syzbot


INFO: rcu detected stall in mmap_pgoff

Status: closed as invalid on 2022/02/08 10:00
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 395d, last: 387d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: rcu detected stall in mmap_pgoff syz error 2 593d 662d 0/1 upstream: reported syz repro on 2021/02/11 18:33
upstream INFO: rcu detected stall in mmap_pgoff (2) 1 283d 283d 0/24 auto-closed as invalid on 2022/05/26 19:52

Sample crash report:
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	1-...!: (10499 ticks this GP) idle=cbd/1/0x4000000000000000 softirq=31836/31836 fqs=37 
	(t=10500 jiffies g=53921 q=240)
rcu: rcu_preempt kthread starved for 10416 jiffies! g53921 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28688 pid:   14 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4969 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6250
 schedule+0xd2/0x260 kernel/sched/core.c:6323
 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881
 rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1955
 rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2128
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 14667 Comm: syz-executor.0 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:loop1+0x218/0x892
Code: f1 16 45 01 ef c5 25 ef da 45 31 e6 44 01 f8 c4 43 7b f0 e1 02 c4 42 25 00 dc c5 a5 fe e0 45 31 e6 45 89 cc 45 21 dc 44 09 e6 <44> 01 f2 44 01 fa 01 f2 c5 55 fe 8f e0 72 16 8b c5 7d 7f 4c 3c 20
RSP: 0018:ffffc900058773a0 EFLAGS: 00000286
RAX: 00000000bf27116c RBX: 0000000029978534 RCX: 00000000632ac510
RDX: 0000000037dc916f RSI: 00000000f53cc92b RDI: 0000000000000000
RBP: ffffc900058775c0 R08: 00000000713a6164 R09: 00000000f4b44d35
R10: 00000000bf5e888b R11: 00000000e529e12a R12: 00000000e4204120
R13: 00000000bde1f6f0 R14: 00000000c5b6613d R15: 000000002f0cdc40
FS:  00007f9b0fa94700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9b0fa94718 CR3: 000000007e676000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 sha256_base_do_update include/crypto/sha256_base.h:65 [inline]
 _sha256_update arch/x86/crypto/sha256_ssse3_glue.c:62 [inline]
 _sha256_update+0x1d8/0x200 arch/x86/crypto/sha256_ssse3_glue.c:46
 crypto_shash_update+0xc4/0x120 crypto/shash.c:131
 ima_calc_file_hash_tfm+0x2e8/0x3b0 security/integrity/ima/ima_crypto.c:495
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline]
 ima_calc_file_hash+0x19d/0x4b0 security/integrity/ima/ima_crypto.c:572
 ima_collect_measurement+0x4c9/0x570 security/integrity/ima/ima_api.c:254
 process_measurement+0xd37/0x1920 security/integrity/ima/ima_main.c:337
 ima_file_mmap+0x10a/0x130 security/integrity/ima/ima_main.c:412
 security_mmap_file+0x15f/0x1b0 security/security.c:1586
 vm_mmap_pgoff+0xd3/0x290 mm/util.c:515
 ksys_mmap_pgoff+0x1c7/0x5a0 mm/mmap.c:1623
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f9b1253fae9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9b0fa94188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f9b12653020 RCX: 00007f9b1253fae9
RDX: 0000000000000004 RSI: 00007ffffffff000 RDI: 0000000020c00000
RBP: 00007f9b12599f6d R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000040032 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9b12b86b2f R14: 00007f9b0fa94300 R15: 0000000000022000
 </TASK>
NMI backtrace for cpu 1
CPU: 1 PID: 14654 Comm: syz-executor.0 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343
 print_cpu_stall kernel/rcu/tree_stall.h:627 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:711 [inline]
 rcu_pending kernel/rcu/tree.c:3878 [inline]
 rcu_sched_clock_irq.cold+0x9d/0x746 kernel/rcu/tree.c:2597
 update_process_times+0x16d/0x200 kernel/time/timer.c:1785
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
 tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1421
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:loop3+0x6e/0x37d
Code: e6 41 89 c4 21 de 41 21 cc 45 01 ef 45 01 d8 44 09 e6 45 01 f3 45 01 f8 45 01 fb 41 89 d7 c4 43 7b f0 e8 19 c4 43 7b f0 f0 0b <45> 31 cf 45 31 f5 c4 43 7b f0 f0 06 45 21 c7 41 01 f3 45 31 f5 c4
RSP: 0018:ffffc900057173a0 EFLAGS: 00000a03
RAX: 00000000a07cc95b RBX: 00000000511eda99 RCX: 00000000add325e8
RDX: 00000000cd333741 RSI: 00000000a15ec9d9 RDI: 0000000000000040
RBP: ffffc900057175c0 R08: 00000000bdf9d6f7 R09: 000000005ac01018
R10: 00000000649a9346 R11: 000000007809b249 R12: 00000000a0500148
R13: 00000000fceb7bde R14: 00000000def7bf3a R15: 00000000cd333741
 sha256_base_do_update include/crypto/sha256_base.h:65 [inline]
 _sha256_update arch/x86/crypto/sha256_ssse3_glue.c:62 [inline]
 _sha256_update+0x1d8/0x200 arch/x86/crypto/sha256_ssse3_glue.c:46
 crypto_shash_update+0xc4/0x120 crypto/shash.c:131
 ima_calc_file_hash_tfm+0x2e8/0x3b0 security/integrity/ima/ima_crypto.c:495
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline]
 ima_calc_file_hash+0x19d/0x4b0 security/integrity/ima/ima_crypto.c:572
 ima_collect_measurement+0x4c9/0x570 security/integrity/ima/ima_api.c:254
 process_measurement+0xd37/0x1920 security/integrity/ima/ima_main.c:337
 ima_file_mmap+0x10a/0x130 security/integrity/ima/ima_main.c:412
 security_mmap_file+0x15f/0x1b0 security/security.c:1586
 vm_mmap_pgoff+0xd3/0x290 mm/util.c:515
 ksys_mmap_pgoff+0x1c7/0x5a0 mm/mmap.c:1623
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f9b1253fae9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9b0fab5188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f9b12652f60 RCX: 00007f9b1253fae9
RDX: 0000000000000004 RSI: 00007ffffffff000 RDI: 0000000020c00000
RBP: 00007f9b12599f6d R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000040032 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9b12b86b2f R14: 00007f9b0fab5300 R15: 0000000000022000
 </TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	45 01 ef             	add    %r13d,%r15d
   3:	c5 25 ef da          	vpxor  %ymm2,%ymm11,%ymm11
   7:	45 31 e6             	xor    %r12d,%r14d
   a:	44 01 f8             	add    %r15d,%eax
   d:	c4 43 7b f0 e1 02    	rorx   $0x2,%r9d,%r12d
  13:	c4 42 25 00 dc       	vpshufb %ymm12,%ymm11,%ymm11
  18:	c5 a5 fe e0          	vpaddd %ymm0,%ymm11,%ymm4
  1c:	45 31 e6             	xor    %r12d,%r14d
  1f:	45 89 cc             	mov    %r9d,%r12d
  22:	45 21 dc             	and    %r11d,%r12d
  25:	44 09 e6             	or     %r12d,%esi
* 28:	44 01 f2             	add    %r14d,%edx <-- trapping instruction
  2b:	44 01 fa             	add    %r15d,%edx
  2e:	01 f2                	add    %esi,%edx
  30:	c5 55 fe 8f e0 72 16 	vpaddd -0x74e98d20(%rdi),%ymm5,%ymm9
  37:	8b
  38:	c5 7d 7f 4c 3c 20    	vmovdqa %ymm9,0x20(%rsp,%rdi,1)

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce 2021/11/14 04:40 upstream ccfff0a2bd2a 83f5c9b5 .config log report info INFO: rcu detected stall in mmap_pgoff
ci-upstream-kasan-gce 2021/11/09 03:31 upstream e851dfae4371 8ab17e57 .config log report info INFO: rcu detected stall in mmap_pgoff
ci-upstream-kasan-gce-root 2021/11/06 05:35 upstream d4439a1189f9 4c1be0be .config log report info INFO: rcu detected stall in mmap_pgoff
* Struck through repros no longer work on HEAD.