INFO: rcu detected stall in netlink_sendmsg

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: ce28bb445388 Merge git://git.kernel.org/pub/scm/linux/kern..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=12662e67400000
kernel config: https://syzkaller.appspot.com/x/.config?x=67a2081147a23142
dashboard link: https://syzkaller.appspot.com/bug?extid=a910a514846e27f15348
compiler: gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a910a5...@syzkaller.appspotmail.com

netlink: 8 bytes leftover after parsing attributes in process
`syz-executor5'.
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 1-...!: (10500 ticks this GP) idle=58a/1/0x4000000000000002
softirq=84145/84145 fqs=0
rcu: (t=10500 jiffies g=122913 q=1655)
rcu: rcu_preempt kthread starved for 10500 jiffies! g122913 f0x0
RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: RCU grace-period kthread stack dump:
rcu_preempt I22568 10 2 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x86c/0x1ed0 kernel/sched/core.c:3472
schedule+0xfe/0x460 kernel/sched/core.c:3516
schedule_timeout+0x140/0x260 kernel/time/timer.c:1804
rcu_gp_fqs_loop+0x762/0xa80 kernel/rcu/tree.c:1934
rcu_gp_kthread+0x341/0xc70 kernel/rcu/tree.c:2090
kthread+0x35a/0x440 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
NMI backtrace for cpu 1
CPU: 1 PID: 10942 Comm: syz-executor1 Not tainted 4.20.0-rc7+ #358
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d3/0x2c6 lib/dump_stack.c:113
nmi_cpu_backtrace.cold.4+0x63/0xa2 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1c2/0x22c lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_dump_cpu_stacks+0x16f/0x1bc kernel/rcu/tree.c:1195
print_cpu_stall.cold.65+0x1f3/0x3c6 kernel/rcu/tree.c:1334
check_cpu_stall kernel/rcu/tree.c:1408 [inline]
rcu_pending kernel/rcu/tree.c:2961 [inline]
rcu_check_callbacks+0xac1/0x1410 kernel/rcu/tree.c:2506
update_process_times+0x2d/0x70 kernel/time/timer.c:1636
tick_sched_handle+0x9f/0x180 kernel/time/tick-sched.c:164
tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1274
__run_hrtimer kernel/time/hrtimer.c:1398 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1460
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1518
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1034 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1059
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
</IRQ>
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x1/0x20 kernel/kcov.c:188
Code: fe ff ff 5d c3 0f 1f 40 00 55 0f b7 d6 0f b7 f7 bf 03 00 00 00 48 89
e5 48 8b 4d 08 e8 88 fe ff ff 5d c3 66 0f 1f 44 00 00 55 <89> f2 89 fe bf
05 00 00 00 48 89 e5 48 8b 4d 08 e8 6a fe ff ff 5d
RSP: 0018:ffff8881c195ef50 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 0000000000040000 RBX: 0000000000000004 RCX: ffffc90005f36000
RDX: 0000000000040000 RSI: 0000000000000004 RDI: 000000000000000e
RBP: ffff8881c195efc0 R08: ffff8881d7da2040 R09: 0000000000000000
R10: 0000000000000000 R11: ffff8881d7da2040 R12: dffffc0000000000
R13: ffff8881c2e07c18 R14: ffff8881b8142d20 R15: 0000000001000000
xfrm_policy_bysel_ctx+0x883/0x1050 net/xfrm/xfrm_policy.c:1664
xfrm_get_policy+0x6a3/0x1140 net/xfrm/xfrm_user.c:1887
xfrm_user_rcv_msg+0x44c/0x8e0 net/xfrm/xfrm_user.c:2663
netlink_rcv_skb+0x16c/0x430 net/netlink/af_netlink.c:2477
xfrm_netlink_rcv+0x6f/0x90 net/xfrm/xfrm_user.c:2671
netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
netlink_unicast+0x59f/0x750 net/netlink/af_netlink.c:1336
netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1917
sock_sendmsg_nosec net/socket.c:621 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:631
___sys_sendmsg+0x7fd/0x930 net/socket.c:2116
__sys_sendmsg+0x11d/0x280 net/socket.c:2154
__do_sys_sendmsg net/socket.c:2163 [inline]
__se_sys_sendmsg net/socket.c:2161 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2161
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457669
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fc47e41ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457669
RDX: 0000000000000000 RSI: 000000002014f000 RDI: 0000000000000003
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc47e41b6d4
R13: 00000000004c44d8 R14: 00000000004d74e8 R15: 00000000ffffffff


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[Florian Westphal]

syzbot <syzbot+a910a5...@syzkaller.appspotmail.com> wrote:
> HEAD commit: ce28bb445388 Merge git://git.kernel.org/pub/scm/linux/kern..
> git tree: net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=12662e67400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=67a2081147a23142
> dashboard link: https://syzkaller.appspot.com/bug?extid=a910a514846e27f15348

Possibly resolved by xfrm policy fixup series whose topmost commit is

#syz fix: xfrm: policy: fix infinite loop when merging src-nodes

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 8d33316d5205 Merge branch 'x86-urgent-for-linus' of git://..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14d5f3bcc00000
kernel config: https://syzkaller.appspot.com/x/.config?x=ee434566c893c7b1
dashboard link: https://syzkaller.appspot.com/bug?extid=a910a514846e27f15348
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13923b60c00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a910a5...@syzkaller.appspotmail.com

kernel msg: ebtables bug: please report to author: Entries_size never zero
kernel msg: ebtables bug: please report to author: Entries_size never zero
kernel msg: ebtables bug: please report to author: Entries_size never zero
kernel msg: ebtables bug: please report to author: Entries_size never zero
32-bit node address hash set to aa1414ac

rcu: INFO: rcu_preempt self-detected stall on CPU

rcu: 1-....: (1 GPs behind) idle=5aa/1/0x4000000000000002
softirq=10469/10470 fqs=5225
rcu: (t=10500 jiffies g=6081 q=489)

