INFO: rcu detected stall in br_multicast_port_group_expired

Status: auto-obsoleted due to no activity on 2024/10/11 20:34
Reported-by: syzbot+41571a9ef70704001e03@syzkaller.appspotmail.com
First crash: 755d, last: 755d
▶ ▼ Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in br_multicast_port_group_expired (2) bridge 1 5 2827d 2867d 0/29 closed as dup on 2019/01/02 16:28
upstream INFO: rcu detected stall in br_multicast_port_group_expired bridge 1 1 2873d 2873d 0/29 closed as invalid on 2018/09/17 08:22
android-5-15 BUG: soft lockup in br_multicast_port_group_expired 1 2 628d 711d 0/2 auto-obsoleted due to no activity on 2025/02/05 03:41
android-6-1 BUG: soft lockup in br_multicast_port_group_expired 1 3 662d 773d 0/2 auto-obsoleted due to no activity on 2025/01/02 19:42
android-54 BUG: soft lockup in br_multicast_port_group_expired 1 1 783d 783d 0/2 auto-obsoleted due to no activity on 2024/09/03 00:58
upstream BUG: soft lockup in br_multicast_port_group_expired net 1 1 209d 209d 0/29 closed as invalid on 2026/03/06 16:20
android-54 BUG: soft lockup in br_multicast_port_group_expired (2) 1 2 457d 496d 0/2 auto-obsoleted due to no activity on 2025/07/26 14:48
android-5-10 BUG: soft lockup in br_multicast_port_group_expired 1 1 704d 704d 0/2 auto-obsoleted due to no activity on 2024/11/21 20:11

Sample crash report:
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	1-....: (1 GPs behind) idle=463/1/0x4000000000000000 softirq=26092/26093 fqs=222 
	(t=10502 jiffies g=35649 q=1560)
NMI backtrace for cpu 1
CPU: 1 PID: 5308 Comm: syz.2.403 Not tainted 5.15.161-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x46a/0x4a0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x181/0x2a0 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:166 [inline]
 rcu_dump_cpu_stacks+0x223/0x390 kernel/rcu/tree_stall.h:349
 print_cpu_stall+0x320/0x600 kernel/rcu/tree_stall.h:633
 check_cpu_stall kernel/rcu/tree_stall.h:727 [inline]
 rcu_pending kernel/rcu/tree.c:3932 [inline]
 rcu_sched_clock_irq+0x8d9/0x1150 kernel/rcu/tree.c:2619
 update_process_times+0x196/0x200 kernel/time/timer.c:1818
 tick_sched_handle kernel/time/tick-sched.c:254 [inline]
 tick_sched_timer+0x386/0x550 kernel/time/tick-sched.c:1473
 __run_hrtimer kernel/time/hrtimer.c:1686 [inline]
 __hrtimer_run_queues+0x55b/0xcf0 kernel/time/hrtimer.c:1750
 hrtimer_interrupt+0x392/0x980 kernel/time/hrtimer.c:1812
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1085 [inline]
 __sysvec_apic_timer_interrupt+0x139/0x470 arch/x86/kernel/apic/apic.c:1102
 sysvec_apic_timer_interrupt+0x3e/0xb0 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:preempt_count_add+0x30/0x180 kernel/sched/core.c:5485
Code: fb 48 c7 c0 c0 0f 3f 91 48 c1 e8 03 49 bf 00 00 00 00 00 fc ff df 42 0f b6 04 38 84 c0 0f 85 e2 00 00 00 83 3d d0 a7 e7 0f 00 <75> 07 65 8b 05 cf 07 ab 7e 65 01 1d c8 07 ab 7e 48 c7 c0 c0 0f 3f
RSP: 0018:ffffc90000dd0188 EFLAGS: 00000246
RAX: 0000000000000004 RBX: 0000000000000001 RCX: ffffffff913f0f03
RDX: dffffc0000000000 RSI: ffffffff812fd943 RDI: 0000000000000001
RBP: ffffc90000dd0298 R08: 0000000000000016 R09: ffffc90000dd0350
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90002f772e0
R13: ffffffff816df420 R14: ffffffff812fd943 R15: dffffc0000000000
 unwind_next_frame+0xbb/0x1fa0 arch/x86/kernel/unwind_orc.c:433
 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x80 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
 ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1705 [inline]
 slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731
 slab_free mm/slub.c:3499 [inline]
 kmem_cache_free+0x91/0x1f0 mm/slub.c:3515
 netlink_broadcast_filtered+0x1083/0x11a0 net/netlink/af_netlink.c:1540
 netlink_broadcast net/netlink/af_netlink.c:1562 [inline]
 nlmsg_multicast include/net/netlink.h:1033 [inline]
 nlmsg_notify+0xf7/0x1b0 net/netlink/af_netlink.c:2551
 br_mdb_notify+0x1474/0x1940 net/bridge/br_mdb.c:812
 br_multicast_del_pg+0x482/0xc60 net/bridge/br_multicast.c:691
 br_multicast_port_group_expired+0x549/0x720 net/bridge/br_multicast.c:753
 call_timer_fn+0x16d/0x560 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x67c/0x890 kernel/time/timer.c:1767
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
 handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
 __do_softirq kernel/softirq.c:592 [inline]
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1096
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:preempt_schedule_irq+0xf2/0x1c0 kernel/sched/core.c:6780
Code: 89 f5 49 c1 ed 03 eb 0d 48 f7 03 08 00 00 00 0f 84 97 00 00 00 bf 01 00 00 00 e8 59 e2 30 f7 e8 a4 55 60 f7 fb bf 01 00 00 00 <e8> a9 b3 ff ff 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 29 a4 a3 f7 48
RSP: 0018:ffffc90002f77140 EFLAGS: 00000286
RAX: 59354c513af2a100 RBX: 1ffff920005eee30 RCX: ffffffff913f0f03
RDX: dffffc0000000000 RSI: ffffffff8a8b2a00 RDI: 0000000000000001
RBP: ffffc90002f77200 R08: ffffffff8186db40 R09: ffffffff8f5fc048
R10: ffffffff8f5fc058 R11: ffffffff8f5fc050 R12: 1ffff920005eee28
R13: 1ffff920005eee2c R14: ffffc90002f77160 R15: dffffc0000000000
 irqentry_exit+0x53/0x80 kernel/entry/common.c:432
 asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:629
RIP: 0010:unwind_done arch/x86/include/asm/unwind.h:46 [inline]
RIP: 0010:unwind_get_return_address+0x1e/0x80 arch/x86/kernel/unwind_orc.c:320
Code: e9 e1 fe ff ff e8 02 b7 e5 08 66 90 41 57 41 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 42 0f b6 04 30 <84> c0 75 47 83 3b 00 74 3a 48 83 c3 48 49 89 df 49 c1 ef 03 43 80
RSP: 0018:ffffc90002f772c0 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: ffffc90002f772e0 RCX: 0000000080000000
RDX: dffffc0000000000 RSI: ffffc90002f77b70 RDI: ffffc90002f772e0
RBP: ffffc90002f77370 R08: ffffc90002f77b70 R09: ffffc90002f77330
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88802440bb80
R13: ffffffff816df420 R14: dffffc0000000000 R15: 0000000000000000
 arch_stack_walk+0xf3/0x140 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 save_stack+0xf6/0x1e0 mm/page_owner.c:119
 __reset_page_owner+0x52/0x180 mm/page_owner.c:140
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317
 free_unref_page+0x95/0x2d0 mm/page_alloc.c:3396
 tlb_batch_list_free mm/mmu_gather.c:61 [inline]
 tlb_finish_mmu+0x249/0x320 mm/mmu_gather.c:341
 exit_mmap+0x3cd/0x670 mm/mmap.c:3188
 __mmput+0x112/0x3b0 kernel/fork.c:1126
 exit_mm+0x688/0x7f0 kernel/exit.c:548
 do_exit+0x626/0x2480 kernel/exit.c:859
 do_group_exit+0x144/0x310 kernel/exit.c:994
 get_signal+0xc66/0x14e0 kernel/signal.c:2889
 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fc381075bd9
Code: Unable to access opcode bytes at RIP 0x7fc381075baf.
RSP: 002b:00007fc37faf60f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fc381203f68 RCX: 00007fc381075bd9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc381203f68
RBP: 00007fc381203f60 R08: 00007fc37faf66c0 R09: 00007fc37faf66c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc381203f6c
R13: 000000000000000b R14: 00007fffe7f08c60 R15: 00007fffe7f08d48
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/03 20:33 linux-5.15.y 4878aadf2d15 f76a75f3 .config console log report info ci2-linux-5-15-kasan-perf INFO: rcu detected stall in br_multicast_port_group_expired
* Struck through repros no longer work on HEAD.