INFO: rcu detected stall in mrp_join_timer

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 84f5ad46 Linux 4.14.162
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=150886e1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=67bcc84091a71c98
dashboard link: https://syzkaller.appspot.com/bug?extid=7c31d15b9117277fe81e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7c31d1...@syzkaller.appspotmail.com

netlink: 20 bytes leftover after parsing attributes in process
`syz-executor.4'.
INFO: rcu_preempt detected stalls on CPUs/tasks:
(detected by 0, t=10502 jiffies, g=1765, c=1764, q=737)
All QSes seen, last rcu_preempt kthread activity 10490
(4294963063-4294952573), jiffies_till_next_fqs=1, root ->qsmask 0x0
syz-executor.5 R running task 27584 7592 7202 0x0000000c
Call Trace:
<IRQ>
sched_show_task kernel/sched/core.c:5168 [inline]
sched_show_task.cold+0x2f0/0x351 kernel/sched/core.c:5143
print_other_cpu_stall kernel/rcu/tree.c:1501 [inline]
check_cpu_stall kernel/rcu/tree.c:1616 [inline]
__rcu_pending kernel/rcu/tree.c:3390 [inline]
rcu_pending kernel/rcu/tree.c:3452 [inline]
rcu_check_callbacks.cold+0xcb1/0xd0a kernel/rcu/tree.c:2792
update_process_times+0x31/0x70 kernel/time/timer.c:1590
tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:161
tick_sched_timer+0x43/0x130 kernel/time/tick-sched.c:1219
__run_hrtimer kernel/time/hrtimer.c:1223 [inline]
__hrtimer_run_queues+0x270/0xbc0 kernel/time/hrtimer.c:1287
hrtimer_interrupt+0x1d8/0x5d0 kernel/time/hrtimer.c:1321
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline]
smp_apic_timer_interrupt+0x11c/0x5e0 arch/x86/kernel/apic/apic.c:1100
apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
RIP: 0010:rb_first+0xa/0x80 lib/rbtree.c:503
RSP: 0018:ffff8880aec07cf0 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: ffff8880a98df928 RCX: 00000000501ba55a
RDX: 0000000000000100 RSI: 0000000000000003 RDI: ffff8880a98df980
RBP: ffff8880aec07d18 R08: 0000000000003a9d R09: ffffffff8958bf28
R10: ffff88805fbf4ab8 R11: ffff88805fbf41c0 R12: ffff8880a98df840
R13: 0000000000000003 R14: ffff8880aec239c0 R15: 0000000000000000
mrp_join_timer+0x36/0x80 net/802/mrp.c:594
call_timer_fn+0x161/0x670 kernel/time/timer.c:1279
expire_timers kernel/time/timer.c:1318 [inline]
__run_timers kernel/time/timer.c:1636 [inline]
__run_timers kernel/time/timer.c:1604 [inline]
run_timer_softirq+0x5b7/0x1520 kernel/time/timer.c:1649
__do_softirq+0x244/0x9a0 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x160/0x1b0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:648 [inline]
smp_apic_timer_interrupt+0x146/0x5e0 arch/x86/kernel/apic/apic.c:1102
apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x41/0x60 kernel/kcov.c:87
RSP: 0018:ffff88805fbff870 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000040000 RBX: ffff88805fad6080 RCX: ffffc9000621e000
RDX: 000000000003ffff RSI: ffffffff830eac27 RDI: ffffffff87049240
RBP: ffff88805fbff870 R08: 0000000000000000 R09: ffff88805fbf4a88
R10: ffff88805fbf4a68 R11: ffff88805fbf41c0 R12: 0000000000000000
R13: ffffffff87049200 R14: ffffffff87049240 R15: ffff88805fad6080
check_preemption_disabled+0x37/0x250 lib/smp_processor_id.c:16
debug_smp_processor_id+0x1c/0x20 lib/smp_processor_id.c:57
rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:360 [inline]
rcu_is_watching+0x15/0xb0 kernel/rcu/tree.c:1130
rcu_read_lock include/linux/rcupdate.h:630 [inline]
__task_pid_nr_ns+0x3b8/0x450 kernel/pid.c:526
task_session_nr_ns include/linux/sched.h:1247 [inline]
task_state fs/proc/array.c:229 [inline]
proc_pid_status+0x1042/0x2240 fs/proc/array.c:400
proc_single_show+0xf0/0x160 fs/proc/base.c:761
seq_read+0x51a/0x1280 fs/seq_file.c:237
do_loop_readv_writev fs/read_write.c:695 [inline]
do_loop_readv_writev fs/read_write.c:682 [inline]
do_iter_read+0x3e2/0x5b0 fs/read_write.c:919
vfs_readv+0xd3/0x130 fs/read_write.c:981
do_preadv+0x15d/0x200 fs/read_write.c:1065
SYSC_preadv fs/read_write.c:1115 [inline]
SyS_preadv+0x31/0x40 fs/read_write.c:1110
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45af49
RSP: 002b:00007fdd5acffc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045af49
RDX: 00000000000001a8 RSI: 00000000200017c0 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdd5ad006d4
R13: 00000000004c950f R14: 00000000004e1c90 R15: 00000000ffffffff
INFO: rcu_sched detected stalls on CPUs/tasks:
0-...: (1 GPs behind) idle=b3a/140000000000002/0 softirq=12269/12270 fqs=28
(detected by 1, t=10502 jiffies, g=1219, c=1218, q=20)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 7592 Comm: syz-executor.5 Not tainted 4.14.162-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff88805fbf41c0 task.stack: ffff88805fbf8000
RIP: 0010:rcu_lockdep_current_cpu_online kernel/rcu/tree.c:1186 [inline]
RIP: 0010:rcu_lockdep_current_cpu_online+0x3a/0x140 kernel/rcu/tree.c:1177
RSP: 0018:ffff8880aec076a8 EFLAGS: 00000096
RAX: 0000000000000000 RBX: ffffffff883412a0 RCX: 0000000000000000
RDX: 0000000000010100 RSI: ffffffff87049200 RDI: ffffffff87049240
RBP: ffff8880aec076c0 R08: 0000003ee0958ea8 R09: ffff88821fff7008
R10: ffff88821fff7010 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00007fdd5ad00700(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2525dfc518 CR3: 0000000098143000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
rcu_read_lock_sched_held+0x97/0x130 kernel/rcu/update.c:113
trace_local_timer_exit arch/x86/include/asm/trace/irq_vectors.h:56 [inline]
smp_apic_timer_interrupt+0x40a/0x5e0 arch/x86/kernel/apic/apic.c:1101
apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
RIP: 0010:__read_once_size include/linux/compiler.h:183 [inline]
RIP: 0010:unwind_next_frame.part.0+0x567/0x8b0
arch/x86/kernel/unwind_frame.c:329
RSP: 0018:ffff8880aec077d8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: ffff8880aec07890 RCX: ffff8880aec07840
RDX: 1ffff11015d80f6a RSI: 1ffff11015d80f1c RDI: ffff8880aec078e0
RBP: ffff8880aec07868 R08: 0000000000000001 R09: ffff8880aec078e8
R10: ffff8880aec078b8 R11: ffff8880aec078c8 R12: 1ffff11015d80f00
R13: 0000000000000000 R14: ffff8880aec07b50 R15: 0000000000000000
unwind_next_frame+0x3b/0x50 arch/x86/kernel/unwind_frame.c:287
__save_stack_trace+0x6b/0xd0 arch/x86/kernel/stacktrace.c:44
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:489
slab_post_alloc_hook mm/slab.h:442 [inline]
slab_alloc mm/slab.c:3390 [inline]
kmem_cache_alloc+0x11b/0x780 mm/slab.c:3550
__build_skb+0x35/0x2e0 net/core/skbuff.c:281
__netdev_alloc_skb+0x289/0x440 net/core/skbuff.c:426
netdev_alloc_skb include/linux/skbuff.h:2648 [inline]
dev_alloc_skb include/linux/skbuff.h:2661 [inline]
send_hsr_supervision_frame+0x110/0xec0 net/hsr/hsr_device.c:265
hsr_announce+0xf5/0x340 net/hsr/hsr_device.c:348
call_timer_fn+0x161/0x670 kernel/time/timer.c:1279
expire_timers kernel/time/timer.c:1318 [inline]
__run_timers kernel/time/timer.c:1636 [inline]
__run_timers kernel/time/timer.c:1604 [inline]
run_timer_softirq+0x5b7/0x1520 kernel/time/timer.c:1649
__do_softirq+0x244/0x9a0 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x160/0x1b0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:648 [inline]
smp_apic_timer_interrupt+0x146/0x5e0 arch/x86/kernel/apic/apic.c:1102
apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x41/0x60 kernel/kcov.c:87
RSP: 0018:ffff88805fbff870 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000040000 RBX: ffff88805fad6080 RCX: ffffc9000621e000
RDX: 000000000003ffff RSI: ffffffff830eac27 RDI: ffffffff87049240
RBP: ffff88805fbff870 R08: 0000000000000000 R09: ffff88805fbf4a88
R10: ffff88805fbf4a68 R11: ffff88805fbf41c0 R12: 0000000000000000
R13: ffffffff87049200 R14: ffffffff87049240 R15: ffff88805fad6080
check_preemption_disabled+0x37/0x250 lib/smp_processor_id.c:16
debug_smp_processor_id+0x1c/0x20 lib/smp_processor_id.c:57
rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:360 [inline]
rcu_is_watching+0x15/0xb0 kernel/rcu/tree.c:1130
rcu_read_lock include/linux/rcupdate.h:630 [inline]
__task_pid_nr_ns+0x3b8/0x450 kernel/pid.c:526
task_session_nr_ns include/linux/sched.h:1247 [inline]
task_state fs/proc/array.c:229 [inline]
proc_pid_status+0x1042/0x2240 fs/proc/array.c:400
proc_single_show+0xf0/0x160 fs/proc/base.c:761
seq_read+0x51a/0x1280 fs/seq_file.c:237
do_loop_readv_writev fs/read_write.c:695 [inline]
do_loop_readv_writev fs/read_write.c:682 [inline]
do_iter_read+0x3e2/0x5b0 fs/read_write.c:919
vfs_readv+0xd3/0x130 fs/read_write.c:981
do_preadv+0x15d/0x200 fs/read_write.c:1065
SYSC_preadv fs/read_write.c:1115 [inline]
SyS_preadv+0x31/0x40 fs/read_write.c:1110
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45af49
RSP: 002b:00007fdd5acffc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045af49
RDX: 00000000000001a8 RSI: 00000000200017c0 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdd5ad006d4
R13: 00000000004c950f R14: 00000000004e1c90 R15: 00000000ffffffff
Code: ad b3 7e a9 00 00 10 00 41 bc 01 00 00 00 74 0c 48 83 c4 08 44 89 e0
5b 41 5c 5d c3 bf 01 00 00 00 e8 bb e6 f1 ff e8 46 6e c0 01 <48> c7 c3 40
c4 02 00 48 ba 00 00 00 00 00 fc ff df 89 c0 48 8d
rcu_sched kthread starved for 730 jiffies! g1219 c1218 f0x0
RCU_GP_WAIT_FQS(3) ->state=0x402 ->cpu=1
rcu_sched I29824 9 2 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2808 [inline]
__schedule+0x7b8/0x1cd0 kernel/sched/core.c:3384
schedule+0x92/0x1c0 kernel/sched/core.c:3428
schedule_timeout+0x43e/0xe10 kernel/time/timer.c:1746
rcu_gp_kthread+0xbf4/0x1ec0 kernel/rcu/tree.c:2255
kthread+0x319/0x430 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 3d40d711 Linux 4.19.93
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13c94949e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=be639726c8387103
dashboard link: https://syzkaller.appspot.com/bug?extid=52543f85839e0c2e22ae

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+52543f...@syzkaller.appspotmail.com

netlink: 20 bytes leftover after parsing attributes in process

`syz-executor.5'.
IPVS: ftp: loaded support on port[0] = 21
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 1-...!: (1 GPs behind) idle=73a/1/0x4000000000000004
softirq=397891/397892 fqs=35
rcu: (t=10500 jiffies g=361821 q=1852)
NMI backtrace for cpu 1
CPU: 1 PID: 6827 Comm: syz-executor.0 Not tainted 4.19.93-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011

Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_dump_cpu_stacks+0x189/0x1d5 kernel/rcu/tree.c:1340
print_cpu_stall kernel/rcu/tree.c:1478 [inline]
check_cpu_stall kernel/rcu/tree.c:1550 [inline]
__rcu_pending kernel/rcu/tree.c:3293 [inline]
rcu_pending kernel/rcu/tree.c:3336 [inline]
rcu_check_callbacks.cold+0x5e3/0xd90 kernel/rcu/tree.c:2682
update_process_times+0x32/0x80 kernel/time/timer.c:1638
tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:164
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1274
__run_hrtimer kernel/time/hrtimer.c:1401 [inline]
__hrtimer_run_queues+0x33b/0xdc0 kernel/time/hrtimer.c:1463
hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1521
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline]
smp_apic_timer_interrupt+0x111/0x550 arch/x86/kernel/apic/apic.c:1092
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
RIP: 0010:preempt_count_sub+0x67/0x160 kernel/sched/core.c:3272
Code: 75 18 65 8b 05 ba dd b8 7e 25 ff ff ff 7f 39 c3 7f 1b 81 fb fe 00 00
00 76 6b 65 8b 05 a2 dd b8 7e f7 db 65 01 1d 99 dd b8 7e <5b> 5d c3 e8 81
38 1d 02 85 c0 74 f4 48 c7 c0 00 4c dc 8a 48 ba 00
RSP: 0018:ffff8880ae907c88 EFLAGS: 00000213 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000102 RBX: 00000000ffffffff RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffffffff836649b3 RDI: 0000000000000001
RBP: ffff8880ae907c90 R08: ffff888094e36680 R09: ffff888094e36f48
R10: 0000000000000000 R11: 0000000000000000 R12: 000000005539fc2b
R13: ffff888095533d00 R14: 1ffff11015d20fa6 R15: 0000000000000000
prandom_u32+0x64/0xb0 lib/random32.c:85
mrp_join_timer_arm+0x26/0x80 net/802/mrp.c:585
mrp_join_timer+0x79/0x80 net/802/mrp.c:599
call_timer_fn+0x18d/0x720 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers kernel/time/timer.c:1684 [inline]
__run_timers kernel/time/timer.c:1652 [inline]
run_timer_softirq+0x64f/0x16a0 kernel/time/timer.c:1697
__do_softirq+0x25c/0x921 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
</IRQ>
RIP: 0010:write_comp_data+0x68/0x70 kernel/kcov.c:146
Code: 00 00 4e 8d 14 dd 28 00 00 00 4d 39 d0 72 1b 49 83 c1 01 4a 89 7c 10
e0 4a 89 74 10 e8 4a 89 54 10 f0 4a 89 4c d8 20 4c 89 08 <c3> 0f 1f 80 00
00 00 00 55 40 0f b6 d6 40 0f b6 f7 31 ff 48 89 e5
RSP: 0018:ffff8880596376b0 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffff888059637948 RCX: ffffffff81953e7d
RDX: 0000000000001000 RSI: 0000000000001000 RDI: 0000000000000004
RBP: ffff8880596376b8 R08: ffff888094e36680 R09: fffff940004c143f
R10: fffff940004c143e R11: ffffea000260a1f3 R12: 0000000000001000
R13: 0000000000001000 R14: ffffea000260a1c0 R15: ffffea000260a1c0
__tlb_remove_page_size+0x9d/0x500 mm/memory.c:297
__tlb_remove_page include/asm-generic/tlb.h:161 [inline]
zap_pte_range mm/memory.c:1341 [inline]
zap_pmd_range mm/memory.c:1440 [inline]
zap_pud_range mm/memory.c:1469 [inline]
zap_p4d_range mm/memory.c:1490 [inline]
unmap_page_range+0xf0e/0x1fb0 mm/memory.c:1511
unmap_single_vma+0x19d/0x300 mm/memory.c:1556
unmap_vmas+0xae/0x180 mm/memory.c:1586
exit_mmap+0x2c2/0x530 mm/mmap.c:3097
__mmput kernel/fork.c:1005 [inline]
mmput+0x15f/0x4c0 kernel/fork.c:1026
exit_mm kernel/exit.c:546 [inline]
do_exit+0x899/0x3080 kernel/exit.c:863
do_group_exit+0x135/0x370 kernel/exit.c:979
get_signal+0x3ec/0x1fc0 kernel/signal.c:2578
do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: Bad RIP value.
RSP: 002b:00007f6a07cc5cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 000000000075bf28 RCX: 000000000045af49
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bf28

RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bf2c
R13: 00007ffcb0f5ea8f R14: 00007f6a07cc69c0 R15: 000000000075bf2c

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.

[syzbot]