rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: (detected by 0, t=10502 jiffies, g=297481, q=145) rcu: All QSes seen, last rcu_preempt kthread activity 10502 (4295125599-4295115097), jiffies_till_next_fqs=1, root ->qsmask 0x0 rcu: rcu_preempt kthread starved for 10504 jiffies! g297481 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28872 pid: 11 ppid: 2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:3774 [inline] __schedule+0x893/0x2130 kernel/sched/core.c:4523 schedule+0xcf/0x270 kernel/sched/core.c:4601 schedule_timeout+0x148/0x250 kernel/time/timer.c:1871 rcu_gp_fqs_loop kernel/rcu/tree.c:1925 [inline] rcu_gp_kthread+0xb4c/0x1c90 kernel/rcu/tree.c:2099 kthread+0x3af/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 ================================ WARNING: inconsistent lock state 5.10.0-rc4-syzkaller #0 Not tainted -------------------------------- inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. syz-executor.1/23829 [HC0[0]:SC1[1]:HE0:SE0] takes: ffffffff8b33f7d8 (rcu_node_0){?.-.}-{2:2}, at: print_other_cpu_stall kernel/rcu/tree_stall.h:487 [inline] ffffffff8b33f7d8 (rcu_node_0){?.-.}-{2:2}, at: check_cpu_stall kernel/rcu/tree_stall.h:646 [inline] ffffffff8b33f7d8 (rcu_node_0){?.-.}-{2:2}, at: rcu_pending kernel/rcu/tree.c:3694 [inline] ffffffff8b33f7d8 (rcu_node_0){?.-.}-{2:2}, at: rcu_sched_clock_irq.cold+0xbc/0xee8 kernel/rcu/tree.c:2567 {IN-HARDIRQ-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5435 [inline] lock_acquire+0x2a3/0x8c0 kernel/locking/lockdep.c:5400 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:159 rcu_report_exp_cpu_mult+0x72/0x320 kernel/rcu/tree_exp.h:237 flush_smp_call_function_queue+0x34b/0x640 kernel/smp.c:425 __sysvec_call_function_single+0x95/0x3d0 arch/x86/kernel/smp.c:248 asm_call_irq_on_stack+0xf/0x20 __run_sysvec_on_irqstack arch/x86/include/asm/irq_stack.h:37 [inline] run_sysvec_on_irqstack_cond arch/x86/include/asm/irq_stack.h:89 [inline] sysvec_call_function_single+0xbd/0x100 arch/x86/kernel/smp.c:243 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:639 native_restore_fl arch/x86/include/asm/irqflags.h:41 [inline] arch_local_irq_restore arch/x86/include/asm/irqflags.h:84 [inline] lock_acquire kernel/locking/lockdep.c:5438 [inline] lock_acquire+0x2cd/0x8c0 kernel/locking/lockdep.c:5400 down_write+0x8d/0x150 kernel/locking/rwsem.c:1531 anon_vma_lock_write include/linux/rmap.h:120 [inline] __anon_vma_prepare+0xba/0x560 mm/rmap.c:203 anon_vma_prepare include/linux/rmap.h:153 [inline] do_anonymous_page mm/memory.c:3520 [inline] handle_pte_fault mm/memory.c:4372 [inline] __handle_mm_fault mm/memory.c:4509 [inline] handle_mm_fault+0x87d/0x55d0 mm/memory.c:4607 faultin_page mm/gup.c:885 [inline] __get_user_pages+0x642/0x1360 mm/gup.c:1097 __get_user_pages_locked mm/gup.c:1283 [inline] __get_user_pages_remote+0x18f/0x7a0 mm/gup.c:1810 get_user_pages_remote+0x63/0x90 mm/gup.c:1883 get_arg_page+0xba/0x200 fs/exec.c:222 copy_string_kernel+0x1b4/0x520 fs/exec.c:633 kernel_execve+0x25c/0x460 fs/exec.c:1956 call_usermodehelper_exec_async+0x2de/0x580 kernel/umh.c:110 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 irq event stamp: 12247783 hardirqs last enabled at (12247782): [] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631 hardirqs last disabled at (12247783): [] sysvec_apic_timer_interrupt+0xc/0x100 arch/x86/kernel/apic/apic.c:1091 softirqs last enabled at (754): [] asm_call_irq_on_stack+0xf/0x20 softirqs last disabled at (1545): [] asm_call_irq_on_stack+0xf/0x20 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(rcu_node_0); lock(rcu_node_0); *** DEADLOCK *** 4 locks held by syz-executor.1/23829: #0: ffff888010dea460 (sb_writers#8){.+.+}-{0:0}, at: do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 #1: ffffffff8ba16a58 (tomoyo_ss){....}-{0:0}, at: tomoyo_path_perm+0x1c1/0x400 security/tomoyo/file.c:847 #2: ffffc90000007d80 ((&app->join_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline] #2: ffffc90000007d80 ((&app->join_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1400 #3: ffffffff8b33f7d8 (rcu_node_0){?.-.}-{2:2}, at: print_other_cpu_stall kernel/rcu/tree_stall.h:487 [inline] #3: ffffffff8b33f7d8 (rcu_node_0){?.-.}-{2:2}, at: check_cpu_stall kernel/rcu/tree_stall.h:646 [inline] #3: ffffffff8b33f7d8 (rcu_node_0){?.-.}-{2:2}, at: rcu_pending kernel/rcu/tree.c:3694 [inline] #3: ffffffff8b33f7d8 (rcu_node_0){?.-.}-{2:2}, at: rcu_sched_clock_irq.cold+0xbc/0xee8 kernel/rcu/tree.c:2567 stack backtrace: CPU: 0 PID: 23829 Comm: syz-executor.1 Not tainted 5.10.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:118 print_usage_bug kernel/locking/lockdep.c:3738 [inline] valid_state kernel/locking/lockdep.c:3749 [inline] mark_lock_irq kernel/locking/lockdep.c:3952 [inline] mark_lock.cold+0x32/0x74 kernel/locking/lockdep.c:4409 mark_held_locks+0x9f/0xe0 kernel/locking/lockdep.c:4010 __trace_hardirqs_on_caller kernel/locking/lockdep.c:4028 [inline] lockdep_hardirqs_on_prepare kernel/locking/lockdep.c:4096 [inline] lockdep_hardirqs_on_prepare+0x135/0x400 kernel/locking/lockdep.c:4048 trace_hardirqs_on+0x5b/0x1c0 kernel/trace/trace_preemptirq.c:49 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631 RIP: 0010:lock_acquire+0x149/0x8c0 kernel/locking/lockdep.c:5439 Code: 43 08 00 00 00 00 48 8b 84 24 a8 00 00 00 65 48 2b 04 25 28 00 00 00 0f 85 de 05 00 00 48 81 c4 b0 00 00 00 5b 5d 41 5c 41 5d <41> 5e 41 5f c3 65 8b 15 9b 48 ab 7e 83 fa 07 0f 87 3c 05 00 00 89 RSP: 0018:ffffc90000007d28 EFLAGS: 00000282 RAX: 0000000000000000 RBX: 0000000000000100 RCX: ffffffff8155f374 RDX: 1ffff11014d705a9 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffffc90000007d80 R08: 0000000000000000 R09: ffffffff8ebbb737 R10: fffffbfff1d776e6 R11: 0000000000000000 R12: ffff88801dcfb410 R13: 1ffff92000000faa R14: 0000000000000000 R15: 0000000000000000 call_timer_fn+0x12b/0x6b0 kernel/time/timer.c:1407 expire_timers kernel/time/timer.c:1455 [inline] __run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1747 __run_timers kernel/time/timer.c:1728 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1760 __do_softirq+0x2a0/0x9f6 kernel/softirq.c:298 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x132/0x200 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631 RIP: 0010:tomoyo_check_acl+0xb0/0x450 security/tomoyo/domain.c:173 Code: 03 00 00 49 8b 5d 00 49 39 dd 0f 84 fa 01 00 00 e8 b5 bb e9 fd 48 8d 7b 18 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 0f b6 04 28 <38> d0 7f 08 84 c0 0f 85 f7 02 00 00 44 0f b6 73 18 31 ff 44 89 f6 RSP: 0018:ffffc90017e97be8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888015142500 RCX: ffffc9000b0d4000 RDX: 0000000000000000 RSI: ffffffff838675ab RDI: ffff888015142518 RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffffff8ebbb6ff R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90017e97d18 R13: ffff888011fb1d90 R14: 0000000000000000 R15: 0000000000000000 tomoyo_path_permission security/tomoyo/file.c:586 [inline] tomoyo_path_permission+0x1ff/0x3a0 security/tomoyo/file.c:573 tomoyo_path_perm+0x2f0/0x400 security/tomoyo/file.c:838 security_path_truncate+0xcf/0x140 security/security.c:1145 do_sys_ftruncate+0x533/0x860 fs/open.c:193 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45de87 Code: 24 