rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-....: (1 GPs behind) idle=57d/1/0x4000000000000000 softirq=126680/126682 fqs=5023 (t=10502 jiffies g=184641 q=1054 ncpus=2) NMI backtrace for cpu 0 CPU: 0 PID: 3634 Comm: syz-executor.2 Not tainted 5.18.0-syzkaller-04956-g4548ad7287c4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1e6/0x230 lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x262/0x3f0 kernel/rcu/tree_stall.h:371 print_cpu_stall kernel/rcu/tree_stall.h:668 [inline] check_cpu_stall kernel/rcu/tree_stall.h:753 [inline] rcu_pending kernel/rcu/tree.c:3977 [inline] rcu_sched_clock_irq.cold+0x144/0x901 kernel/rcu/tree.c:2675 update_process_times+0x11a/0x1a0 kernel/time/timer.c:1839 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:243 tick_sched_timer+0xee/0x120 kernel/time/tick-sched.c:1481 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline] __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1112 sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0010:crng_make_state+0x350/0x7a0 drivers/char/random.c:352 Code: 2c 19 fd 48 85 ed 0f 85 7a 02 00 00 e8 79 29 19 fd 31 ff 48 89 de e8 ff 2b 19 fd 48 85 db 74 06 e8 65 29 19 fd fb 48 83 c4 18 <5b> 5d 41 5c 41 5d 41 5e 41 5f e9 51 29 19 fd e8 4c 29 19 fd 8b 1d RSP: 0018:ffffc90000007b28 EFLAGS: 00000286 RAX: 0000000000000000 RBX: 0000000000000200 RCX: 0000000000000100 RDX: ffff88801c999d80 RSI: ffffffff84608afb RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff9009d9b7 R10: ffffffff84608af1 R11: 00000000983f2037 R12: ffff8880b9c36f48 R13: 0000000000000000 R14: ffffc90000007b80 R15: ffffc90000007cc8 _get_random_bytes.part.0+0x95/0x1a0 drivers/char/random.c:364 _get_random_bytes drivers/char/random.c:360 [inline] get_random_bytes+0x2d/0x40 drivers/char/random.c:396 sfq_perturbation+0xd4/0x2c0 net/sched/sch_sfq.c:612 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790 __run_timers kernel/time/timer.c:1768 [inline] run_timer_softirq+0x152/0x1d0 kernel/time/timer.c:1805 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0010:is_cow_mapping include/linux/mm.h:1277 [inline] RIP: 0010:copy_present_pte mm/memory.c:964 [inline] RIP: 0010:copy_pte_range mm/memory.c:1071 [inline] RIP: 0010:copy_pmd_range mm/memory.c:1157 [inline] RIP: 0010:copy_pud_range mm/memory.c:1194 [inline] RIP: 0010:copy_p4d_range mm/memory.c:1218 [inline] RIP: 0010:copy_page_range+0xef8/0x3e50 mm/memory.c:1291 Code: 89 e0 48 c1 e8 03 42 0f b6 14 28 4c 89 e0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 2b 28 00 00 41 83 04 24 01 e8 98 2a c6 ff <4c> 8b 64 24 28 bf 20 00 00 00 41 83 e4 28 4c 89 e6 e8 12 2d c6 ff RSP: 0018:ffffc900039c7808 EFLAGS: 00000293 RAX: 0000000000000000 RBX: 80000000509c0007 RCX: 0000000000000000 RDX: ffff88801c999d80 RSI: ffffffff81b389c8 RDI: 0000000000000003 RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff81b39476 R11: 0000000000000000 R12: ffffc900039c79e8 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 dup_mmap kernel/fork.c:701 [inline] dup_mm+0xa4e/0x13d0 kernel/fork.c:1526 copy_mm kernel/fork.c:1578 [inline] copy_process+0x3b1c/0x6ff0 kernel/fork.c:2239 kernel_clone+0xe7/0xab0 kernel/fork.c:2644 __do_sys_clone+0xc8/0x110 kernel/fork.c:2761 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fc4c2e876fb ================================ WARNING: inconsistent lock state 5.18.0-syzkaller-04956-g4548ad7287c4 #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. syz-executor.2/3634 [HC1[1]:SC1[1]:HE0:SE0] takes: ffffffff8beb4158 (vmap_area_lock){?.