bisecting fixing commit since 7b6ae471e5415bc2bf4384a83ccb4c21de7824c0
building syzkaller on 29c3f20f99b6befe0395fe8e474b1e24240cac95
testing commit 7b6ae471e5415bc2bf4384a83ccb4c21de7824c0
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 5988f4234514afa725ad165bcc1a226ff36ef6524eb814d30e9c7c52ee589afd
run #0: crashed: INFO: rcu detected stall in corrupted
run #1: crashed: INFO: rcu detected stall in ieee80211_iface_work
run #2: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #3: crashed: INFO: rcu detected stall in smp_call_function
run #4: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #5: crashed: INFO: rcu detected stall in smp_call_function
run #6: crashed: INFO: rcu detected stall in smp_call_function
run #7: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #8: crashed: INFO: rcu detected stall in addrconf_rs_timer
run #9: crashed: INFO: rcu detected stall in smp_call_function
run #10: crashed: INFO: rcu detected stall in ieee80211_iface_work
run #11: crashed: INFO: rcu detected stall in ieee80211_iface_work
run #12: crashed: BUG: soft lockup in mac80211_hwsim_beacon
run #13: crashed: INFO: rcu detected stall in smp_call_function
run #14: crashed: INFO: rcu detected stall in smp_call_function
run #15: crashed: INFO: rcu detected stall in ieee80211_iface_work
run #16: crashed: INFO: rcu detected stall in ieee80211_iface_work
run #17: crashed: INFO: rcu detected stall in worker_thread
run #18: crashed: INFO: rcu detected stall in corrupted
run #19: crashed: INFO: rcu detected stall in addrconf_rs_timer
testing current HEAD c5c17547b778975b3d83a73c8d84e8fb5ecf3ba5
testing commit c5c17547b778975b3d83a73c8d84e8fb5ecf3ba5
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 819936bdf08f954616142b82ffe7087d55fb049391f1f292d25071f7565dc4a3
run #0: crashed: INFO: rcu detected stall in gc_worker
run #1: crashed: INFO: rcu detected stall in gc_worker
run #2: crashed: INFO: rcu detected stall in syscall_exit_to_user_mode
run #3: crashed: INFO: rcu detected stall in gc_worker
run #4: crashed: INFO: rcu detected stall in tx
run #5: crashed: INFO: rcu detected stall in wg_ratelimiter_gc_entries
run #6: crashed: INFO: rcu detected stall in sys_rename
run #7: crashed: INFO: rcu detected stall in batadv_dat_purge
run #8: crashed: INFO: rcu detected stall in newstat
run #9: crashed: INFO: rcu detected stall in gc_worker
revisions tested: 2, total time: 29m44.969359764s (build: 12m53.723562022s, test: 15m59.604824596s)
the crash still happens on HEAD
commit msg: Merge tag 'net-5.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
crash: INFO: rcu detected stall in gc_worker
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
(detected by 1, t=15239 jiffies, g=9081, q=430)
rcu: All QSes seen, last rcu_preempt kthread activity 11471 (4294976757-4294965286), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 11471 jiffies! g9081 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:28960 pid: 14 ppid: 2 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0x90d/0x26c0 kernel/sched/core.c:6253
schedule+0xd2/0x260 kernel/sched/core.c:6326
schedule_timeout+0x11d/0x250 kernel/time/timer.c:1881
rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1955
rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2128
kthread+0x3ab/0x480 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 1
CPU: 1 PID: 8533 Comm: kworker/1:6 Not tainted 5.16.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_power_efficient gc_worker
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x30/0xc0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x11f/0x170 lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_check_gp_kthread_starvation.cold+0x1fb/0x200 kernel/rcu/tree_stall.h:481
print_other_cpu_stall kernel/rcu/tree_stall.h:586 [inline]
check_cpu_stall kernel/rcu/tree_stall.h:729 [inline]
rcu_pending kernel/rcu/tree.c:3878 [inline]
rcu_sched_clock_irq+0x2125/0x2200 kernel/rcu/tree.c:2597
update_process_times+0x13b/0x1c0 kernel/time/timer.c:1785
tick_sched_handle+0x6f/0x130 kernel/time/tick-sched.c:226
tick_sched_timer+0x132/0x210 kernel/time/tick-sched.c:1421
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x18a/0xb00 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x2f5/0x780 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
__sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5605
Code: b2 af 7e 83 f8 01 0f 85 b4 02 00 00 9c 58 f6 c4 02 0f 85 9f 02 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc90006207bb8 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92000c40f79 RCX: 1a83a179c7163254
RDX: 1ffff1100ed2099b RSI: ffffffff88cb48c0 RDI: ffffffff8920cba0
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8ee66947
R10: fffffbfff1dccd28 R11: 000000000007a08a R12: 0000000000000002
R13: 0000000000000000 R14: ffffffff8ab76040 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:268 [inline]
rcu_read_lock include/linux/rcupdate.h:688 [inline]
gc_worker+0x125/0xbf0 net/netfilter/nf_conntrack_core.c:1439
process_one_work+0x87f/0x1450 kernel/workqueue.c:2298
worker_thread+0x598/0x1040 kernel/workqueue.c:2445
kthread+0x3ab/0x480 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: b2 af mov $0xaf,%dl
2: 7e 83 jle 0xffffff87
4: f8 clc
5: 01 0f add %ecx,(%rdi)
7: 85 b4 02 00 00 9c 58 test %esi,0x589c0000(%rdx,%rax,1)
e: f6 c4 02 test $0x2,%ah
11: 0f 85 9f 02 00 00 jne 0x2b6
17: 48 83 7c 24 08 00 cmpq $0x0,0x8(%rsp)
1d: 74 01 je 0x20
1f: fb sti
20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
27: fc ff df
* 2a: 48 01 c3 add %rax,%rbx <-- trapping instruction
2d: 48 c7 03 00 00 00 00 movq $0x0,(%rbx)
34: 48 c7 43 08 00 00 00 movq $0x0,0x8(%rbx)
3b: 00
3c: 48 rex.W
3d: 8b .byte 0x8b
3e: 84 .byte 0x84
3f: 24 .byte 0x24