[syzbot] [mm?] INFO: rcu detected stall in kcompactd (2)
15 views
Skip to first unread message
syzbot
May 31, 2024, 11:17:28 PMMay 31
to ak...@linux-foundation.org, linux-...@vger.kernel.org, linu...@kvack.org, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 2bfcfd584ff5 Merge tag 'pmdomain-v6.10-rc1' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15099734980000
kernel config: https://syzkaller.appspot.com/x/.config?x=238430243a58f702
dashboard link: https://syzkaller.appspot.com/bug?extid=54594368fbd5a4f1754a
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ccc672980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17314572980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/261f1cc4b66a/disk-2bfcfd58.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e0a2dd5351d9/vmlinux-2bfcfd58.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dab3ffb1a0d4/bzImage-2bfcfd58.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+545943...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: (detected by 1, t=10502 jiffies, g=9993, q=77 ncpus=2)
rcu: All QSes seen, last rcu_preempt kthread activity 1800 (4294972632-4294970832), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 1800 jiffies! g9993 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27680 pid:17 tgid:17 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6745
preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6924
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
rcu_gp_fqs_loop+0x217/0xb00 kernel/rcu/tree.c:2000
rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2202
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 PID: 34 Comm: kcompactd0 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 26 68 80 f6 48 89 df e8 0e e5 80 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 25 27 72 f6 65 8b 05 b6 86 18 75 85 c0 74 16 5b
RSP: 0018:ffffc90000a18248 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffffffff94ca7948 RCX: 1ffffffff2857134
RDX: 0000000000000000 RSI: ffffffff8b2cade0 RDI: ffffffff8b8fffc0
RBP: 0000000000000286 R08: 0000000000000001 R09: fffffbfff284d670
R10: ffffffff9426b387 R11: 0000000000000002 R12: ffffffff94ca7940
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888059c72800
FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff8f455d78 CR3: 0000000049512000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__debug_check_no_obj_freed lib/debugobjects.c:998 [inline]
debug_check_no_obj_freed+0x328/0x600 lib/debugobjects.c:1019
slab_free_hook mm/slub.c:2162 [inline]
slab_free mm/slub.c:4436 [inline]
kfree+0x284/0x3b0 mm/slub.c:4557
ieee80211_inform_bss+0x76e/0x1140 net/mac80211/scan.c:160
rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
cfg80211_inform_single_bss_data+0x893/0x1f70 net/wireless/scan.c:2277
cfg80211_inform_bss_data+0x205/0x39d0 net/wireless/scan.c:3101
cfg80211_inform_bss_frame_data+0x271/0x7c0 net/wireless/scan.c:3191
ieee80211_bss_info_update+0x311/0xab0 net/mac80211/scan.c:226
ieee80211_scan_rx+0x47c/0xad0 net/mac80211/scan.c:340
__ieee80211_rx_handle_packet net/mac80211/rx.c:5222 [inline]
ieee80211_rx_list+0x1be1/0x2e90 net/mac80211/rx.c:5459
ieee80211_rx_napi+0xdd/0x400 net/mac80211/rx.c:5482
ieee80211_rx include/net/mac80211.h:5093 [inline]
ieee80211_tasklet_handler+0xd6/0x130 net/mac80211/main.c:438
tasklet_action_common.constprop.0+0x24c/0x3e0 kernel/softirq.c:785
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:free_object lib/debugobjects.c:423 [inline]
RIP: 0010:debug_object_free+0x294/0x500 lib/debugobjects.c:866
Code: 4d 89 6c 24 08 48 8b 7c 24 10 48 89 ce 48 b8 00 01 00 00 00 00 ad de 48 89 03 48 83 c0 22 48 89 43 08 e8 ff 6b 61 06 48 89 df <e8> e7 d0 ff ff 0f b6 05 e0 df 3f 10 84 c0 0f 85 13 fe ff ff 8b 05
RSP: 0018:ffffc90000aa7bb0 EFLAGS: 00000286
RAX: 0000000080000000 RBX: ffff88805aa2d070 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff8b2cade0 RDI: ffff88805aa2d070
RBP: ffffc90000aa7ca0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8fe45e57 R11: 0000000000000000 R12: ffff888021d9be00
R13: ffffffff94d302d8 R14: ffffc90000aa7cd0 R15: 1ffff92000154f7a
destroy_timer_on_stack kernel/time/timer.c:866 [inline]
schedule_timeout+0x14f/0x2a0 kernel/time/timer.c:2585
kcompactd+0xad3/0xde0 mm/compaction.c:3199
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 2bfcfd584ff5 Merge tag 'pmdomain-v6.10-rc1' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15099734980000
kernel config: https://syzkaller.appspot.com/x/.config?x=238430243a58f702
dashboard link: https://syzkaller.appspot.com/bug?extid=54594368fbd5a4f1754a
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ccc672980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17314572980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/261f1cc4b66a/disk-2bfcfd58.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e0a2dd5351d9/vmlinux-2bfcfd58.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dab3ffb1a0d4/bzImage-2bfcfd58.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+545943...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: (detected by 1, t=10502 jiffies, g=9993, q=77 ncpus=2)
rcu: All QSes seen, last rcu_preempt kthread activity 1800 (4294972632-4294970832), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 1800 jiffies! g9993 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27680 pid:17 tgid:17 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6745
preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6924
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
rcu_gp_fqs_loop+0x217/0xb00 kernel/rcu/tree.c:2000
rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2202
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 PID: 34 Comm: kcompactd0 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 26 68 80 f6 48 89 df e8 0e e5 80 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 25 27 72 f6 65 8b 05 b6 86 18 75 85 c0 74 16 5b
RSP: 0018:ffffc90000a18248 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffffffff94ca7948 RCX: 1ffffffff2857134
RDX: 0000000000000000 RSI: ffffffff8b2cade0 RDI: ffffffff8b8fffc0
RBP: 0000000000000286 R08: 0000000000000001 R09: fffffbfff284d670
R10: ffffffff9426b387 R11: 0000000000000002 R12: ffffffff94ca7940
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888059c72800
FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff8f455d78 CR3: 0000000049512000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__debug_check_no_obj_freed lib/debugobjects.c:998 [inline]
debug_check_no_obj_freed+0x328/0x600 lib/debugobjects.c:1019
slab_free_hook mm/slub.c:2162 [inline]
slab_free mm/slub.c:4436 [inline]
kfree+0x284/0x3b0 mm/slub.c:4557
ieee80211_inform_bss+0x76e/0x1140 net/mac80211/scan.c:160
rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
cfg80211_inform_single_bss_data+0x893/0x1f70 net/wireless/scan.c:2277
cfg80211_inform_bss_data+0x205/0x39d0 net/wireless/scan.c:3101
cfg80211_inform_bss_frame_data+0x271/0x7c0 net/wireless/scan.c:3191
ieee80211_bss_info_update+0x311/0xab0 net/mac80211/scan.c:226
ieee80211_scan_rx+0x47c/0xad0 net/mac80211/scan.c:340
__ieee80211_rx_handle_packet net/mac80211/rx.c:5222 [inline]
ieee80211_rx_list+0x1be1/0x2e90 net/mac80211/rx.c:5459
ieee80211_rx_napi+0xdd/0x400 net/mac80211/rx.c:5482
ieee80211_rx include/net/mac80211.h:5093 [inline]
ieee80211_tasklet_handler+0xd6/0x130 net/mac80211/main.c:438
tasklet_action_common.constprop.0+0x24c/0x3e0 kernel/softirq.c:785
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:free_object lib/debugobjects.c:423 [inline]
RIP: 0010:debug_object_free+0x294/0x500 lib/debugobjects.c:866
Code: 4d 89 6c 24 08 48 8b 7c 24 10 48 89 ce 48 b8 00 01 00 00 00 00 ad de 48 89 03 48 83 c0 22 48 89 43 08 e8 ff 6b 61 06 48 89 df <e8> e7 d0 ff ff 0f b6 05 e0 df 3f 10 84 c0 0f 85 13 fe ff ff 8b 05
RSP: 0018:ffffc90000aa7bb0 EFLAGS: 00000286
RAX: 0000000080000000 RBX: ffff88805aa2d070 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff8b2cade0 RDI: ffff88805aa2d070
RBP: ffffc90000aa7ca0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8fe45e57 R11: 0000000000000000 R12: ffff888021d9be00
R13: ffffffff94d302d8 R14: ffffc90000aa7cd0 R15: 1ffff92000154f7a
destroy_timer_on_stack kernel/time/timer.c:866 [inline]
schedule_timeout+0x14f/0x2a0 kernel/time/timer.c:2585
kcompactd+0xad3/0xde0 mm/compaction.c:3199
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Hillf Danton
Jun 1, 2024, 3:01:36 AMJun 1
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Fri, 31 May 2024 20:17:26 -0700
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
--- x/net/mac80211/ieee80211_i.h
+++ y/net/mac80211/ieee80211_i.h
@@ -1437,6 +1437,7 @@ struct ieee80211_local {
* queues increases over the limit. */
#define IEEE80211_IRQSAFE_QUEUE_LIMIT 128
struct tasklet_struct tasklet;
+ struct work_struct tlw;
struct sk_buff_head skb_queue;
struct sk_buff_head skb_queue_unreliable;
--- x/net/mac80211/main.c
+++ y/net/mac80211/main.c
@@ -423,9 +423,9 @@ u64 ieee80211_reset_erp_info(struct ieee
BSS_CHANGED_ERP_SLOT;
}
-static void ieee80211_tasklet_handler(struct tasklet_struct *t)
+static void ieee80211_tlw_fn(struct work_struct *w)
{
- struct ieee80211_local *local = from_tasklet(local, t, tasklet);
+ struct ieee80211_local *local = container_of(w, struct ieee80211_local, tlw);
struct sk_buff *skb;
while ((skb = skb_dequeue(&local->skb_queue)) ||
@@ -450,6 +450,13 @@ static void ieee80211_tasklet_handler(st
}
}
+static void ieee80211_tasklet_handler(struct tasklet_struct *t)
+{
+ struct ieee80211_local *local = from_tasklet(local, t, tasklet);
+
+ schedule_work(&local->tlw);
+}
+
static void ieee80211_restart_work(struct work_struct *work)
{
struct ieee80211_local *local =
@@ -989,6 +996,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
tasklet_setup(&local->tasklet, ieee80211_tasklet_handler);
+ INIT_WORK(&local->tlw, ieee80211_tlw_fn);
skb_queue_head_init(&local->skb_queue);
skb_queue_head_init(&local->skb_queue_unreliable);
@@ -1634,6 +1642,7 @@ void ieee80211_unregister_hw(struct ieee
tasklet_kill(&local->tx_pending_tasklet);
tasklet_kill(&local->tasklet);
+ flush_work(&local->tlw);
#ifdef CONFIG_INET
unregister_inetaddr_notifier(&local->ifa_notifier);
--
> syzbot found the following issue on:
>
> HEAD commit: 2bfcfd584ff5 Merge tag 'pmdomain-v6.10-rc1' of git://git.k..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17314572980000
>
> HEAD commit: 2bfcfd584ff5 Merge tag 'pmdomain-v6.10-rc1' of git://git.k..
> git tree: upstream
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
--- x/net/mac80211/ieee80211_i.h
+++ y/net/mac80211/ieee80211_i.h
@@ -1437,6 +1437,7 @@ struct ieee80211_local {
* queues increases over the limit. */
#define IEEE80211_IRQSAFE_QUEUE_LIMIT 128
struct tasklet_struct tasklet;
+ struct work_struct tlw;
struct sk_buff_head skb_queue;
struct sk_buff_head skb_queue_unreliable;
--- x/net/mac80211/main.c
+++ y/net/mac80211/main.c
@@ -423,9 +423,9 @@ u64 ieee80211_reset_erp_info(struct ieee
BSS_CHANGED_ERP_SLOT;
}
-static void ieee80211_tasklet_handler(struct tasklet_struct *t)
+static void ieee80211_tlw_fn(struct work_struct *w)
{
- struct ieee80211_local *local = from_tasklet(local, t, tasklet);
+ struct ieee80211_local *local = container_of(w, struct ieee80211_local, tlw);
struct sk_buff *skb;
while ((skb = skb_dequeue(&local->skb_queue)) ||
@@ -450,6 +450,13 @@ static void ieee80211_tasklet_handler(st
}
}
+static void ieee80211_tasklet_handler(struct tasklet_struct *t)
+{
+ struct ieee80211_local *local = from_tasklet(local, t, tasklet);
+
+ schedule_work(&local->tlw);
+}
+
static void ieee80211_restart_work(struct work_struct *work)
{
struct ieee80211_local *local =
@@ -989,6 +996,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
tasklet_setup(&local->tasklet, ieee80211_tasklet_handler);
+ INIT_WORK(&local->tlw, ieee80211_tlw_fn);
skb_queue_head_init(&local->skb_queue);
skb_queue_head_init(&local->skb_queue_unreliable);
@@ -1634,6 +1642,7 @@ void ieee80211_unregister_hw(struct ieee
tasklet_kill(&local->tx_pending_tasklet);
tasklet_kill(&local->tasklet);
+ flush_work(&local->tlw);
#ifdef CONFIG_INET
unregister_inetaddr_notifier(&local->ifa_notifier);
--
syzbot
Jun 1, 2024, 3:48:06 AMJun 1
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
[ 81.944615][ T5146] bridge0: port 1(bridge_slave_0) entered disabled state
[ 81.951935][ T5146] bridge_slave_0: entered allmulticast mode
[ 81.960430][ T5146] bridge_slave_0: entered promiscuous mode
[ 81.970387][ T5146] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.977775][ T5146] bridge0: port 2(bridge_slave_1) entered disabled state
[ 81.985453][ T5146] bridge_slave_1: entered allmulticast mode
[ 81.992774][ T5146] bridge_slave_1: entered promiscuous mode
[ 82.027267][ T5146] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 82.039373][ T5146] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 82.074403][ T5146] team0: Port device team_slave_0 added
[ 82.083676][ T5146] team0: Port device team_slave_1 added
[ 82.113625][ T5146] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 82.120805][ T5146] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 82.147567][ T5146] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 82.160698][ T5146] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 82.167825][ T5146] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 82.194902][ T5146] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 82.240270][ T5146] hsr_slave_0: entered promiscuous mode
[ 82.246999][ T5146] hsr_slave_1: entered promiscuous mode
[ 82.453879][ T5146] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 82.478824][ T5146] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 82.496604][ T5146] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 82.509657][ T5146] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 82.562091][ T5146] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.569601][ T5146] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 82.578275][ T5146] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.585637][ T5146] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 82.713033][ T5146] 8021q: adding VLAN 0 to HW filter on device bond0
[ 82.744216][ T5140] bridge0: port 1(bridge_slave_0) entered disabled state
[ 82.755171][ T5140] bridge0: port 2(bridge_slave_1) entered disabled state
[ 82.783071][ T5146] 8021q: adding VLAN 0 to HW filter on device team0
[ 82.803680][ T5140] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.811352][ T5140] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 82.838143][ T5140] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.845839][ T5140] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 82.948475][ T29] kauditd_printk_skb: 22 callbacks suppressed
[ 82.948493][ T29] audit: type=1400 audit(1717227990.019:119): avc: denied { sys_module } for pid=5146 comm="syz-executor.0" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[ 83.070363][ T5146] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 83.118313][ T5146] veth0_vlan: entered promiscuous mode
[ 83.131345][ T5146] veth1_vlan: entered promiscuous mode
[ 83.168139][ T5146] veth0_macvtap: entered promiscuous mode
[ 83.178211][ T5146] veth1_macvtap: entered promiscuous mode
[ 83.200264][ T5146] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 83.219446][ T5146] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 83.236833][ T5146] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.247593][ T5146] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.256441][ T5146] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.265850][ T5146] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.450515][ T966] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 83.469211][ T29] audit: type=1400 audit(1717227990.539:120): avc: denied { mounton } for pid=5163 comm="syz-executor.0" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 83.549010][ T966] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 83.624282][ T966] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 83.715583][ T966] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.452113][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.461626][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.515647][ T5140] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.524461][ T5140] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.539120][ T29] audit: type=1400 audit(1717227991.609:121): avc: denied { mounton } for pid=5178 comm="syz-executor.0" path="/dev/binderfs" dev="devtmpfs" ino=2322 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1
[ 84.566088][ T5140] ------------[ cut here ]------------
[ 84.572557][ T5140] WARNING: CPU: 1 PID: 5140 at net/mac80211/rx.c:5345 ieee80211_rx_list+0x14c7/0x2e90
[ 84.582391][ T5140] Modules linked in:
[ 84.586360][ T5140] CPU: 1 PID: 5140 Comm: kworker/1:3 Not tainted 6.10.0-rc1-syzkaller-00267-gcc8ed4d0a848-dirty #0
[ 84.597188][ T5140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 84.607390][ T5140] Workqueue: events ieee80211_tlw_fn
[ 84.612868][ T5140] RIP: 0010:ieee80211_rx_list+0x14c7/0x2e90
[ 84.618825][ T5140] Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ca 19 00 00 8b 53 70 4c 89 ee 48 89 ef e8 a4 da fd ff e9 fa ef ff ff e8 ea 6a 2f f7 90 <0f> 0b 90 e9 15 ec ff ff e8 dc 6a 2f f7 90 0f 0b 90 e9 f3 ef ff ff
[ 84.638882][ T5140] RSP: 0018:ffffc90003307a30 EFLAGS: 00010293
[ 84.645067][ T5140] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8a5e561c
[ 84.653489][ T5140] RDX: ffff88802a5fda00 RSI: ffffffff8a5e6a06 RDI: 0000000000000005
[ 84.661885][ T5140] RBP: ffff88802d9d18c0 R08: 0000000000000005 R09: 0000000000000000
[ 84.670144][ T5140] R10: 0000000000000000 R11: 0000000000000002 R12: ffff88802d9d18c0
[ 84.672636][ T29] audit: type=1400 audit(1717227991.729:122): avc: denied { write } for pid=5077 comm="syz-execprog" path="pipe:[4192]" dev="pipefs" ino=4192 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 84.678546][ T5140] R13: ffff88802d9d1998 R14: 0000000000000000 R15: 0000000000000001
2024/06/01 07:46:31 executed programs: 0
[ 84.709403][ T5140] FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
[ 84.718466][ T5140] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 84.725189][ T5140] CR2: 00007f325e4a8e20 CR3: 000000000d97a000 CR4: 00000000003506f0
[ 84.733402][ T5140] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 84.741553][ T5140] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 84.749611][ T5140] Call Trace:
[ 84.753003][ T5140] <TASK>
[ 84.755955][ T5140] ? show_regs+0x8c/0xa0
[ 84.760242][ T5140] ? __warn+0xe5/0x3c0
[ 84.764453][ T5140] ? ieee80211_rx_list+0x14c7/0x2e90
[ 84.769861][ T5140] ? report_bug+0x3c0/0x580
[ 84.774731][ T5140] ? handle_bug+0x3d/0x70
[ 84.779099][ T5140] ? exc_invalid_op+0x17/0x50
[ 84.783938][ T5140] ? asm_exc_invalid_op+0x1a/0x20
[ 84.789143][ T5140] ? ieee80211_rx_list+0xdc/0x2e90
[ 84.794358][ T5140] ? ieee80211_rx_list+0x14c6/0x2e90
[ 84.799676][ T5140] ? ieee80211_rx_list+0x14c7/0x2e90
[ 84.805045][ T5140] ? hlock_class+0x4e/0x130
[ 84.809592][ T5140] ? __pfx_ieee80211_rx_list+0x10/0x10
[ 84.815396][ T5140] ? __pfx_lock_acquire+0x10/0x10
[ 84.820503][ T5140] ? lock_acquire+0x1b1/0x560
[ 84.825288][ T5140] ? find_held_lock+0x2d/0x110
[ 84.830112][ T5140] ? skb_dequeue+0x126/0x180
[ 84.835291][ T5140] ieee80211_rx_napi+0xdd/0x400
[ 84.840191][ T5140] ? __pfx_ieee80211_rx_napi+0x10/0x10
[ 84.845773][ T5140] ? lockdep_hardirqs_on+0x7c/0x110
[ 84.851025][ T5140] ? _raw_spin_unlock_irqrestore+0x3b/0x80
[ 84.857042][ T5140] ieee80211_tlw_fn+0xd6/0x130
[ 84.862090][ T5140] process_one_work+0x9fb/0x1b60
[ 84.867157][ T5140] ? __pfx_mld_ifc_work+0x10/0x10
[ 84.872489][ T5140] ? __pfx_process_one_work+0x10/0x10
[ 84.878201][ T5140] ? assign_work+0x1a0/0x250
[ 84.882986][ T5140] worker_thread+0x6c8/0xf70
[ 84.887707][ T5140] ? __kthread_parkme+0x148/0x220
[ 84.892921][ T5140] ? __pfx_worker_thread+0x10/0x10
[ 84.894637][ T5125] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 84.898054][ T5140] kthread+0x2c1/0x3a0
[ 84.909279][ T5140] ? _raw_spin_unlock_irq+0x23/0x50
[ 84.912900][ T5125] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 84.914681][ T5140] ? __pfx_kthread+0x10/0x10
[ 84.924978][ T5125] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 84.926794][ T5140] ret_from_fork+0x45/0x80
[ 84.935683][ T5125] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 84.938755][ T5140] ? __pfx_kthread+0x10/0x10
[ 84.946745][ T5125] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 84.950428][ T5140] ret_from_fork_asm+0x1a/0x30
[ 84.957954][ T5125] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 84.962370][ T5140] </TASK>
[ 84.972986][ T5140] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 84.980459][ T5140] CPU: 1 PID: 5140 Comm: kworker/1:3 Not tainted 6.10.0-rc1-syzkaller-00267-gcc8ed4d0a848-dirty #0
[ 84.991319][ T5140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 85.001528][ T5140] Workqueue: events ieee80211_tlw_fn
[ 85.007106][ T5140] Call Trace:
[ 85.010388][ T5140] <TASK>
[ 85.013496][ T5140] dump_stack_lvl+0x3d/0x1f0
[ 85.018103][ T5140] panic+0x6f5/0x7a0
[ 85.022022][ T5140] ? __pfx_panic+0x10/0x10
[ 85.026565][ T5140] ? show_trace_log_lvl+0x363/0x500
[ 85.031964][ T5140] ? check_panic_on_warn+0x1f/0xb0
[ 85.037176][ T5140] ? ieee80211_rx_list+0x14c7/0x2e90
[ 85.042571][ T5140] check_panic_on_warn+0xab/0xb0
[ 85.047700][ T5140] __warn+0xf1/0x3c0
[ 85.051781][ T5140] ? ieee80211_rx_list+0x14c7/0x2e90
[ 85.057169][ T5140] report_bug+0x3c0/0x580
[ 85.061622][ T5140] handle_bug+0x3d/0x70
[ 85.065871][ T5140] exc_invalid_op+0x17/0x50
[ 85.070468][ T5140] asm_exc_invalid_op+0x1a/0x20
[ 85.075450][ T5140] RIP: 0010:ieee80211_rx_list+0x14c7/0x2e90
[ 85.081363][ T5140] Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ca 19 00 00 8b 53 70 4c 89 ee 48 89 ef e8 a4 da fd ff e9 fa ef ff ff e8 ea 6a 2f f7 90 <0f> 0b 90 e9 15 ec ff ff e8 dc 6a 2f f7 90 0f 0b 90 e9 f3 ef ff ff
[ 85.101245][ T5140] RSP: 0018:ffffc90003307a30 EFLAGS: 00010293
[ 85.108038][ T5140] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8a5e561c
[ 85.116881][ T5140] RDX: ffff88802a5fda00 RSI: ffffffff8a5e6a06 RDI: 0000000000000005
[ 85.124862][ T5140] RBP: ffff88802d9d18c0 R08: 0000000000000005 R09: 0000000000000000
[ 85.132941][ T5140] R10: 0000000000000000 R11: 0000000000000002 R12: ffff88802d9d18c0
[ 85.141199][ T5140] R13: ffff88802d9d1998 R14: 0000000000000000 R15: 0000000000000001
[ 85.149190][ T5140] ? ieee80211_rx_list+0xdc/0x2e90
[ 85.154513][ T5140] ? ieee80211_rx_list+0x14c6/0x2e90
[ 85.159919][ T5140] ? hlock_class+0x4e/0x130
[ 85.164547][ T5140] ? __pfx_ieee80211_rx_list+0x10/0x10
[ 85.170107][ T5140] ? __pfx_lock_acquire+0x10/0x10
[ 85.175318][ T5140] ? lock_acquire+0x1b1/0x560
[ 85.180027][ T5140] ? find_held_lock+0x2d/0x110
[ 85.184947][ T5140] ? skb_dequeue+0x126/0x180
[ 85.189673][ T5140] ieee80211_rx_napi+0xdd/0x400
[ 85.194554][ T5140] ? __pfx_ieee80211_rx_napi+0x10/0x10
[ 85.200441][ T5140] ? lockdep_hardirqs_on+0x7c/0x110
[ 85.205754][ T5140] ? _raw_spin_unlock_irqrestore+0x3b/0x80
[ 85.211578][ T5140] ieee80211_tlw_fn+0xd6/0x130
[ 85.216362][ T5140] process_one_work+0x9fb/0x1b60
[ 85.221362][ T5140] ? __pfx_mld_ifc_work+0x10/0x10
[ 85.226489][ T5140] ? __pfx_process_one_work+0x10/0x10
[ 85.231972][ T5140] ? assign_work+0x1a0/0x250
[ 85.236874][ T5140] worker_thread+0x6c8/0xf70
[ 85.241562][ T5140] ? __kthread_parkme+0x148/0x220
[ 85.246604][ T5140] ? __pfx_worker_thread+0x10/0x10
[ 85.251718][ T5140] kthread+0x2c1/0x3a0
[ 85.255815][ T5140] ? _raw_spin_unlock_irq+0x23/0x50
[ 85.261048][ T5140] ? __pfx_kthread+0x10/0x10
[ 85.265657][ T5140] ret_from_fork+0x45/0x80
[ 85.270174][ T5140] ? __pfx_kthread+0x10/0x10
[ 85.274772][ T5140] ret_from_fork_asm+0x1a/0x30
[ 85.279563][ T5140] </TASK>
[ 85.283148][ T5140] Kernel Offset: disabled
[ 85.287609][ T5140] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3235630346=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at f550015e9
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=f550015e921148a45f14a8ea6ac8fe1ade4907af -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240527-170128'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=f550015e921148a45f14a8ea6ac8fe1ade4907af -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240527-170128'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++14 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"f550015e921148a45f14a8ea6ac8fe1ade4907af\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=14d75314980000
Tested on:
commit: cc8ed4d0 Merge tag 'drm-fixes-2024-06-01' of https://g..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
syzbot tried to test the proposed patch but the build/boot failed:
[ 81.944615][ T5146] bridge0: port 1(bridge_slave_0) entered disabled state
[ 81.951935][ T5146] bridge_slave_0: entered allmulticast mode
[ 81.960430][ T5146] bridge_slave_0: entered promiscuous mode
[ 81.970387][ T5146] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.977775][ T5146] bridge0: port 2(bridge_slave_1) entered disabled state
[ 81.985453][ T5146] bridge_slave_1: entered allmulticast mode
[ 81.992774][ T5146] bridge_slave_1: entered promiscuous mode
[ 82.027267][ T5146] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 82.039373][ T5146] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 82.074403][ T5146] team0: Port device team_slave_0 added
[ 82.083676][ T5146] team0: Port device team_slave_1 added
[ 82.113625][ T5146] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 82.120805][ T5146] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 82.147567][ T5146] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 82.160698][ T5146] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 82.167825][ T5146] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 82.194902][ T5146] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 82.240270][ T5146] hsr_slave_0: entered promiscuous mode
[ 82.246999][ T5146] hsr_slave_1: entered promiscuous mode
[ 82.453879][ T5146] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 82.478824][ T5146] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 82.496604][ T5146] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 82.509657][ T5146] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 82.562091][ T5146] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.569601][ T5146] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 82.578275][ T5146] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.585637][ T5146] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 82.713033][ T5146] 8021q: adding VLAN 0 to HW filter on device bond0
[ 82.744216][ T5140] bridge0: port 1(bridge_slave_0) entered disabled state
[ 82.755171][ T5140] bridge0: port 2(bridge_slave_1) entered disabled state
[ 82.783071][ T5146] 8021q: adding VLAN 0 to HW filter on device team0
[ 82.803680][ T5140] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.811352][ T5140] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 82.838143][ T5140] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.845839][ T5140] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 82.948475][ T29] kauditd_printk_skb: 22 callbacks suppressed
[ 82.948493][ T29] audit: type=1400 audit(1717227990.019:119): avc: denied { sys_module } for pid=5146 comm="syz-executor.0" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[ 83.070363][ T5146] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 83.118313][ T5146] veth0_vlan: entered promiscuous mode
[ 83.131345][ T5146] veth1_vlan: entered promiscuous mode
[ 83.168139][ T5146] veth0_macvtap: entered promiscuous mode
[ 83.178211][ T5146] veth1_macvtap: entered promiscuous mode
[ 83.200264][ T5146] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 83.219446][ T5146] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 83.236833][ T5146] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.247593][ T5146] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.256441][ T5146] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.265850][ T5146] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.450515][ T966] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 83.469211][ T29] audit: type=1400 audit(1717227990.539:120): avc: denied { mounton } for pid=5163 comm="syz-executor.0" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 83.549010][ T966] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 83.624282][ T966] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 83.715583][ T966] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.452113][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.461626][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.515647][ T5140] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.524461][ T5140] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.539120][ T29] audit: type=1400 audit(1717227991.609:121): avc: denied { mounton } for pid=5178 comm="syz-executor.0" path="/dev/binderfs" dev="devtmpfs" ino=2322 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1
[ 84.566088][ T5140] ------------[ cut here ]------------
[ 84.572557][ T5140] WARNING: CPU: 1 PID: 5140 at net/mac80211/rx.c:5345 ieee80211_rx_list+0x14c7/0x2e90
[ 84.582391][ T5140] Modules linked in:
[ 84.586360][ T5140] CPU: 1 PID: 5140 Comm: kworker/1:3 Not tainted 6.10.0-rc1-syzkaller-00267-gcc8ed4d0a848-dirty #0
[ 84.597188][ T5140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 84.607390][ T5140] Workqueue: events ieee80211_tlw_fn
[ 84.612868][ T5140] RIP: 0010:ieee80211_rx_list+0x14c7/0x2e90
[ 84.618825][ T5140] Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ca 19 00 00 8b 53 70 4c 89 ee 48 89 ef e8 a4 da fd ff e9 fa ef ff ff e8 ea 6a 2f f7 90 <0f> 0b 90 e9 15 ec ff ff e8 dc 6a 2f f7 90 0f 0b 90 e9 f3 ef ff ff
[ 84.638882][ T5140] RSP: 0018:ffffc90003307a30 EFLAGS: 00010293
[ 84.645067][ T5140] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8a5e561c
[ 84.653489][ T5140] RDX: ffff88802a5fda00 RSI: ffffffff8a5e6a06 RDI: 0000000000000005
[ 84.661885][ T5140] RBP: ffff88802d9d18c0 R08: 0000000000000005 R09: 0000000000000000
[ 84.670144][ T5140] R10: 0000000000000000 R11: 0000000000000002 R12: ffff88802d9d18c0
[ 84.672636][ T29] audit: type=1400 audit(1717227991.729:122): avc: denied { write } for pid=5077 comm="syz-execprog" path="pipe:[4192]" dev="pipefs" ino=4192 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 84.678546][ T5140] R13: ffff88802d9d1998 R14: 0000000000000000 R15: 0000000000000001
2024/06/01 07:46:31 executed programs: 0
[ 84.709403][ T5140] FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
[ 84.718466][ T5140] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 84.725189][ T5140] CR2: 00007f325e4a8e20 CR3: 000000000d97a000 CR4: 00000000003506f0
[ 84.733402][ T5140] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 84.741553][ T5140] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 84.749611][ T5140] Call Trace:
[ 84.753003][ T5140] <TASK>
[ 84.755955][ T5140] ? show_regs+0x8c/0xa0
[ 84.760242][ T5140] ? __warn+0xe5/0x3c0
[ 84.764453][ T5140] ? ieee80211_rx_list+0x14c7/0x2e90
[ 84.769861][ T5140] ? report_bug+0x3c0/0x580
[ 84.774731][ T5140] ? handle_bug+0x3d/0x70
[ 84.779099][ T5140] ? exc_invalid_op+0x17/0x50
[ 84.783938][ T5140] ? asm_exc_invalid_op+0x1a/0x20
[ 84.789143][ T5140] ? ieee80211_rx_list+0xdc/0x2e90
[ 84.794358][ T5140] ? ieee80211_rx_list+0x14c6/0x2e90
[ 84.799676][ T5140] ? ieee80211_rx_list+0x14c7/0x2e90
[ 84.805045][ T5140] ? hlock_class+0x4e/0x130
[ 84.809592][ T5140] ? __pfx_ieee80211_rx_list+0x10/0x10
[ 84.815396][ T5140] ? __pfx_lock_acquire+0x10/0x10
[ 84.820503][ T5140] ? lock_acquire+0x1b1/0x560
[ 84.825288][ T5140] ? find_held_lock+0x2d/0x110
[ 84.830112][ T5140] ? skb_dequeue+0x126/0x180
[ 84.835291][ T5140] ieee80211_rx_napi+0xdd/0x400
[ 84.840191][ T5140] ? __pfx_ieee80211_rx_napi+0x10/0x10
[ 84.845773][ T5140] ? lockdep_hardirqs_on+0x7c/0x110
[ 84.851025][ T5140] ? _raw_spin_unlock_irqrestore+0x3b/0x80
[ 84.857042][ T5140] ieee80211_tlw_fn+0xd6/0x130
[ 84.862090][ T5140] process_one_work+0x9fb/0x1b60
[ 84.867157][ T5140] ? __pfx_mld_ifc_work+0x10/0x10
[ 84.872489][ T5140] ? __pfx_process_one_work+0x10/0x10
[ 84.878201][ T5140] ? assign_work+0x1a0/0x250
[ 84.882986][ T5140] worker_thread+0x6c8/0xf70
[ 84.887707][ T5140] ? __kthread_parkme+0x148/0x220
[ 84.892921][ T5140] ? __pfx_worker_thread+0x10/0x10
[ 84.894637][ T5125] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 84.898054][ T5140] kthread+0x2c1/0x3a0
[ 84.909279][ T5140] ? _raw_spin_unlock_irq+0x23/0x50
[ 84.912900][ T5125] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 84.914681][ T5140] ? __pfx_kthread+0x10/0x10
[ 84.924978][ T5125] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 84.926794][ T5140] ret_from_fork+0x45/0x80
[ 84.935683][ T5125] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 84.938755][ T5140] ? __pfx_kthread+0x10/0x10
[ 84.946745][ T5125] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 84.950428][ T5140] ret_from_fork_asm+0x1a/0x30
[ 84.957954][ T5125] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 84.962370][ T5140] </TASK>
[ 84.972986][ T5140] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 84.980459][ T5140] CPU: 1 PID: 5140 Comm: kworker/1:3 Not tainted 6.10.0-rc1-syzkaller-00267-gcc8ed4d0a848-dirty #0
[ 84.991319][ T5140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 85.001528][ T5140] Workqueue: events ieee80211_tlw_fn
[ 85.007106][ T5140] Call Trace:
[ 85.010388][ T5140] <TASK>
[ 85.013496][ T5140] dump_stack_lvl+0x3d/0x1f0
[ 85.018103][ T5140] panic+0x6f5/0x7a0
[ 85.022022][ T5140] ? __pfx_panic+0x10/0x10
[ 85.026565][ T5140] ? show_trace_log_lvl+0x363/0x500
[ 85.031964][ T5140] ? check_panic_on_warn+0x1f/0xb0
[ 85.037176][ T5140] ? ieee80211_rx_list+0x14c7/0x2e90
[ 85.042571][ T5140] check_panic_on_warn+0xab/0xb0
[ 85.047700][ T5140] __warn+0xf1/0x3c0
[ 85.051781][ T5140] ? ieee80211_rx_list+0x14c7/0x2e90
[ 85.057169][ T5140] report_bug+0x3c0/0x580
[ 85.061622][ T5140] handle_bug+0x3d/0x70
[ 85.065871][ T5140] exc_invalid_op+0x17/0x50
[ 85.070468][ T5140] asm_exc_invalid_op+0x1a/0x20
[ 85.075450][ T5140] RIP: 0010:ieee80211_rx_list+0x14c7/0x2e90
[ 85.081363][ T5140] Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ca 19 00 00 8b 53 70 4c 89 ee 48 89 ef e8 a4 da fd ff e9 fa ef ff ff e8 ea 6a 2f f7 90 <0f> 0b 90 e9 15 ec ff ff e8 dc 6a 2f f7 90 0f 0b 90 e9 f3 ef ff ff
[ 85.101245][ T5140] RSP: 0018:ffffc90003307a30 EFLAGS: 00010293
[ 85.108038][ T5140] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8a5e561c
[ 85.116881][ T5140] RDX: ffff88802a5fda00 RSI: ffffffff8a5e6a06 RDI: 0000000000000005
[ 85.124862][ T5140] RBP: ffff88802d9d18c0 R08: 0000000000000005 R09: 0000000000000000
[ 85.132941][ T5140] R10: 0000000000000000 R11: 0000000000000002 R12: ffff88802d9d18c0
[ 85.141199][ T5140] R13: ffff88802d9d1998 R14: 0000000000000000 R15: 0000000000000001
[ 85.149190][ T5140] ? ieee80211_rx_list+0xdc/0x2e90
[ 85.154513][ T5140] ? ieee80211_rx_list+0x14c6/0x2e90
[ 85.159919][ T5140] ? hlock_class+0x4e/0x130
[ 85.164547][ T5140] ? __pfx_ieee80211_rx_list+0x10/0x10
[ 85.170107][ T5140] ? __pfx_lock_acquire+0x10/0x10
[ 85.175318][ T5140] ? lock_acquire+0x1b1/0x560
[ 85.180027][ T5140] ? find_held_lock+0x2d/0x110
[ 85.184947][ T5140] ? skb_dequeue+0x126/0x180
[ 85.189673][ T5140] ieee80211_rx_napi+0xdd/0x400
[ 85.194554][ T5140] ? __pfx_ieee80211_rx_napi+0x10/0x10
[ 85.200441][ T5140] ? lockdep_hardirqs_on+0x7c/0x110
[ 85.205754][ T5140] ? _raw_spin_unlock_irqrestore+0x3b/0x80
[ 85.211578][ T5140] ieee80211_tlw_fn+0xd6/0x130
[ 85.216362][ T5140] process_one_work+0x9fb/0x1b60
[ 85.221362][ T5140] ? __pfx_mld_ifc_work+0x10/0x10
[ 85.226489][ T5140] ? __pfx_process_one_work+0x10/0x10
[ 85.231972][ T5140] ? assign_work+0x1a0/0x250
[ 85.236874][ T5140] worker_thread+0x6c8/0xf70
[ 85.241562][ T5140] ? __kthread_parkme+0x148/0x220
[ 85.246604][ T5140] ? __pfx_worker_thread+0x10/0x10
[ 85.251718][ T5140] kthread+0x2c1/0x3a0
[ 85.255815][ T5140] ? _raw_spin_unlock_irq+0x23/0x50
[ 85.261048][ T5140] ? __pfx_kthread+0x10/0x10
[ 85.265657][ T5140] ret_from_fork+0x45/0x80
[ 85.270174][ T5140] ? __pfx_kthread+0x10/0x10
[ 85.274772][ T5140] ret_from_fork_asm+0x1a/0x30
[ 85.279563][ T5140] </TASK>
[ 85.283148][ T5140] Kernel Offset: disabled
[ 85.287609][ T5140] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3235630346=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at f550015e9
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=f550015e921148a45f14a8ea6ac8fe1ade4907af -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240527-170128'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=f550015e921148a45f14a8ea6ac8fe1ade4907af -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240527-170128'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++14 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"f550015e921148a45f14a8ea6ac8fe1ade4907af\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=14d75314980000
Tested on:
commit: cc8ed4d0 Merge tag 'drm-fixes-2024-06-01' of https://g..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=238430243a58f702
dashboard link: https://syzkaller.appspot.com/bug?extid=54594368fbd5a4f1754a
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1428dc16980000
dashboard link: https://syzkaller.appspot.com/bug?extid=54594368fbd5a4f1754a
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Hillf Danton
Jun 1, 2024, 5:07:29 AMJun 1
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Fri, 31 May 2024 20:17:26 -0700
> syzbot found the following issue on:
>
> HEAD commit: 2bfcfd584ff5 Merge tag 'pmdomain-v6.10-rc1' of git://git.k..
> git tree: upstream
>
> HEAD commit: 2bfcfd584ff5 Merge tag 'pmdomain-v6.10-rc1' of git://git.k..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17314572980000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
--- x/net/mac80211/main.c
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
+++ y/net/mac80211/main.c
@@ -427,9 +427,12 @@ static void ieee80211_tasklet_handler(st
{
struct ieee80211_local *local = from_tasklet(local, t, tasklet);
struct sk_buff *skb;
+ unsigned int loop = 0;
while ((skb = skb_dequeue(&local->skb_queue)) ||
+ if (++loop == 64)
+ return;
switch (skb->pkt_type) {
case IEEE80211_RX_MSG:
/* Clear skb->pkt_type in order to not confuse kernel
--
syzbot
Jun 1, 2024, 5:34:05 AMJun 1
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: rcu detected stall in batadv_nc_worker
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P1272/1:b..l
rcu: (detected by 1, t=10502 jiffies, g=17369, q=1047 ncpus=2)
task:kworker/u8:8 state:R running task stack:22656 pid:1272 tgid:1272 ppid:2 flags:0x00004000
Workqueue: bat_events batadv_nc_worker
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x1f2/0x560 kernel/locking/lockdep.c:5722
Code: c1 05 9a bf 96 7e 83 f8 01 0f 85 ea 02 00 00 9c 58 f6 c4 02 0f 85 d5 02 00 00 48 85 ed 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc90004bafaa0 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92000975f56 RCX: 0000000072d6c7e4
RDX: 0000000000000001 RSI: ffffffff8b2cb0e0 RDI: ffffffff8b8ffec0
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff284d658
R10: ffffffff9426b2c7 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff8dbb18e0 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
rcu_read_lock include/linux/rcupdate.h:781 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
batadv_nc_worker+0x16e/0x10f0 net/batman-adv/network-coding.c:719
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
init_timer_on_stack_key kernel/time/timer.c:859 [inline]
schedule_timeout+0x102/0x2a0 kernel/time/timer.c:2579
rcu_gp_fqs_loop+0x1eb/0xb00 kernel/rcu/tree.c:2000
RIP: 0010:preempt_count_sub+0x63/0x160 kernel/sched/core.c:5909
Code: 57 13 85 c9 75 1b 65 8b 05 52 5f a6 7e 89 c2 81 e2 ff ff ff 7f 39 d3 7f 17 81 fb fe 00 00 00 76 71 f7 db 65 01 1d 35 5f a6 7e <5b> c3 cc cc cc cc 90 e8 a1 bd 22 03 85 c0 74 51 48 c7 c0 d4 94 e4
RSP: 0018:ffffc90000a17da8 EFLAGS: 00000293
RAX: 0000000080000303 RBX: 00000000ffffffff RCX: 0000000000000000
RDX: 0000000000000303 RSI: ffffffff813cd885 RDI: 0000000000000001
RBP: ffffc90000a18ea0 R08: 0000000000000006 R09: ffffc90000a18df8
R10: ffffc90000a18ea0 R11: ffff8880b93293d8 R12: ffffc90000a11000
R13: ffffc90000a19000 R14: ffffc90000a18ea8 R15: ffffc90000a18df8
<IRQ>
unwind_next_frame+0x11ef/0x23a0 arch/x86/kernel/unwind_orc.c:672
arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slub.c:4121 [inline]
__kmalloc_noprof+0x1ec/0x410 mm/slub.c:4134
kmalloc_noprof include/linux/slab.h:664 [inline]
kzalloc_noprof include/linux/slab.h:778 [inline]
ieee802_11_parse_elems_full+0xea/0x15d0 net/mac80211/parse.c:880
ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2330 [inline]
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2337 [inline]
ieee80211_inform_bss+0xfd/0x1140 net/mac80211/scan.c:79
Code: 41 55 41 54 49 89 fc 55 48 89 f5 53 48 8b 46 08 48 83 f8 20 74 6b 77 48 48 83 f8 08 74 5b 48 83 f8 10 75 2f 41 bd 03 00 00 00 <4c> 8b 75 00 31 db 4d 85 f6 74 1e 48 8b 74 dd 10 4c 89 e2 4c 89 ef
RSP: 0018:ffffc900015c6ea8 EFLAGS: 00000246
RAX: 0000000000000008 RBX: ffffc900015c6f58 RCX: 0000000000000001
RDX: ffff888017790000 RSI: ffffffff8b29c9c0 RDI: 0000000000000002
RBP: ffffffff8b29c9c0 R08: 0000000000000001 R09: 0000000000000009
R10: 0000000000000005 R11: 0000000000000003 R12: 0000000000000002
R13: 0000000000000001 R14: ffffffff907080da R15: 0000000000000002
unwind_next_frame+0x789/0x23a0 arch/x86/kernel/unwind_orc.c:581
arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slub.c:4121 [inline]
__kmalloc_noprof+0x1ec/0x410 mm/slub.c:4134
kmalloc_noprof include/linux/slab.h:664 [inline]
kzalloc_noprof include/linux/slab.h:778 [inline]
cfg80211_inform_single_bss_data+0x530/0x1f70 net/wireless/scan.c:2249
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1578 [inline]
ieee80211_ibss_rx_queued_mgmt+0x1898/0x2f40 net/mac80211/ibss.c:1605
ieee80211_iface_process_skb net/mac80211/iface.c:1605 [inline]
ieee80211_iface_work+0xc07/0xf00 net/mac80211/iface.c:1659
cfg80211_wiphy_work+0x255/0x330 net/wireless/core.c:437
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: rcu detected stall in batadv_nc_worker
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: (detected by 1, t=10502 jiffies, g=17369, q=1047 ncpus=2)
task:kworker/u8:8 state:R running task stack:22656 pid:1272 tgid:1272 ppid:2 flags:0x00004000
Workqueue: bat_events batadv_nc_worker
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6745
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7067
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6745
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x1f2/0x560 kernel/locking/lockdep.c:5722
Code: c1 05 9a bf 96 7e 83 f8 01 0f 85 ea 02 00 00 9c 58 f6 c4 02 0f 85 d5 02 00 00 48 85 ed 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc90004bafaa0 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92000975f56 RCX: 0000000072d6c7e4
RDX: 0000000000000001 RSI: ffffffff8b2cb0e0 RDI: ffffffff8b8ffec0
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff284d658
R10: ffffffff9426b2c7 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff8dbb18e0 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
rcu_read_lock include/linux/rcupdate.h:781 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
batadv_nc_worker+0x16e/0x10f0 net/batman-adv/network-coding.c:719
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
rcu: rcu_preempt kthread starved for 2809 jiffies! g17369 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27680 pid:17 tgid:17 ppid:2 flags:0x00004000
rcu: RCU grace-period kthread stack dump:
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6745
preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6924
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
__debug_object_init+0x34a/0x480 lib/debugobjects.c:645
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6745
preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6924
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
init_timer_on_stack_key kernel/time/timer.c:859 [inline]
schedule_timeout+0x102/0x2a0 kernel/time/timer.c:2579
rcu_gp_fqs_loop+0x1eb/0xb00 kernel/rcu/tree.c:2000
rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2202
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 PID: 61 Comm: kworker/u8:4 Not tainted 6.10.0-rc1-syzkaller-00267-gcc8ed4d0a848-dirty #0
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:preempt_count_sub+0x63/0x160 kernel/sched/core.c:5909
Code: 57 13 85 c9 75 1b 65 8b 05 52 5f a6 7e 89 c2 81 e2 ff ff ff 7f 39 d3 7f 17 81 fb fe 00 00 00 76 71 f7 db 65 01 1d 35 5f a6 7e <5b> c3 cc cc cc cc 90 e8 a1 bd 22 03 85 c0 74 51 48 c7 c0 d4 94 e4
RSP: 0018:ffffc90000a17da8 EFLAGS: 00000293
RAX: 0000000080000303 RBX: 00000000ffffffff RCX: 0000000000000000
RDX: 0000000000000303 RSI: ffffffff813cd885 RDI: 0000000000000001
RBP: ffffc90000a18ea0 R08: 0000000000000006 R09: ffffc90000a18df8
R10: ffffc90000a18ea0 R11: ffff8880b93293d8 R12: ffffc90000a11000
R13: ffffc90000a19000 R14: ffffc90000a18ea8 R15: ffffc90000a18df8
FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd06bfb0000 CR3: 000000007dec4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
unwind_next_frame+0x11ef/0x23a0 arch/x86/kernel/unwind_orc.c:672
arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slub.c:4121 [inline]
__kmalloc_noprof+0x1ec/0x410 mm/slub.c:4134
kmalloc_noprof include/linux/slab.h:664 [inline]
kzalloc_noprof include/linux/slab.h:778 [inline]
ieee802_11_parse_elems_full+0xea/0x15d0 net/mac80211/parse.c:880
ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2330 [inline]
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2337 [inline]
ieee80211_inform_bss+0xfd/0x1140 net/mac80211/scan.c:79
rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
cfg80211_inform_single_bss_data+0x893/0x1f70 net/wireless/scan.c:2277
cfg80211_inform_bss_data+0x205/0x39d0 net/wireless/scan.c:3101
cfg80211_inform_bss_frame_data+0x271/0x7c0 net/wireless/scan.c:3191
ieee80211_bss_info_update+0x311/0xab0 net/mac80211/scan.c:226
ieee80211_scan_rx+0x47c/0xad0 net/mac80211/scan.c:340
__ieee80211_rx_handle_packet net/mac80211/rx.c:5222 [inline]
ieee80211_rx_list+0x1be1/0x2e90 net/mac80211/rx.c:5459
ieee80211_rx_napi+0xdd/0x400 net/mac80211/rx.c:5482
ieee80211_rx include/net/mac80211.h:5093 [inline]
ieee80211_tasklet_handler+0xee/0x150 net/mac80211/main.c:441
cfg80211_inform_single_bss_data+0x893/0x1f70 net/wireless/scan.c:2277
cfg80211_inform_bss_data+0x205/0x39d0 net/wireless/scan.c:3101
cfg80211_inform_bss_frame_data+0x271/0x7c0 net/wireless/scan.c:3191
ieee80211_bss_info_update+0x311/0xab0 net/mac80211/scan.c:226
ieee80211_scan_rx+0x47c/0xad0 net/mac80211/scan.c:340
__ieee80211_rx_handle_packet net/mac80211/rx.c:5222 [inline]
ieee80211_rx_list+0x1be1/0x2e90 net/mac80211/rx.c:5459
ieee80211_rx_napi+0xdd/0x400 net/mac80211/rx.c:5482
ieee80211_rx include/net/mac80211.h:5093 [inline]
tasklet_action_common.constprop.0+0x24c/0x3e0 kernel/softirq.c:785
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_switch+0x30/0x90 kernel/kcov.c:320
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Code: 41 55 41 54 49 89 fc 55 48 89 f5 53 48 8b 46 08 48 83 f8 20 74 6b 77 48 48 83 f8 08 74 5b 48 83 f8 10 75 2f 41 bd 03 00 00 00 <4c> 8b 75 00 31 db 4d 85 f6 74 1e 48 8b 74 dd 10 4c 89 e2 4c 89 ef
RSP: 0018:ffffc900015c6ea8 EFLAGS: 00000246
RAX: 0000000000000008 RBX: ffffc900015c6f58 RCX: 0000000000000001
RDX: ffff888017790000 RSI: ffffffff8b29c9c0 RDI: 0000000000000002
RBP: ffffffff8b29c9c0 R08: 0000000000000001 R09: 0000000000000009
R10: 0000000000000005 R11: 0000000000000003 R12: 0000000000000002
R13: 0000000000000001 R14: ffffffff907080da R15: 0000000000000002
unwind_next_frame+0x789/0x23a0 arch/x86/kernel/unwind_orc.c:581
arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slub.c:4121 [inline]
__kmalloc_noprof+0x1ec/0x410 mm/slub.c:4134
kmalloc_noprof include/linux/slab.h:664 [inline]
kzalloc_noprof include/linux/slab.h:778 [inline]
cfg80211_inform_single_bss_data+0x530/0x1f70 net/wireless/scan.c:2249
cfg80211_inform_bss_data+0x205/0x39d0 net/wireless/scan.c:3101
cfg80211_inform_bss_frame_data+0x271/0x7c0 net/wireless/scan.c:3191
ieee80211_bss_info_update+0x311/0xab0 net/mac80211/scan.c:226
ieee80211_rx_bss_info net/mac80211/ibss.c:1099 [inline]
cfg80211_inform_bss_frame_data+0x271/0x7c0 net/wireless/scan.c:3191
ieee80211_bss_info_update+0x311/0xab0 net/mac80211/scan.c:226
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1578 [inline]
ieee80211_ibss_rx_queued_mgmt+0x1898/0x2f40 net/mac80211/ibss.c:1605
ieee80211_iface_process_skb net/mac80211/iface.c:1605 [inline]
ieee80211_iface_work+0xc07/0xf00 net/mac80211/iface.c:1659
cfg80211_wiphy_work+0x255/0x330 net/wireless/core.c:437
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Tested on:
commit: cc8ed4d0 Merge tag 'drm-fixes-2024-06-01' of https://g..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1096541c980000
commit: cc8ed4d0 Merge tag 'drm-fixes-2024-06-01' of https://g..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=238430243a58f702
dashboard link: https://syzkaller.appspot.com/bug?extid=54594368fbd5a4f1754a
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=16007026980000
dashboard link: https://syzkaller.appspot.com/bug?extid=54594368fbd5a4f1754a
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Reply all
Reply to author
Forward
0 new messages