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline] ffffffff8beb4158 (vmap_area_lock){?.+.}-{2:2}, at: find_vmap_area mm/vmalloc.c:1805 [inline] ffffffff8beb4158 (vmap_area_lock){?.+.}-{2:2}, at: find_vm_area+0x1c/0x190 mm/vmalloc.c:2527 {HARDIRQ-ON-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5634 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5599 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:349 [inline] alloc_vmap_area+0xa49/0x1f00 mm/vmalloc.c:1586 __get_vm_area_node+0x142/0x3f0 mm/vmalloc.c:2455 get_vm_area_caller+0x43/0x50 mm/vmalloc.c:2508 __ioremap_caller.constprop.0+0x292/0x600 arch/x86/mm/ioremap.c:280 acpi_os_ioremap include/acpi/acpi_io.h:13 [inline] acpi_map drivers/acpi/osl.c:297 [inline] acpi_os_map_iomem+0x463/0x550 drivers/acpi/osl.c:356 acpi_tb_acquire_table+0xd8/0x209 drivers/acpi/acpica/tbdata.c:142 acpi_tb_validate_table drivers/acpi/acpica/tbdata.c:317 [inline] acpi_tb_validate_table+0x50/0x8c drivers/acpi/acpica/tbdata.c:308 acpi_tb_verify_temp_table+0x84/0x674 drivers/acpi/acpica/tbdata.c:504 acpi_reallocate_root_table+0x374/0x3e0 drivers/acpi/acpica/tbxface.c:180 acpi_early_init+0x13a/0x438 drivers/acpi/bus.c:1200 start_kernel+0x3cf/0x48f init/main.c:1098 secondary_startup_64_no_verify+0xce/0xdb irq event stamp: 79793197 hardirqs last enabled at (79793196): [] crng_make_state+0x54d/0x7a0 drivers/char/random.c:351 hardirqs last disabled at (79793197): [] sysvec_apic_timer_interrupt+0xb/0xc0 arch/x86/kernel/apic/apic.c:1106 softirqs last enabled at (25485600): [] tcp_close+0x38/0xc0 net/ipv4/tcp.c:2910 softirqs last disabled at (25485979): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last disabled at (25485979): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(vmap_area_lock); lock(vmap_area_lock); *** DEADLOCK *** 7 locks held by syz-executor.2/3634: #0: ffffffff8be65830 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap kernel/fork.c:589 [inline] #0: ffffffff8be65830 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm+0x108/0x13d0 kernel/fork.c:1526 #1: ffff888024380828 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #1: ffff888024380828 (&mm->mmap_lock#2){++++}-{3:3}, at: dup_mmap kernel/fork.c:590 [inline] #1: ffff888024380828 (&mm->mmap_lock#2){++++}-{3:3}, at: dup_mm+0x12e/0x13d0 kernel/fork.c:1526 #2: ffff88807cf9a428 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:78 [inline] #2: ffff88807cf9a428 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap kernel/fork.c:599 [inline] #2: ffff88807cf9a428 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mm+0x18a/0x13d0 kernel/fork.c:1526 #3: ffff88802685b7f8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline] #3: ffff88802685b7f8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pte_range mm/memory.c:1022 [inline] #3: ffff88802685b7f8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pmd_range mm/memory.c:1157 [inline] #3: ffff88802685b7f8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pud_range mm/memory.c:1194 [inline] #3: ffff88802685b7f8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_p4d_range mm/memory.c:1218 [inline] #3: ffff88802685b7f8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_page_range+0xb7b/0x3e50 mm/memory.c:1291 #4: ffff888018749c18 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pte_range mm/memory.c:1029 [inline] #4: ffff888018749c18 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pmd_range mm/memory.c:1157 [inline] #4: ffff888018749c18 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pud_range mm/memory.c:1194 [inline] #4: ffff888018749c18 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_p4d_range mm/memory.c:1218 [inline] #4: ffff888018749c18 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_page_range+0xc50/0x3e50 mm/memory.c:1291 #5: ffffc90000007d70 ((&q->perturb_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline] #5: ffffc90000007d70 ((&q->perturb_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1464 #6: ffffffff8bd8f218 (rcu_node_0){-.-.}-{2:2}, at: rcu_dump_cpu_stacks+0xd4/0x3f0 kernel/rcu/tree_stall.h:366 stack backtrace: CPU: 0 PID: 3634 Comm: syz-executor.2 Not tainted 5.18.0-syzkaller-04956-g4548ad7287c4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_usage_bug kernel/locking/lockdep.c:3930 [inline] valid_state kernel/locking/lockdep.c:3942 [inline] mark_lock_irq kernel/locking/lockdep.c:4145 [inline] mark_lock.part.0.cold+0x18/0xd8 kernel/locking/lockdep.c:4601 mark_lock kernel/locking/lockdep.c:4565 [inline] mark_usage kernel/locking/lockdep.c:4493 [inline] __lock_acquire+0x14ad/0x56c0 kernel/locking/lockdep.c:4976 lock_acquire kernel/locking/lockdep.c:5634 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5599 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:349 [inline] find_vmap_area mm/vmalloc.c:1805 [inline] find_vm_area+0x1c/0x190 mm/vmalloc.c:2527 check_heap_object mm/usercopy.c:176 [inline] __check_object_size mm/usercopy.c:252 [inline] __check_object_size+0x1fb/0x7a0 mm/usercopy.c:214 check_object_size include/linux/thread_info.h:199 [inline] __copy_from_user_inatomic include/linux/uaccess.h:62 [inline] copy_from_user_nmi arch/x86/lib/usercopy.c:47 [inline] copy_from_user_nmi+0xcb/0x130 arch/x86/lib/usercopy.c:31 copy_code arch/x86/kernel/dumpstack.c:91 [inline] show_opcodes+0x59/0xb0 arch/x86/kernel/dumpstack.c:121 show_iret_regs+0xd/0x33 arch/x86/kernel/dumpstack.c:149 __show_regs+0x1e/0x60 arch/x86/kernel/process_64.c:74 show_trace_log_lvl+0x25b/0x2ba arch/x86/kernel/dumpstack.c:292 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1e6/0x230 lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x262/0x3f0 kernel/rcu/tree_stall.h:371 print_cpu_stall kernel/rcu/tree_stall.h:668 [inline] check_cpu_stall kernel/rcu/tree_stall.h:753 [inline] rcu_pending kernel/rcu/tree.c:3977 [inline] rcu_sched_clock_irq.cold+0x144/0x901 kernel/rcu/tree.c:2675 update_process_times+0x11a/0x1a0 kernel/time/timer.c:1839 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:243 tick_sched_timer+0xee/0x120 kernel/time/tick-sched.c:1481 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline] __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1112 sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0010:crng_make_state+0x350/0x7a0 drivers/char/random.c:352 Code: 2c 19 fd 48 85 ed 0f 85 7a 02 00 00 e8 79 29 19 fd 31 ff 48 89 de e8 ff 2b 19 fd 48 85 db 74 06 e8 65 29 19 fd fb 48 83 c4 18 <5b> 5d 41 5c 41 5d 41 5e 41 5f