syzbot


INFO: rcu detected stall in add_timer_on

Status: auto-closed as invalid on 2020/06/20 03:49
Reported-by: syzbot+bc83046eaf5e00d036e1@syzkaller.appspotmail.com
First crash: 854d, last: 854d

Sample crash report:
INFO: rcu_sched detected stalls on CPUs/tasks:
	(detected by 0, t=10502 jiffies, g=25519, c=25518, q=1)
All QSes seen, last rcu_sched kthread activity 10444 (4295028264-4295017820), jiffies_till_next_fqs=1, root ->qsmask 0x0
syz-executor.5  R  running task    26688 12926  20879 0x00000008
Call Trace:
 <IRQ>
 sched_show_task kernel/sched/core.c:5168 [inline]
 sched_show_task.cold+0x2f0/0x351 kernel/sched/core.c:5143
 print_other_cpu_stall kernel/rcu/tree.c:1501 [inline]
 check_cpu_stall kernel/rcu/tree.c:1616 [inline]
 __rcu_pending kernel/rcu/tree.c:3390 [inline]
 rcu_pending kernel/rcu/tree.c:3452 [inline]
 rcu_check_callbacks.cold+0xcb1/0xd0a kernel/rcu/tree.c:2792
 update_process_times+0x31/0x70 kernel/time/timer.c:1590
 tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:165
 tick_sched_timer+0x43/0x130 kernel/time/tick-sched.c:1223
 __run_hrtimer kernel/time/hrtimer.c:1223 [inline]
 __hrtimer_run_queues+0x270/0xbc0 kernel/time/hrtimer.c:1287
 hrtimer_interrupt+0x1d8/0x5d0 kernel/time/hrtimer.c:1321
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline]
 smp_apic_timer_interrupt+0x11c/0x5e0 arch/x86/kernel/apic/apic.c:1100
 apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
RIP: 0010:add_timer_on+0x0/0x6e0 kernel/time/timer.c:1102
RSP: 0018:ffff8880aec07cb8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff10
RAX: ffff88806cdc8080 RBX: 0000000000000001 RCX: 1ffffffff11642ee
RDX: 0000000000000100 RSI: 0000000000000001 RDI: ffffffff89a7cd60
RBP: ffff8880aec07d40 R08: 000000d52b01c2a6 R09: ffff88806cdc89c0
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff87eed440
R13: ffffffff87f93eb8 R14: dffffc0000000000 R15: 000000d52b01c2a6
 call_timer_fn+0x161/0x670 kernel/time/timer.c:1279
 expire_timers kernel/time/timer.c:1318 [inline]
 __run_timers kernel/time/timer.c:1636 [inline]
 __run_timers kernel/time/timer.c:1604 [inline]
 run_timer_softirq+0x5b7/0x1520 kernel/time/timer.c:1649
 __do_softirq+0x244/0x9a0 kernel/softirq.c:288
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x160/0x1b0 kernel/softirq.c:409
 exiting_irq arch/x86/include/asm/apic.h:648 [inline]
 smp_apic_timer_interrupt+0x146/0x5e0 arch/x86/kernel/apic/apic.c:1102
 apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
 </IRQ>
RIP: 0010:schedule_debug kernel/sched/core.c:3198 [inline]
RIP: 0010:__schedule+0xf0/0x1cd0 kernel/sched/core.c:3308
RSP: 0018:ffff8881faab71d0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: ffff8881faab0000 RCX: ffffc90012eb8000
RDX: 1ffff1103f556000 RSI: ffffffff830df56c RDI: ffff88806cdc8098
RBP: ffff8881faab7278 R08: 000000d4b14296cd R09: ffff88806cdc8948
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: 000000000002b540 R14: ffff88806cdc8080 R15: ffff8880aec2b540
 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:3611
 retint_kernel+0x1b/0x2d
RIP: 0010:qlink_to_object mm/kasan/quarantine.c:136 [inline]
RIP: 0010:qlink_free mm/kasan/quarantine.c:141 [inline]
RIP: 0010:qlist_free_all+0x39/0x150 mm/kasan/quarantine.c:166
RSP: 0018:ffff8881faab7368 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: 0000000000000282 RCX: ffffea000256221f
RDX: 0000000000000000 RSI: ffff88806c9ac300 RDI: ffff88806c9ac300
RBP: ffff8881faab7398 R08: ffff88806cdc8080 R09: ffff88806cdc8948
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88808e86d540 R14: ffff8881faab73a8 R15: ffff8880aa800dc0
 quarantine_reduce+0x147/0x180 mm/kasan/quarantine.c:259
 kasan_kmalloc+0xa0/0xf0 mm/kasan/kasan.c:536
 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:489
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc mm/slab.c:3390 [inline]
 kmem_cache_alloc_trace+0x13b/0x790 mm/slab.c:3616
 kmalloc include/linux/slab.h:488 [inline]
 kzalloc include/linux/slab.h:661 [inline]
 snd_timer_instance_new+0x4f/0x3c0 sound/core/timer.c:111
 snd_timer_open+0x882/0x15e0 sound/core/timer.c:321
 snd_seq_timer_open+0x210/0x520 sound/core/seq/seq_timer.c:287
 queue_use+0x9e/0x200 sound/core/seq/seq_queue.c:514
 snd_seq_queue_alloc+0x2b5/0x490 sound/core/seq/seq_queue.c:199
 snd_seq_ioctl_create_queue+0xad/0x2f0 sound/core/seq/seq_clientmgr.c:1528
 snd_seq_kernel_client_ctl+0xd7/0x120 sound/core/seq/seq_clientmgr.c:2360
 alloc_seq_queue.isra.0+0xcd/0x150 sound/core/seq/oss/seq_oss_init.c:370
 snd_seq_oss_open+0x2d7/0x8d0 sound/core/seq/oss/seq_oss_init.c:228
 odev_open+0x69/0x90 sound/core/seq/oss/seq_oss.c:138
 soundcore_open+0x3f3/0x5a0 sound/sound_core.c:640
 chrdev_open+0x207/0x590 fs/char_dev.c:423
 do_dentry_open+0x73b/0xeb0 fs/open.c:777
 vfs_open+0x105/0x220 fs/open.c:891
 do_last fs/namei.c:3428 [inline]
 path_openat+0x917/0x3e50 fs/namei.c:3569
 do_filp_open+0x18e/0x250 fs/namei.c:3603
 do_sys_open+0x2c5/0x430 fs/open.c:1084
 SYSC_openat fs/open.c:1111 [inline]
 SyS_openat+0x30/0x40 fs/open.c:1105
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45c449
