INFO: rcu detected stall in addrconf_dad_work (2)

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 7d120bf2 Linux 4.19.90
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10f452fee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f97143d0904aeaa
dashboard link: https://syzkaller.appspot.com/bug?extid=9353d06a9f55bda184c2
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=138c160ae00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126af5b6e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+9353d0...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 0-....: (1 GPs behind) idle=382/1/0x4000000000000002
softirq=11292/11298 fqs=5239
rcu: (t=10500 jiffies g=6085 q=205)
NMI backtrace for cpu 0
CPU: 0 PID: 7749 Comm: kworker/0:3 Not tainted 4.19.90-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_dump_cpu_stacks+0x189/0x1d5 kernel/rcu/tree.c:1340
print_cpu_stall kernel/rcu/tree.c:1478 [inline]
check_cpu_stall kernel/rcu/tree.c:1550 [inline]
__rcu_pending kernel/rcu/tree.c:3293 [inline]
rcu_pending kernel/rcu/tree.c:3336 [inline]
rcu_check_callbacks.cold+0x5e3/0xd90 kernel/rcu/tree.c:2682
update_process_times+0x32/0x80 kernel/time/timer.c:1638
tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:164
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1274
__run_hrtimer kernel/time/hrtimer.c:1398 [inline]
__hrtimer_run_queues+0x33b/0xdc0 kernel/time/hrtimer.c:1460
hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1518
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline]
smp_apic_timer_interrupt+0x111/0x550 arch/x86/kernel/apic/apic.c:1092
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
</IRQ>
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:23 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:67 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x11/0x50 kernel/kcov.c:101
Code: 09 00 00 00 00 e9 96 e9 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 55 48 89 e5 48 8b 75 08 65 48 8b 04 25 40 ee 01 00 <65> 8b 15 78 a9
96 7e 81 e2 00 01 1f 00 75 2b 8b 90 d0 12 00 00 83
RSP: 0018:ffff888095b5f3e0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffff888095698380 RBX: ffff888092272930 RCX: ffffffff85e32fd6
RDX: 0000000000000000 RSI: ffffffff85e3329b RDI: ffff888092272970
RBP: ffff888095b5f3e0 R08: ffff888095698380 R09: ffffffff8a0b1008
R10: ffffffff8a0b1010 R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff888094ee6710 R15: ffff888094ee6480
fq_flow_add_tail net/sched/sch_fq.c:141 [inline]
fq_dequeue+0x8fb/0x1450 net/sched/sch_fq.c:489
dequeue_skb net/sched/sch_generic.c:282 [inline]
qdisc_restart net/sched/sch_generic.c:385 [inline]
__qdisc_run+0x1e5/0x19f0 net/sched/sch_generic.c:403
__dev_xmit_skb net/core/dev.c:3501 [inline]
__dev_queue_xmit+0x165c/0x2fe0 net/core/dev.c:3811
dev_queue_xmit+0x18/0x20 net/core/dev.c:3876
neigh_resolve_output net/core/neighbour.c:1374 [inline]
neigh_resolve_output+0x5d2/0x9a0 net/core/neighbour.c:1354
neigh_output include/net/neighbour.h:501 [inline]
ip6_finish_output2+0xb7f/0x2550 net/ipv6/ip6_output.c:120
ip6_finish_output+0x574/0xbe0 net/ipv6/ip6_output.c:154
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip6_output+0x235/0x7c0 net/ipv6/ip6_output.c:171
dst_output include/net/dst.h:447 [inline]
NF_HOOK include/linux/netfilter.h:289 [inline]
ndisc_send_skb+0xf3b/0x1460 net/ipv6/ndisc.c:491
ndisc_send_rs+0x136/0x6e0 net/ipv6/ndisc.c:685
addrconf_dad_completed+0x32e/0xbb0 net/ipv6/addrconf.c:4142
addrconf_dad_work+0x789/0x1110 net/ipv6/addrconf.c:4053
process_one_work+0x989/0x1750 kernel/workqueue.c:2153
worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot suspects this bug was fixed by commit:

commit 94ac4a4d938f51a18a51286fd94a46c1d6558103
Author: Eric Dumazet <edum...@google.com>
Date: Mon Jan 6 14:10:39 2020 +0000

pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=149adfaee00000
start commit: 7d120bf2 Linux 4.19.90
git tree: linux-4.19.y

kernel config: https://syzkaller.appspot.com/x/.config?x=f97143d0904aeaa
dashboard link: https://syzkaller.appspot.com/bug?extid=9353d06a9f55bda184c2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=138c160ae00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126af5b6e00000

If the result looks correct, please mark the bug fixed by replying with:

#syz fix: pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM

For information about bisection process see: https://goo.gl/tpsmEJ#bisection