bisecting fixing commit since 5c8fe583cce542aa0b84adc939ce85293de36e5e
building syzkaller on 2242f77fdc5a6c50bd8fa1021d2abc8b83e09e8d
testing commit 5c8fe583cce542aa0b84adc939ce85293de36e5e
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 4e73d9222e74623d1b7cee06c2202994a4dfba03c8beeb8fe3e74f4f5ee6d5cd
run #0: crashed: WARNING in __cfg80211_ibss_joined
run #1: crashed: INFO: rcu detected stall in corrupted
run #2: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #3: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #4: crashed: INFO: rcu detected stall in corrupted
run #5: crashed: BUG: soft lockup in mac80211_hwsim_beacon
run #6: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #7: crashed: BUG: soft lockup in mac80211_hwsim_beacon
run #8: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #9: crashed: BUG: soft lockup in mac80211_hwsim_beacon
run #10: crashed: BUG: soft lockup in __hrtimer_run_queues
run #11: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #12: crashed: INFO: rcu detected stall in addrconf_rs_timer
run #13: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #14: crashed: BUG: soft lockup in ieee80211_tasklet_handler
run #15: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon
run #16: OK
run #17: OK
run #18: OK
run #19: OK
testing current HEAD 5472f14a37421d1bca3dddf33cabd3bd6dbefbbc
testing commit 5472f14a37421d1bca3dddf33cabd3bd6dbefbbc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: f4ab62280bfee6ec749284d86197b6639917ab167a6d839a8a244b8f00b18d94
run #0: crashed: INFO: rcu detected stall in corrupted
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
reproducer seems to be flaky
Reproducer flagged being flaky
revisions tested: 2, total time: 28m46.200430014s (build: 10m48.751251558s, test: 17m11.842659928s)
the crash still happens on HEAD
commit msg: Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
crash: INFO: rcu detected stall in corrupted
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 1-...!: (1 ticks this GP) idle=7d9/1/0x4000000000000000 softirq=10430/10430 fqs=0
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5664/1:b..l
(detected by 0, t=10502 jiffies, g=10213, q=277)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5659 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:queued_write_lock_slowpath+0x137/0x2c0 kernel/locking/qrwlock.c:78
Code: 00 00 00 00 fc ff df 49 01 c7 41 83 c6 03 41 0f b6 07 41 38 c6 7c 08 84 c0 0f 85 3e 01 00 00 8b 03 3d 00 01 00 00 74 19 f3 90 <41> 0f b6 07 41 38 c6 7c ec 84 c0 74 e8 48 89 df e8 54 54 54 00 eb
RSP: 0018:ffffc9000313faa0 EFLAGS: 00000006
RAX: 0000000000000300 RBX: ffffffff8a80a080 RCX: ffffffff81538faf
RDX: fffffbfff1501411 RSI: 0000000000000004 RDI: ffffffff8a80a080
RBP: 1ffff92000627f55 R08: 0000000000000001 R09: ffffffff8a80a083
R10: fffffbfff1501410 R11: 000000000007a08a R12: ffffffff8a80a084
R13: 00000000000000ff R14: 0000000000000003 R15: fffffbfff1501410
FS: 0000000000000000(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fac1e87c718 CR3: 000000000a88e000 CR4: 0000000000350ee0
Call Trace:
queued_write_lock include/asm-generic/qrwlock.h:97 [inline]
do_raw_write_lock+0x1ce/0x280 kernel/locking/spinlock_debug.c:210
exit_notify kernel/exit.c:673 [inline]
do_exit+0xa87/0x25c0 kernel/exit.c:852
do_group_exit+0xe7/0x290 kernel/exit.c:929
get_signal+0x3bf/0x1c70 kernel/signal.c:2852
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x465af9
Code: Unable to access opcode bytes at RIP 0x465acf.
