[syzbot] [mm?] INFO: rcu detected stall in newfstat (4)
0 views
Skip to first unread message
syzbot
1:54 PM (1 hour ago) 1:54 PM
to ak...@linux-foundation.org, brendan...@linux.dev, han...@cmpxchg.org, linux-...@vger.kernel.org, linu...@kvack.org, mho...@suse.com, sur...@google.com, syzkall...@googlegroups.com, vba...@kernel.org, z...@nvidia.com
Hello,
syzbot found the following issue on:
HEAD commit: b88c841d1164 Merge tag 'input-for-v7.3-rc6' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=146d540d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=129d675874dbf896
dashboard link: https://syzkaller.appspot.com/bug?extid=04923483cd73f0f718e7
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/79043a1c3fab/disk-b88c841d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ce311933da44/vmlinux-b88c841d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ac3d65b82833/bzImage-b88c841d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+049234...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5590/3:b..l P4962/1:b..l P5806/1:b..l P5600/1:b..l P5601/1:b..l
rcu: (detected by 1, t=10852 jiffies, g=12029, q=787 ncpus=2)
task:syz-executor state:R running task stack:21760 pid:5601 tgid:5601 ppid:5599 task_flags:0x400140 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:7606
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x205/0xa10 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:kasan_byte_accessible+0x18/0x30 mm/kasan/generic.c:212
Code: 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 0f b6 07 <3c> 07 0f 96 c0 e9 8e 24 57 09 66 66 2e 0f 1f 84 00 00 00 00 00 0f
RSP: 0018:ffffc900031e75a0 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff81b9b261 RDI: fffffbfff1fbd8b4
RBP: ffffffff8fdec5a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000200 R11: 0000000000018b70 R12: ffffffff81b9b261
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
__kasan_check_byte+0x13/0x50 mm/kasan/common.c:584
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire kernel/locking/lockdep.c:5916 [inline]
lock_acquire+0x132/0x380 kernel/locking/lockdep.c:5899
rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:183
__reset_page_owner+0x84/0x190 mm/page_owner.c:338
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4683 [inline]
slab_alloc_node mm/slub.c:4996 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_noprof+0x2cc/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
tomoyo_realpath_from_path+0xb6/0x690 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x276/0x460 security/tomoyo/file.c:827
security_inode_getattr+0x116/0x280 security/security.c:1895
vfs_getattr fs/stat.c:259 [inline]
vfs_fstat+0x4b/0xe0 fs/stat.c:281
__do_sys_newfstat+0x8b/0x110 fs/stat.c:551
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5c9b79c7e7
RSP: 002b:00007ffe84674818 EFLAGS: 00000206 ORIG_RAX: 0000000000000005
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5c9b79c7e7
RDX: 0000000000000000 RSI: 00007ffe84674820 RDI: 0000000000000003
RBP: 00007ffe8467491c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000012253 R15: 00007ffe84674970
</TASK>
task:syz-executor state:R running task stack:23240 pid:5600 tgid:5600 ppid:5596 task_flags:0x400140 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:7606
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x205/0xa10 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5947
Code: 05 cf 2e a6 13 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 de f7 5d 10 0f 82 c9 02 00 00 8b 35 7e 29 5e 10 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 6d 2e a6 13 0f 85 09 03 00 00 48 83 c4
RSP: 0018:ffffc90003baf918 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000200
RDX: 0000000000000000 RSI: ffffffff8e3bd310 RDI: ffffffff8c625580
RBP: ffffffff8fdec5a0 R08: 000000004fbfa448 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:183
__reset_page_owner+0x84/0x190 mm/page_owner.c:338
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4683 [inline]
slab_alloc_node mm/slub.c:4996 [inline]
kmem_cache_alloc_noprof+0x269/0x6a0 mm/slub.c:5010
alloc_filename fs/namei.c:147 [inline]
do_getname+0x35/0x390 fs/namei.c:187
getname_flags fs/namei.c:230 [inline]
class_filename_flags_constructor include/linux/fs.h:2589 [inline]
user_path_at+0x26/0x60 fs/namei.c:3669
do_mount fs/namespace.c:4322 [inline]
__do_sys_mount fs/namespace.c:4543 [inline]
__se_sys_mount fs/namespace.c:4520 [inline]
__x64_sys_mount+0x1fb/0x310 fs/namespace.c:4520
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe36f99f44a
RSP: 002b:00007ffdfc81cdd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fe36fa35586 RCX: 00007fe36f99f44a
RDX: 00007fe36fa3558b RSI: 00007fe36fa35586 RDI: 00007fe36fa3558b
RBP: 00007fe36fa35500 R08: 0000000000000000 R09: 00007fe36fc267b8
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe36fa09668
R13: 00007fe36fa09640 R14: 00007ffdfc81d048 R15: 0000000000000000
</TASK>
task:dhcpcd state:R running task stack:27064 pid:5806 tgid:5806 ppid:5268 task_flags:0x400140 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_notrace+0x57/0xd0 kernel/sched/core.c:7556
preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13
rcu_is_watching+0x90/0xc0 kernel/rcu/tree.c:754
trace_lock_release include/trace/events/lock.h:68 [inline]
lock_release+0x24d/0x310 kernel/locking/lockdep.c:5954
rcu_lock_release include/linux/rcupdate.h:319 [inline]
rcu_read_unlock include/linux/rcupdate.h:880 [inline]
class_rcu_destructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0x3c3/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:183
__reset_page_owner+0x84/0x190 mm/page_owner.c:338
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4683 [inline]
slab_alloc_node mm/slub.c:4996 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_node_track_caller_noprof+0x2da/0x870 mm/slub.c:5545
kmalloc_reserve+0xe8/0x350 net/core/skbuff.c:637
__alloc_skb+0x185/0x710 net/core/skbuff.c:715
alloc_skb include/linux/skbuff.h:1384 [inline]
alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6803
sock_alloc_send_pskb+0x801/0x980 net/core/sock.c:3022
unix_dgram_sendmsg+0x3c7/0x1810 net/unix/af_unix.c:2144
unix_seqpacket_sendmsg+0x12a/0x1d0 net/unix/af_unix.c:2545
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:815 [inline]
sock_write_iter+0x53a/0x5b0 net/socket.c:1266
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x1f8/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4487f58407
RSP: 002b:00007ffdf70f6870 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4487ece780 RCX: 00007f4487f58407
RDX: 000000000000002a RSI: 00007ffdf70f68d0 RDI: 0000000000000005
RBP: 0000561ab88aa301 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffdf70f6d00
R13: 0000000000000016 R14: 00007ffdf70f7230 R15: 00007ffdf70f6de0
</TASK>
task:klogd state:R running task stack:25960 pid:4962 tgid:4962 ppid:1 task_flags:0x400100 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:7606
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x205/0xa10 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5947
Code: 05 cf 2e a6 13 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 de f7 5d 10 0f 82 c9 02 00 00 8b 35 7e 29 5e 10 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 6d 2e a6 13 0f 85 09 03 00 00 48 83 c4
RSP: 0018:ffffc9000385f440 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000200
RDX: 0000000000000000 RSI: ffffffff8e3bd310 RDI: ffffffff8c625580
RBP: ffffffff8fdec5a0 R08: 000000004fbfa448 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:183
__reset_page_owner+0x84/0x190 mm/page_owner.c:338
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_kmalloc+0x8a/0xb0 mm/kasan/common.c:417
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_node_track_caller_noprof+0x33d/0x870 mm/slub.c:5545
kmalloc_reserve+0xe8/0x350 net/core/skbuff.c:637
__alloc_skb+0x185/0x710 net/core/skbuff.c:715
alloc_skb include/linux/skbuff.h:1384 [inline]
alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6803
sock_alloc_send_pskb+0x801/0x980 net/core/sock.c:3022
unix_dgram_sendmsg+0x3c7/0x1810 net/unix/af_unix.c:2144
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:815 [inline]
__sys_sendto+0x48b/0x4e0 net/socket.c:2281
__do_sys_sendto net/socket.c:2288 [inline]
__se_sys_sendto net/socket.c:2284 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2284
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcefc3ab407
RSP: 002b:00007ffe305ea720 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fcefc25bc80 RCX: 00007fcefc3ab407
