syzbot

 sign-in | mailing list | source | docs
🐞 Open [994] ≡ Subsystems 🐞 Fixed [5242] 🐞 Invalid [12515] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: rcu detected stall in ip_list_rcv (4)

Status: auto-closed as invalid on 2022/09/01 16:20
Subsystems: netfilter
[Documentation on labels]
First crash: 663d, last: 663d
▶ ▼ Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: soft lockup in ip_list_rcv (2) kvm 8 731d 732d 0/26 auto-closed as invalid on 2022/06/25 08:42
upstream INFO: rcu detected stall in ip_list_rcv (6) net C done 1 46d 144d 0/26 upstream: reported C repro on 2023/12/04 09:45
upstream INFO: rcu detected stall in ip_list_rcv (5) lsm netfilter 3 288d 346d 0/26 auto-obsoleted due to no activity on 2023/10/11 22:12
upstream INFO: rcu detected stall in ip_list_rcv net C error done 3 1305d 1331d 15/26 fixed on 2020/11/16 12:12
upstream INFO: rcu detected stall in ip_list_rcv (2) netfilter 3 1159d 1238d 0/26 auto-closed as invalid on 2021/05/23 12:59
upstream INFO: rcu detected stall in ip_list_rcv (3) net 1 851d 851d 0/26 closed as invalid on 2022/02/08 10:10
android-5-15 BUG: soft lockup in ip_list_rcv 2 2d16h 3d13h 0/2 premoderation: reported on 2024/04/23 12:02

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	0-...!: (1 ticks this GP) idle=3554/1/0x4000000000000000 softirq=68482/68482 fqs=0
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P2970/1:b..l P20986/1:b..l
	(detected by 1, t=10502 jiffies, g=97885, q=131 ncpus=2)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 3605 Comm: syz-fuzzer Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
RIP: 0010:__this_cpu_preempt_check+0x1/0x20 lib/smp_processor_id.c:65
Code: b7 f0 cb ff eb a2 0f 1f 00 0f 1f 44 00 00 48 c7 c6 60 74 28 8a 48 c7 c7 a0 74 28 8a e9 78 fe ff ff 0f 1f 84 00 00 00 00 00 55 <48> 89 fd 0f 1f 44 00 00 48 89 ee 5d 48 c7 c7 e0 74 28 8a e9 57 fe
RSP: 0018:ffffc90000006d90 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8bd86f80 RDI: ffffffff89cc8900
RBP: ffffffff8bd86f80 R08: 0000000000000000 R09: ffffffff8dbcf6d7
R10: fffffbfff1b79eda R11: 0000000000000001 R12: ffff8880267057c0
R13: 0000000000000000 R14: 00000000ffffffff R15: ffff8880267062d8
FS:  000000c000031490(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1de2908c24 CR3: 0000000074947000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 lockdep_recursion_finish kernel/locking/lockdep.c:466 [inline]
 lock_is_held_type+0xd7/0x140 kernel/locking/lockdep.c:5709
 lock_is_held include/linux/lockdep.h:279 [inline]
 rcu_read_lock_sched_held+0x3a/0x70 kernel/rcu/update.c:125
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x560/0x780 kernel/locking/lockdep.c:5676
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:149 [inline]
 _raw_spin_unlock_irqrestore+0x16/0x70 kernel/locking/spinlock.c:194
 debug_object_activate+0x287/0x3e0 lib/debugobjects.c:693
 debug_hrtimer_activate kernel/time/hrtimer.c:420 [inline]
 debug_activate kernel/time/hrtimer.c:475 [inline]
 enqueue_hrtimer+0x27/0x3e0 kernel/time/hrtimer.c:1084
 __run_hrtimer kernel/time/hrtimer.c:1702 [inline]
 __hrtimer_run_queues+0xaf3/0xe40 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:rcu_read_lock_held_common kernel/rcu/update.c:120 [inline]
RIP: 0010:rcu_read_lock_sched_held+0x2/0x70 kernel/rcu/update.c:123
Code: 49 c1 ec 09 49 83 f4 01 41 83 e4 01 44 89 e0 41 5c c3 45 31 e4 44 89 e0 41 5c c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 41 54 <41> bc 01 00 00 00 e8 b3 80 14 08 85 c0 75 06 44 89 e0 41 5c c3 e8
RSP: 0018:ffffc90000007260 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff815e8891
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffffff8dbcf6d0
RBP: 1ffff92000000e50 R08: 0000000000000000 R09: ffffffff8dbcf6d7
R10: fffffbfff1b79eda R11: 0000000000000000 R12: ffff88801690e320
R13: 0000000000000549 R14: 0000000000000003 R15: ffff888078283862
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x560/0x780 kernel/locking/lockdep.c:5676
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline]
 _raw_spin_unlock_bh+0x12/0x30 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:405 [inline]
 nf_conntrack_tcp_packet+0x1179/0x56d0 net/netfilter/nf_conntrack_proto_tcp.c:1138
 nf_conntrack_handle_packet net/netfilter/nf_conntrack_core.c:1911 [inline]
 nf_conntrack_in+0x33e/0x1740 net/netfilter/nf_conntrack_core.c:2002
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_slow+0xc5/0x1f0 net/netfilter/core.c:620
 nf_hook_slow_list+0x1b1/0x430 net/netfilter/core.c:659
 NF_HOOK_LIST include/linux/netfilter.h:343 [inline]
 ip_sublist_rcv+0x683/0x980 net/ipv4/ip_input.c:624
 ip_list_rcv+0x31a/0x470 net/ipv4/ip_input.c:661
 __netif_receive_skb_list_ptype net/core/dev.c:5523 [inline]
 __netif_receive_skb_list_core+0x548/0x8f0 net/core/dev.c:5571
 __netif_receive_skb_list net/core/dev.c:5623 [inline]
 netif_receive_skb_list_internal+0x75b/0xd80 net/core/dev.c:5714
 gro_normal_list include/net/gro.h:430 [inline]
 gro_normal_list include/net/gro.h:426 [inline]
 napi_complete_done+0x1f1/0x880 net/core/dev.c:6055
 virtqueue_napi_complete drivers/net/virtio_net.c:366 [inline]
 virtnet_poll+0xc9b/0x11a0 drivers/net/virtio_net.c:1631
 __napi_poll+0xb3/0x6d0 net/core/dev.c:6506
 napi_poll net/core/dev.c:6573 [inline]
 net_rx_action+0x9c1/0xd90 net/core/dev.c:6684
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 common_interrupt+0xa9/0xc0 arch/x86/kernel/irq.c:240
 </IRQ>
 <TASK>
 asm_common_interrupt+0x27/0x40 arch/x86/include/asm/idtentry.h:640
RIP: 0010:skb_frag_size_set include/linux/skbuff.h:378 [inline]
RIP: 0010:__skb_fill_page_desc include/linux/skbuff.h:2391 [inline]
RIP: 0010:skb_fill_page_desc include/linux/skbuff.h:2415 [inline]
RIP: 0010:tcp_sendmsg_locked+0x2529/0x2de0 net/ipv4/tcp.c:1377
Code: c1 e3 04 48 c1 ea 03 48 01 eb 48 89 73 30 42 0f b6 34 32 48 89 fa 83 e2 07 83 c2 03 40 38 f2 7c 09 40 84 f6 0f 85 41 06 00 00 <48> 83 c0 03 89 4b 3c 48 c1 e0 04 48 8d 7c 05 08 48 89 f8 48 c1 e8
RSP: 0018:ffffc9000303fa08 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff88807da10ac0 RCX: 00000000000002d0
RDX: 0000000000000007 RSI: 0000000000000000 RDI: ffff88807da10afc
RBP: ffff88807da10ac0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000000f0
R13: ffff888011bfe780 R14: dffffc0000000000 R15: ffff888077ef8c00
 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1473
 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:734
 sock_write_iter+0x284/0x3c0 net/socket.c:1108
 call_write_iter include/linux/fs.h:2188 [inline]
 new_sync_write+0x315/0x4d0 fs/read_write.c:504
 vfs_write+0x7c0/0xac0 fs/read_write.c:591
 ksys_write+0x1e8/0x250 fs/read_write.c:644
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x49dfbb
Code: e8 aa 4b fc ff eb 88 cc cc cc cc cc cc cc cc e8 bb 8f fc ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
RSP: 002b:000000c002fd73c8 EFLAGS: 00000216 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000c00001e000 RCX: 000000000049dfbb
RDX: 00000000000000f0 RSI: 000000c00000a200 RDI: 0000000000000006
RBP: 000000c002fd7418 R08: 0000000000000001 R09: 000000c000152380
R10: 00000000000000f0 R11: 0000000000000216 R12: 000000c002fd74a8
R13: 0000000000000000 R14: 000000c0162d6340 R15: 000000000000007f
 </TASK>
task:udevd           state:R  running task     stack:26688 pid:20986 ppid:  2970 flags:0x00000000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5184 [inline]
 __schedule+0xa09/0x4f10 kernel/sched/core.c:6496
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6804
 irqentry_exit+0x31/0x80 kernel/entry/common.c:428
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:check_kcov_mode kernel/kcov.c:166 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x7/0x60 kernel/kcov.c:200
Code: 4b 00 5d be 03 00 00 00 e9 86 3e 80 02 66 0f 1f 44 00 00 48 8b be a8 01 00 00 e8 b4 ff ff ff 31 c0 c3 90 65 8b 05 29 b8 87 7e <89> c1 48 8b 34 24 81 e1 00 01 00 00 65 48 8b 14 25 80 6f 02 00 a9
RSP: 0018:ffffc90014d57a20 EFLAGS: 00000202
RAX: 0000000080000000 RBX: dffffc0000000000 RCX: ffffffff81db93c8
RDX: ffff88801871ba80 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffff8880271618f8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
R13: ffffffff81db9375 R14: fffffffffffffffe R15: 0000000000000001
 fast_dput fs/dcache.c:774 [inline]
 dput+0x97/0xdb0 fs/dcache.c:900
 handle_mounts fs/namei.c:1546 [inline]
 step_into+0xcb3/0x1d80 fs/namei.c:1844
 walk_component+0x171/0x6a0 fs/namei.c:2020
 lookup_last fs/namei.c:2469 [inline]
 path_lookupat+0x1bb/0x860 fs/namei.c:2493
 filename_lookup+0x1c6/0x590 fs/namei.c:2522
 user_path_at_empty+0x42/0x60 fs/namei.c:2895
 user_path_at include/linux/namei.h:57 [inline]
 do_faccessat+0x127/0x850 fs/open.c:446
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f72e4988bcd
RSP: 002b:00007ffc154039f0 EFLAGS: 00000206 ORIG_RAX: 00000000000001b7
RAX: ffffffffffffffda RBX: 00007ffc15404b80 RCX: 00007f72e4988bcd
RDX: 0000000000000000 RSI: 00007f72e4ae9970 RDI: 000000000000000b
RBP: 000056195c894680 R08: 000056195c869e70 R09: 000056195c857010
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
task:udevd           state:R  running task     stack:24872 pid: 2970 ppid:     1 flags:0x00000000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5184 [inline]
 __schedule+0xa09/0x4f10 kernel/sched/core.c:6496
 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6661
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x57/0x70 kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:415 [inline]
 __wake_up_common_lock+0xde/0x130 kernel/sched/wait.c:139
 sock_def_readable+0xec/0x4e0 net/core/sock.c:3218
 __netlink_sendskb net/netlink/af_netlink.c:1266 [inline]
 netlink_sendskb net/netlink/af_netlink.c:1272 [inline]
 netlink_unicast+0x6e6/0x7f0 net/netlink/af_netlink.c:1360
 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:734
 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2485
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2539
 __sys_sendmsg net/socket.c:2568 [inline]
 __do_sys_sendmsg net/socket.c:2577 [inline]
 __se_sys_sendmsg net/socket.c:2575 [inline]
 __x64_sys_sendmsg+0x132/0x220 net/socket.c:2575
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f72e4998163
RSP: 002b:00007ffc1540a0a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000056195c857db0 RCX: 00007f72e4998163
RDX: 0000000000000000 RSI: 00007ffc1540a0b8 RDI: 0000000000000004
RBP: 000056195c857500 R08: 0000000000000001 R09: 000056195c879130
R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000000af R14: 0000000000000000 R15: 0000000000000000
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g97885 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=0 timer-softirq=38379
rcu: rcu_preempt kthread starved for 10502 jiffies! g97885 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:28664 pid:   16 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5184 [inline]
 __schedule+0xa09/0x4f10 kernel/sched/core.c:6496
 schedule+0xd2/0x1f0 kernel/sched/core.c:6568
 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1935
 rcu_gp_fqs_loop+0x190/0x910 kernel/rcu/tree.c:1657
 rcu_gp_kthread+0x234/0x360 kernel/rcu/tree.c:1854
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 3605 Comm: syz-fuzzer Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
RIP: 0010:__preempt_count_dec_and_test arch/x86/include/asm/preempt.h:95 [inline]
RIP: 0010:rcu_read_unlock_sched_notrace include/linux/rcupdate.h:828 [inline]
RIP: 0010:trace_hrtimer_expire_exit include/trace/events/timer.h:282 [inline]
RIP: 0010:__run_hrtimer kernel/time/hrtimer.c:1688 [inline]
RIP: 0010:__hrtimer_run_queues+0xa39/0xe40 kernel/time/hrtimer.c:1749
Code: d5 03 00 00 48 8b 05 d6 6e 3d 0c e8 31 a5 f9 ff 31 ff 41 89 c4 89 c6 e8 85 b0 0f 00 45 85 e4 0f 84 fb 01 00 00 e8 a7 b3 0f 00 <65> ff 0d d0 6b 97 7e 41 0f 94 c4 31 ff 44 89 e6 e8 22 b0 0f 00 45
RSP: 0018:ffffc90000006fe8 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff888073580340 RCX: 0000000000000100
RDX: ffff8880267057c0 RSI: ffffffff816b0369 RDI: 0000000000000005
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
R13: ffff8880b9a2a640 R14: ffff8880b9a2a540 R15: 0000000000000001
FS:  000000c000031490(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1de2908c24 CR3: 0000000074947000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:rcu_read_lock_held_common kernel/rcu/update.c:120 [inline]
RIP: 0010:rcu_read_lock_sched_held+0x2/0x70 kernel/rcu/update.c:123
Code: 49 c1 ec 09 49 83 f4 01 41 83 e4 01 44 89 e0 41 5c c3 45 31 e4 44 89 e0 41 5c c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 41 54 <41> bc 01 00 00 00 e8 b3 80 14 08 85 c0 75 06 44 89 e0 41 5c c3 e8
RSP: 0018:ffffc90000007260 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff815e8891
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffffff8dbcf6d0
RBP: 1ffff92000000e50 R08: 0000000000000000 R09: ffffffff8dbcf6d7
R10: fffffbfff1b79eda R11: 0000000000000000 R12: ffff88801690e320
R13: 0000000000000549 R14: 0000000000000003 R15: ffff888078283862
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x560/0x780 kernel/locking/lockdep.c:5676
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline]
 _raw_spin_unlock_bh+0x12/0x30 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:405 [inline]
 nf_conntrack_tcp_packet+0x1179/0x56d0 net/netfilter/nf_conntrack_proto_tcp.c:1138
 nf_conntrack_handle_packet net/netfilter/nf_conntrack_core.c:1911 [inline]
 nf_conntrack_in+0x33e/0x1740 net/netfilter/nf_conntrack_core.c:2002
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_slow+0xc5/0x1f0 net/netfilter/core.c:620
 nf_hook_slow_list+0x1b1/0x430 net/netfilter/core.c:659
 NF_HOOK_LIST include/linux/netfilter.h:343 [inline]
 ip_sublist_rcv+0x683/0x980 net/ipv4/ip_input.c:624
 ip_list_rcv+0x31a/0x470 net/ipv4/ip_input.c:661
 __netif_receive_skb_list_ptype net/core/dev.c:5523 [inline]
 __netif_receive_skb_list_core+0x548/0x8f0 net/core/dev.c:5571
 __netif_receive_skb_list net/core/dev.c:5623 [inline]
 netif_receive_skb_list_internal+0x75b/0xd80 net/core/dev.c:5714
 gro_normal_list include/net/gro.h:430 [inline]
 gro_normal_list include/net/gro.h:426 [inline]
 napi_complete_done+0x1f1/0x880 net/core/dev.c:6055
 virtqueue_napi_complete drivers/net/virtio_net.c:366 [inline]
 virtnet_poll+0xc9b/0x11a0 drivers/net/virtio_net.c:1631
 __napi_poll+0xb3/0x6d0 net/core/dev.c:6506
 napi_poll net/core/dev.c:6573 [inline]
 net_rx_action+0x9c1/0xd90 net/core/dev.c:6684
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 common_interrupt+0xa9/0xc0 arch/x86/kernel/irq.c:240
 </IRQ>
 <TASK>
 asm_common_interrupt+0x27/0x40 arch/x86/include/asm/idtentry.h:640
RIP: 0010:skb_frag_size_set include/linux/skbuff.h:378 [inline]
RIP: 0010:__skb_fill_page_desc include/linux/skbuff.h:2391 [inline]
RIP: 0010:skb_fill_page_desc include/linux/skbuff.h:2415 [inline]
RIP: 0010:tcp_sendmsg_locked+0x2529/0x2de0 net/ipv4/tcp.c:1377
Code: c1 e3 04 48 c1 ea 03 48 01 eb 48 89 73 30 42 0f b6 34 32 48 89 fa 83 e2 07 83 c2 03 40 38 f2 7c 09 40 84 f6 0f 85 41 06 00 00 <48> 83 c0 03 89 4b 3c 48 c1 e0 04 48 8d 7c 05 08 48 89 f8 48 c1 e8
RSP: 0018:ffffc9000303fa08 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff88807da10ac0 RCX: 00000000000002d0
RDX: 0000000000000007 RSI: 0000000000000000 RDI: ffff88807da10afc
RBP: ffff88807da10ac0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000000f0
R13: ffff888011bfe780 R14: dffffc0000000000 R15: ffff888077ef8c00
 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1473
 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:734
 sock_write_iter+0x284/0x3c0 net/socket.c:1108
 call_write_iter include/linux/fs.h:2188 [inline]
 new_sync_write+0x315/0x4d0 fs/read_write.c:504
 vfs_write+0x7c0/0xac0 fs/read_write.c:591
 ksys_write+0x1e8/0x250 fs/read_write.c:644
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x49dfbb
Code: e8 aa 4b fc ff eb 88 cc cc cc cc cc cc cc cc e8 bb 8f fc ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
RSP: 002b:000000c002fd73c8 EFLAGS: 00000216 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000c00001e000 RCX: 000000000049dfbb
RDX: 00000000000000f0 RSI: 000000c00000a200 RDI: 0000000000000006
RBP: 000000c002fd7418 R08: 0000000000000001 R09: 000000c000152380
R10: 00000000000000f0 R11: 0000000000000216 R12: 000000c002fd74a8
R13: 0000000000000000 R14: 000000c0162d6340 R15: 000000000000007f
 </TASK>
----------------
Code disassembly (best guess), 4 bytes skipped:
   0:	eb a2                	jmp    0xffffffa4
   2:	0f 1f 00             	nopl   (%rax)
   5:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
   a:	48 c7 c6 60 74 28 8a 	mov    $0xffffffff8a287460,%rsi
  11:	48 c7 c7 a0 74 28 8a 	mov    $0xffffffff8a2874a0,%rdi
  18:	e9 78 fe ff ff       	jmpq   0xfffffe95
  1d:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
  24:	00
  25:	55                   	push   %rbp
* 26:	48 89 fd             	mov    %rdi,%rbp <-- trapping instruction
  29:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  2e:	48 89 ee             	mov    %rbp,%rsi
  31:	5d                   	pop    %rbp
  32:	48 c7 c7 e0 74 28 8a 	mov    $0xffffffff8a2874e0,%rdi
  39:	e9                   	.byte 0xe9
  3a:	57                   	push   %rdi
  3b:	fe                   	.byte 0xfe

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/07/03 16:13 linux-next cb71b93c2dc3 1434eec0 .config console log report info ci-upstream-linux-next-kasan-gce-root INFO: rcu detected stall in ip_list_rcv
* Struck through repros no longer work on HEAD.