syzbot


INFO: rcu detected stall in chrdev_open (3)

Status: upstream: reported C repro on 2021/03/22 19:09
Reported-by: syzbot+ac22ddb8d624dc741fad@syzkaller.appspotmail.com
First crash: 563d, last: 9d18h

Fix bisection: failed (bisect log)
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: rcu detected stall in chrdev_open (2) 1 874d 874d 0/1 auto-closed as invalid on 2020/09/12 23:19
linux-4.14 INFO: rcu detected stall in chrdev_open C error 4 184d 290d 0/1 upstream: reported C repro on 2021/12/21 07:54
linux-4.19 INFO: rcu detected stall in chrdev_open 1 1008d 1008d 0/1 auto-closed as invalid on 2020/05/02 02:53
upstream INFO: rcu detected stall in chrdev_open (2) C done inconclusive 55 262d 1029d 0/24 closed as invalid on 2022/02/08 10:45
upstream INFO: rcu detected stall in chrdev_open 4 1038d 1039d 0/24 closed as invalid on 2019/12/04 14:04

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	(detected by 1, t=10502 jiffies, g=4301, q=93)
rcu: All QSes seen, last rcu_preempt kthread activity 10502 (4294978587-4294968085), jiffies_till_next_fqs=1, root ->qsmask 0x0
syz-executor438 R  running task    26904  8296   8092 0x00000000
Call Trace:
 <IRQ>
 sched_show_task.cold+0x332/0x396 kernel/sched/core.c:5337
 print_other_cpu_stall kernel/rcu/tree.c:1430 [inline]
 check_cpu_stall kernel/rcu/tree.c:1557 [inline]
 __rcu_pending kernel/rcu/tree.c:3293 [inline]
 rcu_pending kernel/rcu/tree.c:3336 [inline]
 rcu_check_callbacks.cold+0xb37/0xe19 kernel/rcu/tree.c:2682
 update_process_times+0x2a/0x70 kernel/time/timer.c:1650
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:168
 tick_sched_timer+0xfc/0x290 kernel/time/tick-sched.c:1278
 __run_hrtimer kernel/time/hrtimer.c:1465 [inline]
 __hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1527
 hrtimer_interrupt+0x326/0x9e0 kernel/time/hrtimer.c:1585
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline]
 smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:unwind_next_frame+0xe40/0x1400 arch/x86/kernel/unwind_orc.c:571
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 03 00 00 4d 89 66 40 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 0f b6 04 02 <84> c0 74 08 3c 03 0f 8e a0 03 00 00 41 39 2e 0f 85 8f 00 00 00 48
RSP: 0018:ffff888094be74b8 EFLAGS: 00000a06 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 1ffff1101297cea0 RCX: 0000000000000000
RDX: 1ffff1101297cebd RSI: ffff888094be7448 RDI: ffff888094be7f38
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001
R10: ffff888094be7647 R11: 0000000000074071 R12: ffff888094be7f58
R13: ffff888094be761d R14: ffff888094be75e8 R15: ffffffff8b8cd904
 __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553
 slab_post_alloc_hook mm/slab.h:445 [inline]
 slab_alloc mm/slab.c:3397 [inline]
 kmem_cache_alloc_trace+0x11a/0x380 mm/slab.c:3623
 kmalloc include/linux/slab.h:515 [inline]
 tty_alloc_file drivers/tty/tty_io.c:187 [inline]
 tty_open+0x138/0x990 drivers/tty/tty_io.c:2023
 chrdev_open+0x266/0x770 fs/char_dev.c:423
 do_dentry_open+0x4aa/0x1160 fs/open.c:796
 do_last fs/namei.c:3421 [inline]
 path_openat+0x793/0x2df0 fs/namei.c:3537
 do_filp_open+0x18c/0x3f0 fs/namei.c:3567
 do_sys_open+0x3b3/0x520 fs/open.c:1085
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f0abc52faf9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0abc4e1318 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f0abc5b73e8 RCX: 00007f0abc52faf9
RDX: 0000000000000802 RSI: 0000000020000840 RDI: ffffffffffffff9c
RBP: 00007f0abc5b73e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 7974742f7665642f
R13: 00007fff488ba54f R14: 00007f0abc4e1400 R15: 0000000000022000
rcu: rcu_preempt kthread starved for 10502 jiffies! g4301 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: RCU grace-period kthread stack dump:
rcu_preempt     R  running task    29760    10      2 0x80000000
Call Trace:
 context_switch kernel/sched/core.c:2828 [inline]
 __schedule+0x887/0x2040 kernel/sched/core.c:3517
 schedule+0x8d/0x1b0 kernel/sched/core.c:3561
 schedule_timeout+0x4cf/0xfe0 kernel/time/timer.c:1818
 rcu_gp_kthread+0xdad/0x21c0 kernel/rcu/tree.c:2202
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
----------------
Code disassembly (best guess):
   0:	48 89 fa             	mov    %rdi,%rdx
   3:	48 c1 ea 03          	shr    $0x3,%rdx
   7:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   b:	0f 85 28 03 00 00    	jne    0x339
  11:	4d 89 66 40          	mov    %r12,0x40(%r14)
  15:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1c:	fc ff df
  1f:	4c 89 f2             	mov    %r14,%rdx
  22:	48 c1 ea 03          	shr    $0x3,%rdx
  26:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	74 08                	je     0x36
  2e:	3c 03                	cmp    $0x3,%al
  30:	0f 8e a0 03 00 00    	jle    0x3d6
  36:	41 39 2e             	cmp    %ebp,(%r14)
  39:	0f 85 8f 00 00 00    	jne    0xce
  3f:	48                   	rex.W

Crashes (17):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2021/10/25 09:37 linux-4.19.y 3f8a27f9e27b 4f0000ee .config log report syz C INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2021/10/23 18:32 linux-4.19.y 3f8a27f9e27b 282f03fb .config log report syz C INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2021/10/20 18:14 linux-4.19.y 3f8a27f9e27b 418a00eb .config log report syz C INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2021/10/04 17:09 linux-4.19.y c2276d585654 ce697b49 .config log report syz C INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2021/03/22 23:13 linux-4.19.y 125222814e7b 8092f30d .config log report syz C INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2022/09/27 14:56 linux-4.19.y 3f8a27f9e27b 10323ddf .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2022/04/07 03:59 linux-4.19.y 3f8a27f9e27b 53c67432 .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2022/04/06 16:11 linux-4.19.y 3f8a27f9e27b 97582466 .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2022/04/01 01:59 linux-4.19.y 3f8a27f9e27b 68fc921a .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2022/04/01 01:30 linux-4.19.y 3f8a27f9e27b 68fc921a .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2022/03/31 00:09 linux-4.19.y 3f8a27f9e27b 9d49f3a7 .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2022/03/24 09:30 linux-4.19.y 3f8a27f9e27b 89bc8608 .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2021/10/09 12:52 linux-4.19.y e34184f53363 838e7e2c .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2021/10/02 03:37 linux-4.19.y c2276d585654 db0f5787 .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2021/07/09 08:33 linux-4.19.y 9f84340f012e 281e815f .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2021/03/22 19:08 linux-4.19.y 125222814e7b 8092f30d .config log report info INFO: rcu detected stall in chrdev_open
ci2-linux-4-19 2021/05/18 13:45 linux-4.19.y 3c8c23092588 a343ba6b .config log report info BUG: soft lockup in chrdev_open
* Struck through repros no longer work on HEAD.