syzbot


INFO: rcu detected stall in dput (5)

Status: auto-closed as invalid on 2022/07/18 12:41
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 230d, last: 230d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in dput (4) C error error 2 360d 719d 0/24 closed as invalid on 2022/02/08 10:37
upstream INFO: rcu detected stall in dput (3) 1 1062d 1062d 0/24 closed as invalid on 2020/01/09 08:13
upstream INFO: rcu detected stall in dput 1 1097d 1097d 0/24 closed as invalid on 2019/12/04 14:04
upstream INFO: rcu detected stall in dput (2) 2 1062d 1062d 0/24 closed as invalid on 2020/01/08 05:33

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	0-...!: (1 ticks this GP) idle=5f3/1/0x4000000000000000 softirq=81619/81619 fqs=0 
	(detected by 1, t=10502 jiffies, g=109493, q=103)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 22082 Comm: syz-executor.2 Not tainted 5.18.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__this_cpu_preempt_check+0xd/0x20 lib/smp_processor_id.c:66
Code: 00 00 48 c7 c6 a0 b9 26 8a 48 c7 c7 e0 b9 26 8a e9 78 fe ff ff 0f 1f 84 00 00 00 00 00 55 48 89 fd 0f 1f 44 00 00 48 89 ee 5d <48> c7 c7 20 ba 26 8a e9 57 fe ff ff cc cc cc cc cc cc cc 0f 1f 44
RSP: 0018:ffffc90000007d38 EFLAGS: 00000082
RAX: 0000000000000001 RBX: 1ffff92000000faa RCX: ffffffff815d505e
RDX: 1ffff1100f57c88b RSI: ffffffff89cc5c80 RDI: ffffffff89cc5c80
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff9003390f
R10: fffffbfff2006721 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8880b9c2a5d8 R15: 0000000000000000
FS:  00005555561bb400(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0e599d090 CR3: 0000000079410000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 lockdep_recursion_finish kernel/locking/lockdep.c:436 [inline]
 lock_acquire kernel/locking/lockdep.c:5643 [inline]
 lock_acquire+0x1bb/0x510 kernel/locking/lockdep.c:5606
 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
 _raw_spin_lock_irq+0x32/0x50 kernel/locking/spinlock.c:170
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x243/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 kernel/locking/spinlock.c:194
Code: 74 24 10 e8 fa c8 fa f7 48 89 ef e8 42 48 fb f7 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 <e8> 23 67 ee f7 65 8b 05 ec 9b 9f 76 85 c0 74 0a 5b 5d c3 e8 00 8e
RSP: 0018:ffffc900166e7c50 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000200 RCX: 1ffffffff1b6dbd9
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffffffff9075f2a0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff817f6218 R11: 0000000000000001 R12: 1ffffffff20ebe53
R13: 0000000000000000 R14: dead000000000100 R15: dffffc0000000000
 __debug_check_no_obj_freed lib/debugobjects.c:1002 [inline]
 debug_check_no_obj_freed+0x20c/0x420 lib/debugobjects.c:1023
 slab_free_hook mm/slub.c:1703 [inline]
 slab_free_freelist_hook+0xeb/0x1c0 mm/slub.c:1754
 slab_free mm/slub.c:3510 [inline]
 kmem_cache_free+0xdd/0x5a0 mm/slub.c:3527
 __d_free fs/dcache.c:298 [inline]
 dentry_free+0xde/0x160 fs/dcache.c:375
 __dentry_kill+0x4cb/0x640 fs/dcache.c:621
 dentry_kill fs/dcache.c:733 [inline]
 dput+0x806/0xdb0 fs/dcache.c:913
 __fput+0x39c/0x9d0 fs/file_table.c:330
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
 exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201
 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:294
 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f9253a3bd2b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffe7a0257c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f9253a3bd2b
RDX: 00007f9253ba0608 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 00007f9253b9d960 R08: 0000000000000000 R09: 00007f9253ba0610
R10: 00007ffe7a0258c0 R11: 0000000000000293 R12: 00000000000e2f9b
R13: 00007ffe7a0258c0 R14: 00007f9253b9bf60 R15: 0000000000000032
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g109493 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=0 timer-softirq=54633
rcu: rcu_preempt kthread starved for 10502 jiffies! g109493 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:28728 pid:   16 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5073 [inline]
 __schedule+0xa9a/0x4cc0 kernel/sched/core.c:6388
 schedule+0xd2/0x1f0 kernel/sched/core.c:6460
 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1884
 rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1971
 rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2144
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 22082 Comm: syz-executor.2 Not tainted 5.18.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:match_held_lock+0x70/0xc0 kernel/locking/lockdep.c:5118
