[v6.1] BUG: soft lockup in fq_pie_timer (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 024f76bca9d0 Linux 6.1.49
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13b0d3eba80000
kernel config: https://syzkaller.appspot.com/x/.config?x=6528d757e35d0c1b
dashboard link: https://syzkaller.appspot.com/bug?extid=34ded2ce3dea42412908
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7576ffcc36ae/disk-024f76bc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a36aca161744/vmlinux-024f76bc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dc5c595ae187/Image-024f76bc.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+34ded2...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [ksoftirqd/1:21]
Modules linked in:
irq event stamp: 5140439
hardirqs last enabled at (5140438): [<ffff80001220974c>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (5140438): [<ffff80001220974c>] _raw_spin_unlock_irq+0x3c/0x90 kernel/locking/spinlock.c:202
hardirqs last disabled at (5140439): [<ffff800012124f2c>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (5140439): [<ffff800012124f2c>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:486
softirqs last enabled at (5107816): [<ffff800008020d74>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last enabled at (5107816): [<ffff800008020d74>] __do_softirq+0xc14/0xea0 kernel/softirq.c:600
softirqs last disabled at (5107821): [<ffff8000081ca4d0>] run_ksoftirqd+0x68/0x258 kernel/softirq.c:934
CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 6.1.49-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : fq_pie_timer+0x1d8/0x41c net/sched/sch_fq_pie.c:388
lr : fq_pie_timer+0x208/0x41c net/sched/sch_fq_pie.c:386
sp : ffff800019f57970
x29: ffff800019f57980 x28: 1fffe0001990255a x27: 000000000000aa51
x26: 00000000004a8344 x25: 1fffe00019902564 x24: dfff800000000000
x23: ffff0000cc812ad0 x22: ffff0000cc812b00 x21: ffff0000cc812b24
x20: ffff0000cc8128f0 x19: ffff0000cc812b50 x18: dfff800000000000
x17: 0000000019ba0d0a x16: ffff8000084f9c5c x15: 0000000000000100
x14: 1ffff00002b160b0 x13: dfff800000000000 x12: ffff7000033eaf14
x11: ff80800010730624 x10: 0000000000000007 x9 : 0000000000000000
x8 : ffff80002d7b6344 x7 : ffff800010730590 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000831cff8
x2 : 0000000000000000 x1 : ffff80002d7b6300 x0 : 0000000000000000
Call trace:
fq_pie_timer+0x1d8/0x41c net/sched/sch_fq_pie.c:388
call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x554/0x718 kernel/time/timer.c:1790
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1803
__do_softirq+0x30c/0xea0 kernel/softirq.c:571
run_ksoftirqd+0x68/0x258 kernel/softirq.c:934
smpboot_thread_fn+0x4b0/0x96c kernel/smpboot.c:164
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 024f76bca9d0 Linux 6.1.49
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=105fd49fa80000

kernel config: https://syzkaller.appspot.com/x/.config?x=6528d757e35d0c1b
dashboard link: https://syzkaller.appspot.com/bug?extid=34ded2ce3dea42412908
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12283fcfa80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7576ffcc36ae/disk-024f76bc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a36aca161744/vmlinux-024f76bc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dc5c595ae187/Image-024f76bc.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+34ded2...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [swapper/1:0]
Modules linked in:
irq event stamp: 1269373
hardirqs last enabled at (1269372): [<ffff80001220974c>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (1269372): [<ffff80001220974c>] _raw_spin_unlock_irq+0x3c/0x90 kernel/locking/spinlock.c:202
hardirqs last disabled at (1269373): [<ffff800012124f2c>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (1269373): [<ffff800012124f2c>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:486
softirqs last enabled at (1213776): [<ffff800008020d74>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last enabled at (1213776): [<ffff800008020d74>] __do_softirq+0xc14/0xea0 kernel/softirq.c:600
softirqs last disabled at (1213795): [<ffff80000802a994>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.1.49-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : __sanitizer_cov_trace_cmp8+0x14/0xa0 kernel/kcov.c:284
lr : pie_calculate_probability+0x520/0x7bc net/sched/sch_pie.c:408
sp : ffff800008017b30
x29: ffff800008017b70 x28: 0000000000000000 x27: 0000000000000000
x26: dfff800000000000 x25: ffff8000287479f0 x24: ffff800028747a0c
x23: 1fffe0001afd6d60 x22: 0000000000000000 x21: 0000000000000000
x20: 1ffff000050e8f3e x19: ffff8000287479d0 x18: 0000000000000140
x17: 0000000000420042 x16: ffff8000084f9edc x15: 0000000000000100
x14: 1ffff00002b160b0 x13: dfff800000000000 x12: ffff700001002f60
x11: ff808000107285fc x10: 0000000000000000 x9 : ffff0000c0a39bc0
x8 : 0000000000000102 x7 : ffff800010730590 x6 : 0000000000000000

