Kernel | Title | Rank 🛈 | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|---|
upstream | INFO: rcu detected stall in mremap kasan mm | 1 | 1 | 1294d | 1294d | 0/29 | closed as invalid on 2022/02/08 10:10 |
syzbot |
sign-in | mailing list | source | docs |
Kernel | Title | Rank 🛈 | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|---|
upstream | INFO: rcu detected stall in mremap kasan mm | 1 | 1 | 1294d | 1294d | 0/29 | closed as invalid on 2022/02/08 10:10 |
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 0-...!: (1 GPs behind) idle=85e4/1/0x4000000000000000 softirq=80096/80097 fqs=0 rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P16902/1:b..l rcu: (detected by 1, t=10502 jiffies, g=64305, q=252 ncpus=2) Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 16933 Comm: syz.1.2938 Not tainted 6.14.0-rc7-syzkaller-00205-g586de92313fc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:__lock_acquire+0x263/0x3c40 kernel/locking/lockdep.c:5154 Code: 41 0f b7 56 20 8b 7c 24 20 81 e2 ff 1f 00 00 39 fa 75 0c 48 83 7c 24 10 00 0f 85 36 0d 00 00 48 8b 44 24 28 44 0f b7 74 24 20 <49> 01 c7 49 8d 47 20 66 41 81 e6 ff 1f 48 89 c2 48 89 44 24 38 48 RSP: 0018:ffffc90000007ab0 EFLAGS: 00000006 RAX: ffff888039e45370 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 000000000000006f RSI: 1ffff110073c8a77 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 R10: 000000000000000a R11: 0000000000000001 R12: ffffffff9aaa4788 R13: ffff888039e44880 R14: 0000000000000000 R15: 0000000000000050 FS: 00007fed5f3966c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555572fa2808 CR3: 000000005a5d2000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <IRQ> lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 debug_object_activate+0x149/0x4a0 lib/debugobjects.c:818 debug_hrtimer_activate kernel/time/hrtimer.c:455 [inline] debug_activate kernel/time/hrtimer.c:496 [inline] enqueue_hrtimer+0x25/0x3c0 kernel/time/hrtimer.c:1100 __run_hrtimer kernel/time/hrtimer.c:1818 [inline] __hrtimer_run_queues+0x903/0xae0 kernel/time/hrtimer.c:1865 hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1927 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline] __sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1049 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:rol32 include/linux/bitops.h:127 [inline] RIP: 0010:jhash2 include/linux/jhash.h:129 [inline] RIP: 0010:hash_stack lib/stackdepot.c:514 [inline] RIP: 0010:stack_depot_save_flags+0x70/0x9c0 lib/stackdepot.c:614 Code: 8d 1c 85 7b 71 f5 75 83 f8 03 89 c1 0f 86 9a 03 00 00 89 d8 89 df 4c 89 ea 03 42 08 83 e9 03 48 83 c2 0c 44 8b 4a f4 03 7a f8 <89> c6 41 29 c1 c1 c6 04 41 01 d9 01 f8 44 31 ce 8d 1c 06 29 f7 41 RSP: 0018:ffffc9001347f0d8 EFLAGS: 00000a17 RAX: 0000000059bd2497 RBX: 00000000b4611443 RCX: 000000000000000c RDX: ffffc9001347f1a0 RSI: 000000004c56ece5 RDI: 0000000007c60624 RBP: 0000000000000001 R08: 0000000000000000 R09: 00000000ffffffff R10: ffffffff90626c17 R11: 0000000000000001 R12: 0000000000140dca R13: ffffc9001347f158 R14: 000000000000000f R15: 000000000000000f save_stack+0x16f/0x1f0 mm/page_owner.c:157 __set_page_owner+0x8b/0x560 mm/page_owner.c:320 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1551 prep_new_page mm/page_alloc.c:1559 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3477 __alloc_frozen_pages_noprof+0x221/0x2470 mm/page_alloc.c:4740 alloc_pages_mpol+0x1fc/0x540 mm/mempolicy.c:2270 folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2289 vma_alloc_folio_noprof+0xee/0x1b0 mm/mempolicy.c:2324 folio_prealloc mm/memory.c:1060 [inline] alloc_anon_folio mm/memory.c:4834 [inline] do_anonymous_page mm/memory.c:4891 [inline] do_pte_missing+0x202f/0x3e10 mm/memory.c:4057 handle_pte_fault mm/memory.c:5888 [inline] __handle_mm_fault+0x103c/0x2a40 mm/memory.c:6031 handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6200 faultin_page mm/gup.c:1196 [inline] __get_user_pages+0x773/0x36f0 mm/gup.c:1491 populate_vma_page_range+0x27f/0x3a0 mm/gup.c:1929 __mm_populate+0x1d6/0x380 mm/gup.c:2032 mm_populate include/linux/mm.h:3392 [inline] __do_sys_mremap+0xe3c/0x1630 mm/mremap.c:1243 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fed5e58d169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fed5f396038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 RAX: ffffffffffffffda RBX: 00007fed5e7a5fa0 RCX: 00007fed5e58d169 RDX: 0000000005000000 RSI: 0000000000002000 RDI: 0000200000ff5000 RBP: 00007fed5e60e2a0 R08: 0000200000ffd000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fed5e7a5fa0 R15: 00007ffd38d13aa8 </TASK> task:syz.3.2928 state:R running task