RSP: 002b:00007fac1e8be218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 000000000056bf68 RCX: 0000000000465af9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf68
RBP: 000000000056bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf6c
R13: 00007ffefc11db0f R14: 00007fac1e8be300 R15: 0000000000022000
task:syz-executor.0 state:R running task stack:28192 pid: 5664 ppid: 3856 flags:0x00000000
Call Trace:
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0x908/0x26a0 kernel/sched/core.c:6253
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6668
irqentry_exit+0x31/0x80 kernel/entry/common.c:425
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:lock_is_held_type+0xf8/0x130 kernel/locking/lockdep.c:5685
Code: 60 48 cb 88 e8 89 09 00 00 b8 ff ff ff ff 65 0f c1 05 6c 05 a1 77 83 f8 01 75 22 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 <44> 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 45 31 ed eb c0 0f 0b 48
RSP: 0000:ffffc90002ddf6f0 EFLAGS: 00000296
RAX: 0000000000000001 RBX: 0000000000000003 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff88cb4860 RDI: ffffffff891de2a0
RBP: ffffffff8ab69140 R08: 0000000000000001 R09: ffffffff8e423907
R10: fffffbfff1c84720 R11: ffff88807e62c1a0 R12: ffff88807c8eb880
R13: 0000000000000001 R14: 00000000ffffffff R15: ffff88807c8ec2c0
ext4_get_group_desc+0x132/0x3e0 fs/ext4/balloc.c:284
__ext4_get_inode_loc+0x197/0x11c0 fs/ext4/inode.c:4403
ext4_get_inode_loc fs/ext4/inode.c:4544 [inline]
ext4_reserve_inode_write+0x13c/0x340 fs/ext4/inode.c:5713
__ext4_mark_inode_dirty+0x142/0x6e0 fs/ext4/inode.c:5882
ext4_dirty_inode+0xba/0x100 fs/ext4/inode.c:5919
__mark_inode_dirty+0x2bc/0xb00 fs/fs-writeback.c:2399
generic_update_time+0x18e/0x300 fs/inode.c:1782
inode_update_time fs/inode.c:1795 [inline]
file_update_time+0x32e/0x420 fs/inode.c:2012
ext4_page_mkwrite+0x282/0x14a0 fs/ext4/inode.c:6037
do_page_mkwrite+0x186/0x410 mm/memory.c:2856
do_shared_fault mm/memory.c:4229 [inline]
do_fault mm/memory.c:4297 [inline]
handle_pte_fault mm/memory.c:4551 [inline]
__handle_mm_fault+0x1aae/0x3f20 mm/memory.c:4686
handle_mm_fault+0x21d/0x780 mm/memory.c:4784
do_user_addr_fault+0x2da/0xcd0 arch/x86/mm/fault.c:1397
handle_page_fault arch/x86/mm/fault.c:1485 [inline]
exc_page_fault+0x5a/0xc0 arch/x86/mm/fault.c:1541
asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x411970
RSP: 002b:00007ffcf4238f90 EFLAGS: 00010206
RAX: 0000001b2c820000 RBX: 0000000000000003 RCX: 0000000000418e0b
RDX: ffffffffffffffbc RSI: 00007ffcf4238d50 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffcf4238bd0
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000001 R15: 00007ffcf4239210
rcu: rcu_preempt kthread starved for 10502 jiffies! g10213 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:29144 pid: 13 ppid: 2 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0x908/0x26a0 kernel/sched/core.c:6253
schedule+0xd2/0x260 kernel/sched/core.c:6326
schedule_timeout+0x11d/0x250 kernel/time/timer.c:1881
rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1955
rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2128
kthread+0x3ab/0x480 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 0
CPU: 0 PID: 5662 Comm: syz-executor.2 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x45/0x59 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x30/0xac lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x11f/0x170 lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_check_gp_kthread_starvation.cold+0x1fb/0x200 kernel/rcu/tree_stall.h:481
print_other_cpu_stall kernel/rcu/tree_stall.h:586 [inline]
check_cpu_stall kernel/rcu/tree_stall.h:729 [inline]
rcu_pending kernel/rcu/tree.c:3878 [inline]
rcu_sched_clock_irq+0x21a0/0x2200 kernel/rcu/tree.c:2597
update_process_times+0x13b/0x1c0 kernel/time/timer.c:1785
tick_sched_handle+0x6f/0x130 kernel/time/tick-sched.c:226
tick_sched_timer+0x132/0x210 kernel/time/tick-sched.c:1428
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x19e/0xba0 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x2f5/0x780 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
__sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:91 [inline]
RIP: 0010:lock_is_held_type+0x42/0x130 kernel/locking/lockdep.c:5673
Code: 09 04 85 c9 0f 84 d2 00 00 00 65 8b 05 27 06 a1 77 85 c0 0f 85 c3 00 00 00 65 4c 8b 24 25 40 70 02 00 41 8b 94 24 c4 09 00 00 <85> d2 0f 85 aa 00 00 00 48 89 fd 41 89 f6 9c 8f 04 24 fa 48 c7 c7
RSP: 0018:ffffc90000007828 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffffff8ab69080
RBP: ffff888071fb4c90 R08: 0000000000000000 R09: ffffffff8c6ab0d7
R10: fffffbfff18d561a R11: 0000000000000000 R12: ffff88807e68b880
R13: 00000000ffffffff R14: ffffffff89d80244 R15: 0000000000000008
lock_is_held include/linux/lockdep.h:283 [inline]
rcu_read_lock_sched_held+0x3a/0x70 kernel/rcu/update.c:125
trace_cfg80211_return_bool net/wireless/trace.h:2652 [inline]
trace_cfg80211_return_bool net/wireless/trace.h:2652 [inline]
cfg80211_rx_mgmt_khz+0x6be/0x8a0 net/wireless/mlme.c:782
ieee80211_rx_h_userspace_mgmt net/mac80211/rx.c:3599 [inline]
ieee80211_rx_handlers+0x5393/0x9ff0 net/mac80211/rx.c:3939
ieee80211_invoke_rx_handlers net/mac80211/rx.c:3973 [inline]
ieee80211_prepare_and_rx_handle+0x1a6c/0x4d60 net/mac80211/rx.c:4688
__ieee80211_rx_handle_packet net/mac80211/rx.c:4786 [inline]
ieee80211_rx_list+0x7c5/0x2310 net/mac80211/rx.c:4971
ieee80211_rx_napi+0xbb/0x330 net/mac80211/rx.c:4994
ieee80211_rx include/net/mac80211.h:4582 [inline]
ieee80211_tasklet_handler+0xe9/0x100 net/mac80211/main.c:235
tasklet_action_common.constprop.0+0x201/0x2e0 kernel/softirq.c:784
__do_softirq+0x291/0x99e kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:mm_update_next_owner+0x321/0x6d0 kernel/exit.c:428
Code: 4c 09 48 8d b5 80 fb ff ff 48 81 fd 80 b5 8b 8a 75 39 e9 67 01 00 00 48 8d be 80 04 00 00 48 89 f8 48 c1 e8 03 42 80 3c 28 00 <0f> 85 bb 02 00 00 48 8b ae 80 04 00 00 48 8d b5 80 fb ff ff 48 81
RSP: 0018:ffffc90003007b60 EFLAGS: 00000246
RAX: 1ffff1100f373418 RBX: ffff88807e68be28 RCX: ffffffff815384eb
RDX: fffffbfff1501411 RSI: ffff888079b99c40 RDI: ffff888079b9a0c0
RBP: ffff888017c73610 R08: 0000000000000000 R09: ffff888079b9a110
R10: fffffbfff1501410 R11: 000000000007a08a R12: ffff88807e68b880
R13: dffffc0000000000 R14: ffff88807d665b00 R15: ffff888079b99c40
exit_mm kernel/exit.c:506 [inline]
do_exit+0x9a0/0x25c0 kernel/exit.c:819
do_group_exit+0xe7/0x290 kernel/exit.c:929
get_signal+0x3bf/0x1c70 kernel/signal.c:2852
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x465af9
Code: Unable to access opcode bytes at RIP 0x465acf.
RSP: 002b:00007fac24120188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: 0000000020ffc000 RBX: 000000000056c008 RCX: 0000000000465af9
RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffc000
RBP: 00000000004b0682 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000246 R12: 000000000056c008
R13: 00007ffd2377d56f R14: 00007fac24120300 R15: 0000000000022000
----------------
Code disassembly (best guess), 6 bytes skipped:
0: df 49 01 fisttps 0x1(%rcx)
3: c7 41 83 c6 03 41 0f movl $0xf4103c6,-0x7d(%rcx)
a: b6 07 mov $0x7,%dh
c: 41 38 c6 cmp %al,%r14b
f: 7c 08 jl 0x19
11: 84 c0 test %al,%al
13: 0f 85 3e 01 00 00 jne 0x157
19: 8b 03 mov (%rbx),%eax
1b: 3d 00 01 00 00 cmp $0x100,%eax
20: 74 19 je 0x3b
22: f3 90 pause
* 24: 41 0f b6 07 movzbl (%r15),%eax <-- trapping instruction
28: 41 38 c6 cmp %al,%r14b
2b: 7c ec jl 0x19
2d: 84 c0 test %al,%al
2f: 74 e8 je 0x19
31: 48 89 df mov %rbx,%rdi
34: e8 54 54 54 00 callq 0x54548d
39: eb .byte 0xeb