x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000831cff8

x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
preempt_count arch/arm64/include/asm/preempt.h:13 [inline]
check_kcov_mode kernel/kcov.c:173 [inline]
write_comp_data kernel/kcov.c:236 [inline]
__sanitizer_cov_trace_cmp8+0x14/0xa0 kernel/kcov.c:284
fq_pie_timer+0x1f0/0x41c net/sched/sch_fq_pie.c:387

call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x554/0x718 kernel/time/timer.c:1790
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1803
__do_softirq+0x30c/0xea0 kernel/softirq.c:571

____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0x28c/0x534 kernel/softirq.c:650
irq_exit_rcu+0x14/0x84 kernel/softirq.c:662
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:577
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0x68/0xdc kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x1e0/0x514 kernel/sched/idle.c:303
cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:400
secondary_start_kernel+0x19c/0x1c4 arch/arm64/kernel/smp.c:265
__secondary_switched+0xb0/0xb4 arch/arm64/kernel/head.S:618


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 4aa6747d9352 Linux 6.1.69
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10fee26ee80000
kernel config: https://syzkaller.appspot.com/x/.config?x=e3efadc69a1b0490

dashboard link: https://syzkaller.appspot.com/bug?extid=34ded2ce3dea42412908
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e0ad76e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1367031ae80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/31c5d5a5223e/disk-4aa6747d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/85c4938c28c7/vmlinux-4aa6747d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0fcb53eb57be/Image-4aa6747d.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+34ded2...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [ksoftirqd/0:15]
Modules linked in:
irq event stamp: 1105791
hardirqs last enabled at (1105790): [<ffff800012225c44>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (1105790): [<ffff800012225c44>] _raw_spin_unlock_irq+0x3c/0x90 kernel/locking/spinlock.c:202
hardirqs last disabled at (1105791): [<ffff800012141594>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (1105791): [<ffff800012141594>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:486
softirqs last enabled at (569192): [<ffff800008020d7c>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last enabled at (569192): [<ffff800008020d7c>] __do_softirq+0xc1c/0xe38 kernel/softirq.c:600
softirqs last disabled at (569197): [<ffff8000081ca478>] run_ksoftirqd+0x68/0x258 kernel/softirq.c:934
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.1.69-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __sanitizer_cov_trace_const_cmp8+0x14/0x90 kernel/kcov.c:312
lr : pie_calculate_probability+0x3e0/0x7bc net/sched/sch_pie.c:374
sp : ffff800019e578c0
x29: ffff800019e57900 x28: fffffff0a3da8872 x27: fffffff0a3da8872
x26: 0000000000000000 x25: ffff0000e8e70630 x24: 1fffe0001d1ce0c6
x23: 1fffe00019c3cb60 x22: ffff0000ce1e5b00 x21: 0000000000000000
x20: 1fffe0001d1ce0c6 x19: 0000000000000000 x18: 0000000000000140
x17: ffff8000083fc1ac x16: ffff8000084fa8cc x15: 0000000000000000
x14: 1ffff00002b040b0 x13: dfff800000000000 x12: ffff7000033caf14
x11: 0000000000ff0100 x10: 0000000000000101 x9 : ffff0000c09ab780
x8 : 00051ea8f5c60d90 x7 : ffff800010700364 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000831ce70
x2 : 0000000000000000 x1 : fffffff0a3da8872 x0 : 0000000000000000

Call trace:
preempt_count arch/arm64/include/asm/preempt.h:13 [inline]
check_kcov_mode kernel/kcov.c:173 [inline]
write_comp_data kernel/kcov.c:236 [inline]

__sanitizer_cov_trace_const_cmp8+0x14/0x90 kernel/kcov.c:311
fq_pie_timer+0x22c/0x540 net/sched/sch_fq_pie.c:391

call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x554/0x718 kernel/time/timer.c:1790
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1803

__do_softirq+0x314/0xe38 kernel/softirq.c:571

run_ksoftirqd+0x68/0x258 kernel/softirq.c:934
smpboot_thread_fn+0x4b0/0x96c kernel/smpboot.c:164
kthread+0x250/0x2d8 kernel/kthread.c:376

ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864