bisecting fixing commit since d573e8a79f70404ba08623d1de7ea617d55092ac building syzkaller on d96e88f3207d7ac7ad65e13b896f702ad04c46f7 testing commit d573e8a79f70404ba08623d1de7ea617d55092ac with gcc (GCC) 8.1.0 kernel signature: 72c32d7aaf11785e653e2dae0860ead2de6a085a6a29ec06bfa7fadb5e39f6bd run #0: crashed: INFO: rcu detected stall in pie_timer run #1: crashed: INFO: rcu detected stall in pie_timer run #2: crashed: INFO: rcu detected stall in pie_timer run #3: crashed: INFO: rcu detected stall in pie_timer run #4: crashed: INFO: rcu detected stall in run_timer_softirq run #5: crashed: INFO: rcu detected stall in pie_timer run #6: crashed: INFO: rcu detected stall in pie_timer run #7: crashed: INFO: rcu detected stall in run_timer_softirq run #8: crashed: INFO: rcu detected stall in pie_timer run #9: crashed: INFO: rcu detected stall in call_timer_fn testing current HEAD b499cf4b3a901e87e1f933df04abf69b54de4457 testing commit b499cf4b3a901e87e1f933df04abf69b54de4457 with gcc (GCC) 8.1.0 kernel signature: 56b213f4b923a868204c5f50cbd5c6ab10db3c93874f03f97a8482c04d15ddc8 run #0: crashed: INFO: rcu detected stall in run_timer_softirq run #1: crashed: INFO: rcu detected stall in pie_timer run #2: crashed: INFO: rcu detected stall in run_timer_softirq run #3: crashed: INFO: rcu detected stall in check_preemption_disabled run #4: crashed: INFO: rcu detected stall in run_timer_softirq run #5: crashed: INFO: rcu detected stall in pie_timer run #6: crashed: INFO: rcu detected stall in run_timer_softirq run #7: crashed: INFO: rcu detected stall in run_timer_softirq run #8: crashed: INFO: rcu detected stall in run_timer_softirq run #9: crashed: INFO: rcu detected stall in call_timer_fn revisions tested: 2, total time: 33m10.93979015s (build: 17m11.144773541s, test: 15m27.966471396s) the crash still happens on HEAD commit msg: Linux 4.19.102 crash: INFO: rcu detected stall in call_timer_fn SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19354 comm=syz-executor.2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19353 comm=syz-executor.4 rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-....: (1 GPs behind) idle=766/1/0x4000000000000004 softirq=31567/31568 fqs=5250 rcu: (t=10502 jiffies g=21977 q=174) NMI backtrace for cpu 0 CPU: 0 PID: 19444 Comm: syz-executor.2 Not tainted 4.19.102-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x123/0x177 lib/dump_stack.c:118 nmi_cpu_backtrace.cold.4+0x3e/0x76 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xe6/0x11a lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x175/0x1c2 kernel/rcu/tree.c:1340 print_cpu_stall kernel/rcu/tree.c:1478 [inline] check_cpu_stall kernel/rcu/tree.c:1550 [inline] __rcu_pending kernel/rcu/tree.c:3293 [inline] rcu_pending kernel/rcu/tree.c:3336 [inline] rcu_check_callbacks.cold.82+0x5bd/0xd3d kernel/rcu/tree.c:2682 update_process_times+0x2a/0x60 kernel/time/timer.c:1638 tick_sched_handle+0x77/0x140 kernel/time/tick-sched.c:168 tick_sched_timer+0x37/0xf0 kernel/time/tick-sched.c:1278 __run_hrtimer kernel/time/hrtimer.c:1401 [inline] __hrtimer_run_queues+0x2f7/0xab0 kernel/time/hrtimer.c:1463 hrtimer_interrupt+0x2df/0x760 kernel/time/hrtimer.c:1521 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline] smp_apic_timer_interrupt+0x114/0x540 arch/x86/kernel/apic/apic.c:1092 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893 RIP: 0010:rcu_lockdep_current_cpu_online+0xe8/0x1d0 kernel/rcu/tree.c:1078 Code: 00 00 49 8b 9e d8 12 00 00 e8 84 ff a0 01 89 c0 48 8d 3c c5 00 6f bb 87 48 89 fa 48 c1 ea 03 42 80 3c 22 00 0f 85 aa 00 00 00 <49> 03 5c c5 00 48 8d 7b 20 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f RSP: 0018:ffff8880aea07cc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000000 RBX: 000000000002cfc0 RCX: 0000000000000000 RDX: 1ffffffff0f76de0 RSI: ffffffff86ff2560 RDI: ffffffff87bb6f00 RBP: ffff8880aea07cf8 R08: ffffed1015d44733 R09: ffffed1015d44732 R10: ffffed1015d44732 R11: ffff8880aea23993 R12: dffffc0000000000 R13: ffffffff87bb6f00 R14: ffffffff87f9c180 R15: ffff8880aea23a00 rcu_read_lock_sched_held+0x96/0x120 kernel/rcu/update.c:115 trace_timer_expire_exit include/trace/events/timer.h:121 [inline] call_timer_fn+0x43a/0x510 kernel/time/timer.c:1327 expire_timers kernel/time/timer.c:1363 [inline] __run_timers kernel/time/timer.c:1684 [inline] run_timer_softirq+0xb63/0x1180 kernel/time/timer.c:1697 __do_softirq+0x260/0x92d kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x13e/0x540 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:kfree+0x11a/0x220 mm/slab.c:3823 Code: 1f 44 00 00 e8 77 38 d5 ff 5b 41 5c 41 5d 41 5e 5d c3 e8 d9 36 d5 ff 48 83 3d 29 f3 60 06 00 0f 84 07 01 00 00 