bisecting fixing commit since d573e8a79f70404ba08623d1de7ea617d55092ac building syzkaller on d96e88f3207d7ac7ad65e13b896f702ad04c46f7 testing commit d573e8a79f70404ba08623d1de7ea617d55092ac with gcc (GCC) 8.1.0 kernel signature: 71c67fee83022e39fb262d129f6a9884ae097034 run #0: crashed: INFO: rcu detected stall in lock_is_held_type run #1: crashed: INFO: rcu detected stall in run_timer_softirq run #2: crashed: INFO: rcu detected stall in run_timer_softirq run #3: crashed: INFO: rcu detected stall in pie_timer run #4: crashed: INFO: rcu detected stall in run_timer_softirq run #5: crashed: INFO: rcu detected stall in pie_timer run #6: crashed: INFO: rcu detected stall in run_timer_softirq run #7: crashed: INFO: rcu detected stall in run_timer_softirq run #8: crashed: INFO: rcu detected stall in run_timer_softirq run #9: crashed: INFO: rcu detected stall in run_timer_softirq testing current HEAD fb683b5e3f53a73e761952735736180939a313df testing commit fb683b5e3f53a73e761952735736180939a313df with gcc (GCC) 8.1.0 kernel signature: 120be38b6eb5077de683977a8ec3d3956d7f400d run #0: crashed: INFO: rcu detected stall in run_timer_softirq run #1: crashed: INFO: rcu detected stall in pie_timer run #2: crashed: INFO: rcu detected stall in run_timer_softirq run #3: crashed: INFO: rcu detected stall in pie_timer run #4: crashed: INFO: rcu detected stall in call_timer_fn run #5: crashed: INFO: rcu detected stall in pie_timer run #6: crashed: INFO: rcu detected stall in pie_timer run #7: crashed: INFO: rcu detected stall in pie_timer run #8: crashed: INFO: rcu detected stall in pie_timer run #9: crashed: INFO: rcu detected stall in run_timer_softirq revisions tested: 2, total time: 33m17.121161841s (build: 16m37.939990565s, test: 16m4.754330546s) the crash still happens on HEAD commit msg: Linux 4.19.88 crash: INFO: rcu detected stall in run_timer_softirq SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=739 comm=syz-executor.2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=729 comm=syz-executor.5 rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 1-....: (1 GPs behind) idle=e7e/1/0x4000000000000004 softirq=58370/58371 fqs=5243 rcu: (t=10500 jiffies g=46741 q=1694) NMI backtrace for cpu 1 CPU: 1 PID: 917 Comm: syz-executor.1 Not tainted 4.19.88-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x123/0x177 lib/dump_stack.c:118 nmi_cpu_backtrace.cold.4+0x3e/0x76 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xe6/0x11a lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x175/0x1c2 kernel/rcu/tree.c:1340 print_cpu_stall kernel/rcu/tree.c:1478 [inline] check_cpu_stall kernel/rcu/tree.c:1550 [inline] __rcu_pending kernel/rcu/tree.c:3293 [inline] rcu_pending kernel/rcu/tree.c:3336 [inline] rcu_check_callbacks.cold.82+0x5bd/0xd3d kernel/rcu/tree.c:2682 update_process_times+0x2a/0x60 kernel/time/timer.c:1638 tick_sched_handle+0x77/0x140 kernel/time/tick-sched.c:164 tick_sched_timer+0x37/0xf0 kernel/time/tick-sched.c:1274 __run_hrtimer kernel/time/hrtimer.c:1398 [inline] __hrtimer_run_queues+0x2f7/0xab0 kernel/time/hrtimer.c:1460 hrtimer_interrupt+0x2df/0x760 kernel/time/hrtimer.c:1518 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline] smp_apic_timer_interrupt+0x114/0x540 arch/x86/kernel/apic/apic.c:1092 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893 RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline] RIP: 0010:_raw_spin_unlock_irq+0x56/0x80 kernel/locking/spinlock.c:192 Code: f2 87 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 32 48 83 3d db 37 73 01 00 74 1f fb 66 0f 1f 44 00 00 01 00 00 00 e8 e0 9f c3 fa 65 8b 05 79 1e 83 79 85 c0 74 05 5b RSP: 0018:ffff8880aeb07de0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: ffff8880aeb23a00 RCX: 0000000000000000 RDX: 1ffffffff0fe40e3 RSI: 0000000000000000 RDI: ffffffff87f20718 RBP: ffff8880aeb07de8 R08: ffffed1015d64741 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880aeb07e60 R13: dffffc0000000000 R14: ffffffff853381a0 R15: ffff8880aeb23a00 expire_timers kernel/time/timer.c:1362 [inline] __run_timers kernel/time/timer.c:1684 [inline] run_timer_softirq+0xb58/0x1180 kernel/time/timer.c:1697 __do_softirq+0x260/0x92d kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x13e/0x540 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:kfree+0x11a/0x220 mm/slab.c:3823 Code: 1f 44 00 00 e8 37 44 d5 ff 5b 41 5c 41 5d 41 5e 5d c3 e8 99 42 d5 ff 48 83 3d d9 0b 61 06 00 0f 84 07 01 00 00 4c 89 e7 57 9d <0f> 1f 44 00 00 5b 41 5c 41 5d 41 5e 5d c3 4c 89 f2 48 89 de 4c 89 RSP: 0018:ffff888057d779a0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000007 RBX: ffff88809589ea80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000286 RBP: ffff888057d779c0 R08: 0000000000000070 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000286 R13: ffff88809a38c7c0 R14: ffffffff8181b3bc R15: 0000000000000100 kvfree+0x2c/0x30 mm/util.c:452 __free_fdtable+0x2c/0x70 fs/file.c:31 put_files_struct+0x1be/0x250 fs/file.c:420 exit_files+0x79/0xa0 fs/file.c:445 do_exit+0x9f5/0x2d40 kernel/exit.c:871 do_group_exit+0xf4/0x2f0 kernel/exit.c:979 get_signal+0x313/0x1a00 kernel/signal.c:2578 do_signal+0x87/0x1960 arch/x86/kernel/signal.c:821 exit_to_usermode_loop+0x114/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459a09 Code: Bad RIP value. RSP: 002b:00007fc9a0f6ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: 0000000000000003 RBX: 0000000000000005 RCX: 0000000000459a09 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 000000002001d000 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fc9a0f6b6d4 R13: 00000000004c6855 R14: 00000000004dba68 R15: 00000000ffffffff selinux_nlmsg_perm: 39 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=975 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=985 comm=syz-executor.4 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=980 comm=syz-executor.3 IPVS: ftp: loaded support on port[0] = 21 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1002 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1000 comm=syz-executor.5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=998 comm=syz-executor.3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1003 comm=syz-executor.4 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1017 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1023 comm=syz-executor.2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1019 comm=syz-executor.5 chnl_net:caif_netlink_parms(): no params data found bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode bond0: Enslaving bond_slave_0 as an active interface with an up link bond0: Enslaving bond_slave_1 as an active interface with an up link IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready team0: Port device team_slave_0 added IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready device hsr_slave_0 entered promiscuous mode device hsr_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 8021q: adding VLAN 0 to HW filter on device batadv0 selinux_nlmsg_perm: 11 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1118 comm=syz-executor.4 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1120 comm=syz-executor.3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1125 comm=syz-executor.2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1142 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1131 comm=syz-executor.5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1161 comm=syz-executor.4 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1150 comm=syz-executor.2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1163 comm=syz-executor.3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1167 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1165 comm=syz-executor.5