bisecting fixing commit since ae4b064e2a616b545acf02b8f50cc513b32c7522 building syzkaller on 08003f6440deafc4e193b159c4acece64f7864b1 testing commit ae4b064e2a616b545acf02b8f50cc513b32c7522 with gcc (GCC) 8.4.1 20210217 kernel signature: 79450ac766e6ee1c6d674c4246108ce8e17a02768744d4e7b53c5a30c04b9f53 run #0: crashed: BUG: workqueue lockup run #1: crashed: BUG: workqueue lockup run #2: crashed: BUG: workqueue lockup run #3: crashed: BUG: workqueue lockup run #4: crashed: BUG: workqueue lockup run #5: crashed: BUG: workqueue lockup run #6: crashed: BUG: workqueue lockup run #7: crashed: INFO: rcu detected stall in corrupted run #8: crashed: INFO: rcu detected stall in chrdev_open run #9: crashed: BUG: workqueue lockup run #10: crashed: INFO: rcu detected stall in corrupted run #11: crashed: INFO: rcu detected stall in corrupted run #12: crashed: INFO: rcu detected stall in chrdev_open run #13: crashed: INFO: rcu detected stall in corrupted run #14: crashed: INFO: rcu detected stall in corrupted run #15: crashed: INFO: rcu detected stall in chrdev_open run #16: crashed: INFO: rcu detected stall in corrupted run #17: crashed: INFO: rcu detected stall in corrupted run #18: crashed: INFO: rcu detected stall in corrupted run #19: crashed: INFO: rcu detected stall in chrdev_open testing current HEAD 8124c8a6b35386f73523d27eacb71b5364a68c4c testing commit 8124c8a6b35386f73523d27eacb71b5364a68c4c with gcc (GCC) 10.2.1 20210217 kernel signature: 311caa0ac0b2b19de66589eb250b2ee2c5bbdec5c22aa32519ab72217c11016e run #0: crashed: BUG: workqueue lockup run #1: crashed: BUG: workqueue lockup run #2: crashed: BUG: workqueue lockup run #3: crashed: BUG: workqueue lockup run #4: crashed: BUG: workqueue lockup run #5: crashed: INFO: rcu detected stall in chrdev_open run #6: crashed: INFO: rcu detected stall in chrdev_open run #7: crashed: INFO: rcu detected stall in chrdev_open run #8: crashed: INFO: rcu detected stall in chrdev_open run #9: crashed: INFO: rcu detected stall in chrdev_open revisions tested: 2, total time: 24m58.317324687s (build: 13m28.059063549s, test: 10m28.605719998s) the crash still happens on HEAD commit msg: Linux 5.13-rc4 crash: INFO: rcu detected stall in chrdev_open rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): (detected by 0, t=10503 jiffies, g=6829, q=324) rcu: All QSes seen, last rcu_preempt kthread activity 8419 (4294954373-4294945954), jiffies_till_next_fqs=1, root ->qsmask 0x0 rcu: rcu_preempt kthread starved for 8421 jiffies! g6829 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:29296 pid: 13 ppid: 2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:4339 [inline] __schedule+0xf63/0x23d0 kernel/sched/core.c:5147 schedule+0xdb/0x280 kernel/sched/core.c:5226 schedule_timeout+0x133/0x220 kernel/time/timer.c:1892 rcu_gp_fqs_loop kernel/rcu/tree.c:2004 [inline] rcu_gp_kthread+0xcf6/0x22c0 kernel/rcu/tree.c:2177 kthread+0x37d/0x460 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 7395 Comm: syz-executor.4 Not tainted 5.13.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:19 [inline] RIP: 0010:static_key_false include/linux/jump_label.h:200 [inline] RIP: 0010:native_write_msr+0x6/0x30 arch/x86/include/asm/msr.h:162 Code: 65 f8 c9 c3 44 89 e7 e8 e8 e2 f9 ff b8 40 00 00 00 0f 00 d8 44 89 e7 e8 c8 e3 f9 ff eb d1 e8 c1 6f 79 06 90 89 f9 89 f0 0f 30 <0f> 1f 44 00 00 c3 55 48 c1 e2 20 89 f6 48 89 e5 48 09 d6 31 d2 e8 RSP: 0000:ffffc90000178e80 EFLAGS: 00000046 RAX: 00000000000001c8 RBX: 0000000000000838 RCX: 0000000000000838 RDX: 0000000000000000 RSI: 00000000000001c8 RDI: 0000000000000838 RBP: ffffc90000178e98 R08: 0000000000000001 R09: 0000000000000002 R10: ffff88811e018bd8 R11: 0000000000000001 R12: ffff8881f6720180 R13: 00000000000001c8 R14: 00000028237962e4 R15: ffff8881f6727280 FS: 00007f856a5e8700(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd6de96a18 CR3: 0000000122bf3006 CR4: 00000000001706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: apic_write arch/x86/include/asm/apic.h:393 [inline] lapic_next_event+0x51/0x80 arch/x86/kernel/apic/apic.c:472 clockevents_program_event+0x1da/0x2a0 kernel/time/clockevents.c:334 tick_program_event+0x6b/0xd0 kernel/time/tick-oneshot.c:44 hrtimer_interrupt+0x3b7/0x950 kernel/time/hrtimer.c:1676 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0x143/0x530 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0x98/0xc0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:647 RIP: 0010:instrument_atomic_read_write include/linux/instrumented.h:101 [inline] RIP: 0010:atomic_fetch_add_relaxed include/asm-generic/atomic-instrumented.h:142 [inline] RIP: 0010:__refcount_add include/linux/refcount.h:193 [inline] RIP: 0010:__refcount_inc include/linux/refcount.h:250 [inline] RIP: 0010:refcount_inc include/linux/refcount.h:267 [inline] RIP: 0010:kref_get include/linux/kref.h:45 [inline] RIP: 0010:tty_driver_kref_get include/linux/tty_driver.h:356 [inline] RIP: 0010:get_tty_driver drivers/tty/tty_io.c:326 [inline] RIP: 0010:tty_lookup_driver+0x118/0x430 drivers/tty/tty_io.c:1965 Code: 48 c1 ea 03 0f b6 14 02 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 73 02 00 00 4d 8d 6c 24 04 41 89 1e be 04 00 00 00 <4c> 89 ef e8 60 f1 ee fd b8 01 00 00 00 f0 41 0f c1 44 24 04 85 c0 RSP: 0000:ffffc900047d7840 EFLAGS: 00000297 RAX: 0000000000000003 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000004 RSI: 0000000000000004 RDI: ffff88810b6bf734 RBP: ffffc900047d7868 R08: 0000000000000000 R09: ffffffff89e86207 R10: fffffbfff13d0c40 R11: 0000000000008800 R12: ffff88810b6bf700 R13: ffff88810b6bf704 R14: ffffc900047d78f0 R15: dffffc0000000000 tty_open_by_driver drivers/tty/tty_io.c:2067 [inline] tty_open+0x4a2/0xf60 drivers/tty/tty_io.c:2150 chrdev_open+0x237/0x6a0 fs/char_dev.c:414 do_dentry_open+0x42d/0xf90 fs/open.c:826 vfs_open+0x9a/0xc0 fs/open.c:940 do_open fs/namei.c:3361 [inline] path_openat+0xa73/0x25d0 fs/namei.c:3494 do_filp_open+0x193/0x3d0 fs/namei.c:3521 do_sys_openat2+0x120/0x3d0 fs/open.c:1187 do_sys_open fs/open.c:1203 [inline] __do_sys_openat fs/open.c:1219 [inline] __se_sys_openat fs/open.c:1214 [inline] __x64_sys_openat+0x124/0x200 fs/open.c:1214 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x462209 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f856a5e81a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000000000052bf00 RCX: 0000000000462209 RDX: 0000000000000000 RSI: 0000000020000380 RDI: ffffffffffffff9c RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000004f8a08 R14: 00000000004b41d5 R15: 00007f856a5e86bc