INFO: rcu detected stall in br_handle_frame

Status: fixed on 2019/12/07 19:18
Reported-by: syzbot+2f010f92f469db8b4a9e@syzkaller.appspotmail.com
Fix commit: d4d6ec6dac07 sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
First crash: 2524d, last: 2511d
Fix bisection: fixed by (bisect log) :
commit a9e91767b921ee196ab693fa13a81b278f53ddac
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date: Sun Sep 8 20:40:51 2019 +0000

  sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero

  
▶ ▼ Similar bugs (14)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in br_handle_frame (5) bridge 1 syz 24 633d 661d 28/29 fixed on 2024/11/12 23:31
linux-4.14 INFO: rcu detected stall in br_handle_frame (3) 1 1 2134d 2134d 0/1 auto-closed as invalid on 2021/01/28 07:46
upstream INFO: rcu detected stall in br_handle_frame 1 syz, C done 341 2514d 2519d 13/29 fixed on 2019/10/09 10:54
upstream INFO: rcu detected stall in br_handle_frame (2) net 1 syz, C done 2 2418d 2415d 15/29 fixed on 2020/02/18 14:31
upstream INFO: rcu detected stall in br_handle_frame (3) bridge 1 1 1844d 1844d 0/29 auto-closed as invalid on 2021/10/15 13:41
linux-4.14 INFO: rcu detected stall in br_handle_frame (2) 1 syz, C done 1 2419d 2419d 1/1 fixed on 2020/01/19 15:05
linux-4.14 INFO: rcu detected stall in br_handle_frame 1 syz, C done 15 2511d 2523d 1/1 fixed on 2019/12/07 19:24
linux-4.19 INFO: rcu detected stall in br_handle_frame (2) 1 syz, C error 31 1279d 2119d 0/1 upstream: reported C repro on 2020/10/14 18:56
linux-6.1 INFO: rcu detected stall in br_handle_frame (2) 1 5 115d 301d 0/3 auto-obsoleted due to no activity on 2026/07/20 06:55
linux-5.15 INFO: rcu detected stall in br_handle_frame 1 syz, C inconclusive 3 257d 908d 0/3 upstream: reported C repro on 2024/02/08 13:52
upstream INFO: rcu detected stall in br_handle_frame (6) prio:normal netfilter bridge 1 syz, C error error 161 4h52m 202d 0/29 upstream: reported C repro on 2026/01/13 18:06
linux-6.1 INFO: rcu detected stall in br_handle_frame 1 2 707d 789d 0/3 auto-obsoleted due to no activity on 2024/12/04 21:21
upstream INFO: rcu detected stall in br_handle_frame (4) kernel 1 1 1683d 1683d 0/29 closed as invalid on 2022/02/08 10:10
linux-6.6 INFO: rcu detected stall in br_handle_frame 1 21 26d 256d 0/2 upstream: reported on 2025/11/21 04:49

Sample crash report:
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	0-...!: (1 GPs behind) idle=912/1/0x4000000000000002 softirq=9357/9358 fqs=8 
rcu: 	 (t=10500 jiffies g=4701 q=23)
rcu: rcu_preempt kthread starved for 10484 jiffies! g4701 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: RCU grace-period kthread stack dump:
rcu_preempt     I29504    10      2 0x80000000
Call Trace:
 context_switch kernel/sched/core.c:2826 [inline]
 __schedule+0x866/0x1dc0 kernel/sched/core.c:3474
 schedule+0x92/0x1c0 kernel/sched/core.c:3518
 schedule_timeout+0x4db/0xfc0 kernel/time/timer.c:1804
 rcu_gp_kthread+0xd5c/0x2190 kernel/rcu/tree.c:2202
 kthread+0x354/0x420 kernel/kthread.c:246
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
NMI backtrace for cpu 0
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.73 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x189/0x1d5 kernel/rcu/tree.c:1340
 print_cpu_stall kernel/rcu/tree.c:1478 [inline]
 check_cpu_stall kernel/rcu/tree.c:1550 [inline]
 __rcu_pending kernel/rcu/tree.c:3293 [inline]
 rcu_pending kernel/rcu/tree.c:3336 [inline]
 rcu_check_callbacks.cold+0x5e3/0xd90 kernel/rcu/tree.c:2682
 update_process_times+0x32/0x80 kernel/time/timer.c:1636
 tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:164
 tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1274
 __run_hrtimer kernel/time/hrtimer.c:1398 [inline]
 __hrtimer_run_queues+0x33b/0xdc0 kernel/time/hrtimer.c:1460
 hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline]
 smp_apic_timer_interrupt+0x111/0x550 arch/x86/kernel/apic/apic.c:1092
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
 </IRQ>
RIP: 0010:__list_del_entry_valid+0xb1/0xf5 lib/list_debug.c:54
Code: 02 00 75 53 49 8b 14 24 4c 39 f2 0f 85 99 00 00 00 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 24 49 8b 55 08 4c 39 f2 0f 85 aa 00 00 00 41 5c b8 01 00 00 00
RSP: 0018:ffff8880aa236970 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffff888088fe9978 RCX: ffffffff858eb8e9
RDX: 1ffff110111fd343 RSI: ffffffff858ebd9b RDI: ffff888088fe9a18
RBP: ffff8880aa236988 R08: ffff8880aa226240 R09: 0000000000000006
R10: ffff8880aa226bb0 R11: 0000000032e66a09 R12: ffff888088fe9a10
R13: ffff888088fe9a10 R14: ffff888088fe9978 R15: 0000000000000000
 __list_del_entry include/linux/list.h:117 [inline]
 list_move_tail include/linux/list.h:182 [inline]
 hhf_dequeue+0x5aa/0xa00 net/sched/sch_hhf.c:438
 dequeue_skb net/sched/sch_generic.c:277 [inline]
 qdisc_restart net/sched/sch_generic.c:380 [inline]
 __qdisc_run+0x1e7/0x1960 net/sched/sch_generic.c:398
 __dev_xmit_skb net/core/dev.c:3501 [inline]
 __dev_queue_xmit+0x165c/0x2fe0 net/core/dev.c:3811
 dev_queue_xmit+0x18/0x20 net/core/dev.c:3876
 br_dev_queue_push_xmit+0x405/0x5d0 net/bridge/br_forward.c:56
 br_nf_dev_queue_xmit+0x365/0x1610 net/bridge/br_netfilter_hooks.c:779
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 br_nf_post_routing+0x76f/0x12f0 net/bridge/br_netfilter_hooks.c:825
 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline]
 nf_hook_slow+0xbc/0x1e0 net/netfilter/core.c:511
 nf_hook include/linux/netfilter.h:244 [inline]
 NF_HOOK include/linux/netfilter.h:287 [inline]
 br_forward_finish+0x215/0x400 net/bridge/br_forward.c:69
 br_nf_hook_thresh+0x2e9/0x370 net/bridge/br_netfilter_hooks.c:1008
 br_nf_forward_finish+0x356/0x700 net/bridge/br_netfilter_hooks.c:553
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 br_nf_forward_ip net/bridge/br_netfilter_hooks.c:620 [inline]
 br_nf_forward_ip+0x6b4/0x17c0 net/bridge/br_netfilter_hooks.c:564
 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline]
 nf_hook_slow+0xbc/0x1e0 net/netfilter/core.c:511
 nf_hook include/linux/netfilter.h:244 [inline]
 NF_HOOK include/linux/netfilter.h:287 [inline]
 __br_forward+0x393/0xb30 net/bridge/br_forward.c:113
 deliver_clone+0x61/0xc0 net/bridge/br_forward.c:129
 br_flood+0x5fa/0x710 net/bridge/br_forward.c:238
 br_handle_frame_finish+0xf72/0x1510 net/bridge/br_input.c:167
 br_nf_hook_thresh+0x2e9/0x370 net/bridge/br_netfilter_hooks.c:1008
 br_nf_pre_routing_finish_ipv6+0x6ed/0xd70 net/bridge/br_netfilter_ipv6.c:210
 NF_HOOK include/linux/netfilter.h:289 [inline]
 br_nf_pre_routing_ipv6+0x4a5/0x8ca net/bridge/br_netfilter_ipv6.c:240
 br_nf_pre_routing+0x1016/0x159c net/bridge/br_netfilter_hooks.c:494
 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline]
 nf_hook_slow+0xbc/0x1e0 net/netfilter/core.c:511
 nf_hook include/linux/netfilter.h:244 [inline]
 NF_HOOK include/linux/netfilter.h:287 [inline]
 br_handle_frame+0x985/0x1480 net/bridge/br_input.c:306
 __netif_receive_skb_core+0xac1/0x3570 net/core/dev.c:4861
 __netif_receive_skb_one_core+0xa8/0x1a0 net/core/dev.c:4930
 __netif_receive_skb+0x2c/0x1d0 net/core/dev.c:5044
 process_backlog+0x23a/0x7a0 net/core/dev.c:5855
 napi_poll net/core/dev.c:6278 [inline]
 net_rx_action+0x4f5/0x1070 net/core/dev.c:6344
 __do_softirq+0x25c/0x921 kernel/softirq.c:292
 run_ksoftirqd kernel/softirq.c:653 [inline]
 run_ksoftirqd+0x8e/0x110 kernel/softirq.c:645
 smpboot_thread_fn+0x6a3/0xa30 kernel/smpboot.c:164
 kthread+0x354/0x420 kernel/kthread.c:246
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

Crashes (41):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/19 01:07 linux-4.19.y db2d0b7c1dde 46c0be24 .config console log report syz C ci2-linux-4-19
2019/09/17 00:38 linux-4.19.y db2d0b7c1dde 51ca0454 .config console log report syz C ci2-linux-4-19
2019/09/16 04:42 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/15 17:36 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/15 12:21 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/15 10:31 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/15 08:24 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/15 05:16 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/14 00:43 linux-4.19.y ee809c7e0895 32d59357 .config console log report syz C ci2-linux-4-19
2019/09/11 09:57 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/11 02:55 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/11 00:28 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/10 21:16 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/10 03:22 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/10 01:14 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/09 13:05 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/09 09:13 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/09 06:48 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/08 23:20 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/08 11:10 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/08 06:23 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/08 03:43 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/07 14:48 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/07 07:22 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2019/09/16 23:07 linux-4.19.y db2d0b7c1dde 51ca0454 .config console log report ci2-linux-4-19
2019/09/16 13:04 linux-4.19.y db2d0b7c1dde 55c50e70 .config console log report ci2-linux-4-19
2019/09/15 19:58 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/15 18:51 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/15 11:23 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/14 11:34 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/13 15:14 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/13 05:14 linux-4.19.y ee809c7e0895 40fa42bc .config console log report ci2-linux-4-19
2019/09/13 01:09 linux-4.19.y ee809c7e0895 40fa42bc .config console log report ci2-linux-4-19
2019/09/12 08:23 linux-4.19.y ee809c7e0895 0b7672ee .config console log report ci2-linux-4-19
2019/09/11 21:12 linux-4.19.y ee809c7e0895 f4e53c10 .config console log report ci2-linux-4-19
2019/09/11 20:39 linux-4.19.y ee809c7e0895 f4e53c10 .config console log report ci2-linux-4-19
2019/09/11 05:59 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report ci2-linux-4-19
2019/09/10 18:17 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report ci2-linux-4-19
2019/09/10 10:27 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report ci2-linux-4-19
2019/09/06 13:42 linux-4.19.y 0fed55c248d9 c16be727 .config console log report ci2-linux-4-19
2019/09/06 13:32 linux-4.19.y 0fed55c248d9 c16be727 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.