INFO: rcu detected stall in br_forward_delay_timer_expired (2)

Status: auto-obsoleted due to no activity on 2025/06/08 07:03
Reported-by: syzbot+14d2cccbe0db73ea209f@syzkaller.appspotmail.com
First crash: 521d, last: 521d
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 INFO: rcu detected stall in br_forward_delay_timer_expired 1 1 672d 672d 0/3 auto-obsoleted due to no activity on 2025/01/08 10:41
upstream INFO: rcu detected stall in br_forward_delay_timer_expired net 1 2 2439d 2439d 0/29 closed as invalid on 2019/11/29 14:24
android-5-15 BUG: soft lockup in br_forward_delay_timer_expired 1 1 585d 585d 0/2 auto-obsoleted due to no activity on 2025/03/26 03:08
linux-4.14 BUG: soft lockup in br_forward_delay_timer_expired 1 1 1632d 1632d 0/1 auto-closed as invalid on 2022/06/13 01:08
android-54 BUG: soft lockup in br_forward_delay_timer_expired 1 1 550d 550d 0/2 auto-obsoleted due to no activity on 2025/04/30 09:57

Sample crash report:
rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2639 jiffies s: 1725 root: 0x1/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 4376 Comm: syz.4.5 Not tainted 6.1.129-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:static_key_false include/linux/jump_label.h:207 [inline]
RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:147 [inline]
RIP: 0010:wrmsr arch/x86/include/asm/msr.h:254 [inline]
RIP: 0010:native_apic_msr_write+0x35/0x50 arch/x86/include/asm/apic.h:206
Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 c3 89 f6 31 d2 e9 cf b8 33 03 66 2e 0f 1f 84 00 00 00 00 00
RSP: 0018:ffffc90000007340 EFLAGS: 00000046
RAX: 00000000000000b6 RBX: ffffffff8cdf4b30 RCX: 0000000000000838
RDX: 0000000000000000 RSI: 00000000000000b6 RDI: 0000000000000838
RBP: 00000000000000b6 R08: ffffffff817cd5cd R09: fffffbfff1d413e6
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880b8e271c0
R13: dffffc0000000000 R14: 00000000000000b6 R15: dffffc0000000000
FS:  00007fc385bff6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feb29865f98 CR3: 000000007f3d3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 apic_write arch/x86/include/asm/apic.h:394 [inline]
 lapic_next_event+0x5b/0x70 arch/x86/kernel/apic/apic.c:478
 clockevents_program_event+0x1c5/0x310 kernel/time/clockevents.c:334
 hrtimer_interrupt+0x546/0x980 kernel/time/hrtimer.c:1828
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1107 [inline]
 __sysvec_apic_timer_interrupt+0x158/0x5b0 arch/x86/kernel/apic/apic.c:1124
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0x4d/0xc0 arch/x86/kernel/apic/apic.c:1118
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:arch_stack_walk+0x114/0x140 arch/x86/kernel/stacktrace.c:24
Code: ff 48 89 df e8 cd 08 09 00 48 85 c0 74 1e 4c 89 f7 48 89 c6 41 ff d5 84 c0 74 11 48 89 df e8 d3 09 09 00 83 bd 70 ff ff ff 00 <75> d5 65 48 8b 04 25 28 00 00 00 48 3b 45 d0 75 0f 48 83 c4 68 5b
RSP: 0018:ffffc900000075a0 EFLAGS: 00000202
RAX: 0000000000000101 RBX: ffffc900000075a0 RCX: 0000000000000102
RDX: dffffc0000000000 RSI: ffffc90000000000 RDI: 0000000000000001
RBP: ffffc90000007630 R08: ffffc90000007fe0 R09: ffffc900000075f0
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888019291dc0
R13: ffffffff81784af0 R14: ffffc90000007680 R15: 0000000000000000
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 kmem_cache_free+0x292/0x510 mm/slub.c:3683
 netlink_broadcast+0xfe5/0x1110 net/netlink/af_netlink.c:1508