RSP: 002b:00007f0c27b2ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f0c27b2f6d4 RCX: 000000000045c449
RDX: 0000000000000001 RSI: 00000000200019c0 RDI: ffffffffffffff9c
RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000007d3 R14: 00000000004ca437 R15: 000000000076bf2c
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
device bridge_slave_1 left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_0 left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
device veth1_macvtap left promiscuous mode
device veth0_macvtap left promiscuous mode
device veth1_vlan left promiscuous mode
device veth0_vlan left promiscuous mode
bond5 (unregistering): Released all slaves
bond0 (unregistering): Releasing backup interface bond4
bond4 (unregistering): Released all slaves
bond0 (unregistering): Releasing backup interface bond3
bond3 (unregistering): Released all slaves
bond0 (unregistering): Releasing backup interface bond2
bond2 (unregistering): Released all slaves
bond0 (unregistering): Releasing backup interface bond1
bond1 (unregistering): Released all slaves
device hsr_slave_1 left promiscuous mode
device hsr_slave_0 left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
bond0 (unregistering): Releasing backup interface bond_slave_1
bond0 (unregistering): Releasing backup interface bond_slave_0
bond0 (unregistering): Released all slaves
audit: type=1400 audit(1582256928.241:472): avc:  denied  { map } for  pid=12941 comm="syz-executor.2" path="/sys/kernel/debug/kcov" dev="debugfs" ino=1124 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
chnl_net:caif_netlink_parms(): no params data found
IPVS: ftp: loaded support on port[0] = 21
chnl_net:caif_netlink_parms(): no params data found
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered disabled state
device bridge_slave_0 entered promiscuous mode
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_1 entered promiscuous mode
bond0: Enslaving bond_slave_0 as an active interface with an up link
bond0: Enslaving bond_slave_1 as an active interface with an up link
IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
team0: Port device team_slave_0 added
IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
team0: Port device team_slave_1 added
batman_adv: batadv0: Adding interface: batadv_slave_0
batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
IPVS: ftp: loaded support on port[0] = 21
batman_adv: batadv0: Adding interface: batadv_slave_1
batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered disabled state
device bridge_slave_0 entered promiscuous mode
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_1 entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
bond0: Enslaving bond_slave_0 as an active interface with an up link
device hsr_slave_0 entered promiscuous mode
device hsr_slave_1 entered promiscuous mode
bond0: Enslaving bond_slave_1 as an active interface with an up link
IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
chnl_net:caif_netlink_parms(): no params data found
IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
team0: Port device team_slave_0 added
IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
team0: Port device team_slave_1 added
batman_adv: batadv0: Adding interface: batadv_slave_0
batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
batman_adv: batadv0: Adding interface: batadv_slave_1
batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
IPVS: ftp: loaded support on port[0] = 21
IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
device hsr_slave_0 entered promiscuous mode
device hsr_slave_1 entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
chnl_net:caif_netlink_parms(): no params data found
IPVS: ftp: loaded support on port[0] = 21
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered disabled state
device bridge_slave_0 entered promiscuous mode
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_1 entered promiscuous mode
bond0: Enslaving bond_slave_0 as an active interface with an up link
IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
bond0: Enslaving bond_slave_1 as an active interface with an up link
IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
team0: Port device team_slave_0 added
IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
team0: Port device team_slave_1 added
8021q: adding VLAN 0 to HW filter on device bond0
chnl_net:caif_netlink_parms(): no params data found
IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
batman_adv: batadv0: Adding interface: batadv_slave_0
batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
8021q: adding VLAN 0 to HW filter on device bond0
IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
8021q: adding VLAN 0 to HW filter on device team0
batman_adv: batadv0: Adding interface: batadv_slave_1
batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered disabled state
device bridge_slave_0 entered promiscuous mode

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-14 2020/02/21 03:48 linux-4.14.y 98db2bf27b9e bd2a74a3 .config log report