bisecting fixing commit since 8e37395c3a5dceff62a5010ebbbc107f4145935c
building syzkaller on f111d03be02771a52d5610a70bca229e552c7753
testing commit 8e37395c3a5dceff62a5010ebbbc107f4145935c
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 8001aacabe270e02bf923bf02655cf1a2177a893061e26128d205fd3a8aa0c35
run #0: crashed: INFO: rcu detected stall in chrdev_open
run #1: crashed: INFO: rcu detected stall in chrdev_open
run #2: crashed: INFO: rcu detected stall in chrdev_open
run #3: crashed: INFO: rcu detected stall in chrdev_open
run #4: crashed: INFO: rcu detected stall in chrdev_open
run #5: crashed: INFO: rcu detected stall in chrdev_open
run #6: crashed: INFO: rcu detected stall in chrdev_open
run #7: crashed: INFO: rcu detected stall in chrdev_open
run #8: crashed: INFO: rcu detected stall in corrupted
run #9: crashed: INFO: rcu detected stall in corrupted
run #10: crashed: INFO: rcu detected stall in chrdev_open
run #11: crashed: INFO: rcu detected stall in chrdev_open
run #12: crashed: INFO: rcu detected stall in chrdev_open
run #13: crashed: INFO: rcu detected stall in clone
run #14: crashed: INFO: rcu detected stall in chrdev_open
run #15: crashed: INFO: rcu detected stall in clone
run #16: crashed: INFO: rcu detected stall in chrdev_open
run #17: crashed: INFO: rcu detected stall in chrdev_open
run #18: crashed: INFO: rcu detected stall in chrdev_open
run #19: crashed: INFO: rcu detected stall in chrdev_open
testing current HEAD dcb85f85fa6f142aae1fe86f399d4503d49f2b60
testing commit dcb85f85fa6f142aae1fe86f399d4503d49f2b60
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: a1c6032033461ea7ed49a38ae64fd0257dba72bebeb07211a421597aa97d7dbc
run #0: crashed: INFO: rcu detected stall in corrupted
run #1: crashed: INFO: rcu detected stall in sys_exit_group
run #2: crashed: INFO: rcu detected stall in chrdev_open
run #3: crashed: INFO: rcu detected stall in chrdev_open
run #4: crashed: INFO: rcu detected stall in chrdev_open
run #5: crashed: INFO: rcu detected stall in sys_exit_group
run #6: crashed: INFO: rcu detected stall in chrdev_open
run #7: crashed: INFO: rcu detected stall in chrdev_open
run #8: crashed: INFO: rcu detected stall in chrdev_open
run #9: crashed: INFO: rcu detected stall in corrupted
revisions tested: 2, total time: 23m6.512034749s (build: 13m1.180044923s, test: 9m17.492278905s)
the crash still happens on HEAD
commit msg: gcc-plugins/stackleak: Use noinstr in favor of notrace
crash: INFO: rcu detected stall in corrupted
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P3001/1:b..l
(detected by 1, t=10502 jiffies, g=6181, q=275)
task:udevd state:R running task stack:26752 pid: 3001 ppid: 1 flags:0x00000000
Call Trace:
context_switch kernel/sched/core.c:4986 [inline]
__schedule+0xa72/0x4d70 kernel/sched/core.c:6295
preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6461
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x57/0x70 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:404 [inline]
__wake_up_common_lock+0xde/0x130 kernel/sched/wait.c:140
sock_def_readable+0xb7/0x350 net/core/sock.c:3147
__netlink_sendskb net/netlink/af_netlink.c:1264 [inline]
netlink_sendskb net/netlink/af_netlink.c:1270 [inline]
netlink_unicast+0x5ad/0x700 net/netlink/af_netlink.c:1358
netlink_sendmsg+0x770/0xc10 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:705 [inline]
sock_sendmsg+0xab/0xe0 net/socket.c:725
