syzbot


INFO: rcu detected stall in batadv_dat_purge

Status: auto-closed as invalid on 2022/01/10 03:55
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 412d, last: 412d

Sample crash report:
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	0-...!: (1 GPs behind) idle=d79/1/0x4000000000000000 softirq=206987/206988 fqs=1 
	(t=13297 jiffies g=379349 q=1517)
NMI backtrace for cpu 0
CPU: 0 PID: 26130 Comm: kworker/u4:2 Not tainted 5.15.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_dat_purge
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343
 print_cpu_stall kernel/rcu/tree_stall.h:627 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:711 [inline]
 rcu_pending kernel/rcu/tree.c:3880 [inline]
 rcu_sched_clock_irq.cold+0x9d/0x746 kernel/rcu/tree.c:2599
 update_process_times+0x16d/0x200 kernel/time/timer.c:1785
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
 tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1421
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:511 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock+0x10c/0x2b0 kernel/locking/spinlock_debug.c:115
Code: 3c 03 0f 8e 66 01 00 00 8b 55 08 65 8b 05 94 c4 a5 7e 39 c2 0f 84 33 01 00 00 48 89 ef be 04 00 00 00 c7 44 24 28 00 00 00 00 <e8> 7f b1 61 00 be 04 00 00 00 48 8d 7c 24 28 e8 70 b1 61 00 8b 44
RSP: 0018:ffffc9000426fc10 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 1ffff9200084df83 RCX: 0000000000000000
RDX: 00000000ffffffff RSI: 0000000000000004 RDI: ffff88802aba7240
RBP: ffff88802aba7240 R08: 0000000000000000 R09: ffffffff8fd0aa27
R10: fffffbfff1fa1544 R11: 0000000000000000 R12: ffff88802aba7248
R13: ffff88802aba7250 R14: ffffffff88d16d10 R15: 00000000000001c9
 spin_lock_bh include/linux/spinlock.h:368 [inline]
 __batadv_dat_purge.part.0+0xfa/0x3b0 net/batman-adv/distributed-arp-table.c:175
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:168 [inline]
 batadv_dat_purge+0x47/0x60 net/batman-adv/distributed-arp-table.c:206
 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
NMI backtrace for cpu 0
CPU: 0 PID: 26130 Comm: kworker/u4:2 Not tainted 5.15.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_dat_purge
RIP: 0010:__sanitizer_cov_trace_pc+0x5c/0x60 kernel/kcov.c:207
Code: 82 18 15 00 00 83 f8 02 75 20 48 8b 8a 20 15 00 00 8b 92 1c 15 00 00 48 8b 01 48 83 c0 01 48 39 c2 76 07 48 89 34 c1 48 89 01 <c3> 0f 1f 00 41 55 41 54 49 89 fc 55 48 bd eb 83 b5 80 46 86 c8 61
RSP: 0018:ffffc90000007dd0 EFLAGS: 00000046
RAX: 0000000000010202 RBX: ffff88807c8a8340 RCX: 0000000000000000
RDX: ffff88807ace0000 RSI: ffffffff83f5ed24 RDI: ffff8880755fdb48
RBP: ffff8880b9c22510 R08: ffff8880755fdb40 R09: 0000000000000001
R10: ffffffff83f5ecec R11: 0000000000000000 R12: ffff8880b9c22518
R13: 0000000000000000 R14: ffff8880b9c223c0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d522000 CR3: 000000000b68e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 rb_erase_cached include/linux/rbtree.h:126 [inline]
 timerqueue_del+0x74/0x140 lib/timerqueue.c:57
 __remove_hrtimer+0xa1/0x2a0 kernel/time/hrtimer.c:1116
 __run_hrtimer kernel/time/hrtimer.c:1665 [inline]
 __hrtimer_run_queues+0x4ea/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:511 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock+0x10c/0x2b0 kernel/locking/spinlock_debug.c:115
Code: 3c 03 0f 8e 66 01 00 00 8b 55 08 65 8b 05 94 c4 a5 7e 39 c2 0f 84 33 01 00 00 48 89 ef be 04 00 00 00 c7 44 24 28 00 00 00 00 <e8> 7f b1 61 00 be 04 00 00 00 48 8d 7c 24 28 e8 70 b1 61 00 8b 44
RSP: 0018:ffffc9000426fc10 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 1ffff9200084df83 RCX: 0000000000000000
RDX: 00000000ffffffff RSI: 0000000000000004 RDI: ffff88802aba7240
RBP: ffff88802aba7240 R08: 0000000000000000 R09: ffffffff8fd0aa27
R10: fffffbfff1fa1544 R11: 0000000000000000 R12: ffff88802aba7248
R13: ffff88802aba7250 R14: ffffffff88d16d10 R15: 00000000000001c9
 spin_lock_bh include/linux/spinlock.h:368 [inline]
 __batadv_dat_purge.part.0+0xfa/0x3b0 net/batman-adv/distributed-arp-table.c:175
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:168 [inline]
 batadv_dat_purge+0x47/0x60 net/batman-adv/distributed-arp-table.c:206
 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
   0:	3c 03                	cmp    $0x3,%al
   2:	0f 8e 66 01 00 00    	jle    0x16e
   8:	8b 55 08             	mov    0x8(%rbp),%edx
   b:	65 8b 05 94 c4 a5 7e 	mov    %gs:0x7ea5c494(%rip),%eax        # 0x7ea5c4a6
  12:	39 c2                	cmp    %eax,%edx
  14:	0f 84 33 01 00 00    	je     0x14d
  1a:	48 89 ef             	mov    %rbp,%rdi
  1d:	be 04 00 00 00       	mov    $0x4,%esi
  22:	c7 44 24 28 00 00 00 	movl   $0x0,0x28(%rsp)
  29:	00
* 2a:	e8 7f b1 61 00       	callq  0x61b1ae <-- trapping instruction
  2f:	be 04 00 00 00       	mov    $0x4,%esi
  34:	48 8d 7c 24 28       	lea    0x28(%rsp),%rdi
  39:	e8 70 b1 61 00       	callq  0x61b1ae
  3e:	8b                   	.byte 0x8b
  3f:	44                   	rex.R

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-net-kasan-gce 2021/10/12 03:54 net-next ce8bd03c47fc 838e7e2c .config log report info INFO: rcu detected stall in batadv_dat_purge
* Struck through repros no longer work on HEAD.