bisecting fixing commit since d6765985a42a660f078896d5c5b27f97c580a490
building syzkaller on 9d2ab5dfe7727dfea4b9b279f4edf731acb386ef
testing commit d6765985a42a660f078896d5c5b27f97c580a490
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 65241d6ac4131102e3bb9c9a61f5d375abcc730a52f149fb3b1cdca04a394b59
run #0: crashed: WARNING in __cfg80211_ibss_joined
run #1: crashed: INFO: rcu detected stall in security_file_open
run #2: crashed: INFO: rcu detected stall in net_tx_action
run #3: crashed: INFO: rcu detected stall in clone
run #4: crashed: INFO: rcu detected stall in batadv_purge_orig
run #5: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #6: crashed: INFO: rcu detected stall in net_tx_action
run #7: crashed: INFO: rcu detected stall in tc_modify_qdisc
run #8: crashed: INFO: rcu detected stall in tc_modify_qdisc
run #9: crashed: INFO: rcu detected stall in tc_modify_qdisc
run #10: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #11: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #12: crashed: BUG: soft lockup in sys_getdents
run #13: crashed: BUG: soft lockup in mac80211_hwsim_beacon
run #14: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #15: crashed: INFO: rcu detected stall in ieee80211_iface_work
run #16: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #17: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #18: crashed: BUG: workqueue lockup
run #19: crashed: INFO: rcu detected stall in __hrtimer_run_queues
testing current HEAD 7fe7f3182a0dd8f9bad463598ed103b3d8cfa739
testing commit 7fe7f3182a0dd8f9bad463598ed103b3d8cfa739
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 241b16c491054a70e2785aedb527f23405c0e06cce99f64335435292fcdbec67
run #0: crashed: INFO: rcu detected stall in tc_modify_qdisc
run #1: crashed: BUG: soft lockup in smp_call_function
run #2: crashed: INFO: rcu detected stall in ip6_mc_input
run #3: crashed: INFO: rcu detected stall in ieee80211_iface_work
run #4: crashed: INFO: rcu detected stall in __hrtimer_run_queues
run #5: crashed: BUG: soft lockup in net_tx_action
run #6: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #7: crashed: BUG: soft lockup in mac80211_hwsim_beacon
run #8: crashed: INFO: rcu detected stall in corrupted
run #9: crashed: INFO: rcu detected stall in ieee80211_iface_work
revisions tested: 2, total time: 28m4.792419436s (build: 13m22.429553657s, test: 14m4.114152257s)
the crash still happens on HEAD
commit msg: Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
crash: INFO: rcu detected stall in ieee80211_iface_work
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 0-...!: (5 ticks this GP) idle=2c3/1/0x4000000000000000 softirq=10617/10617 fqs=0
(t=16441 jiffies g=8677 q=1123)
rcu: rcu_preempt kthread timer wakeup didn't happen for 16440 jiffies! g8677 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=0 timer-softirq=4000
rcu: rcu_preempt kthread starved for 16441 jiffies! g8677 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:28760 pid: 14 ppid: 2 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:4940 [inline]
__schedule+0x90d/0x26c0 kernel/sched/core.c:6287
schedule+0xd3/0x270 kernel/sched/core.c:6366
schedule_timeout+0x11d/0x250 kernel/time/timer.c:1881
rcu_gp_fqs_loop+0x186/0x800 kernel/rcu/tree.c:1957
rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2130
kthread+0x38b/0x460 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 0
CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.15.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy5 ieee80211_iface_work
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x30/0xc0 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x11a/0x160 lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_check_gp_kthread_starvation.cold+0x1fb/0x200 kernel/rcu/tree_stall.h:481
print_cpu_stall kernel/rcu/tree_stall.h:625 [inline]
check_cpu_stall kernel/rcu/tree_stall.h:711 [inline]
rcu_pending kernel/rcu/tree.c:3880 [inline]
rcu_sched_clock_irq.cold+0x98/0x746 kernel/rcu/tree.c:2599
update_process_times+0x13b/0x1c0 kernel/time/timer.c:1785
tick_sched_handle+0x6f/0x130 kernel/time/tick-sched.c:226
tick_sched_timer+0x132/0x210 kernel/time/tick-sched.c:1421
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x18a/0xb00 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x2f5/0x780 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
__sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:48 [inline]
RIP: 0010:stack_access_ok arch/x86/kernel/unwind_orc.c:342 [inline]
RIP: 0010:deref_stack_reg+0x0/0x150 arch/x86/kernel/unwind_orc.c:352
Code: 14 24 e9 7b ff ff ff 48 89 14 24 e8 fa 10 7a 00 48 8b 14 24 e9 48 ff ff ff 48 89 0c 24 e8 e8 10 7a 00 48 8b 0c 24 eb 9d 66 90 <48> b8 00 00 00 00 00 fc ff df 41 55 41 54 49 89 fc 55 48 89 f5 53
RSP: 0018:ffffc90000cd6900 EFLAGS: 00000283
RAX: 0000000000000000 RBX: 1ffff9200019ad29 RCX: 0000000000000000
RDX: ffffc90000cd6a20 RSI: ffffc90000cd6da8 RDI: ffffc90000cd69e0
RBP: 0000000000000001 R08: ffffffff8d89bbee R09: 0000000000000001
R10: fffff5200019ad47 R11: 000000000007a089 R12: ffffc90000cd6dd8
R13: ffffc90000cd6a15 R14: ffffc90000cd69e0 R15: ffffc90000cd6a14
unwind_next_frame+0x13e0/0x1ce0 arch/x86/kernel/unwind_orc.c:587
arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121
kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
kasan_record_aux_stack+0xe9/0x110 mm/kasan/generic.c:348
kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3552
cfg80211_update_known_bss+0x785/0xa90 net/wireless/scan.c:1660
cfg80211_bss_update+0xd9/0x20b0 net/wireless/scan.c:1707
cfg80211_inform_single_bss_frame_data+0x60d/0xcb0 net/wireless/scan.c:2411
cfg80211_inform_bss_frame_data+0x94/0xa80 net/wireless/scan.c:2444
ieee80211_bss_info_update+0x284/0x8c0 net/mac80211/scan.c:190
ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
ieee80211_rx_mgmt_probe_beacon+0x7ad/0x1640 net/mac80211/ibss.c:1608
ieee80211_ibss_rx_queued_mgmt+0xaec/0x12e0 net/mac80211/ibss.c:1635
ieee80211_iface_process_skb net/mac80211/iface.c:1439 [inline]
ieee80211_iface_work+0x729/0x970 net/mac80211/iface.c:1493
process_one_work+0x87f/0x1450 kernel/workqueue.c:2297
worker_thread+0x598/0x1040 kernel/workqueue.c:2444
kthread+0x38b/0x460 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
NMI backtrace for cpu 0
CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.15.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy5 ieee80211_iface_work
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x30/0xc0 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x11a/0x160 lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343
print_cpu_stall kernel/rcu/tree_stall.h:627 [inline]
check_cpu_stall kernel/rcu/tree_stall.h:711 [inline]
rcu_pending kernel/rcu/tree.c:3880 [inline]
rcu_sched_clock_irq.cold+0x9d/0x746 kernel/rcu/tree.c:2599
update_process_times+0x13b/0x1c0 kernel/time/timer.c:1785
tick_sched_handle+0x6f/0x130 kernel/time/tick-sched.c:226
tick_sched_timer+0x132/0x210 kernel/time/tick-sched.c:1421
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x18a/0xb00 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x2f5/0x780 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
__sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:48 [inline]
RIP: 0010:stack_access_ok arch/x86/kernel/unwind_orc.c:342 [inline]
RIP: 0010:deref_stack_reg+0x0/0x150 arch/x86/kernel/unwind_orc.c:352
Code: 14 24 e9 7b ff ff ff 48 89 14 24 e8 fa 10 7a 00 48 8b 14 24 e9 48 ff ff ff 48 89 0c 24 e8 e8 10 7a 00 48 8b 0c 24 eb 9d 66 90 <48> b8 00 00 00 00 00 fc ff df 41 55 41 54 49 89 fc 55 48 89 f5 53
RSP: 0018:ffffc90000cd6900 EFLAGS: 00000283
RAX: 0000000000000000 RBX: 1ffff9200019ad29 RCX: 0000000000000000
RDX: ffffc90000cd6a20 RSI: ffffc90000cd6da8 RDI: ffffc90000cd69e0
RBP: 0000000000000001 R08: ffffffff8d89bbee R09: 0000000000000001
R10: fffff5200019ad47 R11: 000000000007a089 R12: ffffc90000cd6dd8
R13: ffffc90000cd6a15 R14: ffffc90000cd69e0 R15: ffffc90000cd6a14
unwind_next_frame+0x13e0/0x1ce0 arch/x86/kernel/unwind_orc.c:587
arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121
kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
kasan_record_aux_stack+0xe9/0x110 mm/kasan/generic.c:348
kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3552
cfg80211_update_known_bss+0x785/0xa90 net/wireless/scan.c:1660
cfg80211_bss_update+0xd9/0x20b0 net/wireless/scan.c:1707
cfg80211_inform_single_bss_frame_data+0x60d/0xcb0 net/wireless/scan.c:2411
cfg80211_inform_bss_frame_data+0x94/0xa80 net/wireless/scan.c:2444
ieee80211_bss_info_update+0x284/0x8c0 net/mac80211/scan.c:190
ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
ieee80211_rx_mgmt_probe_beacon+0x7ad/0x1640 net/mac80211/ibss.c:1608
ieee80211_ibss_rx_queued_mgmt+0xaec/0x12e0 net/mac80211/ibss.c:1635
ieee80211_iface_process_skb net/mac80211/iface.c:1439 [inline]
ieee80211_iface_work+0x729/0x970 net/mac80211/iface.c:1493
process_one_work+0x87f/0x1450 kernel/workqueue.c:2297
worker_thread+0x598/0x1040 kernel/workqueue.c:2444
kthread+0x38b/0x460 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 14 24 adc $0x24,%al
2: e9 7b ff ff ff jmpq 0xffffff82
7: 48 89 14 24 mov %rdx,(%rsp)
b: e8 fa 10 7a 00 callq 0x7a110a
10: 48 8b 14 24 mov (%rsp),%rdx
14: e9 48 ff ff ff jmpq 0xffffff61
19: 48 89 0c 24 mov %rcx,(%rsp)
1d: e8 e8 10 7a 00 callq 0x7a110a
22: 48 8b 0c 24 mov (%rsp),%rcx
26: eb 9d jmp 0xffffffc5
28: 66 90 xchg %ax,%ax
* 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
31: fc ff df
34: 41 55 push %r13
36: 41 54 push %r12
38: 49 89 fc mov %rdi,%r12
3b: 55 push %rbp
3c: 48 89 f5 mov %rsi,%rbp
3f: 53 push %rbx