syzbot


INFO: rcu detected stall in sys_inotify_add_watch

Status: auto-closed as invalid on 2021/12/16 04:51
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 442d, last: 442d

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P155/1:b..l P26394/1:b..l P30071/1:b..l P30062/1:b..l
	(detected by 0, t=10502 jiffies, g=145829, q=13)
task:systemd-udevd   state:R  running task     stack:27872 pid:30062 ppid:  2975 flags:0x00000000
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0x940/0x26f0 kernel/sched/core.c:6287
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6687
 irqentry_exit+0x31/0x80 kernel/entry/common.c:427
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x13/0x60 kernel/kcov.c:196
Code: 00 4d 8b 03 48 0f bd ca 49 8b 45 00 48 63 c9 e9 64 ff ff ff 0f 1f 00 65 8b 05 29 ad 8c 7e 89 c1 48 8b 34 24 81 e1 00 01 00 00 <65> 48 8b 14 25 40 f0 01 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82
RSP: 0018:ffffc9000b51fb00 EFLAGS: 00000246
RAX: 0000000080000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81ca11e4 RDI: 0000000000000003
RBP: ffff888011467410 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff81ca11c7 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000081 R14: ffffffff8b83cc00 R15: ffff888011467412
 inode_permission.part.0+0xc4/0x440 fs/namei.c:528
 inode_permission fs/namei.c:505 [inline]
 may_lookup fs/namei.c:1683 [inline]
 link_path_walk.part.0+0x277/0xd00 fs/namei.c:2239
 link_path_walk fs/namei.c:2221 [inline]
 path_lookupat+0xc8/0x860 fs/namei.c:2448
 filename_lookup+0x1c6/0x590 fs/namei.c:2478
 user_path_at_empty+0x42/0x60 fs/namei.c:2801
 user_path_at include/linux/namei.h:57 [inline]
 inotify_find_inode+0x32/0x170 fs/notify/inotify/inotify_user.c:355
 __do_sys_inotify_add_watch fs/notify/inotify/inotify_user.c:756 [inline]
 __se_sys_inotify_add_watch fs/notify/inotify/inotify_user.c:709 [inline]
 __x64_sys_inotify_add_watch+0x1f1/0x350 fs/notify/inotify/inotify_user.c:709
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f00ce62e397
RSP: 002b:00007ffcf39ea588 EFLAGS: 00000202 ORIG_RAX: 00000000000000fe
RAX: ffffffffffffffda RBX: 0000559360e939d0 RCX: 00007f00ce62e397
RDX: 0000000000000008 RSI: 0000559360e9e1e0 RDI: 0000000000000009
RBP: 00007ffcf39ea750 R08: 000055935f97b670 R09: 0000000000000008
R10: 0000559360ea4f58 R11: 0000000000000202 R12: 00007ffcf39ea6a0
R13: 0000559360e939d0 R14: 0000000000000003 R15: 000000000000000e
task:syz-executor.4  state:R  running task     stack:28912 pid:30071 ppid:  6579 flags:0x00000000
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0x940/0x26f0 kernel/sched/core.c:6287
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6687
 irqentry_exit+0x31/0x80 kernel/entry/common.c:427
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:lock_is_held_type+0xfd/0x140 kernel/locking/lockdep.c:5673
Code: 00 00 b8 ff ff ff ff 65 0f c1 05 8e 0d cd 76 83 f8 01 75 29 9c 58 f6 c4 02 75 3d 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 <44> 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 45 31 ed eb b9 0f 0b 48
RSP: 0018:ffffc9000bdaf820 EFLAGS: 00000292
RAX: 0000000000000046 RBX: 0000000000000002 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff8b97d3e0 R08: 0000000000000000 R09: ffff8880b9c32a8b
R10: ffffed1017386551 R11: 0000000000000000 R12: ffff88807b8e2100
R13: 0000000000000001 R14: 00000000ffffffff R15: ffff88807b8e2b48
 get_mem_cgroup_from_mm+0x84/0x6c0 mm/memcontrol.c:928
 __mem_cgroup_charge+0x16/0x90 mm/memcontrol.c:6733
 mem_cgroup_charge include/linux/memcontrol.h:694 [inline]
 shmem_add_to_page_cache+0x9ee/0x1680 mm/shmem.c:713
 shmem_getpage_gfp+0x8ad/0x25e0 mm/shmem.c:1935
 shmem_getpage mm/shmem.c:151 [inline]
 shmem_write_begin+0xff/0x1e0 mm/shmem.c:2469
 generic_perform_write+0x202/0x510 mm/filemap.c:3770
 __generic_file_write_iter+0x24e/0x640 mm/filemap.c:3897
 generic_file_write_iter+0xd7/0x220 mm/filemap.c:3929
 call_write_iter include/linux/fs.h:2163 [inline]
 new_sync_write+0x40b/0x640 fs/read_write.c:507
 vfs_write+0x7cf/0xae0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x1fd/0x250 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f09127bf8d7
RSP: 002b:00007f090fd82f20 EFLAGS: 00000293 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007f0912856cc0 RCX: 00007f09127bf8d7
RDX: 0000000000000080 RSI: 0000000020012d00 RDI: 0000000000000003
