bisecting fixing commit since f4cc0ed9b2c72687303b035379c5824a02224354 building syzkaller on 7509bf360eba1461ac6059e4cacfbc29c9d2d4c7 testing commit f4cc0ed9b2c72687303b035379c5824a02224354 with gcc (GCC) 8.1.0 kernel signature: fb07a4326455eeaf5525bdbe4dd256a6e50fd0d92c6babd7c3693ffad8adb5f0 run #0: crashed: INFO: rcu detected stall in corrupted run #1: crashed: INFO: rcu detected stall in sendfile64 run #2: crashed: INFO: rcu detected stall in ext4_file_write_iter run #3: crashed: INFO: rcu detected stall in sendfile64 run #4: crashed: INFO: rcu detected stall in ext4_file_write_iter run #5: crashed: INFO: rcu detected stall in corrupted run #6: crashed: INFO: rcu detected stall in sendfile64 run #7: crashed: INFO: rcu detected stall in corrupted run #8: crashed: INFO: rcu detected stall in corrupted run #9: crashed: INFO: rcu detected stall in corrupted testing current HEAD 87335852c5d9ec629f80bb2257b9a9945962b719 testing commit 87335852c5d9ec629f80bb2257b9a9945962b719 with gcc (GCC) 8.1.0 kernel signature: 274105b1fe6f8a0f234f7b64d9fa8dbc8472c7849a176247a35669b39167f41a run #0: crashed: INFO: rcu detected stall in corrupted run #1: crashed: INFO: rcu detected stall in corrupted run #2: crashed: INFO: rcu detected stall in corrupted run #3: crashed: INFO: rcu detected stall in corrupted run #4: crashed: INFO: rcu detected stall in corrupted run #5: crashed: INFO: rcu detected stall in corrupted run #6: crashed: INFO: rcu detected stall in sendfile64 run #7: crashed: INFO: rcu detected stall in corrupted run #8: crashed: INFO: rcu detected stall in corrupted run #9: crashed: INFO: rcu detected stall in corrupted revisions tested: 2, total time: 25m57.689269001s (build: 16m14.763120698s, test: 8m52.104631024s) the crash still happens on HEAD commit msg: Linux 4.14.209 crash: INFO: rcu detected stall in corrupted IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 8021q: adding VLAN 0 to HW filter on device batadv0 INFO: rcu_sched self-detected stall on CPU 0-...: (10499 ticks this GP) idle=212/140000000000001/0 softirq=8057/8059 fqs=1 (t=10501 jiffies g=294 c=293 q=5) rcu_sched kthread starved for 10499 jiffies! g294 c293 f0x0 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=0 INFO: rcu_preempt detected stalls on CPUs/tasks: rcu_sched R running task 29832 9 2 0x80000000 (detected by 1, t=10502 jiffies, g=972, c=971, q=539) Call Trace: All QSes seen, last rcu_preempt kthread activity 10500 (4294952081-4294941581), jiffies_till_next_fqs=1, root ->qsmask 0x0 syz-executor.5 R context_switch kernel/sched/core.c:2808 [inline] __schedule+0x780/0x1d20 kernel/sched/core.c:3384 running task 27000 7019 6127 0x00000000 Call Trace: sched_show_task.cold.89+0x2e1/0x342 kernel/sched/core.c:5169 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 print_other_cpu_stall kernel/rcu/tree.c:1501 [inline] check_cpu_stall kernel/rcu/tree.c:1616 [inline] __rcu_pending kernel/rcu/tree.c:3390 [inline] rcu_pending kernel/rcu/tree.c:3452 [inline] rcu_check_callbacks.cold.77+0xc96/0xcfa kernel/rcu/tree.c:2792 schedule_timeout+0x40c/0xcc0 kernel/time/timer.c:1747 update_process_times+0x2a/0x60 kernel/time/timer.c:1591 tick_sched_handle+0x7b/0x140 kernel/time/tick-sched.c:165 tick_sched_timer+0x34/0xf0 kernel/time/tick-sched.c:1223 __run_hrtimer kernel/time/hrtimer.c:1223 [inline] __hrtimer_run_queues+0x297/0xaf0 kernel/time/hrtimer.c:1287 rcu_gp_kthread+0xbbf/0x1e00 kernel/rcu/tree.c:2255 kthread+0x338/0x400 kernel/kthread.c:232 hrtimer_interrupt+0x1ae/0x600 kernel/time/hrtimer.c:1321 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline] smp_apic_timer_interrupt+0x11f/0x5d0 arch/x86/kernel/apic/apic.c:1100 NMI backtrace for cpu 0 apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:preempt_count_add+0x6b/0x1a0 kernel/sched/core.c:3107 RSP: 0018:ffff888095767438 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 1ffffffff126fed8 RSI: ffffffff86bcf1e0 RDI: 0000000000000001 RBP: ffff888095767448 R08: 000000000000001c R09: ffffea0001e68b40 R10: 0000000000000001 R11: dffffc0000000000 R12: 0000000000000001 R13: ffff88808d719440 R14: ffff88808d719230 R15: ffff8880b2d782c0 rcu_lockdep_current_cpu_online+0x37/0x140 kernel/rcu/tree.c:1185 rcu_read_lock_sched_held+0x96/0x120 kernel/rcu/update.c:113 trace_ext4_da_write_end include/trace/events/ext4.h:382 [inline] ext4_da_write_end+0x675/0xa20 fs/ext4/inode.c:3172 CPU: 0 PID: 7012 Comm: syz-executor.3 Not tainted 4.14.209-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 generic_perform_write+0x318/0x450 mm/filemap.c:3066 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 nmi_cpu_backtrace.cold.4+0x3e/0x76 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xe6/0x11a lib/nmi_backtrace.c:62 __generic_file_write_iter+0x201/0x580 mm/filemap.c:3180 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 ext4_file_write_iter+0x27a/0xe40 fs/ext4/file.c:270 trigger_single_cpu_backtrace include/linux/nmi.h:158 [inline] rcu_dump_cpu_stacks+0x172/0x1bf kernel/rcu/tree.c:1396 print_cpu_stall kernel/rcu/tree.c:1542 [inline] check_cpu_stall kernel/rcu/tree.c:1610 [inline] __rcu_pending kernel/rcu/tree.c:3390 [inline] rcu_pending kernel/rcu/tree.c:3452 [inline] rcu_check_callbacks.cold.77+0x415/0xcfa kernel/rcu/tree.c:2792 update_process_times+0x2a/0x60 kernel/time/timer.c:1591 tick_sched_handle+0x7b/0x140 kernel/time/tick-sched.c:165 tick_sched_timer+0x34/0xf0 kernel/time/tick-sched.c:1223 call_write_iter include/linux/fs.h:1778 [inline] do_iter_readv_writev+0x460/0x900 fs/read_write.c:675 __run_hrtimer kernel/time/hrtimer.c:1223 [inline] __hrtimer_run_queues+0x297/0xaf0 kernel/time/hrtimer.c:1287 do_iter_write+0x12b/0x520 fs/read_write.c:954 hrtimer_interrupt+0x1ae/0x600 kernel/time/hrtimer.c:1321 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline] smp_apic_timer_interrupt+0x11f/0x5d0 arch/x86/kernel/apic/apic.c:1100 vfs_iter_write+0x5b/0xb0 fs/read_write.c:967 apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793 iter_file_splice_write+0x540/0xc20 fs/splice.c:749 RIP: 0010:memcmp+0x91/0x160 lib/string.c:885 RSP: 0018:ffff8880b45175e0 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff10 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x104/0x1c0 fs/splice.c:1018 RAX: 0000000000000000 RBX: ffff8880b45176b2 RCX: 0000000000000002 splice_direct_to_actor+0x27c/0x750 fs/splice.c:973 RDX: ffff8880b45176f0 RSI: ffff888094048872 RDI: 0000000000000001 RBP: ffff8880b4517608 R08: ffff8880b4517688 R09: 00000000ea68f5ef R10: 0000000000000002 R11: 000000001fd98007 R12: dffffc0000000000 R13: 0000000000000068 R14: ffff888094048830 R15: 0000000000004171 find_stack lib/stackdepot.c:180 [inline] depot_save_stack+0x122/0x43a lib/stackdepot.c:229 save_stack+0xa9/0xd0 mm/kasan/kasan.c:453 do_splice_direct+0x144/0x250 fs/splice.c:1061 do_sendfile+0x463/0xd00 fs/read_write.c:1441 SYSC_sendfile64 fs/read_write.c:1496 [inline] SyS_sendfile64+0x97/0x110 fs/read_write.c:1488 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x459599 RSP: 002b:00007f9b2d79cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459599 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:551 RDX: 0000000020000000 RSI: 0000000000000003 RDI: 0000000000000003 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 00008080fffffffe R11: 0000000000000246 R12: 00007f9b2d79d6d4 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc+0x144/0x7b0 mm/slab.c:3729 R13: 00000000004c6b70 R14: 00000000004dbde8 R15: 00000000ffffffff rcu_preempt kthread starved for 10500 jiffies! g972 c971 f0x2 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=0 kmalloc_array include/linux/slab.h:607 [inline] kcalloc include/linux/slab.h:618 [inline] iter_file_splice_write+0x126/0xc20 fs/splice.c:692 rcu_preempt R running task 29720 8 2 0x80000000 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x780/0x1d20 kernel/sched/core.c:3384 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x104/0x1c0 fs/splice.c:1018 splice_direct_to_actor+0x27c/0x750 fs/splice.c:973 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_timeout+0x40c/0xcc0 kernel/time/timer.c:1747 do_splice_direct+0x144/0x250 fs/splice.c:1061 rcu_gp_kthread+0xbbf/0x1e00 kernel/rcu/tree.c:2255 kthread+0x338/0x400 kernel/kthread.c:232 do_sendfile+0x463/0xd00 fs/read_write.c:1441 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 SYSC_sendfile64 fs/read_write.c:1496 [inline] SyS_sendfile64+0x97/0x110 fs/read_write.c:1488 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x459599 RSP: 002b:00007f9717c0ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459599 RDX: 0000000020000000 RSI: 0000000000000003 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 00008080fffffffe R11: 0000000000000246 R12: 00007f9717c0b6d4 R13: 00000000004c6b70 R14: 00000000004dbde8 R15: 00000000ffffffff