INFO: rcu detected stall in corrupted

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 35766839 Linux 4.19.103
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11b842e6e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=84f14e7b6cbc7d27
dashboard link: https://syzkaller.appspot.com/bug?extid=4bea9151b23acf20355a
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=146797a5e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4bea91...@syzkaller.appspotmail.com

audit: type=1804 audit(1581566213.140:3474): pid=13449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir089983765/syzkaller.ghx5sk/114/bus" dev="sda1" ino=16964 res=1
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: (detected by 0, t=10502 jiffies, g=26917, q=551)
rcu: INFO: Stall ended before state dump start
audit: type=1804 audit(1581566213.240:3475): pid=13457 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir111663019/syzkaller.m8NAVj/118/bus" dev="sda1" ino=16520 res=1
audit: type=1804 audit(1581566213.240:3476): pid=13452 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir399405326/syzkaller.TU5WKk/116/bus" dev="sda1" ino=16519 res=1
audit: type=1804 audit(1581566213.300:3477): pid=13460 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir845827440/syzkaller.HPQnjl/114/bus" dev="sda1" ino=16975 res=1
audit: type=1804 audit(1581566213.370:3478): pid=13458 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir437940751/syzkaller.z9m7Yk/117/bus" dev="sda1" ino=16971 res=1
audit: type=1804 audit(1581566215.410:3479): pid=13453 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir392182818/syzkaller.zUaiXn/111/bus" dev="sda1" ino=16970 res=1
syz-executor.3 (8182) used greatest stack depth: 22720 bytes left
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
chnl_net:caif_netlink_parms(): no params data found
chnl_net:caif_netlink_parms(): no params data found
chnl_net:caif_netlink_parms(): no params data found
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered disabled state
device bridge_slave_0 entered promiscuous mode
chnl_net:caif_netlink_parms(): no params data found
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_1 entered promiscuous mode
chnl_net:caif_netlink_parms(): no params data found
chnl_net:caif_netlink_parms(): no params data found
bond0: Enslaving bond_slave_0 as an active interface with an up link
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
device bridge_slave_1 left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_0 left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
device veth1_macvtap left promiscuous mode
device veth0_macvtap left promiscuous mode
device veth1_vlan left promiscuous mode
device veth0_vlan left promiscuous mode


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10a0f4ffb00000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=4bea9151b23acf20355a
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1517825bb00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1716bbdfb00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4bea91...@syzkaller.appspotmail.com

[ 8125] 0 8125 4423 527 49152 0 1000 syz-executor046
[ 8126] 0 8126 4423 527 49152 0 1000 syz-executor046
[ 8127] 0 8127 4423 527 49152 0 1000 syz-executor046

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:

rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P9524
rcu: (detected by 0, t=10503 jiffies, g=5025, q=2)
syz-executor046 R running task 26800 9524 8347 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2828 [inline]
__schedule+0x887/0x2040 kernel/sched/core.c:3517
preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:3641
___preempt_schedule+0x16/0x18
__raw_spin_unlock include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock+0x3b/0x40 kernel/locking/spinlock.c:176
spin_unlock include/linux/spinlock.h:369 [inline]
task_unlock include/linux/sched/task.h:152 [inline]
dump_tasks mm/oom_kill.c:428 [inline]
dump_header+0xb92/0xc3f mm/oom_kill.c:452
oom_kill_process.cold+0x10/0x692 mm/oom_kill.c:956
out_of_memory mm/oom_kill.c:1132 [inline]
out_of_memory+0x34d/0x1390 mm/oom_kill.c:1064
__alloc_pages_may_oom mm/page_alloc.c:3553 [inline]
__alloc_pages_slowpath mm/page_alloc.c:4255 [inline]
__alloc_pages_nodemask+0x23a2/0x2890 mm/page_alloc.c:4419
__alloc_pages include/linux/gfp.h:496 [inline]
__alloc_pages_node include/linux/gfp.h:509 [inline]
kmem_getpages mm/slab.c:1412 [inline]
cache_grow_begin+0xa4/0x8a0 mm/slab.c:2682
fallback_alloc+0x213/0x2e0 mm/slab.c:3224
__do_cache_alloc mm/slab.c:3361 [inline]
slab_alloc mm/slab.c:3389 [inline]
kmem_cache_alloc+0x1e4/0x370 mm/slab.c:3557
anon_vma_chain_alloc mm/rmap.c:129 [inline]
anon_vma_clone+0x32d/0x5e0 mm/rmap.c:273
anon_vma_fork+0x82/0x630 mm/rmap.c:332
dup_mmap kernel/fork.c:504 [inline]
dup_mm kernel/fork.c:1285 [inline]
copy_mm kernel/fork.c:1341 [inline]
copy_process.part.0+0x360f/0x8260 kernel/fork.c:1913
copy_process kernel/fork.c:1710 [inline]
_do_fork+0x22f/0xf30 kernel/fork.c:2219
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f13005389b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f13004ea1f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f13005c03e8 RCX: 00007f13005389b9
RDX: 0000000000000000 RSI: 00000000200012c0 RDI: 0000000000020400
RBP: 00007f13005c03e0 R08: 0000000000000000 R09: 0000000e00000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13005c03ec
R13: 00007ffcc678538f R14: 00007f13004ea300 R15: 0000000000022000
syz-executor046 R running task 26800 9524 8347 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2828 [inline]
__schedule+0x887/0x2040 kernel/sched/core.c:3517
preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:3641
___preempt_schedule+0x16/0x18
__raw_spin_unlock include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock+0x3b/0x40 kernel/locking/spinlock.c:176
spin_unlock include/linux/spinlock.h:369 [inline]
task_unlock include/linux/sched/task.h:152 [inline]
dump_tasks mm/oom_kill.c:428 [inline]
dump_header+0xb92/0xc3f mm/oom_kill.c:452
oom_kill_process.cold+0x10/0x692 mm/oom_kill.c:956
out_of_memory mm/oom_kill.c:1132 [inline]
out_of_memory+0x34d/0x1390 mm/oom_kill.c:1064
__alloc_pages_may_oom mm/page_alloc.c:3553 [inline]
__alloc_pages_slowpath mm/page_alloc.c:4255 [inline]
__alloc_pages_nodemask+0x23a2/0x2890 mm/page_alloc.c:4419
__alloc_pages include/linux/gfp.h:496 [inline]
__alloc_pages_node include/linux/gfp.h:509 [inline]
kmem_getpages mm/slab.c:1412 [inline]
cache_grow_begin+0xa4/0x8a0 mm/slab.c:2682
fallback_alloc+0x213/0x2e0 mm/slab.c:3224
__do_cache_alloc mm/slab.c:3361 [inline]
slab_alloc mm/slab.c:3389 [inline]
kmem_cache_alloc+0x1e4/0x370 mm/slab.c:3557
anon_vma_chain_alloc mm/rmap.c:129 [inline]
anon_vma_clone+0x32d/0x5e0 mm/rmap.c:273
anon_vma_fork+0x82/0x630 mm/rmap.c:332
dup_mmap kernel/fork.c:504 [inline]
dup_mm kernel/fork.c:1285 [inline]
copy_mm kernel/fork.c:1341 [inline]
copy_process.part.0+0x360f/0x8260 kernel/fork.c:1913
copy_process kernel/fork.c:1710 [inline]
_do_fork+0x22f/0xf30 kernel/fork.c:2219
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f13005389b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f13004ea1f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f13005c03e8 RCX: 00007f13005389b9
RDX: 0000000000000000 RSI: 00000000200012c0 RDI: 0000000000020400
RBP: 00007f13005c03e0 R08: 0000000000000000 R09: 0000000e00000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13005c03ec
R13: 00007ffcc678538f R14: 00007f13004ea300 R15: 0000000000022000
[ 8128] 0 8128 4423 527 49152 0 1000 syz-executor046