RBP: 0000000000000034 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000506000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000003 R14: 00000000200004a0 R15: 000000000000001c
task:kworker/u4:7    state:R  running task     stack:25400 pid:26394 ppid:     2 flags:0x00004000
Workqueue: bat_events batadv_nc_worker
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0x940/0x26f0 kernel/sched/core.c:6287
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6687
 irqentry_exit+0x31/0x80 kernel/entry/common.c:427
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5593
Code: 60 a7 7e 83 f8 01 0f 85 b4 02 00 00 9c 58 f6 c4 02 0f 85 9f 02 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc900175afb30 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92002eb5f68 RCX: 0bf81aee8f9736ba
RDX: 1ffff11006048986 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8fcff927
R10: fffffbfff1f9ff24 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: ffffffff8b97d3e0 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:267 [inline]
 rcu_read_lock include/linux/rcupdate.h:687 [inline]
 batadv_nc_process_nc_paths.part.0+0xec/0x3c0 net/batman-adv/network-coding.c:689
 batadv_nc_process_nc_paths net/batman-adv/network-coding.c:681 [inline]
 batadv_nc_worker+0xc46/0xfa0 net/batman-adv/network-coding.c:730
 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
task:kworker/u4:3    state:R  running task     stack:24256 pid:  155 ppid:     2 flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0x940/0x26f0 kernel/sched/core.c:6287
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6687
 irqentry_exit+0x31/0x80 kernel/entry/common.c:427
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__sanitizer_cov_trace_cmp8+0x69/0x70 kernel/kcov.c:265
Code: 3c cd 28 00 00 00 48 39 fe 72 1f 48 83 c2 01 4c 89 44 38 e8 48 c7 44 38 e0 06 00 00 00 48 89 4c 38 f0 4e 89 54 c8 20 48 89 10 <c3> 66 0f 1f 44 00 00 53 41 89 fb 41 89 f1 bf 03 00 00 00 65 48 8b
RSP: 0018:ffffc90001de7b40 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00000000000472c1 RCX: 00000000000472c1
RDX: 0000000000000000 RSI: ffff8880131cc080 RDI: 0000000000000003
RBP: 00000000000472c1 R08: 00000000000472c1 R09: 0000000000000001
R10: ffffffff879fe66b R11: 0000000000000000 R12: ffffffff8d3b5780
R13: ffffc90001de7ca8 R14: 0000000000000002 R15: dffffc0000000000
 inet_twsk_purge+0x4bb/0x7d0 net/ipv4/inet_timewait_sock.c:297
 ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171
 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:591
 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g145829 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=1 timer-softirq=69833
rcu: rcu_preempt kthread starved for 10502 jiffies! g145829 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:28952 pid:   14 ppid:     2 flags:0x00004000
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0x940/0x26f0 kernel/sched/core.c:6287
 schedule+0xd3/0x270 kernel/sched/core.c:6366
 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881
 rcu_gp_fqs_loop+0x186/0x800 kernel/rcu/tree.c:1957
 rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2130
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
----------------
Code disassembly (best guess):
   0:	00 4d 8b             	add    %cl,-0x75(%rbp)
   3:	03 48 0f             	add    0xf(%rax),%ecx
   6:	bd ca 49 8b 45       	mov    $0x458b49ca,%ebp
   b:	00 48 63             	add    %cl,0x63(%rax)
   e:	c9                   	leaveq
   f:	e9 64 ff ff ff       	jmpq   0xffffff78
  14:	0f 1f 00             	nopl   (%rax)
  17:	65 8b 05 29 ad 8c 7e 	mov    %gs:0x7e8cad29(%rip),%eax        # 0x7e8cad47
  1e:	89 c1                	mov    %eax,%ecx
  20:	48 8b 34 24          	mov    (%rsp),%rsi
  24:	81 e1 00 01 00 00    	and    $0x100,%ecx
* 2a:	65 48 8b 14 25 40 f0 	mov    %gs:0x1f040,%rdx <-- trapping instruction
  31:	01 00
  33:	a9 00 01 ff 00       	test   $0xff0100,%eax
  38:	74 0e                	je     0x48
  3a:	85 c9                	test   %ecx,%ecx
  3c:	74 35                	je     0x73
  3e:	8b                   	.byte 0x8b
  3f:	82                   	.byte 0x82

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2021/09/17 04:42 upstream bdb575f87217 5b989942 .config log report info INFO: rcu detected stall in sys_inotify_add_watch
* Struck through repros no longer work on HEAD.