RDX: 00000000000000a1 RSI: 00007ffe305ea860 RDI: 0000000000000003
RBP: 00007ffe305eac90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffe305eaca8
R13: 00007ffe305ea860 R14: 0000000000000086 R15: 00007ffe305ea860
</TASK>
task:syz-executor state:R running task stack:22616 pid:5590 tgid:5590 ppid:5589 task_flags:0x400100 flags:0x00080800
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_common+0x3c/0xb0 kernel/sched/core.c:7463
preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
__local_bh_enable_ip+0x106/0x120 kernel/softirq.c:480
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
__dev_queue_xmit+0xa75/0x4a40 net/core/dev.c:4993
dev_queue_xmit include/linux/netdevice.h:3464 [inline]
neigh_resolve_output net/core/neighbour.c:1616 [inline]
neigh_resolve_output+0x51f/0x8f0 net/core/neighbour.c:1596
neigh_output include/net/neighbour.h:560 [inline]
ip_finish_output2+0x851/0x2400 net/ipv4/ip_output.c:236
__ip_finish_output.part.0+0x444/0x6f0 net/ipv4/ip_output.c:314
__ip_finish_output net/ipv4/ip_output.c:302 [inline]
ip_finish_output net/ipv4/ip_output.c:324 [inline]
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip_output+0x39b/0xc10 net/ipv4/ip_output.c:437
dst_output include/net/dst.h:471 [inline]
ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131
__ip_queue_xmit+0x885/0x1f40 net/ipv4/ip_output.c:533
__tcp_transmit_skb+0x3503/0x4f40 net/ipv4/tcp_output.c:1716
tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline]
tcp_write_xmit+0x1130/0x8470 net/ipv4/tcp_output.c:3062
tcp_sendmsg_locked+0x2c02/0x4420 net/ipv4/tcp.c:1394
tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1451
inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:865
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:815 [inline]
sock_write_iter+0x4ea/0x5b0 net/socket.c:1266
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x1f8/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4dac559357
RSP: 002b:00007ffd050a5c90 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555560ecd540 RCX: 00007f4dac559357
RDX: 0000000000049be8 RSI: 00007f4da97b6418 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000049be8
R13: 0000555560ee1ed0 R14: 00007ffd050a6270 R15: 00007f4da97b6418
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: b88c841d1164 Merge tag 'input-for-v7.3-rc6' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=146d540d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=129d675874dbf896
dashboard link: https://syzkaller.appspot.com/bug?extid=04923483cd73f0f718e7
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/79043a1c3fab/disk-b88c841d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ce311933da44/vmlinux-b88c841d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ac3d65b82833/bzImage-b88c841d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+049234...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5590/3:b..l P4962/1:b..l P5806/1:b..l P5600/1:b..l P5601/1:b..l
rcu: (detected by 1, t=10852 jiffies, g=12029, q=787 ncpus=2)
task:syz-executor state:R running task stack:21760 pid:5601 tgid:5601 ppid:5599 task_flags:0x400140 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:7606
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x205/0xa10 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:kasan_byte_accessible+0x18/0x30 mm/kasan/generic.c:212
Code: 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 0f b6 07 <3c> 07 0f 96 c0 e9 8e 24 57 09 66 66 2e 0f 1f 84 00 00 00 00 00 0f
RSP: 0018:ffffc900031e75a0 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff81b9b261 RDI: fffffbfff1fbd8b4
RBP: ffffffff8fdec5a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000200 R11: 0000000000018b70 R12: ffffffff81b9b261
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
__kasan_check_byte+0x13/0x50 mm/kasan/common.c:584
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire kernel/locking/lockdep.c:5916 [inline]
lock_acquire+0x132/0x380 kernel/locking/lockdep.c:5899
rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:183
__reset_page_owner+0x84/0x190 mm/page_owner.c:338
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4683 [inline]
slab_alloc_node mm/slub.c:4996 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_noprof+0x2cc/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
tomoyo_realpath_from_path+0xb6/0x690 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x276/0x460 security/tomoyo/file.c:827
security_inode_getattr+0x116/0x280 security/security.c:1895
vfs_getattr fs/stat.c:259 [inline]
vfs_fstat+0x4b/0xe0 fs/stat.c:281
__do_sys_newfstat+0x8b/0x110 fs/stat.c:551
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5c9b79c7e7
RSP: 002b:00007ffe84674818 EFLAGS: 00000206 ORIG_RAX: 0000000000000005
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5c9b79c7e7
RDX: 0000000000000000 RSI: 00007ffe84674820 RDI: 0000000000000003
RBP: 00007ffe8467491c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000012253 R15: 00007ffe84674970
</TASK>
task:syz-executor state:R running task stack:23240 pid:5600 tgid:5600 ppid:5596 task_flags:0x400140 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:7606
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x205/0xa10 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5947
Code: 05 cf 2e a6 13 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 de f7 5d 10 0f 82 c9 02 00 00 8b 35 7e 29 5e 10 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 6d 2e a6 13 0f 85 09 03 00 00 48 83 c4
RSP: 0018:ffffc90003baf918 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000200
RDX: 0000000000000000 RSI: ffffffff8e3bd310 RDI: ffffffff8c625580
RBP: ffffffff8fdec5a0 R08: 000000004fbfa448 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:183
__reset_page_owner+0x84/0x190 mm/page_owner.c:338
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4683 [inline]
slab_alloc_node mm/slub.c:4996 [inline]
kmem_cache_alloc_noprof+0x269/0x6a0 mm/slub.c:5010
alloc_filename fs/namei.c:147 [inline]
do_getname+0x35/0x390 fs/namei.c:187
getname_flags fs/namei.c:230 [inline]
class_filename_flags_constructor include/linux/fs.h:2589 [inline]
user_path_at+0x26/0x60 fs/namei.c:3669
do_mount fs/namespace.c:4322 [inline]
__do_sys_mount fs/namespace.c:4543 [inline]
__se_sys_mount fs/namespace.c:4520 [inline]
__x64_sys_mount+0x1fb/0x310 fs/namespace.c:4520
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe36f99f44a
RSP: 002b:00007ffdfc81cdd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fe36fa35586 RCX: 00007fe36f99f44a
RDX: 00007fe36fa3558b RSI: 00007fe36fa35586 RDI: 00007fe36fa3558b
RBP: 00007fe36fa35500 R08: 0000000000000000 R09: 00007fe36fc267b8
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe36fa09668
R13: 00007fe36fa09640 R14: 00007ffdfc81d048 R15: 0000000000000000
</TASK>
task:dhcpcd state:R running task stack:27064 pid:5806 tgid:5806 ppid:5268 task_flags:0x400140 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_notrace+0x57/0xd0 kernel/sched/core.c:7556
preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13
rcu_is_watching+0x90/0xc0 kernel/rcu/tree.c:754
trace_lock_release include/trace/events/lock.h:68 [inline]
lock_release+0x24d/0x310 kernel/locking/lockdep.c:5954
rcu_lock_release include/linux/rcupdate.h:319 [inline]
rcu_read_unlock include/linux/rcupdate.h:880 [inline]
class_rcu_destructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0x3c3/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:183
__reset_page_owner+0x84/0x190 mm/page_owner.c:338
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4683 [inline]
slab_alloc_node mm/slub.c:4996 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_node_track_caller_noprof+0x2da/0x870 mm/slub.c:5545
kmalloc_reserve+0xe8/0x350 net/core/skbuff.c:637
__alloc_skb+0x185/0x710 net/core/skbuff.c:715
alloc_skb include/linux/skbuff.h:1384 [inline]
alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6803
sock_alloc_send_pskb+0x801/0x980 net/core/sock.c:3022
unix_dgram_sendmsg+0x3c7/0x1810 net/unix/af_unix.c:2144
unix_seqpacket_sendmsg+0x12a/0x1d0 net/unix/af_unix.c:2545
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:815 [inline]
sock_write_iter+0x53a/0x5b0 net/socket.c:1266
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x1f8/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4487f58407
RSP: 002b:00007ffdf70f6870 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4487ece780 RCX: 00007f4487f58407
RDX: 000000000000002a RSI: 00007ffdf70f68d0 RDI: 0000000000000005
RBP: 0000561ab88aa301 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffdf70f6d00
R13: 0000000000000016 R14: 00007ffdf70f7230 R15: 00007ffdf70f6de0
</TASK>
task:klogd state:R running task stack:25960 pid:4962 tgid:4962 ppid:1 task_flags:0x400100 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:7606
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x205/0xa10 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5947
Code: 05 cf 2e a6 13 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 de f7 5d 10 0f 82 c9 02 00 00 8b 35 7e 29 5e 10 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 6d 2e a6 13 0f 85 09 03 00 00 48 83 c4
RSP: 0018:ffffc9000385f440 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000200
RDX: 0000000000000000 RSI: ffffffff8e3bd310 RDI: ffffffff8c625580
RBP: ffffffff8fdec5a0 R08: 000000004fbfa448 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:183
__reset_page_owner+0x84/0x190 mm/page_owner.c:338
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_kmalloc+0x8a/0xb0 mm/kasan/common.c:417
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_node_track_caller_noprof+0x33d/0x870 mm/slub.c:5545
kmalloc_reserve+0xe8/0x350 net/core/skbuff.c:637
__alloc_skb+0x185/0x710 net/core/skbuff.c:715
alloc_skb include/linux/skbuff.h:1384 [inline]
alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6803
sock_alloc_send_pskb+0x801/0x980 net/core/sock.c:3022
unix_dgram_sendmsg+0x3c7/0x1810 net/unix/af_unix.c:2144
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:815 [inline]
__sys_sendto+0x48b/0x4e0 net/socket.c:2281
__do_sys_sendto net/socket.c:2288 [inline]
__se_sys_sendto net/socket.c:2284 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2284
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcefc3ab407
RSP: 002b:00007ffe305ea720 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fcefc25bc80 RCX: 00007fcefc3ab407
RDX: 00000000000000a1 RSI: 00007ffe305ea860 RDI: 0000000000000003
RBP: 00007ffe305eac90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffe305eaca8
R13: 00007ffe305ea860 R14: 0000000000000086 R15: 00007ffe305ea860
</TASK>
task:syz-executor state:R running task stack:22616 pid:5590 tgid:5590 ppid:5589 task_flags:0x400100 flags:0x00080800
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7284
preempt_schedule_common+0x3c/0xb0 kernel/sched/core.c:7463
preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
__local_bh_enable_ip+0x106/0x120 kernel/softirq.c:480
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
__dev_queue_xmit+0xa75/0x4a40 net/core/dev.c:4993
dev_queue_xmit include/linux/netdevice.h:3464 [inline]
neigh_resolve_output net/core/neighbour.c:1616 [inline]
neigh_resolve_output+0x51f/0x8f0 net/core/neighbour.c:1596
neigh_output include/net/neighbour.h:560 [inline]
ip_finish_output2+0x851/0x2400 net/ipv4/ip_output.c:236
__ip_finish_output.part.0+0x444/0x6f0 net/ipv4/ip_output.c:314
__ip_finish_output net/ipv4/ip_output.c:302 [inline]
ip_finish_output net/ipv4/ip_output.c:324 [inline]
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip_output+0x39b/0xc10 net/ipv4/ip_output.c:437
dst_output include/net/dst.h:471 [inline]
ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131
__ip_queue_xmit+0x885/0x1f40 net/ipv4/ip_output.c:533
__tcp_transmit_skb+0x3503/0x4f40 net/ipv4/tcp_output.c:1716
tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline]
tcp_write_xmit+0x1130/0x8470 net/ipv4/tcp_output.c:3062
tcp_sendmsg_locked+0x2c02/0x4420 net/ipv4/tcp.c:1394
tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1451
inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:865
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:815 [inline]
sock_write_iter+0x4ea/0x5b0 net/socket.c:1266
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x1f8/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4dac559357
RSP: 002b:00007ffd050a5c90 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555560ecd540 RCX: 00007f4dac559357
RDX: 0000000000049be8 RSI: 00007f4da97b6418 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000049be8
R13: 0000555560ee1ed0 R14: 00007ffd050a6270 R15: 00007f4da97b6418
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages