syzbot


INFO: rcu detected stall in newlstat (2)

Status: auto-closed as invalid on 2022/04/30 11:07
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 270d, last: 270d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in newlstat 7 362d 425d 0/24 closed as invalid on 2022/02/08 10:00
upstream INFO: rcu detected stall in newlstat (3) 1 142d 142d 0/24 auto-closed as invalid on 2022/10/05 01:09

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (1 GPs behind) idle=a95/1/0x4000000000000000 softirq=206908/206910 fqs=0 
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P1266/1:b..l
	(detected by 0, t=10502 jiffies, g=288465, q=245)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 3608 Comm: syz-executor.3 Not tainted 5.17.0-rc6-next-20220301-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:hlock_class kernel/locking/lockdep.c:228 [inline]
RIP: 0010:__lock_acquire+0x145a/0x56c0 kernel/locking/lockdep.c:5056
Code: f8 66 81 e3 ff 1f 0f b7 db be 08 00 00 00 48 89 d8 48 c1 f8 06 48 8d 3c c5 80 69 e0 8f e8 6e 59 67 00 48 0f a3 1d 46 29 83 0e <0f> 83 2c 06 00 00 48 8d 1c 5b 48 c1 e3 06 48 81 c3 a0 6d e0 8f 48
RSP: 0018:ffffc900001e0b70 EFLAGS: 00000047
RAX: 0000000000000001 RBX: 000000000000018f RCX: ffffffff815d4032
RDX: fffffbfff1fc0d37 RSI: 0000000000000008 RDI: ffffffff8fe069b0
RBP: ffff88801c08a7f2 R08: 0000000000000000 R09: ffffffff8fe069b7
R10: fffffbfff1fc0d36 R11: 0000000000000001 R12: ffff88801c08a7d0
R13: ffff88801c089d40 R14: 0000000000000001 R15: 0bd22b9a19aa4d02
FS:  00005555561ce400(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd4a248ee8 CR3: 000000001aace000 CR4: 00000000003526e0
DR0: 000000000000006e DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 lock_acquire kernel/locking/lockdep.c:5672 [inline]
 lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5637
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:354 [inline]
 advance_sched+0x53/0x9a0 net/sched/sch_taprio.c:714
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5640
Code: e2 a4 7e 83 f8 01 0f 85 b4 02 00 00 9c 58 f6 c4 02 0f 85 9f 02 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc9000419fbf0 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92000833f80 RCX: ffffffff815d421e
RDX: 1ffff110038114f4 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff8fe069b7
R10: fffffbfff1fc0d36 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: ffff888077b68f28 R15: 0000000000000000
 __might_fault mm/memory.c:5318 [inline]
 __might_fault+0x104/0x170 mm/memory.c:5311
 strncpy_from_user+0x2f/0x3c0 lib/strncpy_from_user.c:117
 getname_flags.part.0+0x95/0x4f0 fs/namei.c:149
 getname_flags+0x9a/0xe0 include/linux/audit.h:323
 vfs_fstatat+0x73/0xb0 fs/stat.c:254
 vfs_lstat include/linux/fs.h:3218 [inline]
 __do_sys_newlstat+0x8b/0x110 fs/stat.c:412
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f3d484880e6
Code: ff ff ff 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 41 89 f8 48 89 f7 48 89 d6 41 83 f8 01 77 29 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 c3 90 48 c7 c2 b8 ff ff ff f7 d8 64 89 02
RSP: 002b:00007ffd4a249628 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3d484880e6
RDX: 00007ffd4a249660 RSI: 00007ffd4a249660 RDI: 00007ffd4a2496f0
RBP: 00007ffd4a2496f0 R08: 0000000000000001 R09: 00007ffd4a2494c0
R10: 00005555561cf873 R11: 0000000000000246 R12: 00007f3d484e21ea
R13: 00007ffd4a24a7b0 R14: 00005555561cf810 R15: 00007ffd4a24a7f0
 </TASK>
task:kworker/u4:5    state:R  running task     stack:23768 pid: 1266 ppid:     2 flags:0x00004000
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5043 [inline]
 __schedule+0xa94/0x4910 kernel/sched/core.c:6352
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6660
 irqentry_exit+0x31/0x80 kernel/entry/common.c:435
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5640
Code: e2 a4 7e 83 f8 01 0f 85 b4 02 00 00 9c 58 f6 c4 02 0f 85 9f 02 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc90005737b98 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92000ae6f75 RCX: 809179bc7d3d5a7c
RDX: 1ffff11003c7b89c RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8fe06987
R10: fffffbfff1fc0d30 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: ffffffff8bb85960 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:268 [inline]
 rcu_read_lock include/linux/rcupdate.h:694 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
 batadv_nc_worker+0x12d/0xfa0 net/batman-adv/network-coding.c:719
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g288465 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=0 timer-softirq=134917
rcu: rcu_preempt kthread starved for 10502 jiffies! g288465 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:28752 pid:   16 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5043 [inline]
 __schedule+0xa94/0x4910 kernel/sched/core.c:6352
 schedule+0xd2/0x1f0 kernel/sched/core.c:6424
 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881
 rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1999
 rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2172
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 0
CPU: 0 PID: 32728 Comm: syz-executor.0 Not tainted 5.17.0-rc6-next-20220301-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1e6/0x230 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_check_gp_kthread_starvation.cold+0x1fb/0x200 kernel/rcu/tree_stall.h:516
 print_other_cpu_stall kernel/rcu/tree_stall.h:621 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:767 [inline]
 rcu_pending kernel/rcu/tree.c:3960 [inline]
 rcu_sched_clock_irq+0x21ae/0x22a0 kernel/rcu/tree.c:2660
 update_process_times+0x16d/0x200 kernel/time/timer.c:1785
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:243
 tick_sched_timer+0xee/0x120 kernel/time/tick-sched.c:1473
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:csd_lock_wait kernel/smp.c:440 [inline]
RIP: 0010:smp_call_function_single+0x1b5/0x4b0 kernel/smp.c:758
Code: 48 8d 74 24 40 48 89 44 24 50 48 8b 44 24 08 48 89 44 24 58 e8 bc fa ff ff 41 89 c5 eb 07 e8 92 98 0b 00 f3 90 44 8b 64 24 48 <31> ff 41 83 e4 01 44 89 e6 e8 9d 9a 0b 00 45 85 e4 75 e1 e8 73 98
RSP: 0018:ffffc9000b5ff1e0 EFLAGS: 00000246
RAX: 0000000000040000 RBX: 1ffff920016bfe40 RCX: ffffc90003b21000
RDX: 0000000000040000 RSI: ffffffff816d621e RDI: 0000000000000003
RBP: ffffc9000b5ff2b0 R08: 0000000000000000 R09: ffffffff8fe06a1f
R10: ffffffff816d6233 R11: 0000000000000000 R12: 0000000000000011
R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000
 rcu_barrier+0x289/0x630 kernel/rcu/tree.c:4140
 nft_rhash_destroy+0x25/0x40 net/netfilter/nft_set_hash.c:411
 nf_tables_newset+0x2773/0x3360 net/netfilter/nf_tables_api.c:4483
 nfnetlink_rcv_batch+0x1716/0x25f0 net/netfilter/nfnetlink.c:513
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]
 nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:652
 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
 netlink_unicast+0x539/0x7e0 net/netlink/af_netlink.c:1343
 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:705 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:725
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2413
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f979c489049
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f979d535168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f979c59bf60 RCX: 00007f979c489049
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 00007f979c4e308d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff5da6aabf R14: 00007f979d535300 R15: 0000000000022000
 </TASK>
----------------
Code disassembly (best guess):
   0:	f8                   	clc
   1:	66 81 e3 ff 1f       	and    $0x1fff,%bx
   6:	0f b7 db             	movzwl %bx,%ebx
   9:	be 08 00 00 00       	mov    $0x8,%esi
   e:	48 89 d8             	mov    %rbx,%rax
  11:	48 c1 f8 06          	sar    $0x6,%rax
  15:	48 8d 3c c5 80 69 e0 	lea    -0x701f9680(,%rax,8),%rdi
  1c:	8f
  1d:	e8 6e 59 67 00       	callq  0x675990
  22:	48 0f a3 1d 46 29 83 	bt     %rbx,0xe832946(%rip)        # 0xe832970
  29:	0e
* 2a:	0f 83 2c 06 00 00    	jae    0x65c <-- trapping instruction
  30:	48 8d 1c 5b          	lea    (%rbx,%rbx,2),%rbx
  34:	48 c1 e3 06          	shl    $0x6,%rbx
  38:	48 81 c3 a0 6d e0 8f 	add    $0xffffffff8fe06da0,%rbx
  3f:	48                   	rex.W

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-linux-next-kasan-gce-root 2022/03/01 11:03 linux-next e6ada6df471f 45a13a73 .config log report info INFO: rcu detected stall in newlstat
* Struck through repros no longer work on HEAD.