Hello,
syzbot found the following issue on:
HEAD commit: d358e5254674 Merge tag 'for-6.19/dm-changes' of git://git...
git tree: upstream
console output:
https://syzkaller.appspot.com/x/log.txt?x=1452d1c2580000
kernel config:
https://syzkaller.appspot.com/x/.config?x=4d5b48b67d177d90
dashboard link:
https://syzkaller.appspot.com/bug?extid=8a24c20967f51cda0a1e
compiler: arm-linux-gnueabi-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm
CC: [
linux-...@vger.kernel.org tg...@linutronix.de]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable):
https://storage.googleapis.com/syzbot-assets/98a89b9f34e4/non_bootable_disk-d358e525.raw.xz
vmlinux:
https://storage.googleapis.com/syzbot-assets/f888bdaa51d7/vmlinux-d358e525.xz
kernel image:
https://storage.googleapis.com/syzbot-assets/43a6a5237d71/zImage-d358e525.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by:
syzbot+8a24c2...@syzkaller.appspotmail.com
watchdog: BUG: soft lockup - CPU#0 stuck for 430s! [migration/0:18]
Modules linked in:
CPU: 0 UID: 0 PID: 18 Comm: migration/0 Not tainted syzkaller #0 PREEMPT
Hardware name: ARM-Versatile Express
Stopper: multi_cpu_stop+0x0/0x16c kernel/stop_machine.c:198 <- __stop_cpus.constprop.0+0x64/0xa4
PC is at multi_cpu_stop+0xd8/0x16c kernel/stop_machine.c:228
LR is at multi_cpu_stop+0xd8/0x16c kernel/stop_machine.c:227
pc : [<803737ac>] lr : [<803737ac>] psr: 60070013
sp : df861ed8 ip : df861ed8 fp : df861f0c
r10: 00000001 r9 : 00000000 r8 : 00000001
r7 : 8280c6d0 r6 : df979cc4 r5 : df979cd8 r4 : 00000001
r3 : 00000001 r2 : 00000000 r1 : 00000008 r0 : 8280c6d0
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 30c5387d Table: 84d30900 DAC: fffffffd
Call trace:
[<803736d4>] (multi_cpu_stop) from [<803731b4>] (cpu_stopper_thread+0x90/0x130 kernel/stop_machine.c:512)
r10:df979c8c r9:83215400 r8:dddc7574 r7:dddc756c r6:803736d4 r5:dddc7568
r4:df979cc4
[<80373124>] (cpu_stopper_thread) from [<80288200>] (smpboot_thread_fn+0x108/0x2f0 kernel/smpboot.c:160)
r10:00000000 r9:00000000 r8:00000000 r7:00000001 r6:828fd6d0 r5:830c1000
r4:83215400
[<802880f8>] (smpboot_thread_fn) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463)
r9:830c1000 r8:802880f8 r7:df819de0 r6:830bf400 r5:83215400 r4:00000001
[<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137)
Exception stack(0xdf861fb0 to 0xdf861ff8)
1fa0: 00000000 00000000 00000000 00000000
1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0
r4:830c1040
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT
Hardware name: ARM-Versatile Express
PC is at arch_spin_lock arch/arm/include/asm/spinlock.h:73 [inline]
PC is at do_raw_spin_lock include/linux/spinlock.h:187 [inline]
PC is at __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
PC is at _raw_spin_lock+0x4c/0x58 kernel/locking/spinlock.c:154
LR is at __raw_spin_lock include/linux/spinlock_api_smp.h:132 [inline]
LR is at _raw_spin_lock+0x18/0x58 kernel/locking/spinlock.c:154
pc : [<81abc000>] lr : [<81abbfcc>] psr: 80000113
sp : df805d68 ip : df805d68 fp : df805d7c
r10: 81c05450 r9 : 840e3e40 r8 : 83e6d688
r7 : 840e3f68 r6 : 00000001 r5 : 00000001 r4 : 840e3f68
