protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 INFO: rcu_preempt self-detected stall on CPU 0-...: (1 GPs behind) idle=0ee/140000000000001/0 softirq=23769/23774 fqs=8 (t=10500 jiffies g=4653 c=4652 q=454) rcu_preempt kthread starved for 9911 jiffies! g4653 c4652 f0x0 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=1 rcu_preempt R running task 29824 8 2 0x80000000 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x7b8/0x1cd0 kernel/sched/core.c:3384 schedule+0x92/0x1c0 kernel/sched/core.c:3428 schedule_timeout+0x43e/0xe10 kernel/time/timer.c:1746 rcu_gp_kthread+0xbf4/0x1ec0 kernel/rcu/tree.c:2255 kthread+0x319/0x430 kernel/kthread.c:232 protocol 88fb is buggy, dev hsr_slave_0 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 NMI backtrace for cpu 0 protocol 88fb is buggy, dev hsr_slave_1 CPU: 0 PID: 13172 Comm: syz-executor.1 Not tainted 4.14.163-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 nmi_cpu_backtrace.cold+0x57/0x94 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x141/0x189 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_single_cpu_backtrace include/linux/nmi.h:158 [inline] rcu_dump_cpu_stacks+0x186/0x1d2 kernel/rcu/tree.c:1396 print_cpu_stall kernel/rcu/tree.c:1542 [inline] check_cpu_stall kernel/rcu/tree.c:1610 [inline] __rcu_pending kernel/rcu/tree.c:3390 [inline] rcu_pending kernel/rcu/tree.c:3452 [inline] rcu_check_callbacks.cold+0x43d/0xd0a kernel/rcu/tree.c:2792 update_process_times+0x31/0x70 kernel/time/timer.c:1590 tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:161 tick_sched_timer+0x43/0x130 kernel/time/tick-sched.c:1219 __run_hrtimer kernel/time/hrtimer.c:1223 [inline] __hrtimer_run_queues+0x270/0xbc0 kernel/time/hrtimer.c:1287 hrtimer_interrupt+0x1d8/0x5d0 kernel/time/hrtimer.c:1321 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline] smp_apic_timer_interrupt+0x11c/0x5e0 arch/x86/kernel/apic/apic.c:1100 apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792 RIP: 0010:unwind_next_frame+0x1d/0x50 arch/x86/kernel/unwind_frame.c:287 RSP: 0018:ffff8880aec077e8 EFLAGS: 00000296 ORIG_RAX: ffffffffffffff10 RAX: dffffc0000000000 RBX: ffff8880aec078a0 RCX: 000000000000001a RDX: 0000000000000000 RSI: ffffffff857b2ce2 RDI: ffff8880aec07800 RBP: ffff8880aec077f0 R08: 0000000000000001 R09: ffff8880aec07858 R10: ffff8880aec07828 R11: ffff8880aec07838 R12: 0000000000000000 R13: 0000000000000000 R14: ffff88804f650240 R15: ffff8880aa800940 __save_stack_trace+0x6b/0xd0 arch/x86/kernel/stacktrace.c:44 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x45/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529 kmem_cache_alloc_node_trace+0x153/0x770 mm/slab.c:3661 __do_kmalloc_node mm/slab.c:3681 [inline] __kmalloc_node_track_caller+0x3d/0x80 mm/slab.c:3696 __kmalloc_reserve.isra.0+0x40/0xe0 net/core/skbuff.c:137 pskb_expand_head+0x116/0xc10 net/core/skbuff.c:1462 __skb_pad+0x200/0x5f0 net/core/skbuff.c:1638 __skb_put_padto include/linux/skbuff.h:3009 [inline] skb_put_padto include/linux/skbuff.h:3028 [inline] send_hsr_supervision_frame+0xbcf/0xec0 net/hsr/hsr_device.c:316 hsr_announce+0xf5/0x340 net/hsr/hsr_device.c:348 call_timer_fn+0x161/0x670 kernel/time/timer.c:1279 expire_timers kernel/time/timer.c:1318 [inline] __run_timers kernel/time/timer.c:1636 [inline] __run_timers kernel/time/timer.c:1604 [inline] run_timer_softirq+0x5b7/0x1520 kernel/time/timer.c:1649 __do_softirq+0x244/0x9a0 kernel/softirq.c:288 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1015 do_softirq.part.0+0x10e/0x160 kernel/softirq.c:332 do_softirq kernel/softirq.c:324 [inline] __local_bh_enable_ip+0x154/0x1a0 kernel/softirq.c:185 local_bh_enable include/linux/bottom_half.h:32 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:725 [inline] ip_finish_output2+0x7ae/0x14a0 net/ipv4/ip_output.c:231 ip_do_fragment+0x1999/0x2170 net/ipv4/ip_output.c:678 ip_fragment.constprop.0+0x148/0x200 net/ipv4/ip_output.c:549 ip_finish_output+0x7bd/0xc60 net/ipv4/ip_output.c:315 NF_HOOK_COND include/linux/netfilter.h:239 [inline] ip_mc_output+0x24a/0xd40 net/ipv4/ip_output.c:390 dst_output include/net/dst.h:462 [inline] ip_local_out+0x97/0x170 net/ipv4/ip_output.c:124 ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1422 ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1442 raw_sendmsg+0x1930/0x2450 net/ipv4/raw.c:669 inet_sendmsg+0x122/0x500 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xce/0x110 net/socket.c:656 kernel_sendmsg+0x44/0x50 net/socket.c:664 sock_no_sendpage+0x107/0x130 net/core/sock.c:2569 inet_sendpage+0x3b8/0x580 net/ipv4/af_inet.c:780 kernel_sendpage+0x92/0xf0 net/socket.c:3406 sock_sendpage+0x8b/0xc0 net/socket.c:871 pipe_to_sendpage+0x242/0x340 fs/splice.c:451 splice_from_pipe_feed fs/splice.c:502 [inline] __splice_from_pipe+0x348/0x780 fs/splice.c:626 splice_from_pipe+0xf0/0x150 fs/splice.c:661 generic_splice_sendpage+0x3c/0x50 fs/splice.c:832 do_splice_from fs/splice.c:851 [inline] do_splice fs/splice.c:1147 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0xd92/0x1430 fs/splice.c:1382 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45af49 RSP: 002b:00007fb43b89bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045af49 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb43b89c6d4 R13: 00000000004cc4cc R14: 00000000004e6480 R15: 00000000ffffffff INFO: rcu_sched detected stalls on CPUs/tasks: protocol 88fb is buggy, dev hsr_slave_0 0-...: (1 GPs behind) idle=0ee/140000000000000/0 softirq=23773/23774 fqs=6 protocol 88fb is buggy, dev hsr_slave_1 (detected by 1, t=10573 jiffies, g=3965, c=3964, q=3) Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 13178 Comm: syz-executor.4 Not tainted 4.14.163-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff888050784080 task.stack: ffff88804ffd8000 RIP: 0010:lock_acquire+0x1f4/0x430 kernel/locking/lockdep.c:3998 RSP: 0018:ffff88804ffdf6c0 EFLAGS: 00000286 RAX: 1ffffffff0fe2d29 RBX: ffffea00023bfc80 RCX: 00000000a9554e69 RDX: dffffc0000000000 RSI: ffff888050784928 RDI: 0000000000000286 RBP: ffff88804ffdf6e0 R08: 0000000000000000 R09: ffff888050784948 R10: ffff888050784928 R11: ffff888050784080 R12: ffffffff87f886a0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000007196b4 CR3: 000000007ec66000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_lock_acquire include/linux/rcupdate.h:242 [inline] rcu_read_lock include/linux/rcupdate.h:629 [inline] lock_page_memcg+0x39/0x220 mm/memcontrol.c:1669 page_remove_file_rmap mm/rmap.c:1211 [inline] page_remove_rmap+0x19f/0x940 mm/rmap.c:1296 zap_pte_range mm/memory.c:1342 [inline] zap_pmd_range mm/memory.c:1444 [inline] zap_pud_range mm/memory.c:1473 [inline] zap_p4d_range mm/memory.c:1494 [inline] unmap_page_range+0xabd/0x19f0 mm/memory.c:1515 unmap_single_vma+0x15d/0x2c0 mm/memory.c:1560 unmap_vmas+0xac/0x170 mm/memory.c:1590 exit_mmap+0x285/0x4e0 mm/mmap.c:3056 __mmput kernel/fork.c:930 [inline] mmput+0x114/0x440 kernel/fork.c:951 exit_mm kernel/exit.c:545 [inline] do_exit+0x952/0x2cd0 kernel/exit.c:845 do_group_exit+0x111/0x330 kernel/exit.c:955 get_signal+0x381/0x1cd0 kernel/signal.c:2413 do_signal+0x86/0x19a0 arch/x86/kernel/signal.c:814 exit_to_usermode_loop+0x15c/0x220 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x459411 RSP: 002b:00007fff1151a770 EFLAGS: 00000293 ORIG_RAX: 0000000000000023 RAX: 0000000000000000 RBX: 00000000000396c2 RCX: 0000000000459411 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff1151a780 RBP: 0000000000000001 R08: 000000006e783fbb R09: 000000006e783fbf R10: 00007fff1151a870 R11: 0000000000000293 R12: 000000000075bf20 R13: 000000000075c9a0 R14: 0000000000760390 R15: 000000000075bfd4 Code: c1 e8 03 80 3c 10 00 0f 85 f5 01 00 00 48 83 3d 9a cb a8 06 00 0f 84 5e 01 00 00 48 8b 7d c8 57 9d 0f 1f 44 00 00 48 8d 65 d8 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 65 8b 05 5b e3 b8 7e 83 f8 3f 0f rcu_sched kthread starved for 10003 jiffies! g3965 c3964 f0x0 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=0 rcu_sched R running task 29824 9 2 0x80000000 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x7b8/0x1cd0 kernel/sched/core.c:3384 preempt_schedule_common+0x4f/0xe0 kernel/sched/core.c:3508 preempt_schedule+0x4b/0x60 kernel/sched/core.c:3534 ___preempt_schedule+0x16/0x18 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline] _raw_spin_unlock_irqrestore+0xbd/0xe0 kernel/locking/spinlock.c:192 force_qs_rnp+0xc0/0x4d0 kernel/rcu/tree.c:2854 rcu_gp_fqs kernel/rcu/tree.c:2117 [inline] rcu_gp_kthread+0xe91/0x1ec0 kernel/rcu/tree.c:2269 kthread+0x319/0x430 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 net_ratelimit: 4 callbacks suppressed protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 net_ratelimit: 4 callbacks suppressed protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1