syzbot


INFO: rcu detected stall in __fput

Status: auto-closed as invalid on 2021/10/21 19:09
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 470d, last: 470d

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	0-...!: (1 GPs behind) idle=acb/1/0x4000000000000000 softirq=31728/31730 fqs=12 
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P19448/1:b..l
	(detected by 1, t=10502 jiffies, g=49389, q=151)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1 Comm: systemd Not tainted 5.14.0-rc6-next-20210820-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__netif_schedule+0x2/0x2f0 net/core/dev.c:3046
Code: e4 46 9d fa e9 58 fd ff ff e8 da 46 9d fa e9 9e fe ff ff e8 d0 46 9d fa e9 04 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 41 56 <41> 55 41 54 55 53 48 89 fb e8 00 7a 57 fa 48 8d bb 88 01 00 00 be
RSP: 0018:ffffc90000007d98 EFLAGS: 00000046
RAX: 0000000080010000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff888010e68000 RSI: ffffffff87545eec RDI: ffff88807e195800
RBP: 0000000140000002 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff87545edd R11: 0000000000000000 R12: ffff888070444480
R13: 1891020431220408 R14: ffff8880704444a0 R15: 1891020431220408
FS:  00007f9351b59500(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000970004 CR3: 0000000026506000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 advance_sched+0x4d6/0x9b0 net/sched/sch_taprio.c:764
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x612/0xe60 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x96/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__fput+0x2c7/0x9f0 fs/file_table.c:281
Code: 03 0f b6 04 02 84 c0 74 08 3c 01 0f 8e 1c 06 00 00 41 0f b7 45 00 bf 00 20 00 00 66 25 00 f0 89 c6 89 44 24 08 e8 b9 d2 ae ff <8b> 44 24 08 66 3d 00 20 0f 84 81 04 00 00 e8 d6 cb ae ff 4c 89 f2
RSP: 0018:ffffc90000c67e48 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00000000000a0003 RCX: ffff888010e68000
RDX: 0000000000000000 RSI: ffff888010e68000 RDI: 0000000000000003
RBP: ffff8880709ef680 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff81c7aca7 R11: 0000000000002000 R12: ffff8880709ef704
R13: ffff88801729b2a0 R14: ffff8880709ef6a8 R15: ffff888015fdcaa0
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:209
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f93503f628d
Code: c1 20 00 00 75 10 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 37 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007fff8f108c30 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00007f93503f628d
RDX: 00005647247491b0 RSI: 0000000000000100 RDI: 0000000000000007
RBP: 00007f9351b592f8 R08: 0000000000000020 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 000056472455eec0 R14: 0000564724530a20 R15: 0000000000000002
task:syz-executor.2  state:R  running task     stack:30152 pid:19448 ppid:  6565 flags:0x00000000
Call Trace:
 context_switch kernel/sched/core.c:4756 [inline]
 __schedule+0x943/0x2700 kernel/sched/core.c:6029
 preempt_schedule_common+0x49/0xd0 kernel/sched/core.c:6201
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
 _raw_spin_unlock_irqrestore+0x5f/0x70 kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:423 [inline]
 timerfd_clock_was_set+0x16b/0x2e0 fs/timerfd.c:113
 clock_was_set+0x5cf/0x790 kernel/time/hrtimer.c:980
 do_settimeofday64 kernel/time/timekeeping.c:1327 [inline]
 do_settimeofday64+0x3a7/0x580 kernel/time/timekeeping.c:1293
 do_sys_settimeofday64 kernel/time/time.c:195 [inline]
 do_sys_settimeofday64+0x1e2/0x250 kernel/time/time.c:169
 __do_sys_clock_settime kernel/time/posix-timers.c:1079 [inline]
 __se_sys_clock_settime kernel/time/posix-timers.c:1067 [inline]
 __x64_sys_clock_settime+0x1a1/0x280 kernel/time/posix-timers.c:1067
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007f7cef462188 EFLAGS: 00000246 ORIG_RAX: 00000000000000e3
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000000
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffdc8c8a88f R14: 00007f7cef462300 R15: 0000000000022000
rcu: rcu_preempt kthread starved for 10478 jiffies! g49389 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28504 pid:   14 ppid:     2 flags:0x00004000
Call Trace:
 context_switch kernel/sched/core.c:4756 [inline]
 __schedule+0x943/0x2700 kernel/sched/core.c:6029
 schedule+0xd7/0x280 kernel/sched/core.c:6108
 schedule_timeout+0x14e/0x2a0 kernel/time/timer.c:1881
 rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1955
 rcu_gp_kthread+0x1e1/0x320 kernel/rcu/tree.c:2128
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 1
CPU: 1 PID: 8055 Comm: kworker/1:4 Not tainted 5.14.0-rc6-next-20210820-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events fqdir_free_fn
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_check_gp_kthread_starvation.cold+0x200/0x205 kernel/rcu/tree_stall.h:481
 print_other_cpu_stall kernel/rcu/tree_stall.h:586 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:729 [inline]
 rcu_pending kernel/rcu/tree.c:3878 [inline]
 rcu_sched_clock_irq+0x2138/0x2220 kernel/rcu/tree.c:2597
 update_process_times+0x171/0x200 kernel/time/timer.c:1785
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
 tick_sched_timer+0x1b8/0x2d0 kernel/time/tick-sched.c:1421
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x1c3/0xe60 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x96/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:csd_lock_wait kernel/smp.c:440 [inline]
RIP: 0010:smp_call_function_single+0x1b0/0x4b0 kernel/smp.c:758
Code: 10 8b 7c 24 1c 48 8d 74 24 40 48 89 44 24 50 48 8b 44 24 08 48 89 44 24 58 e8 bc fa ff ff 41 89 c5 eb 07 e8 42 60 0b 00 f3 90 <44> 8b 64 24 48 31 ff 41 83 e4 01 44 89 e6 e8 7d 67 0b 00 45 85 e4
RSP: 0018:ffffc90016cd7b80 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 1ffff92002d9af74 RCX: 0000000000000000
RDX: ffff88807bd49c80 RSI: ffffffff816b184e RDI: 0000000000000003
RBP: ffffc90016cd7c58 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff816b1863 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: ffff8880b9c32900
 rcu_barrier+0x2a6/0x440 kernel/rcu/tree.c:4024
 fqdir_free_fn+0x32/0x160 net/ipv4/inet_fragment.c:163
 process_one_work+0x9c9/0x16b0 kernel/workqueue.c:2297
 worker_thread+0x65b/0x1200 kernel/workqueue.c:2444
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
   0:	e4 46                	in     $0x46,%al
   2:	9d                   	popfq
   3:	fa                   	cli
   4:	e9 58 fd ff ff       	jmpq   0xfffffd61
   9:	e8 da 46 9d fa       	callq  0xfa9d46e8
   e:	e9 9e fe ff ff       	jmpq   0xfffffeb1
  13:	e8 d0 46 9d fa       	callq  0xfa9d46e8
  18:	e9 04 fd ff ff       	jmpq   0xfffffd21
  1d:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
  24:	00 00 00 00
  28:	41 56                	push   %r14
* 2a:	41 55                	push   %r13 <-- trapping instruction
  2c:	41 54                	push   %r12
  2e:	55                   	push   %rbp
  2f:	53                   	push   %rbx
  30:	48 89 fb             	mov    %rdi,%rbx
  33:	e8 00 7a 57 fa       	callq  0xfa577a38
  38:	48 8d bb 88 01 00 00 	lea    0x188(%rbx),%rdi
  3f:	be                   	.byte 0xbe

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-linux-next-kasan-gce-root 2021/08/22 19:09 linux-next 86ed57fd8c93 b599f2fc .config log report info INFO: rcu detected stall in __fput
* Struck through repros no longer work on HEAD.