syzbot


INFO: rcu detected stall in sctp_generate_t1_init_event

Status: auto-closed as invalid on 2020/04/06 14:59
Reported-by: syzbot+4a2bc4670246e32eba63@syzkaller.appspotmail.com
First crash: 1601d, last: 1601d

Sample crash report:
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
INFO: rcu_preempt detected stalls on CPUs/tasks:
	(detected by 0, t=10502 jiffies, g=29360, c=29359, q=303)
All QSes seen, last rcu_preempt kthread activity 10503 (4295024389-4295013886), jiffies_till_next_fqs=1, root ->qsmask 0x0
syz-executor.2  R  running task    29024  4009   6973 0x00000008
Call Trace:
 <IRQ>
 sched_show_task kernel/sched/core.c:5168 [inline]
 sched_show_task.cold+0x2f0/0x351 kernel/sched/core.c:5143
 print_other_cpu_stall kernel/rcu/tree.c:1501 [inline]
 check_cpu_stall kernel/rcu/tree.c:1616 [inline]
 __rcu_pending kernel/rcu/tree.c:3390 [inline]
 rcu_pending kernel/rcu/tree.c:3452 [inline]
 rcu_check_callbacks.cold+0xcb1/0xd0a kernel/rcu/tree.c:2792
 update_process_times+0x31/0x70 kernel/time/timer.c:1590
 tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:161
 tick_sched_timer+0x43/0x130 kernel/time/tick-sched.c:1219
 __run_hrtimer kernel/time/hrtimer.c:1220 [inline]
 __hrtimer_run_queues+0x270/0xbc0 kernel/time/hrtimer.c:1284
 hrtimer_interrupt+0x1d8/0x5d0 kernel/time/hrtimer.c:1318
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline]
 smp_apic_timer_interrupt+0x11c/0x5e0 arch/x86/kernel/apic/apic.c:1100
 apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
RIP: 0010:fib_table_lookup+0x180/0x1680 net/ipv4/fib_trie.c:1327
RSP: 0000:ffff8880aec073c8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888058832a80
RDX: 0000000000000100 RSI: ffffffff87f888a0 RDI: 0000000000000282
RBP: ffff8880aec07490 R08: 0000000000000000 R09: ffff888058832b68
R10: ffff888058832b48 R11: ffff888058832200 R12: ffff8880854d86a0
R13: 000000000000000a R14: ffff8880854d86a0 R15: ffff8880994458b0
 fib4_rule_action net/ipv4/fib_rules.c:135 [inline]
 fib4_rule_action+0x208/0x310 net/ipv4/fib_rules.c:108
 fib_rules_lookup+0x2a4/0x950 net/core/fib_rules.c:279
 __fib_lookup+0xd3/0x1a0 net/ipv4/fib_rules.c:93
 fib_lookup include/net/ip_fib.h:318 [inline]
 ip_route_output_key_hash_rcu+0xf9e/0x2750 net/ipv4/route.c:2449
 ip_route_output_key_hash+0x1c0/0x2e0 net/ipv4/route.c:2339
 __ip_route_output_key include/net/route.h:126 [inline]
 ip_route_output_flow+0x27/0xa0 net/ipv4/route.c:2597
 ip_route_output_key include/net/route.h:136 [inline]
 sctp_v4_get_dst+0xa9e/0x1030 net/sctp/protocol.c:512
 sctp_transport_route+0xa5/0x430 net/sctp/transport.c:305
 sctp_packet_config+0x7e4/0x9f0 net/sctp/output.c:106
 sctp_outq_flush+0x49c/0x31b0 net/sctp/outqueue.c:879
 sctp_outq_uncork+0x60/0x70 net/sctp/outqueue.c:761
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1776 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1179 [inline]
 sctp_do_sm+0x417/0x4ae0 net/sctp/sm_sideeffect.c:1150
 sctp_generate_timeout_event+0x1a1/0x340 net/sctp/sm_sideeffect.c:308
 sctp_generate_t1_init_event+0x1b/0x20 net/sctp/sm_sideeffect.c:330
 call_timer_fn+0x161/0x670 kernel/time/timer.c:1279
 expire_timers kernel/time/timer.c:1318 [inline]
 __run_timers kernel/time/timer.c:1636 [inline]
 __run_timers kernel/time/timer.c:1604 [inline]
 run_timer_softirq+0x5b7/0x1520 kernel/time/timer.c:1649
 __do_softirq+0x244/0x9a0 kernel/softirq.c:288
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x160/0x1b0 kernel/softirq.c:409
 exiting_irq arch/x86/include/asm/apic.h:648 [inline]
 smp_apic_timer_interrupt+0x146/0x5e0 arch/x86/kernel/apic/apic.c:1102
 apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
 </IRQ>
RIP: 0010:preempt_schedule_irq+0xab/0x140 kernel/sched/core.c:3611
RSP: 0000:ffff88804300fe18 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: 1ffffffff0fe2d2b RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888058832a7c
RBP: ffff88804300fe38 R08: 000000b3abae7952 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffed100b106440
R13: ffff888058832200 R14: ffffffff87f16958 R15: 0000000000000000
 retint_kernel+0x1b/0x2d
RIP: 0010:exit_to_usermode_loop+0x6d/0x220 arch/x86/entry/common.c:152
RSP: 0000:ffff88804300fef0 EFLAGS: 00000216 ORIG_RAX: ffffffffffffff10
RAX: 0000000000040000 RBX: 0000000000000008 RCX: ffffc9000a065000
RDX: 0000000000000c49 RSI: ffffffff81006596 RDI: ffff888058832a7c
RBP: ffff88804300ff20 R08: 000000b3ab47db3a R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffed100b106440 R14: ffff88804300ff58 R15: ffff888058832200
 prepare_exit_to_usermode+0x1b5/0x220 arch/x86/entry/common.c:199
 retint_user+0x8/0x18
RIP: 0033:0x45d53a
protocol 88fb is buggy, dev hsr_slave_0
RSP: 002b:00007ffaa7929c58 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: 000000000075c270 RCX: 000000000045d53a
RDX: 00000000004c2bf3 RSI: 00007ffaa7929c60 RDI: 0000000000000001
RBP: 000000000075c268 R08: 0000000000000009 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 000000000075c274
R13: 00000000004ca798 R14: 00000000004e39e0 R15: 000000000075c274
rcu_preempt kthread starved for 10549 jiffies! g29360 c29359 f0x2 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=1
rcu_preempt     R  running task    29344     8      2 0x80000000
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x7b8/0x1cd0 kernel/sched/core.c:3384
 schedule+0x92/0x1c0 kernel/sched/core.c:3428
 schedule_timeout+0x43e/0xe10 kernel/time/timer.c:1746
 rcu_gp_kthread+0xbf4/0x1ec0 kernel/rcu/tree.c:2255
 kthread+0x319/0x430 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
net_ratelimit: 6 callbacks suppressed
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
protocol 88fb is buggy, dev hsr_slave_0
protocol 88fb is buggy, dev hsr_slave_1
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
device bridge_slave_1 left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_0 left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
device hsr_slave_1 left promiscuous mode
device hsr_slave_0 left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
bond0 (unregistering): Releasing backup interface bond_slave_1
bond0 (unregistering): Releasing backup interface bond_slave_0
bond0 (unregistering): Released all slaves

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/08 14:58 linux-4.14.y a844dc4c5442 1508f453 .config console log report ci2-linux-4-14
* Struck through repros no longer work on HEAD.