Code: 06 48 0f af c2 0f b7 53 20 81 e2 ff 1f 00 00 48 39 d0 0f 94 c0 48 83 c4 08 0f b6 c0 5b c3 31 f6 e8 c5 fe ff ff 48 85 c0 75 b2 <31> c0 48 83 c4 08 5b c3 48 83 c4 08 b8 01 00 00 00 5b c3 e8 88 dc
RSP: 0018:ffffc90000007be0 EFLAGS: 00000046
RAX: 0000000000000005 RBX: ffff88807abe4488 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8bd81d20 RDI: ffff88807abe4488
RBP: ffffffff8bd81d20 R08: 0000000000000000 R09: ffffffff8db70d17
R10: fffffbfff1b6e1a2 R11: 0000000000000001 R12: ffff88807abe3a00
R13: ffff88807abe4460 R14: 00000000ffffffff R15: ffff88807abe4488
FS:  00005555561bb400(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0e599d090 CR3: 0000000079410000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __lock_is_held kernel/locking/lockdep.c:5382 [inline]
 lock_is_held_type+0xa7/0x140 kernel/locking/lockdep.c:5684
 lock_is_held include/linux/lockdep.h:283 [inline]
 rcu_read_lock_sched_held+0x3a/0x70 kernel/rcu/update.c:125
 trace_lock_release include/trace/events/lock.h:58 [inline]
 lock_release+0x522/0x720 kernel/locking/lockdep.c:5652
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:149 [inline]
 _raw_spin_unlock_irqrestore+0x16/0x70 kernel/locking/spinlock.c:194
 debug_object_activate+0x287/0x3e0 lib/debugobjects.c:689
 debug_hrtimer_activate kernel/time/hrtimer.c:420 [inline]
 debug_activate kernel/time/hrtimer.c:475 [inline]
 enqueue_hrtimer+0x27/0x3e0 kernel/time/hrtimer.c:1084
 __run_hrtimer kernel/time/hrtimer.c:1702 [inline]
 __hrtimer_run_queues+0xb02/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 kernel/locking/spinlock.c:194
Code: 74 24 10 e8 fa c8 fa f7 48 89 ef e8 42 48 fb f7 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 <e8> 23 67 ee f7 65 8b 05 ec 9b 9f 76 85 c0 74 0a 5b 5d c3 e8 00 8e
RSP: 0018:ffffc900166e7c50 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000200 RCX: 1ffffffff1b6dbd9
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffffffff9075f2a0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff817f6218 R11: 0000000000000001 R12: 1ffffffff20ebe53
R13: 0000000000000000 R14: dead000000000100 R15: dffffc0000000000
 __debug_check_no_obj_freed lib/debugobjects.c:1002 [inline]
 debug_check_no_obj_freed+0x20c/0x420 lib/debugobjects.c:1023
 slab_free_hook mm/slub.c:1703 [inline]
 slab_free_freelist_hook+0xeb/0x1c0 mm/slub.c:1754
 slab_free mm/slub.c:3510 [inline]
 kmem_cache_free+0xdd/0x5a0 mm/slub.c:3527
 __d_free fs/dcache.c:298 [inline]
 dentry_free+0xde/0x160 fs/dcache.c:375
 __dentry_kill+0x4cb/0x640 fs/dcache.c:621
 dentry_kill fs/dcache.c:733 [inline]
 dput+0x806/0xdb0 fs/dcache.c:913
 __fput+0x39c/0x9d0 fs/file_table.c:330
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
 exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201
 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:294
 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f9253a3bd2b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffe7a0257c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f9253a3bd2b
RDX: 00007f9253ba0608 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 00007f9253b9d960 R08: 0000000000000000 R09: 00007f9253ba0610
R10: 00007ffe7a0258c0 R11: 0000000000000293 R12: 00000000000e2f9b
R13: 00007ffe7a0258c0 R14: 00007f9253b9bf60 R15: 0000000000000032
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	48 c7 c6 a0 b9 26 8a 	mov    $0xffffffff8a26b9a0,%rsi
   9:	48 c7 c7 e0 b9 26 8a 	mov    $0xffffffff8a26b9e0,%rdi
  10:	e9 78 fe ff ff       	jmpq   0xfffffe8d
  15:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
  1c:	00
  1d:	55                   	push   %rbp
  1e:	48 89 fd             	mov    %rdi,%rbp
  21:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  26:	48 89 ee             	mov    %rbp,%rsi
  29:	5d                   	pop    %rbp
* 2a:	48 c7 c7 20 ba 26 8a 	mov    $0xffffffff8a26ba20,%rdi <-- trapping instruction
  31:	e9 57 fe ff ff       	jmpq   0xfffffe8d
  36:	cc                   	int3
  37:	cc                   	int3
  38:	cc                   	int3
  39:	cc                   	int3
  3a:	cc                   	int3
  3b:	cc                   	int3
  3c:	cc                   	int3
  3d:	0f                   	.byte 0xf
  3e:	1f                   	(bad)
  3f:	44                   	rex.R

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2022/04/19 12:40 upstream b2d229d4ddb1 c334415e .config log report info INFO: rcu detected stall in dput
* Struck through repros no longer work on HEAD.