e9 51 29 19 fd e8 4c 29 19 fd 8b 1d RSP: 0018:ffffc90000007b28 EFLAGS: 00000286 RAX: 0000000000000000 RBX: 0000000000000200 RCX: 0000000000000100 RDX: ffff88801c999d80 RSI: ffffffff84608afb RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff9009d9b7 R10: ffffffff84608af1 R11: 00000000983f2037 R12: ffff8880b9c36f48 R13: 0000000000000000 R14: ffffc90000007b80 R15: ffffc90000007cc8 _get_random_bytes.part.0+0x95/0x1a0 drivers/char/random.c:364 _get_random_bytes drivers/char/random.c:360 [inline] get_random_bytes+0x2d/0x40 drivers/char/random.c:396 sfq_perturbation+0xd4/0x2c0 net/sched/sch_sfq.c:612 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790 __run_timers kernel/time/timer.c:1768 [inline] run_timer_softirq+0x152/0x1d0 kernel/time/timer.c:1805 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0010:is_cow_mapping include/linux/mm.h:1277 [inline] RIP: 0010:copy_present_pte mm/memory.c:964 [inline] RIP: 0010:copy_pte_range mm/memory.c:1071 [inline] RIP: 0010:copy_pmd_range mm/memory.c:1157 [inline] RIP: 0010:copy_pud_range mm/memory.c:1194 [inline] RIP: 0010:copy_p4d_range mm/memory.c:1218 [inline] RIP: 0010:copy_page_range+0xef8/0x3e50 mm/memory.c:1291 Code: 89 e0 48 c1 e8 03 42 0f b6 14 28 4c 89 e0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 2b 28 00 00 41 83 04 24 01 e8 98 2a c6 ff <4c> 8b 64 24 28 bf 20 00 00 00 41 83 e4 28 4c 89 e6 e8 12 2d c6 ff RSP: 0018:ffffc900039c7808 EFLAGS: 00000293 RAX: 0000000000000000 RBX: 80000000509c0007 RCX: 0000000000000000 RDX: ffff88801c999d80 RSI: ffffffff81b389c8 RDI: 0000000000000003 RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff81b39476 R11: 0000000000000000 R12: ffffc900039c79e8 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 dup_mmap kernel/fork.c:701 [inline] dup_mm+0xa4e/0x13d0 kernel/fork.c:1526 copy_mm kernel/fork.c:1578 [inline] copy_process+0x3b1c/0x6ff0 kernel/fork.c:2239 kernel_clone+0xe7/0xab0 kernel/fork.c:2644 __do_sys_clone+0xc8/0x110 kernel/fork.c:2761 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fc4c2e876fb Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00 RSP: 002b:00007ffe91122700 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc4c2e876fb RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000555555bc4400 R10: 0000555555bc46d0 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffe911227e0 Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00 RSP: 002b:00007ffe91122700 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc4c2e876fb RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000555555bc4400 R10: 0000555555bc46d0 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffe911227e0 ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ---------------- Code disassembly (best guess): 0: 2c 19 sub $0x19,%al 2: fd std 3: 48 85 ed test %rbp,%rbp 6: 0f 85 7a 02 00 00 jne 0x286 c: e8 79 29 19 fd callq 0xfd19298a 11: 31 ff xor %edi,%edi 13: 48 89 de mov %rbx,%rsi 16: e8 ff 2b 19 fd callq 0xfd192c1a 1b: 48 85 db test %rbx,%rbx 1e: 74 06 je 0x26 20: e8 65 29 19 fd callq 0xfd19298a 25: fb sti 26: 48 83 c4 18 add $0x18,%rsp * 2a: 5b pop %rbx <-- trapping instruction 2b: 5d pop %rbp 2c: 41 5c pop %r12 2e: 41 5d pop %r13 30: 41 5e pop %r14 32: 41 5f pop %r15 34: e9 51 29 19 fd jmpq 0xfd19298a 39: e8 4c 29 19 fd callq 0xfd19298a 3e: 8b .byte 0x8b 3f: 1d .byte 0x1d