07 22:57 linux-4.19.y 6db10b4d5efd efe0f24d .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/10/06 06:34 linux-4.19.y c2276d585654 0a63fd36 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/10/03 12:30 linux-4.19.y c2276d585654 db0f5787 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/09/26 19:16 linux-4.19.y c2276d585654 8cac236e .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/09/13 15:49 linux-4.19.y b172b44fcb17 3ce60af8 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/09/08 17:07 linux-4.19.y b172b44fcb17 e2776ee4 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/09/03 14:39 linux-4.19.y b172b44fcb17 d236a457 .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/09/02 17:38 linux-4.19.y e23d55af0e1f d0f0970b .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/08/20 22:31 linux-4.19.y 59456c9cc40c b599f2fc .config log report info BUG: soft lockup in mod_timer
ci2-linux-4-19 2021/04/28 22:25 linux-4.19.y 97a8651cadce 77e2b668 .config log report info BUG: soft lockup in mod_timer