r3 : 00002639 r2 : 0000263a r1 : 00000000 r0 : 00000001
Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 30c5387d Table: 84d30900 DAC: 00000000
Call trace: frame pointer underflow
[<81abbfb4>] (_raw_spin_lock) from [<809c7b2c>] (class_raw_spinlock_constructor include/linux/spinlock.h:535 [inline])
[<81abbfb4>] (_raw_spin_lock) from [<809c7b2c>] (gpio_mmio_set+0x44/0x80 drivers/gpio/gpio-mmio.c:234)
r5:00000001 r4:840e3e40
[<809c7ae8>] (gpio_mmio_set) from [<809b82e8>] (gpiochip_set+0x1c/0x44 drivers/gpio/gpiolib.c:2919)
r7:00000001 r6:00000000 r5:00000000 r4:840cd300
[<809b82cc>] (gpiochip_set) from [<809babb0>] (gpiod_set_raw_value_commit+0x78/0x218 drivers/gpio/gpiolib.c:3662)
[<809bab38>] (gpiod_set_raw_value_commit) from [<809bc450>] (gpiod_set_value_nocheck+0x44/0x58 drivers/gpio/gpiolib.c:3881)
r10:81c05450 r9:df805ebc r8:00000102 r7:ffffa486 r6:00000007 r5:00000001
r4:840cd300
[<809bc40c>] (gpiod_set_value_nocheck) from [<809bc4a0>] (gpiod_set_value+0x3c/0x88 drivers/gpio/gpiolib.c:3903)
[<809bc464>] (gpiod_set_value) from [<809ccc3c>] (gpio_led_set+0x5c/0x60 drivers/leds/leds-gpio.c:57)
r5:84570044 r4:84570044
[<809ccbe0>] (gpio_led_set) from [<809ca4d4>] (__led_set_brightness drivers/leds/led-core.c:52 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca4d4>] (led_set_brightness_nopm drivers/leds/led-core.c:335 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca4d4>] (led_set_brightness_nosleep+0x38/0x44 drivers/leds/led-core.c:369)
r5:84570044 r4:8329f58c
[<809ca49c>] (led_set_brightness_nosleep) from [<809cd538>] (led_heartbeat_function+0x84/0x144 drivers/leds/trigger/ledtrig-heartbeat.c:90)
[<809cd4b4>] (led_heartbeat_function) from [<80327070>] (call_timer_fn+0x30/0x220 kernel/time/timer.c:1748)
r7:ffffa486 r6:809cd4b4 r5:8329f58c r4:83216000
[<80327040>] (call_timer_fn) from [<80327524>] (expire_timers kernel/time/timer.c:1799 [inline])
[<80327040>] (call_timer_fn) from [<80327524>] (__run_timers+0x2c4/0x3f8 kernel/time/timer.c:2373)
r9:df805ebc r8:ffffa486 r7:00000000 r6:809cd4b4 r5:dddd9f00 r4:8329f58c
[<80327260>] (__run_timers) from [<803276c0>] (__run_timer_base kernel/time/timer.c:2385 [inline])
[<80327260>] (__run_timers) from [<803276c0>] (__run_timer_base kernel/time/timer.c:2377 [inline])
[<80327260>] (__run_timers) from [<803276c0>] (run_timer_base+0x68/0x78 kernel/time/timer.c:2394)
r10:83216000 r9:82804d80 r8:00000102 r7:00000001 r6:00000282 r5:00000002
r4:dddd9f00
[<80327658>] (run_timer_base) from [<803276ec>] (run_timer_softirq+0x1c/0x34 kernel/time/timer.c:2404)
r4:82804084
[<803276d0>] (run_timer_softirq) from [<8025b65c>] (handle_softirqs+0x140/0x458 kernel/softirq.c:622)
[<8025b51c>] (handle_softirqs) from [<8025bad0>] (__do_softirq kernel/softirq.c:656 [inline])
[<8025b51c>] (handle_softirqs) from [<8025bad0>] (invoke_softirq kernel/softirq.c:496 [inline])
[<8025b51c>] (handle_softirqs) from [<8025bad0>] (__irq_exit_rcu+0x110/0x1d0 kernel/softirq.c:723)
r10:00000000 r9:83216000 r8:00000000 r7:df865e08 r6:82443f98 r5:8247f0cc
r4:83216000
[<8025b9c0>] (__irq_exit_rcu) from [<8025be48>] (irq_exit+0x10/0x18 kernel/softirq.c:751)
r5:8247f0cc r4:826c3a9c
[<8025be38>] (irq_exit) from [<81aada64>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:295)
[<81aad9e8>] (generic_handle_arch_irq) from [<81a7da0c>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40)
r9:83216000 r8:83e6d688 r7:df865e3c r6:ffffffff r5:60000013 r4:809c832c
[<81a7d9f0>] (call_with_stack) from [<80200bec>] (__irq_svc+0x8c/0xbc arch/arm/kernel/entry-armv.S:228)
Exception stack(0xdf865e08 to 0xdf865e50)
5e00: e04b6008 0000000c 00002639 00000000 e04b6008 0000000c
5e20: 00000001 840e3f68 83e6d688 840e3e40 00000000 df865e6c df865e58 df865e58
5e40: 809c8328 809c832c 60000013 ffffffff
[<809c830c>] (gpio_mmio_write32) from [<809c7b4c>] (gpio_mmio_set+0x64/0x80 drivers/gpio/gpio-mmio.c:241)
r5:00000008 r4:840e3e40
[<809c7ae8>] (gpio_mmio_set) from [<809b82e8>] (gpiochip_set+0x1c/0x44 drivers/gpio/gpiolib.c:2919)
r7:00000001 r6:00000000 r5:00000003 r4:840cd33c
[<809b82cc>] (gpiochip_set) from [<809babb0>] (gpiod_set_raw_value_commit+0x78/0x218 drivers/gpio/gpiolib.c:3662)
[<809bab38>] (gpiod_set_raw_value_commit) from [<809bc450>] (gpiod_set_value_nocheck+0x44/0x58 drivers/gpio/gpiolib.c:3881)
r10:00000000 r9:00000000 r8:00000001 r7:ddde24c0 r6:8339ead8 r5:00000001
r4:840cd33c
[<809bc40c>] (gpiod_set_value_nocheck) from [<809bc4a0>] (gpiod_set_value+0x3c/0x88 drivers/gpio/gpiolib.c:3903)
[<809bc464>] (gpiod_set_value) from [<809ccc3c>] (gpio_led_set+0x5c/0x60 drivers/leds/leds-gpio.c:57)
r5:000000ff r4:84570314
[<809ccbe0>] (gpio_led_set) from [<809ca564>] (__led_set_brightness drivers/leds/led-core.c:52 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca564>] (led_set_brightness_nopm drivers/leds/led-core.c:335 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca564>] (led_set_brightness_nosleep drivers/leds/led-core.c:369 [inline])
[<809ccbe0>] (gpio_led_set) from [<809ca564>] (led_set_brightness+0x84/0x90 drivers/leds/led-core.c:328)
r5:000000ff r4:84570314
[<809ca4e0>] (led_set_brightness) from [<809cc0e4>] (led_trigger_event drivers/leds/led-triggers.c:420 [inline])
[<809ca4e0>] (led_set_brightness) from [<809cc0e4>] (led_trigger_event+0x40/0x58 drivers/leds/led-triggers.c:408)
r5:000000ff r4:84570314
[<809cc0a4>] (led_trigger_event) from [<809cd740>] (ledtrig_cpu+0xac/0xf4 drivers/leds/trigger/ledtrig-cpu.c:86)
r7:ddde24c0 r6:00000002 r5:82b15cd8 r4:000001fd
[<809cd694>] (ledtrig_cpu) from [<80227a38>] (arch_cpu_idle_exit+0x14/0x18 arch/arm/kernel/process.c:98)
r9:00000000 r8:00000001 r7:8280c710 r6:83216000 r5:8280c6d0 r4:00000001
[<80227a24>] (arch_cpu_idle_exit) from [<802b168c>] (do_idle+0x5c/0x2d8 kernel/sched/idle.c:334)
[<802b1630>] (do_idle) from [<802b1c38>] (cpu_startup_entry+0x30/0x34 kernel/sched/idle.c:430)
r10:00000000 r9:414fc0f0 r8:80003000 r7:82a7b4a4 r6:83216000 r5:00000001
r4:00000092
[<802b1c08>] (cpu_startup_entry) from [<8022f360>] (secondary_start_kernel+0x128/0x194 arch/arm/kernel/smp.c:478)
[<8022f238>] (secondary_start_kernel) from [<80220094>] (__enable_mmu+0x0/0xc arch/arm/kernel/head.S:446)
r7:82a7b4a4 r6:30c0387d r5:00000000 r4:830b7bc0
---
This report is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup