syzbot


INFO: rcu detected stall in dccp_write_timer

Status: fixed on 2019/10/09 10:54
Subsystems: net
[Documentation on labels]
Fix commit: d4d6ec6dac07 sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
First crash: 1664d, last: 1662d

Sample crash report:
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	0-...!: (10490 ticks this GP) idle=37e/1/0x4000000000000004 softirq=37843/37843 fqs=0 
	(t=10500 jiffies g=46885 q=835)
rcu: rcu_preempt kthread starved for 10500 jiffies! g46885 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: RCU grace-period kthread stack dump:
rcu_preempt     I29392    10      2 0x80004000
Call Trace:
 context_switch kernel/sched/core.c:3254 [inline]
 __schedule+0x755/0x1580 kernel/sched/core.c:3880
 schedule+0xd9/0x260 kernel/sched/core.c:3947
 schedule_timeout+0x486/0xc50 kernel/time/timer.c:1807
 rcu_gp_fqs_loop kernel/rcu/tree.c:1611 [inline]
 rcu_gp_kthread+0x9b2/0x18c0 kernel/rcu/tree.c:1768
 kthread+0x361/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
NMI backtrace for cpu 0
CPU: 0 PID: 20972 Comm: syz-executor.1 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x70/0xb2 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x23b/0x28b lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x183/0x1cf kernel/rcu/tree_stall.h:254
 print_cpu_stall kernel/rcu/tree_stall.h:455 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:529 [inline]
 rcu_pending kernel/rcu/tree.c:2736 [inline]
 rcu_sched_clock_irq.cold+0x4dd/0xc13 kernel/rcu/tree.c:2183
 update_process_times+0x32/0x80 kernel/time/timer.c:1639
 tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:167
 tick_sched_timer+0x53/0x140 kernel/time/tick-sched.c:1296
 __run_hrtimer kernel/time/hrtimer.c:1389 [inline]
 __hrtimer_run_queues+0x364/0xe40 kernel/time/hrtimer.c:1451
 hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1106 [inline]
 smp_apic_timer_interrupt+0x160/0x610 arch/x86/kernel/apic/apic.c:1131
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:68 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x50 kernel/kcov.c:102
Code: 6d 9f e9 ff 48 c7 05 be 4c 19 09 00 00 00 00 e9 77 e9 ff ff 90 90 90 90 90 90 90 90 90 55 48 89 e5 65 48 8b 04 25 40 fe 01 00 <65> 8b 15 a4 88 8f 7e 81 e2 00 01 1f 00 48 8b 75 08 75 2b 8b 90 f0
RSP: 0018:ffff8880ae809178 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffff8880a4bc6180 RBX: ffff88808b653e38 RCX: ffffffff85c66409
RDX: 0000000000000100 RSI: ffff88808b653ec0 RDI: ffff88808b653e40
RBP: ffff8880ae809178 R08: ffff8880a4bc6180 R09: 0000000000000000
R10: fffffbfff134af9f R11: ffff8880a4bc6180 R12: dffffc0000000000
R13: ffff88808b653b40 R14: ffff88808b653ec0 R15: ffff88808b653ed0
 hhf_dequeue+0x506/0xa20 net/sched/sch_hhf.c:428
 dequeue_skb net/sched/sch_generic.c:263 [inline]
 qdisc_restart net/sched/sch_generic.c:366 [inline]
 __qdisc_run+0x1e5/0x1a00 net/sched/sch_generic.c:384
 __dev_xmit_skb net/core/dev.c:3533 [inline]
 __dev_queue_xmit+0x16f1/0x3650 net/core/dev.c:3838
 dev_queue_xmit+0x18/0x20 net/core/dev.c:3902
 arp_xmit_finish net/ipv4/arp.c:630 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 arp_xmit+0xdf/0x3f0 net/ipv4/arp.c:639
 arp_send_dst.part.0+0x202/0x280 net/ipv4/arp.c:317
 arp_send_dst net/ipv4/arp.c:390 [inline]
 arp_solicit+0x752/0x1380 net/ipv4/arp.c:389
 neigh_probe+0xc6/0x110 net/core/neighbour.c:1012
 __neigh_event_send+0x3e3/0x1760 net/core/neighbour.c:1172
 neigh_event_send include/net/neighbour.h:445 [inline]
 neigh_resolve_output+0x5cf/0x970 net/core/neighbour.c:1474
 neigh_output include/net/neighbour.h:511 [inline]
 ip_finish_output2+0x8a5/0x2570 net/ipv4/ip_output.c:228
 __ip_finish_output net/ipv4/ip_output.c:308 [inline]
 __ip_finish_output+0x5fc/0xb90 net/ipv4/ip_output.c:290
 ip_finish_output+0x38/0x1f0 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip_output+0x21f/0x640 net/ipv4/ip_output.c:432
 dst_output include/net/dst.h:436 [inline]
 ip_local_out+0xbb/0x190 net/ipv4/ip_output.c:125
 __ip_queue_xmit+0x86f/0x1bd0 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5a/0x70 include/net/ip.h:236
 dccp_transmit_skb+0x966/0x1290 net/dccp/output.c:138
 dccp_retransmit_skb+0x118/0x170 net/dccp/output.c:387
 dccp_retransmit_timer net/dccp/timer.c:101 [inline]
 dccp_write_timer+0x43f/0x1420 net/dccp/timer.c:153
 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1322
 expire_timers kernel/time/timer.c:1366 [inline]
 __run_timers kernel/time/timer.c:1685 [inline]
 __run_timers kernel/time/timer.c:1653 [inline]
 run_timer_softirq+0x697/0x17a0 kernel/time/timer.c:1698
 __do_softirq+0x262/0x98c kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x19b/0x1e0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:537 [inline]
 smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1133
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 </IRQ>
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:136 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:166 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:182 [inline]
RIP: 0010:check_memory_region+0x4f/0x1a0 mm/kasan/generic.c:192
Code: 01 00 00 4c 8d 5c 37 ff 49 89 f8 48 b8 00 00 00 00 00 fc ff df 4d 89 da 49 c1 e8 03 4d 8d 24 00 49 c1 ea 03 49 01 c2 4c 89 e0 <49> 8d 5a 01 49 89 d9 4d 29 e1 49 83 f9 10 0f 8e ad 00 00 00 45 89
RSP: 0018:ffff88806124f8d8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: fffff940004c06a8 RBX: ffffea0002603540 RCX: ffffffff81a81eee
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea0002603540
RBP: ffff88806124f8f0 R08: 1ffffd40004c06a8 R09: 0000000000000000
R10: fffff940004c06a8 R11: ffffea0002603547 R12: fffff940004c06a8
R13: 0000000000000000 R14: ffffea0002603548 R15: dead000000000100
 __kasan_check_read+0x11/0x20 mm/kasan/common.c:92
 test_bit include/asm-generic/bitops-instrumented.h:237 [inline]
 PageCompound include/linux/page-flags.h:188 [inline]
 PageHuge+0x1e/0x170 mm/hugetlb.c:1370
 page_remove_file_rmap mm/rmap.c:1221 [inline]
 page_remove_rmap+0x5de/0x1190 mm/rmap.c:1303
 zap_pte_range mm/memory.c:1059 [inline]
 zap_pmd_range mm/memory.c:1161 [inline]
 zap_pud_range mm/memory.c:1190 [inline]
 zap_p4d_range mm/memory.c:1211 [inline]
 unmap_page_range+0xd45/0x2170 mm/memory.c:1232
 unmap_single_vma+0x19d/0x300 mm/memory.c:1277
 unmap_vmas+0x135/0x280 mm/memory.c:1309
 exit_mmap+0x2ba/0x530 mm/mmap.c:3145
 __mmput kernel/fork.c:1064 [inline]
 mmput+0x179/0x4d0 kernel/fork.c:1085
 exit_mm kernel/exit.c:547 [inline]
 do_exit+0x84e/0x2e50 kernel/exit.c:866
 do_group_exit+0x135/0x360 kernel/exit.c:983
 __do_sys_exit_group kernel/exit.c:994 [inline]
 __se_sys_exit_group kernel/exit.c:992 [inline]
 __x64_sys_exit_group+0x44/0x50 kernel/exit.c:992
 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4598e9
Code: Bad RIP value.
RSP: 002b:00007ffe1d182288 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00000000004598e9
RDX: 00000000004135d1 RSI: fffffffffffffff7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffff R09: 00007ffe1d1822e0
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe1d1822e0 R14: 0000000000000000 R15: 00007ffe1d1822f0

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/10 01:31 net-old 28abe5796252 a60cb4cd .config console log report ci-upstream-net-this-kasan-gce
2019/09/09 13:05 net-old 28abe5796252 a60cb4cd .config console log report ci-upstream-net-this-kasan-gce
2019/09/09 09:23 net-old 28abe5796252 a60cb4cd .config console log report ci-upstream-net-this-kasan-gce
2019/09/09 01:02 net-old 28abe5796252 a60cb4cd .config console log report ci-upstream-net-this-kasan-gce
2019/09/07 07:25 net-old 74346c434cd2 a60cb4cd .config console log report ci-upstream-net-this-kasan-gce
* Struck through repros no longer work on HEAD.