NMI backtrace for cpu 1

CPU: 1 PID: 7809 Comm: syz-executor.3 Not tainted 5.0.0-rc6+ #76

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x172/0x1f0 lib/dump_stack.c:113
nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62

arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]

rcu_dump_cpu_stacks+0x183/0x1cf kernel/rcu/tree.c:1211
print_cpu_stall kernel/rcu/tree.c:1348 [inline]
check_cpu_stall kernel/rcu/tree.c:1422 [inline]
rcu_pending kernel/rcu/tree.c:3018 [inline]
rcu_check_callbacks.cold+0x500/0xa4a kernel/rcu/tree.c:2521
update_process_times+0x32/0x80 kernel/time/timer.c:1635
tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:161
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x33e/0xde0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x120/0x570 arch/x86/kernel/apic/apic.c:1060
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
</IRQ>
RIP: 0010:check_memory_region+0x21/0x190 mm/kasan/generic.c:190
Code: 2e 0f 1f 84 00 00 00 00 00 48 85 f6 0f 84 21 01 00 00 48 b8 ff ff ff
ff ff 7f ff ff 55 0f b6 d2 48 39 c7 48 89 e5 41 55 41 54 <53> 0f 86 f6 00
00 00 4c 8d 5c 37 ff 49 89 f8 48 b8 00 00 00 00 00
RSP: 0018:ffff88808b8fea60 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13
RAX: ffff7fffffffffff RBX: ffffe8ffffd2f348 RCX: ffffffff8157be27
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffe8ffffd2f348
RBP: ffff88808b8fea70 R08: 1ffffd1ffffa5e69 R09: fffff91ffffa5e6a
R10: fffff91ffffa5e69 R11: ffffe8ffffd2f34b R12: 0000000000000001
R13: 0000000000000003 R14: fffff91ffffa5e69 R15: 00000000000005e8
kasan_check_read+0x11/0x20 mm/kasan/common.c:100
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
virt_spin_lock arch/x86/include/asm/qspinlock.h:83 [inline]
native_queued_spin_lock_slowpath+0xb7/0x970 kernel/locking/qspinlock.c:337
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:653 [inline]
queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:50 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:90 [inline]
do_raw_spin_lock+0x20e/0x2e0 kernel/locking/spinlock_debug.c:113
__raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
_raw_spin_lock+0x37/0x40 kernel/locking/spinlock.c:144
spin_lock include/linux/spinlock.h:329 [inline]
nf_ct_add_to_unconfirmed_list net/netfilter/nf_conntrack_core.c:462
[inline]
init_conntrack.isra.0+0xa15/0x1180 net/netfilter/nf_conntrack_core.c:1437
resolve_normal_ct net/netfilter/nf_conntrack_core.c:1479 [inline]
nf_conntrack_in+0xa68/0x1070 net/netfilter/nf_conntrack_core.c:1585
ipv4_conntrack_local+0x169/0x210 net/netfilter/nf_conntrack_proto.c:444
nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline]
nf_hook_slow+0xbf/0x1f0 net/netfilter/core.c:511
nf_hook include/linux/netfilter.h:244 [inline]
__ip_local_out+0x403/0x880 net/ipv4/ip_output.c:113
ip_local_out+0x2d/0x1b0 net/ipv4/ip_output.c:122
iptunnel_xmit+0x58e/0x980 net/ipv4/ip_tunnel_core.c:91
udp_tunnel_xmit_skb+0x236/0x310 net/ipv4/udp_tunnel.c:200
tipc_udp_xmit.isra.0+0x7fd/0xcc0 net/tipc/udp_media.c:181
tipc_udp_send_msg+0x295/0x4a0 net/tipc/udp_media.c:247
tipc_bearer_xmit_skb+0x172/0x360 net/tipc/bearer.c:503
tipc_enable_bearer+0xac4/0xd20 net/tipc/bearer.c:328
__tipc_nl_bearer_enable+0x2d1/0x3b0 net/tipc/bearer.c:899
tipc_nl_bearer_enable+0x23/0x40 net/tipc/bearer.c:907
genl_family_rcv_msg+0x6e1/0xd90 net/netlink/genetlink.c:601
genl_rcv_msg+0xca/0x16c net/netlink/genetlink.c:626
netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2477
genl_rcv+0x29/0x40 net/netlink/genetlink.c:637
netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1336
netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1917
sock_sendmsg_nosec net/socket.c:621 [inline]
sock_sendmsg+0xdd/0x130 net/socket.c:631
___sys_sendmsg+0x806/0x930 net/socket.c:2114
__sys_sendmsg+0x105/0x1d0 net/socket.c:2152
__do_sys_sendmsg net/socket.c:2161 [inline]
__se_sys_sendmsg net/socket.c:2159 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2159
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457e29
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7

48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff

ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fafcebf0c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29
RDX: 0000000000000010 RSI: 00000000200000c0 RDI: 0000000000000009
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fafcebf16d4
R13: 00000000004c5210 R14: 00000000004d8fc8 R15: 00000000ffffffff