stack:26320 pid:16902 tgid:16895 ppid:5814 task_flags:0x40044c flags:0x00004006 Call Trace: <TASK> context_switch kernel/sched/core.c:5378 [inline] __schedule+0xf43/0x5890 kernel/sched/core.c:6765 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6944 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 unwind_next_frame+0x1776/0x20c0 arch/x86/kernel/unwind_orc.c:672 __unwind_start+0x45f/0x7f0 arch/x86/kernel/unwind_orc.c:760 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0x74/0x100 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 save_stack+0x162/0x1f0 mm/page_owner.c:156 __reset_page_owner+0x8d/0x400 mm/page_owner.c:297 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_folios+0xa7b/0x1500 mm/page_alloc.c:2707 folios_put_refs+0x587/0x7b0 mm/swap.c:994 folio_batch_release include/linux/pagevec.h:101 [inline] shmem_undo_range+0x586/0x1170 mm/shmem.c:1112 shmem_truncate_range mm/shmem.c:1224 [inline] shmem_evict_inode+0x3a3/0xba0 mm/shmem.c:1352 evict+0x409/0x960 fs/inode.c:796 iput_final fs/inode.c:1946 [inline] iput fs/inode.c:1972 [inline] iput+0x52a/0x890 fs/inode.c:1958 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:440 __dentry_kill+0x1d0/0x600 fs/dcache.c:643 dput.part.0+0x4b1/0x9b0 fs/dcache.c:885 dput+0x1f/0x30 fs/dcache.c:875 __fput+0x51c/0xb70 fs/file_table.c:472 task_work_run+0x14e/0x250 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xad8/0x2db0 kernel/exit.c:938 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087 get_signal+0x24ed/0x26c0 kernel/signal.c:3036 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb34d98d169 RSP: 002b:00007fb34e768038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: 0000000000010106 RBX: 00007fb34dba6080 RCX: 00007fb34d98d169 RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007fb34da0e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fb34dba6080 R15: 00007ffd6cdc06d8 </TASK> rcu: rcu_preempt kthread starved for 10502 jiffies! g64305 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:27456 pid:18 tgid:18 ppid:2 task_flags:0x208040 flags:0x00004000 Call Trace: <TASK> context_switch kernel/sched/core.c:5378 [inline] __schedule+0xf43/0x5890 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6857 schedule_timeout+0x124/0x280 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x1eb/0xb00 kernel/rcu/tree.c:2024 rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2226 kthread+0x3af/0x750 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> rcu: Stack dump where RCU GP kthread last ran: CPU: 1 UID: 0 PID: 12126 Comm: kworker/u8:65 Not tainted 6.14.0-rc7-syzkaller-00205-g586de92313fc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:__sanitizer_cov_trace_pc+0x66/0x70 kernel/kcov.c:235 Code: 82 08 16 00 00 83 f8 02 75 20 48 8b 8a 10 16 00 00 8b 92 0c 16 00 00 48 8b 01 48 83 c0 01 48 39 d0 73 07 48 89 01 48 89 34 c1 <c3> cc cc cc cc 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004527920 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff8880b8646a00 RCX: ffffffff81ade1ea RDX: ffff88802abb2440 RSI: ffffffff81ade1c4 RDI: 0000000000000005 RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000006 R12: ffffed10170c8d41 R13: 0000000000000001 R14: ffff8880b873fe80 R15: ffff8880b8646a08 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e0faff8 CR3: 000000000df80000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> </IRQ> <TASK> rep_nop arch/x86/include/asm/vdso/processor.h:13 [inline] cpu_relax arch/x86/include/asm/vdso/processor.h:18 [inline] csd_lock_wait kernel/smp.c:340 [inline] smp_call_function_many_cond+0x4c4/0x12c0 kernel/smp.c:885 on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1052 on_each_cpu include/linux/smp.h:71 [inline] text_poke_sync arch/x86/kernel/alternative.c:2118 [inline] text_poke_bp_batch+0x22b/0x760 arch/x86/kernel/alternative.c:2328 text_poke_flush arch/x86/kernel/alternative.c:2519 [inline] text_poke_flush arch/x86/kernel/alternative.c:2516 [inline] text_poke_finish+0x30/0x40 arch/x86/kernel/alternative.c:2526 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 jump_label_update+0x1d7/0x400 kernel/jump_label.c:920 static_key_enable_cpuslocked+0x1b7/0x270 kernel/jump_label.c:210 static_key_enable+0x1a/0x20 kernel/jump_label.c:223 toggle_allocation_gate mm/kfence/core.c:850 [inline] toggle_allocation_gate+0xfc/0x260 mm/kfence/core.c:842 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3400 kthread+0x3af/0x750 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2025/03/23 10:44 | upstream | 586de92313fc | 4e8d3850 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-selinux-root | INFO: rcu detected stall in mremap |