syzbot


BUG: soft lockup in tipc_send_work

Status: auto-closed as invalid on 2022/05/04 23:16
Reported-by: syzbot+cef2959345e2bb4dc3bb@syzkaller.appspotmail.com
First crash: 173d, last: 173d

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [kworker/u4:2:34]
Modules linked in:
irq event stamp: 484353
hardirqs last  enabled at (484352): [<ffffffff87400976>] restore_regs_and_return_to_kernel+0x0/0x2a
hardirqs last disabled at (484353): [<ffffffff874018ae>] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793
softirqs last  enabled at (479462): [<ffffffff86d1b18d>] tipc_unregister_callbacks net/tipc/server.c:192 [inline]
softirqs last  enabled at (479462): [<ffffffff86d1b18d>] tipc_close_conn+0xdd/0x200 net/tipc/server.c:200
softirqs last disabled at (479464): [<ffffffff86cdeb32>] spin_lock_bh include/linux/spinlock.h:322 [inline]
softirqs last disabled at (479464): [<ffffffff86cdeb32>] tipc_subscrb_subscrp_delete+0x32/0x330 net/tipc/subscr.c:201
CPU: 0 PID: 34 Comm: kworker/u4:2 Not tainted 4.14.260-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: tipc_send tipc_send_work
task: ffff8880b56b61c0 task.stack: ffff8880b56b8000
RIP: 0010:__read_once_size include/linux/compiler.h:185 [inline]
RIP: 0010:lock_timer_base+0xaa/0x190 kernel/time/timer.c:918
RSP: 0018:ffff8880b56bfae8 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10
RAX: ffff8880b56b61c0 RBX: 00000000010c0008 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8880b56bfb58 RDI: ffff8880b0538b18
RBP: ffff8880b0538b18 R08: ffffffff8c070d08 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880b0538b18
R13: ffffed10160a7168 R14: ffff8880b56bfb58 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e428000 CR3: 0000000008e6a000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 del_timer kernel/time/timer.c:1154 [inline]
 del_timer+0x8b/0xe0 kernel/time/timer.c:1145
 tipc_subscrb_subscrp_delete+0x13a/0x330 net/tipc/subscr.c:207
 tipc_subscrb_delete net/tipc/subscr.c:238 [inline]
 tipc_subscrb_release_cb+0x13/0x20 net/tipc/subscr.c:316
 tipc_close_conn+0x16a/0x200 net/tipc/server.c:203
 tipc_send_to_sock net/tipc/server.c:538 [inline]
 tipc_send_work+0x41e/0x520 net/tipc/server.c:564
 process_one_work+0x793/0x14a0 kernel/workqueue.c:2117
 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 00 00 41 39 5c 24 28 0f 84 99 00 00 00 48 89 74 24 08 e8 4a 40 0d 00 48 8b 74 24 08 48 89 ef e8 2d 00 dc 05 e8 38 40 0d 00 f3 90 <e8> 31 40 0d 00 48 8b 04 24 41 0f b6 55 00 83 e0 07 83 c0 03 38 
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at pc 0xffffffff8723ed1e
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	41 39 5c 24 28       	cmp    %ebx,0x28(%r12)
   7:	0f 84 99 00 00 00    	je     0xa6
   d:	48 89 74 24 08       	mov    %rsi,0x8(%rsp)
  12:	e8 4a 40 0d 00       	callq  0xd4061
  17:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi
  1c:	48 89 ef             	mov    %rbp,%rdi
  1f:	e8 2d 00 dc 05       	callq  0x5dc0051
  24:	e8 38 40 0d 00       	callq  0xd4061
  29:	f3 90                	pause
* 2b:	e8 31 40 0d 00       	callq  0xd4061 <-- trapping instruction
  30:	48 8b 04 24          	mov    (%rsp),%rax
  34:	41 0f b6 55 00       	movzbl 0x0(%r13),%edx
  39:	83 e0 07             	and    $0x7,%eax
  3c:	83 c0 03             	add    $0x3,%eax
  3f:	38                   	.byte 0x38

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-14 2022/01/04 23:16 linux-4.14.y a6ca7c65b137 0a2584dd .config log report info BUG: soft lockup in tipc_send_work