____sys_sendmsg+0x5bf/0x7a0 net/socket.c:2413
___sys_sendmsg+0xd3/0x150 net/socket.c:2467
__sys_sendmsg+0xb2/0x140 net/socket.c:2496
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f31c705f163
RSP: 002b:00007ffe521becf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f31c7647d50 RCX: 00007f31c705f163
RDX: 0000000000000000 RSI: 00007ffe521bed08 RDI: 0000000000000004
RBP: 00007f31c767b6f0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000000b2 R14: 0000000000000000 R15: 0000000000000000
rcu: rcu_preempt kthread starved for 10500 jiffies! g6181 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:28816 pid: 14 ppid: 2 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:4986 [inline]
__schedule+0xa72/0x4d70 kernel/sched/core.c:6295
schedule+0xd2/0x260 kernel/sched/core.c:6368
schedule_timeout+0x11d/0x250 kernel/time/timer.c:1881
rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1963
rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2136
kthread+0x299/0x340 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 4167 Comm: syz-executor.5 Not tainted 5.17.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:get_tty_driver drivers/tty/tty_io.c:319 [inline]
RIP: 0010:tty_lookup_driver+0x5a/0x420 drivers/tty/tty_io.c:1949
Code: ff ff ff 48 3d c0 4c 77 8b 0f 84 24 01 00 00 49 be 00 00 00 00 00 fc ff df 49 8d 7c 24 2c 48 89 f8 48 c1 e8 03 42 0f b6 14 30 <48> 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 67 03 00 00 49
RSP: 0018:ffffc90002cc78a0 EFLAGS: 00000213
RAX: 1ffff11003605785 RBX: 0000000000400043 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888078a64a00 RDI: ffff88801b02bc2c
RBP: 000000000bc00000 R08: 0000000000000000 R09: ffffc90002cc780f
R10: fffff52000598f01 R11: 0000000000000001 R12: ffff88801b02bc00
R13: ffffc90002cc7938 R14: dffffc0000000000 R15: 0000000000400043
FS: 00007ff438566700(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff438ef0000 CR3: 0000000020f12000 CR4: 0000000000350ef0
Call Trace:
tty_open_by_driver drivers/tty/tty_io.c:2051 [inline]
tty_open+0x464/0xd00 drivers/tty/tty_io.c:2133
chrdev_open+0x20f/0x650 fs/char_dev.c:414
do_dentry_open+0x429/0x1040 fs/open.c:824
do_open fs/namei.c:3476 [inline]
path_openat+0x9ea/0x2390 fs/namei.c:3609
do_filp_open+0x199/0x3d0 fs/namei.c:3636
do_sys_openat2+0x11e/0x400 fs/open.c:1214
do_sys_open fs/open.c:1230 [inline]
__do_sys_openat fs/open.c:1246 [inline]
__se_sys_openat fs/open.c:1241 [inline]
__x64_sys_openat+0x11b/0x1d0 fs/open.c:1241
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff438df0a39
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff438566188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ff438ef3f60 RCX: 00007ff438df0a39
RDX: 0000000000000802 RSI: 0000000020000840 RDI: ffffffffffffff9c
RBP: 00007ff438e4ac5f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffa30fa29f R14: 00007ff438566300 R15: 0000000000022000
----------------
Code disassembly (best guess), 2 bytes skipped:
0: ff 48 3d decl 0x3d(%rax)
3: c0 4c 77 8b 0f rorb $0xf,-0x75(%rdi,%rsi,2)
8: 84 24 01 test %ah,(%rcx,%rax,1)
b: 00 00 add %al,(%rax)
d: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
14: fc ff df
17: 49 8d 7c 24 2c lea 0x2c(%r12),%rdi
1c: 48 89 f8 mov %rdi,%rax
1f: 48 c1 e8 03 shr $0x3,%rax
23: 42 0f b6 14 30 movzbl (%rax,%r14,1),%edx
* 28: 48 89 f8 mov %rdi,%rax <-- trapping instruction
2b: 83 e0 07 and $0x7,%eax
2e: 83 c0 03 add $0x3,%eax
31: 38 d0 cmp %dl,%al
33: 7c 08 jl 0x3d
35: 84 d2 test %dl,%dl
37: 0f 85 67 03 00 00 jne 0x3a4
3d: 49 rex.WB