bisecting fixing commit since ef244c3088856cf048c77231653b4c92a7b2213c building syzkaller on a41ca8fa8285754d8561dcc3ed54cca2da60eed7 testing commit ef244c3088856cf048c77231653b4c92a7b2213c with gcc (GCC) 8.1.0 kernel signature: c7ea0758aec9feed6ce9e5beea2cffdee2253dee11f88bc0cdb679b133911b45 run #0: crashed: INFO: rcu detected stall in sys_open run #1: crashed: INFO: rcu detected stall in sys_open run #2: crashed: INFO: rcu detected stall in corrupted run #3: crashed: INFO: rcu detected stall in sys_open run #4: crashed: INFO: rcu detected stall in sys_open run #5: crashed: INFO: rcu detected stall in sys_open run #6: crashed: INFO: rcu detected stall in corrupted run #7: crashed: INFO: rcu detected stall in corrupted run #8: crashed: INFO: rcu detected stall in sys_open run #9: crashed: INFO: rcu detected stall in corrupted testing current HEAD c37da90efff5f183bea6ae4c2af33571f61fe317 testing commit c37da90efff5f183bea6ae4c2af33571f61fe317 with gcc (GCC) 8.1.0 kernel signature: 0dfea05a2965adbb6699eb15350ce6e4ce4c6f610a67405e2816e0395a0dc156 run #0: crashed: INFO: rcu detected stall in sys_open run #1: crashed: INFO: rcu detected stall in sys_open run #2: crashed: INFO: rcu detected stall in sys_open run #3: crashed: INFO: rcu detected stall in corrupted run #4: crashed: INFO: rcu detected stall in sys_open run #5: crashed: INFO: rcu detected stall in sys_open run #6: crashed: INFO: rcu detected stall in sys_open run #7: crashed: INFO: rcu detected stall in sys_open run #8: crashed: INFO: rcu detected stall in sys_open run #9: crashed: INFO: rcu detected stall in corrupted revisions tested: 2, total time: 34m32.868167145s (build: 20m40.447447683s, test: 12m1.443840465s) the crash still happens on HEAD commit msg: Linux 4.19.143 crash: INFO: rcu detected stall in corrupted IPVS: ftp: loaded support on port[0] = 21 audit: type=1800 audit(1599655439.902:17): pid=7888 uid=0 auid=0 ses=8 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=15761 res=0 rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P23 rcu: (detected by 1, t=10502 jiffies, g=6293, q=519) kworker/u4:1 R running task 25000 23 2 0x80000000 Workqueue: bat_events batadv_nc_worker Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x78c/0x1c10 kernel/sched/core.c:3517 preempt_schedule_irq+0x87/0x110 kernel/sched/core.c:3744 retint_kernel+0x1b/0x2d RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline] RIP: 0010:batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:420 [inline] RIP: 0010:batadv_nc_worker+0x10f/0x630 net/batman-adv/network-coding.c:730 Code: 19 88 e8 84 43 e2 fa e8 6f 55 e7 fa 5a 85 c0 74 0d 80 3d e6 30 64 02 00 0f 84 d2 02 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <0f> 85 85 04 00 00 4d 8b 36 4d 85 f6 74 41 49 81 ee 88 01 00 00 74 RSP: 0018:ffff8880a990fd10 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffdc RAX: 1ffff110125549bd RBX: ffff888092b25600 RCX: ffffffff81524241 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880aea23990 RBP: ffff8880a990fd58 R08: ffffed1015d44733 R09: ffffed1015d44732 R10: ffffed1015d44732 R11: ffff8880aea23993 R12: ffff888090984700 R13: 000000000000017d R14: ffff888092aa4de8 R15: dffffc0000000000 process_one_work+0x830/0x1670 kernel/workqueue.c:2155 worker_thread+0x85/0xb60 kernel/workqueue.c:2298 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 kworker/u4:1 R running task 25000 23 2 0x80000000 Workqueue: bat_events batadv_nc_worker Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x78c/0x1c10 kernel/sched/core.c:3517 preempt_schedule_irq+0x87/0x110 kernel/sched/core.c:3744 retint_kernel+0x1b/0x2d RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline] RIP: 0010:batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:420 [inline] RIP: 0010:batadv_nc_worker+0x10f/0x630 net/batman-adv/network-coding.c:730 Code: 19 88 e8 84 43 e2 fa e8 6f 55 e7 fa 5a 85 c0 74 0d 80 3d e6 30 64 02 00 0f 84 d2 02 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <0f> 85 85 04 00 00 4d 8b 36 4d 85 f6 74 41 49 81 ee 88 01 00 00 74 RSP: 0018:ffff8880a990fd10 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffdc RAX: 1ffff110125549bd RBX: ffff888092b25600 RCX: ffffffff81524241 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880aea23990 RBP: ffff8880a990fd58 R08: ffffed1015d44733 R09: ffffed1015d44732 R10: ffffed1015d44732 R11: ffff8880aea23993 R12: ffff888090984700 R13: 000000000000017d R14: ffff888092aa4de8 R15: dffffc0000000000 process_one_work+0x830/0x1670 kernel/workqueue.c:2155 worker_thread+0x85/0xb60 kernel/workqueue.c:2298 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 rcu: rcu_preempt kthread starved for 10502 jiffies! g6293 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: RCU grace-period kthread stack dump: rcu_preempt R running task 29544 10 2 0x80000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x78c/0x1c10 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_timeout+0x3ab/0xe00 kernel/time/timer.c:1825 rcu_gp_kthread+0xce6/0x23d0 kernel/rcu/tree.c:2202 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 syz-executor.2 (7911) used greatest stack depth: 22264 bytes left audit: type=1800 audit(1599655548.178:18): pid=7911 uid=0 auid=0 ses=8 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=15770 res=0 audit: type=1800 audit(1599655548.238:19): pid=7923 uid=0 auid=0 ses=8 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed comm="syz-executor.1" name="bus" dev="sda1" ino=15776 res=0 IPVS: ftp: loaded support on port[0] = 21 syz-executor.1 (7923) used greatest stack depth: 21784 bytes left device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 chnl_net:caif_netlink_parms(): no params data found bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode chnl_net:caif_netlink_parms(): no params data found bond0: Enslaving bond_slave_0 as an active interface with an up link chnl_net:caif_netlink_parms(): no params data found bond0: Enslaving bond_slave_1 as an active interface with an up link bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready team0: Port device team_slave_0 added bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready bond0: Enslaving bond_slave_0 as an active interface with an up link bond0: Enslaving bond_slave_0 as an active interface with an up link IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready bond0: Enslaving bond_slave_1 as an active interface with an up link bond0: Enslaving bond_slave_1 as an active interface with an up link IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready team0: Port device team_slave_0 added IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added device hsr_slave_0 entered promiscuous mode device hsr_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready team0: Port device team_slave_0 added IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready device hsr_slave_0 entered promiscuous mode device hsr_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready device hsr_slave_0 entered promiscuous mode device hsr_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready IPVS: ftp: loaded support on port[0] = 21 IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready IPVS: ftp: loaded support on port[0] = 21 IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready 8021q: adding VLAN 0 to HW filter on device batadv0 IPVS: ftp: loaded support on port[0] = 21 8021q: adding VLAN 0 to HW filter on device batadv0 IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready