bisecting fixing commit since f4cc0ed9b2c72687303b035379c5824a02224354 building syzkaller on 7509bf360eba1461ac6059e4cacfbc29c9d2d4c7 testing commit f4cc0ed9b2c72687303b035379c5824a02224354 with gcc (GCC) 8.1.0 kernel signature: 95b99748c0449c4ed084c1c51b1dacc02d59a4f4a60b4f4a96e61c5b0da99d48 run #0: crashed: INFO: rcu detected stall in ext4_file_write_iter run #1: crashed: INFO: rcu detected stall in corrupted run #2: crashed: INFO: rcu detected stall in sendfile64 run #3: crashed: INFO: rcu detected stall in corrupted run #4: crashed: INFO: rcu detected stall in corrupted run #5: crashed: INFO: rcu detected stall in corrupted run #6: crashed: INFO: rcu detected stall in corrupted run #7: crashed: INFO: rcu detected stall in corrupted run #8: crashed: INFO: rcu detected stall in corrupted run #9: crashed: INFO: rcu detected stall in corrupted testing current HEAD d7e78d08fa77acdea351c8f628f49ca9a0e1029a testing commit d7e78d08fa77acdea351c8f628f49ca9a0e1029a with gcc (GCC) 8.1.0 kernel signature: 02b05492dda2f2409b3a8c4972e4f700b6e3a6c24611eaf1d16702a9c55d8290 run #0: crashed: INFO: rcu detected stall in corrupted run #1: crashed: INFO: rcu detected stall in sendfile64 run #2: crashed: INFO: rcu detected stall in corrupted run #3: crashed: INFO: rcu detected stall in corrupted run #4: crashed: INFO: rcu detected stall in corrupted run #5: crashed: INFO: rcu detected stall in ext4_file_write_iter run #6: crashed: INFO: rcu detected stall in corrupted run #7: crashed: INFO: rcu detected stall in corrupted run #8: crashed: INFO: rcu detected stall in sendfile64 run #9: crashed: INFO: rcu detected stall in corrupted revisions tested: 2, total time: 29m58.700057137s (build: 18m42.144862978s, test: 9m53.417674232s) the crash still happens on HEAD commit msg: Linux 4.14.195 crash: INFO: rcu detected stall in corrupted IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready INFO: rcu_sched detected stalls on CPUs/tasks: (detected by 1, t=10502 jiffies, g=338, c=337, q=6) All QSes seen, last rcu_sched kthread activity 10499 (4294952765-4294942266), jiffies_till_next_fqs=1, root ->qsmask 0x0 syz-executor.3 R running task 27000 7007 6096 0x00000000 Call Trace: sched_show_task.cold.89+0x2e1/0x342 kernel/sched/core.c:5169 print_other_cpu_stall kernel/rcu/tree.c:1501 [inline] check_cpu_stall kernel/rcu/tree.c:1616 [inline] __rcu_pending kernel/rcu/tree.c:3390 [inline] rcu_pending kernel/rcu/tree.c:3452 [inline] rcu_check_callbacks.cold.77+0xc96/0xcfa kernel/rcu/tree.c:2792 update_process_times+0x28/0x90 kernel/time/timer.c:1591 tick_sched_handle+0x7b/0x140 kernel/time/tick-sched.c:165 INFO: rcu_preempt detected stalls on CPUs/tasks: tick_sched_timer+0x34/0xf0 kernel/time/tick-sched.c:1223 __run_hrtimer kernel/time/hrtimer.c:1223 [inline] __hrtimer_run_queues+0x297/0xaf0 kernel/time/hrtimer.c:1287 (detected by 0, t=10502 jiffies, g=1084, c=1083, q=445) All QSes seen, last rcu_preempt kthread activity 10502 (4294952769-4294942267), jiffies_till_next_fqs=1, root ->qsmask 0x0 syz-executor.0 R running task 27000 7012 6102 0x00000000 hrtimer_interrupt+0x1ae/0x600 kernel/time/hrtimer.c:1321 Call Trace: local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline] smp_apic_timer_interrupt+0x11f/0x5d0 arch/x86/kernel/apic/apic.c:1100 sched_show_task.cold.89+0x2e1/0x342 kernel/sched/core.c:5169 apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793 print_other_cpu_stall kernel/rcu/tree.c:1501 [inline] check_cpu_stall kernel/rcu/tree.c:1616 [inline] __rcu_pending kernel/rcu/tree.c:3390 [inline] rcu_pending kernel/rcu/tree.c:3452 [inline] rcu_check_callbacks.cold.77+0xc96/0xcfa kernel/rcu/tree.c:2792 update_process_times+0x28/0x90 kernel/time/timer.c:1591 RIP: 0010:memset_erms+0xb/0x10 arch/x86/lib/memset_64.S:67 tick_sched_handle+0x7b/0x140 kernel/time/tick-sched.c:165 RSP: 0018:ffff88808dbe7550 EFLAGS: 00000246 tick_sched_timer+0x34/0xf0 kernel/time/tick-sched.c:1223 ORIG_RAX: ffffffffffffff10 RAX: ffffed1011b7ce00 RBX: ffff88808dbe75d0 RCX: 0000000000000000 __run_hrtimer kernel/time/hrtimer.c:1223 [inline] __hrtimer_run_queues+0x297/0xaf0 kernel/time/hrtimer.c:1287 RDX: 0000000000000060 RSI: 0000000000000000 RDI: ffff88808dbe7630 RBP: ffff88808dbe7570 R08: ffffed1011b7cec6 R09: ffff88808dbe75d0 R10: ffffed1011b7cec5 R11: ffff88808dbe762f R12: 0000000000000060 R13: 0000000000000000 R14: ffff88808c89c040 R15: ffff88808dbe75d0 memset include/linux/string.h:357 [inline] __unwind_start+0x29/0x410 arch/x86/kernel/unwind_frame.c:393 hrtimer_interrupt+0x1ae/0x600 kernel/time/hrtimer.c:1321 unwind_start arch/x86/include/asm/unwind.h:60 [inline] __save_stack_trace+0x4a/0xd0 arch/x86/kernel/stacktrace.c:43 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline] smp_apic_timer_interrupt+0x11f/0x5d0 arch/x86/kernel/apic/apic.c:1100 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:54 RSP: 0018:ffff888082a2f448 EFLAGS: 00010246 ORIG_RAX: ffffffffffffff10 RAX: ffff88806cf299e4 RBX: 000000000000001c RCX: 000000000000000b RDX: 000000000000001c RSI: ffff88806cf299d9 RDI: ffff88806cf299f5 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:551 RBP: ffff888082a2f468 R08: ffffed100d9e5340 R09: ffffed100d9e533c kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 R10: ffffed100d9e533f R11: ffff88806cf299ff R12: ffff88806cf299e4 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc+0x144/0x7b0 mm/slab.c:3729 R13: ffff88806cf299c8 R14: 00000000000009c8 R15: ffff88808c014180 kmalloc_array include/linux/slab.h:607 [inline] kcalloc include/linux/slab.h:618 [inline] iter_file_splice_write+0x126/0xc20 fs/splice.c:692 memcpy include/linux/string.h:372 [inline] memcpy_from_page+0x8c/0x100 lib/iov_iter.c:453 iov_iter_copy_from_user_atomic+0x4d8/0x900 lib/iov_iter.c:799 generic_perform_write+0x2ca/0x450 mm/filemap.c:3055 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x104/0x1c0 fs/splice.c:1018 splice_direct_to_actor+0x27c/0x750 fs/splice.c:973 __generic_file_write_iter+0x201/0x580 mm/filemap.c:3172 ext4_file_write_iter+0x27a/0xe40 fs/ext4/file.c:270 do_splice_direct+0x144/0x250 fs/splice.c:1061 do_sendfile+0x463/0xd00 fs/read_write.c:1441 call_write_iter include/linux/fs.h:1778 [inline] do_iter_readv_writev+0x460/0x900 fs/read_write.c:675 SYSC_sendfile64 fs/read_write.c:1496 [inline] SyS_sendfile64+0x97/0x110 fs/read_write.c:1488 do_iter_write+0x12b/0x520 fs/read_write.c:954 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 vfs_iter_write+0x5b/0xb0 fs/read_write.c:967 entry_SYSCALL_64_after_hwframe+0x46/0xbb iter_file_splice_write+0x540/0xc20 fs/splice.c:749 RIP: 0033:0x459599 RSP: 002b:00007efcd59dbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459599 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x104/0x1c0 fs/splice.c:1018 RDX: 0000000020000000 RSI: 0000000000000003 RDI: 0000000000000003 splice_direct_to_actor+0x27c/0x750 fs/splice.c:973 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 00008080fffffffe R11: 0000000000000246 R12: 00007efcd59dc6d4 R13: 00000000004c6b70 R14: 00000000004dbde8 R15: 00000000ffffffff rcu_sched kthread starved for 10503 jiffies! g338 c337 f0x2 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=1 rcu_sched R running task 29832 9 2 0x80000000 do_splice_direct+0x144/0x250 fs/splice.c:1061 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x780/0x1d20 kernel/sched/core.c:3384 do_sendfile+0x463/0xd00 fs/read_write.c:1441 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_timeout+0x40c/0xcc0 kernel/time/timer.c:1754 SYSC_sendfile64 fs/read_write.c:1496 [inline] SyS_sendfile64+0x97/0x110 fs/read_write.c:1488 rcu_gp_kthread+0xbbf/0x1e00 kernel/rcu/tree.c:2255 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 kthread+0x338/0x400 kernel/kthread.c:232 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x459599 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 RSP: 002b:00007f634b568c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459599 RDX: 0000000020000000 RSI: 0000000000000003 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 00008080fffffffe R11: 0000000000000246 R12: 00007f634b5696d4 R13: 00000000004c6b70 R14: 00000000004dbde8 R15: 00000000ffffffff rcu_preempt kthread starved for 10502 jiffies! g1084 c1083 f0x2 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=1 rcu_preempt R running task 29832 8 2 0x80000000 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x780/0x1d20 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_timeout+0x40c/0xcc0 kernel/time/timer.c:1754 rcu_gp_kthread+0xbbf/0x1e00 kernel/rcu/tree.c:2255 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404