29 d7 48 69 ff e8 03 00 00 48 89 7c 24 08 48 89 e7 e8 dc e4 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 b8 4d 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f47804b2998 EFLAGS: 00000217 ORIG_RAX: 000000000000004d RAX: ffffffffffffffda RBX: 0000000020000080 RCX: 000000000045de87 RDX: 0000000020002a68 RSI: 0000000008100000 RDI: 0000000000000004 RBP: 0000000008100000 R08: 0000000020002a68 R09: 0000000000000000 R10: fe03f80fe03f80ff R11: 0000000000000217 R12: 00000000000001bf R13: 0000000000000004 R14: 0000000000000004 R15: 000000000118bf2c ------------[ cut here ]------------ timer: mrp_join_timer+0x0/0xc0 net/802/mrp.c:483 preempt leak: 00000100 -> 00000101 WARNING: CPU: 0 PID: 23829 at kernel/time/timer.c:1416 call_timer_fn+0x5d8/0x6b0 kernel/time/timer.c:1416 Modules linked in: CPU: 0 PID: 23829 Comm: syz-executor.1 Not tainted 5.10.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:call_timer_fn+0x5d8/0x6b0 kernel/time/timer.c:1416 Code: e8 dd 62 10 00 89 da 4c 89 f6 48 c7 c7 80 30 4d 89 65 8b 0d 2a 21 a2 7e 81 e1 ff ff ff 7f c6 05 40 01 79 0b 01 e8 b2 74 4d 07 <0f> 0b e9 80 fc ff ff e8 ac 62 10 00 0f 0b e9 fb fd ff ff e8 a0 62 RSP: 0018:ffffc90000007d48 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000100 RCX: 0000000000000000 RDX: ffff8880a6b82440 RSI: ffffffff8158f3d5 RDI: fffff52000000f9b RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8880b9e30627 R10: 0000000000000000 R11: 7270203063783074 R12: 0000000000000000 R13: 1ffff92000000faa R14: ffffffff870eb030 R15: 0000000000000000 FS: 00007f47804b3700(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002010 CR3: 00000001584bc000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: expire_timers kernel/time/timer.c:1455 [inline] __run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1747 __run_timers kernel/time/timer.c:1728 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1760 __do_softirq+0x2a0/0x9f6 kernel/softirq.c:298 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x132/0x200 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631 RIP: 0010:tomoyo_check_acl+0xb0/0x450 security/tomoyo/domain.c:173 Code: 03 00 00 49 8b 5d 00 49 39 dd 0f 84 fa 01 00 00 e8 b5 bb e9 fd 48 8d 7b 18 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 0f b6 04 28 <38> d0 7f 08 84 c0 0f 85 f7 02 00 00 44 0f b6 73 18 31 ff 44 89 f6 RSP: 0018:ffffc90017e97be8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888015142500 RCX: ffffc9000b0d4000 RDX: 0000000000000000 RSI: ffffffff838675ab RDI: ffff888015142518 RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffffff8ebbb6ff R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90017e97d18 R13: ffff888011fb1d90 R14: 0000000000000000 R15: 0000000000000000 tomoyo_path_permission security/tomoyo/file.c:586 [inline] tomoyo_path_permission+0x1ff/0x3a0 security/tomoyo/file.c:573 tomoyo_path_perm+0x2f0/0x400 security/tomoyo/file.c:838 security_path_truncate+0xcf/0x140 security/security.c:1145 do_sys_ftruncate+0x533/0x860 fs/open.c:193 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45de87 Code: 24 29 d7 48 69 ff e8 03 00 00 48 89 7c 24 08 48 89 e7 e8 dc e4 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 b8 4d 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f47804b2998 EFLAGS: 00000217 ORIG_RAX: 000000000000004d RAX: ffffffffffffffda RBX: 0000000020000080 RCX: 000000000045de87 RDX: 0000000020002a68 RSI: 0000000008100000 RDI: 0000000000000004 RBP: 0000000008100000 R08: 0000000020002a68 R09: 0000000000000000 R10: fe03f80fe03f80ff R11: 0000000000000217 R12: 00000000000001bf R13: 0000000000000004 R14: 0000000000000004 R15: 000000000118bf2c