syzbot

 sign-in | mailing list | source | docs
🐞 Open [979] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12473] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: rcu detected stall in sys_clone (6)

Status: auto-closed as invalid on 2022/08/23 03:28
Subsystems: kasan mm
[Documentation on labels]
First crash: 695d, last: 695d
▶ ▼ Similar bugs (13)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: rcu detected stall in sys_clone 1 134d 134d 0/3 auto-obsoleted due to no activity on 2024/03/15 18:08
linux-6.1 INFO: rcu detected stall in sys_clone 3 281d 353d 0/3 auto-obsoleted due to no activity on 2023/10/20 18:18
upstream INFO: rcu detected stall in sys_clone (2) mm 49 1507d 1624d 0/26 auto-closed as invalid on 2020/06/01 05:26
upstream INFO: rcu detected stall in sys_clone (4) kernel 1 1024d 1024d 0/26 auto-closed as invalid on 2021/09/27 17:49
upstream INFO: rcu detected stall in sys_clone (3) kernel 2 1360d 1382d 0/26 auto-closed as invalid on 2020/10/26 22:48
upstream INFO: rcu detected stall in sys_clone kernel 1 1680d 1680d 13/26 fixed on 2019/10/09 10:54
upstream INFO: rcu detected stall in sys_clone (8) mm C 14 3d01h 21d 0/26 upstream: reported C repro on 2024/03/29 00:16
linux-4.19 INFO: rcu detected stall in sys_clone 2 1578d 1597d 0/1 auto-closed as invalid on 2020/04/21 05:46
upstream INFO: rcu detected stall in sys_clone (5) kernfs 5 829d 928d 0/26 closed as invalid on 2022/02/08 10:00
upstream INFO: rcu detected stall in sys_clone (7) fs 1 430d 430d 0/26 auto-obsoleted due to no activity on 2023/05/14 17:18
linux-5.15 INFO: rcu detected stall in sys_clone (2) 1 23d 23d 0/3 upstream: reported on 2024/03/27 00:16
linux-6.1 INFO: rcu detected stall in sys_clone (2) 1 29d 29d 0/3 upstream: reported on 2024/03/20 15:17
android-5-15 BUG: soft lockup in sys_clone 2 1d13h 11d 0/2 premoderation: reported on 2024/04/07 21:07

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (0 ticks this GP) idle=689/1/0x4000000000000000 softirq=98579/98579 fqs=2 
	(detected by 0, t=10502 jiffies, g=137173, q=170 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 16682 Comm: syz-executor.5 Not tainted 5.18.0-syzkaller-01850-gaa051d36ce4a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4712 [inline]
RIP: 0010:__lock_acquire+0x63d/0x1f80 kernel/locking/lockdep.c:4972
Code: ff cd 0f 88 9e 00 00 00 89 eb 83 fd 31 73 79 48 8d 04 9b 49 8d 9c c7 80 0a 00 00 48 89 d8 48 c1 e8 03 0f b6 04 10 84 c0 75 1d <8b> 1b 48 8b 44 24 20 0f b6 04 10 84 c0 75 2e 41 33 5d 00 f7 c3 00
RSP: 0018:ffffc900001e0a28 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff88807be0c620 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffffff8fb2efc0
RBP: 0000000000000004 R08: dffffc0000000000 R09: fffffbfff1f65df9
R10: fffffbfff1f65df9 R11: 1ffffffff1f65df8 R12: 0000000000000005
R13: ffff88807be0c648 R14: ffff88807be0c558 R15: ffff88807be0bb00
FS:  00005555564ad400(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff26c0d53a5 CR3: 0000000027256000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5634
 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:269
 rcu_read_lock include/linux/rcupdate.h:695 [inline]
 advance_sched+0x67e/0x8c0 net/sched/sch_taprio.c:768
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x50b/0xa60 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x3a6/0xfd0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0xf9/0x280 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x8c/0xb0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20
RIP: 0010:lock_acquire+0x21e/0x400 kernel/locking/lockdep.c:5638
Code: 23 00 74 08 4c 89 f7 e8 50 2a 70 00 f6 44 24 61 02 0f 85 76 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 04 2c 00 00 00 00 43 c7 44 2c 09 00 00 00 00 43 c7 44 2c 11
RSP: 0018:ffffc90002d2f6e0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff920005a5ee8 RCX: ffff88807be0c558
RDX: dffffc0000000000 RSI: ffffffff8a8d2ee0 RDI: ffffffff8ae90120
RBP: ffffc90002d2f828 R08: dffffc0000000000 R09: fffffbfff1f65dfb
R10: fffffbfff1f65dfb R11: 1ffffffff1f65dfa R12: dffffc0000000000
R13: 1ffff920005a5ee4 R14: ffffc90002d2f740 R15: 0000000000000246
 fs_reclaim_acquire+0xa6/0x120 mm/page_alloc.c:4589
 might_alloc include/linux/sched/mm.h:262 [inline]
 slab_pre_alloc_hook mm/slab.h:722 [inline]
 slab_alloc_node mm/slub.c:3131 [inline]
 slab_alloc mm/slub.c:3225 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3232 [inline]
 kmem_cache_alloc+0x3a/0x2f0 mm/slub.c:3242
 anon_vma_chain_alloc mm/rmap.c:139 [inline]
 anon_vma_fork+0x1d0/0x540 mm/rmap.c:360
 dup_mmap+0x77c/0xde0 kernel/fork.c:660
 dup_mm+0x8c/0x310 kernel/fork.c:1526
 copy_mm+0x102/0x190 kernel/fork.c:1578
 copy_process+0x1856/0x3f70 kernel/fork.c:2239
 kernel_clone+0x22f/0x7a0 kernel/fork.c:2644
 __do_sys_clone kernel/fork.c:2761 [inline]
 __se_sys_clone kernel/fork.c:2745 [inline]
 __x64_sys_clone+0x289/0x310 kernel/fork.c:2745
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7ff6b48876fb
Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00
RSP: 002b:00007fff3974a3b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff6b48876fb
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 00005555564ad400
R10: 00005555564ad6d0 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff3974a490
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10489 jiffies! g137173 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=0 timer-softirq=87073
rcu: rcu_preempt kthread starved for 10490 jiffies! g137173 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:26424 pid:   16 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5076 [inline]
 __schedule+0x957/0xec0 kernel/sched/core.c:6391
 schedule+0xeb/0x1b0 kernel/sched/core.c:6463
 schedule_timeout+0x1b9/0x300 kernel/time/timer.c:1935
 rcu_gp_fqs_loop+0x2b9/0xfb0 kernel/rcu/tree.c:1999
 rcu_gp_kthread+0xa5/0x360 kernel/rcu/tree.c:2187
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 0
CPU: 0 PID: 3775 Comm: kworker/u4:10 Not tainted 5.18.0-syzkaller-01850-gaa051d36ce4a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound toggle_allocation_gate
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 nmi_cpu_backtrace+0x473/0x4a0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x168/0x280 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_check_gp_kthread_starvation+0x1da/0x250 kernel/rcu/tree_stall.h:518
 print_other_cpu_stall+0x140a/0x1560 kernel/rcu/tree_stall.h:623
 check_cpu_stall kernel/rcu/tree_stall.h:769 [inline]
 rcu_pending kernel/rcu/tree.c:3977 [inline]
 rcu_sched_clock_irq+0x9c4/0x19d0 kernel/rcu/tree.c:2675
 update_process_times+0x148/0x1b0 kernel/time/timer.c:1839
 tick_sched_handle kernel/time/tick-sched.c:243 [inline]
 tick_sched_timer+0x377/0x540 kernel/time/tick-sched.c:1481
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x4cb/0xa60 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x3a6/0xfd0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0xf9/0x280 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x8c/0xb0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20
RIP: 0010:csd_lock_wait kernel/smp.c:414 [inline]
RIP: 0010:smp_call_function_many_cond+0xf23/0x1500 kernel/smp.c:988
Code: 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 08 e8 e3 3e 0c 00 eb 46 90 f3 90 42 0f b6 04 3b 84 c0 75 11 41 f7 04 24 01 00 00 00 <74> 2b e8 c6 3e 0c 00 eb e4 44 89 e1 80 e1 07 80 c1 03 38 c1 7c e2
RSP: 0018:ffffc900042ef780 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 1ffff11017367fd9 RCX: ffff8880194a3b00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900042ef940 R08: ffffffff817a33a8 R09: fffffbfff1f65df9
R10: fffffbfff1f65df9 R11: 1ffffffff1f65df8 R12: ffff8880b9b3fec8
R13: 1ffff110173475a0 R14: 0000000000000001 R15: dffffc0000000000
 on_each_cpu_cond_mask+0x3b/0x80 kernel/smp.c:1154
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1184 [inline]
 text_poke_bp_batch+0x31d/0x960 arch/x86/kernel/alternative.c:1372
 text_poke_flush arch/x86/kernel/alternative.c:1542 [inline]
 text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1549
 arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x129/0x250 kernel/jump_label.c:177
 static_key_enable+0x16/0x20 kernel/jump_label.c:190
 toggle_allocation_gate+0xbf/0x470 mm/kfence/core.c:774
 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289
 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>
----------------
Code disassembly (best guess):
   0:	ff cd                	dec    %ebp
   2:	0f 88 9e 00 00 00    	js     0xa6
   8:	89 eb                	mov    %ebp,%ebx
   a:	83 fd 31             	cmp    $0x31,%ebp
   d:	73 79                	jae    0x88
   f:	48 8d 04 9b          	lea    (%rbx,%rbx,4),%rax
  13:	49 8d 9c c7 80 0a 00 	lea    0xa80(%r15,%rax,8),%rbx
  1a:	00
  1b:	48 89 d8             	mov    %rbx,%rax
  1e:	48 c1 e8 03          	shr    $0x3,%rax
  22:	0f b6 04 10          	movzbl (%rax,%rdx,1),%eax
  26:	84 c0                	test   %al,%al
  28:	75 1d                	jne    0x47
* 2a:	8b 1b                	mov    (%rbx),%ebx <-- trapping instruction
  2c:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
  31:	0f b6 04 10          	movzbl (%rax,%rdx,1),%eax
  35:	84 c0                	test   %al,%al
  37:	75 2e                	jne    0x67
  39:	41 33 5d 00          	xor    0x0(%r13),%ebx
  3d:	f7                   	.byte 0xf7
  3e:	c3                   	retq

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/05/25 03:22 upstream aa051d36ce4a 647c0e27 .config console log report info ci-upstream-kasan-gce-smack-root INFO: rcu detected stall in sys_clone
* Struck through repros no longer work on HEAD.