4c 89 e7 57 9d <0f> 1f 44 00 00 5b 41 5c 41 5d 41 5e 5d c3 4c 89 f2 48 89 de 4c 89 RSP: 0018:ffff888075527378 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000007 RBX: ffff8880930b0a80 RCX: 1ffff1100ecfe5b9 RDX: 0000000000000000 RSI: ffff8880767f2da8 RDI: 0000000000000286 RBP: ffff888075527398 R08: ffff8880767f2dc8 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000286 R13: ffff88812c35e940 R14: ffffffff850b5c94 R15: ffff888097219540 skb_free_head+0x74/0x90 net/core/skbuff.c:554 skb_release_data+0x481/0x6c0 net/core/skbuff.c:574 skb_release_all+0x3d/0x50 net/core/skbuff.c:631 __kfree_skb net/core/skbuff.c:645 [inline] consume_skb+0x91/0x270 net/core/skbuff.c:705 netlink_broadcast_filtered+0x287/0x930 net/netlink/af_netlink.c:1519 netlink_broadcast+0xe/0x10 net/netlink/af_netlink.c:1541 uevent_net_broadcast_tagged lib/kobject_uevent.c:370 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:409 [inline] kobject_uevent_env+0xc7c/0xec0 lib/kobject_uevent.c:590 kobject_uevent+0xb/0x10 lib/kobject_uevent.c:639 device_del+0x5fe/0xa60 drivers/base/core.c:2205 netdev_unregister_kobject+0x184/0x1e0 net/core/net-sysfs.c:1731 rollback_registered_many+0x6a0/0xb60 net/core/dev.c:8204 rollback_registered+0xdc/0x190 net/core/dev.c:8222 unregister_netdevice_queue+0x186/0x240 net/core/dev.c:9275 unregister_netdevice include/linux/netdevice.h:2614 [inline] __tun_detach+0xb05/0xf10 drivers/net/tun.c:737 tun_detach drivers/net/tun.c:754 [inline] tun_chr_close+0xb5/0x150 drivers/net/tun.c:3261 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa62/0x2d20 kernel/exit.c:880 do_group_exit+0xf4/0x2f0 kernel/exit.c:983 get_signal+0x313/0x1a00 kernel/signal.c:2583 do_signal+0x87/0x1960 arch/x86/kernel/signal.c:821 exit_to_usermode_loop+0x114/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459a09 Code: 48 89 44 24 40 48 8b 6c 24 20 48 83 c4 28 c3 e8 5d 88 ff ff eb 8b cc cc cc cc cc cc cc cc cc cc cc 64 48 8b 0c 25 f8 ff ff ff <48> 3b 61 10 76 78 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 48 8b RSP: 002b:00007f4799d35c78 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: 0000000000000006 RBX: 0000000000000005 RCX: 0000000000459a09 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 000000002001d000 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f4799d366d4 R13: 00000000004c6855 R14: 00000000004dba68 R15: 00000000ffffffff selinux_nlmsg_perm: 26 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19511 comm=syz-executor.5 IPVS: ftp: loaded support on port[0] = 21 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19509 comm=syz-executor.3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19502 comm=syz-executor.4 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19506 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19510 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19540 comm=syz-executor.5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19541 comm=syz-executor.0 chnl_net:caif_netlink_parms(): no params data found SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19539 comm=syz-executor.3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19533 comm=syz-executor.1 bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19538 comm=syz-executor.4 bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode bond0: Enslaving bond_slave_0 as an active interface with an up link bond0: Enslaving bond_slave_1 as an active interface with an up link IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready team0: Port device team_slave_0 added IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready device hsr_slave_0 entered promiscuous mode device hsr_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state bridge0: port 1(bridge_slave_0) entered disabled state bridge0: port 2(bridge_slave_1) entered disabled state 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 8021q: adding VLAN 0 to HW filter on device batadv0 selinux_nlmsg_perm: 42 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19793 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19803 comm=syz-executor.5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19816 comm=syz-executor.4 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19825 comm=syz-executor.2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19827 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19832 comm=syz-executor.5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19843 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19849 comm=syz-executor.3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19847 comm=syz-executor.4 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=19852 comm=syz-executor.2