 nlmsg_multicast include/net/netlink.h:1071 [inline]
 nlmsg_notify+0xfb/0x1c0 net/netlink/af_netlink.c:2536
 br_forward_delay_timer_expired+0x2ce/0x420 net/bridge/br_stp_timer.c:98
 call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1504
 expire_timers kernel/time/timer.c:1549 [inline]
 __run_timers+0x67c/0x890 kernel/time/timer.c:1820
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:661
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_schedule_irq+0xf2/0x1c0 kernel/sched/core.c:6872
Code: 89 f5 49 c1 ed 03 eb 0d 48 f7 03 08 00 00 00 0f 84 97 00 00 00 bf 01 00 00 00 e8 f9 e5 a4 f6 e8 f4 b5 d7 f6 fb bf 01 00 00 00 <e8> 79 b4 ff ff 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 c9 4d 28 f7 48
RSP: 0018:ffffc90004656c00 EFLAGS: 00000286
RAX: f13a0a6d91434700 RBX: 1ffff920008cad88 RCX: ffffffff973bd103
RDX: dffffc0000000000 RSI: ffffffff8b0c1d40 RDI: 0000000000000001
RBP: ffffc90004656cc0 R08: ffffffff81b609ac R09: ffffed10171c6ad6
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920008cad80
R13: 1ffff920008cad84 R14: ffffc90004656c20 R15: dffffc0000000000
 irqentry_exit+0x53/0x80 kernel/entry/common.c:439
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:do_slab_free mm/slub.c:3608 [inline]
RIP: 0010:___cache_free+0x1f/0x90 mm/slub.c:3668
Code: ff 66 2e 0f 1f 84 00 00 00 00 00 41 57 41 56 53 49 89 d6 48 89 f3 49 89 ff 48 89 f7 e8 7a 00 00 00 49 89 c0 41 b1 01 49 8b 07 <65> 48 03 05 41 06 21 7e 48 8b 50 08 4c 39 40 10 75 2f 48 8b 00 41
RSP: 0018:ffffc90004656d88 EFLAGS: 00000286
RAX: 000000000003e4a0 RBX: ffff8880307b4600 RCX: ffffea0000c1ed00
RDX: ffffea0000000000 RSI: 0000000000005b82 RDI: 0000000000005b83
RBP: dffffc0000000000 R08: ffffea0000c1ed00 R09: 0000000080040001
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888017c41640
R13: 0000000000000dc0 R14: ffffffff81e1fb2b R15: ffff888017c41640
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x156/0x170 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x1f/0x70 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x52/0x3a0 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 __kmem_cache_alloc_node+0x137/0x260 mm/slub.c:3437
 kmalloc_trace+0x26/0xe0 mm/slab_common.c:1026
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 is_state_visited kernel/bpf/verifier.c:12322 [inline]
 do_check kernel/bpf/verifier.c:12451 [inline]
 do_check_common+0x323d/0xc5c0 kernel/bpf/verifier.c:14933
 do_check_main kernel/bpf/verifier.c:14996 [inline]
 bpf_check+0x105ac/0x16240 kernel/bpf/verifier.c:15573
 bpf_prog_load+0x1311/0x1bf0 kernel/bpf/syscall.c:2646
 __sys_bpf+0x382/0x6c0 kernel/bpf/syscall.c:5025
 __do_sys_bpf kernel/bpf/syscall.c:5129 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5127 [inline]
 __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5127
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc385d8d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc385bff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc385fa5fa0 RCX: 00007fc385d8d169
RDX: 0000000000000048 RSI: 00004000000054c0 RDI: 0000000000000005
RBP: 00007fc385e0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc385fa5fa0 R15: 00007ffd142ca7b8
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/28 07:02 linux-6.1.y 3a8358583626 6a8fcbc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: rcu detected stall in br_forward_delay_timer_expired
* Struck through repros no longer work on HEAD.