INFO: rcu detected stall in mld_ifc_timer_expire (3)

Status: auto-closed as invalid on 2020/09/04 20:48
Subsystems: net
[Documentation on labels]
First crash: 2268d, last: 2268d
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in mld_ifc_timer_expire 1 syz, C done 152 2533d 2541d 13/29 fixed on 2019/10/09 10:54
linux-4.19 INFO: rcu detected stall in mld_ifc_timer_expire 1 syz, C done 33 2530d 2542d 1/1 fixed on 2019/12/07 19:18
linux-4.14 INFO: rcu detected stall in mld_ifc_timer_expire 1 syz, C done 9 2532d 2542d 1/1 fixed on 2019/12/06 15:57
upstream INFO: rcu detected stall in mld_ifc_timer_expire (2) bridge 1 1 2454d 2454d 0/29 closed as invalid on 2019/12/04 14:04

Sample crash report:
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	1-...!: (1 GPs behind) idle=186/1/0x4000000000000004 softirq=10856/10857 fqs=112 
	(t=10500 jiffies g=12053 q=272)
rcu: rcu_preempt kthread starved for 10251 jiffies! g12053 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
rcu_preempt     I28832    10      2 0x80004000
Call Trace:
 context_switch kernel/sched/core.c:3430 [inline]
 __schedule+0x8f3/0x1fc0 kernel/sched/core.c:4156
 schedule+0xd0/0x2a0 kernel/sched/core.c:4231
 schedule_timeout+0x35c/0x850 kernel/time/timer.c:1897
 rcu_gp_fqs_loop kernel/rcu/tree.c:1856 [inline]
 rcu_gp_kthread+0xc74/0x1a10 kernel/rcu/tree.c:2026
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351
NMI backtrace for cpu 1
CPU: 1 PID: 8322 Comm: syz-executor.1 Not tainted 5.7.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1e6/0x221 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x19b/0x1e5 kernel/rcu/tree_stall.h:320
 print_cpu_stall kernel/rcu/tree_stall.h:553 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:627 [inline]
 rcu_pending kernel/rcu/tree.c:3471 [inline]
 rcu_sched_clock_irq.cold+0x55a/0xd25 kernel/rcu/tree.c:2486
 update_process_times+0x25/0x60 kernel/time/timer.c:1726
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:176
 tick_sched_timer+0x4e/0x140 kernel/time/tick-sched.c:1320
 __run_hrtimer kernel/time/hrtimer.c:1520 [inline]
 __hrtimer_run_queues+0x5ca/0xed0 kernel/time/hrtimer.c:1584
 hrtimer_interrupt+0x312/0x770 kernel/time/hrtimer.c:1646
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1080 [inline]
 smp_apic_timer_interrupt+0x15b/0x600 arch/x86/kernel/apic/apic.c:1105
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:765 [inline]
RIP: 0010:kmem_cache_free+0xa4/0x320 mm/slab.c:3695
Code: e8 81 27 00 00 84 c0 74 76 41 f7 c4 00 02 00 00 74 4e e8 7f b4 c6 ff 48 83 3d 87 12 e2 07 00 0f 84 f8 01 00 00 4c 89 e7 57 9d <0f> 1f 44 00 00 4c 8b 64 24 20 0f 1f 44 00 00 65 8b 05 06 17 4f 7e
RSP: 0018:ffffc90000da7b10 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffff88819b23ba40 RCX: 1ffffffff15173ba
RDX: 1ffff11011e59140 RSI: 0000000000000000 RDI: 0000000000000282
RBP: ffff8880a97bbc40 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff8c347a4f R11: fffffbfff1868f49 R12: 0000000000000282
R13: ffffffff8623114f R14: ffffffff86290bd8 R15: 00000000000003e8
 kfree_skbmem net/core/skbuff.c:622 [inline]
 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:616
 __kfree_skb net/core/skbuff.c:679 [inline]
 kfree_skb net/core/skbuff.c:696 [inline]
 kfree_skb+0x102/0x410 net/core/skbuff.c:690
 enqueue_to_backlog+0x288/0xc80 net/core/dev.c:4545
 netif_rx_internal+0x127/0x620 net/core/dev.c:4774
 netif_rx+0x82/0x5f0 net/core/dev.c:4801
 loopback_xmit+0x261/0x6ec drivers/net/loopback.c:88
 __netdev_start_xmit include/linux/netdevice.h:4607 [inline]
 netdev_start_xmit include/linux/netdevice.h:4621 [inline]
 xmit_one net/core/dev.c:3545 [inline]
 dev_hard_start_xmit+0x1a4/0x9b0 net/core/dev.c:3561
 __dev_queue_xmit+0x25e1/0x30a0 net/core/dev.c:4120
 neigh_hh_output include/net/neighbour.h:499 [inline]
 neigh_output include/net/neighbour.h:508 [inline]
 ip_finish_output2+0x15f2/0x2360 net/ipv4/ip_output.c:228
 ip_do_fragment+0x9ba/0x1c80 net/ipv4/ip_output.c:905
 ip_fragment.constprop.0+0x171/0x240 net/ipv4/ip_output.c:573
 __ip_finish_output net/ipv4/ip_output.c:304 [inline]
 __ip_finish_output+0x4b5/0xbd0 net/ipv4/ip_output.c:288
 ip_finish_output+0x34/0x1f0 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0x1fe/0x620 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:435 [inline]
 ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:125
 iptunnel_xmit+0x619/0x9d0 net/ipv4/ip_tunnel_core.c:81
 geneve_xmit_skb drivers/net/geneve.c:929 [inline]
 geneve_xmit+0xdef/0x2d70 drivers/net/geneve.c:1004
 __netdev_start_xmit include/linux/netdevice.h:4607 [inline]
 netdev_start_xmit include/linux/netdevice.h:4621 [inline]
 xmit_one net/core/dev.c:3545 [inline]
 dev_hard_start_xmit+0x1a4/0x9b0 net/core/dev.c:3561
 __dev_queue_xmit+0x25e1/0x30a0 net/core/dev.c:4120
 neigh_resolve_output net/core/neighbour.c:1489 [inline]
 neigh_resolve_output+0x566/0x930 net/core/neighbour.c:1469
 neigh_output include/net/neighbour.h:510 [inline]
 ip6_finish_output2+0xf32/0x22d0 net/ipv6/ip6_output.c:117
 __ip6_finish_output+0x442/0xab0 net/ipv6/ip6_output.c:143
 ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:153
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip6_output+0x239/0x810 net/ipv6/ip6_output.c:176
 dst_output include/net/dst.h:435 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 mld_sendpack+0x961/0xdf0 net/ipv6/mcast.c:1679
 mld_send_cr net/ipv6/mcast.c:1975 [inline]
 mld_ifc_timer_expire+0x42e/0x920 net/ipv6/mcast.c:2474
 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1786
 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x192/0x1d0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:546 [inline]
 smp_apic_timer_interrupt+0x19e/0x600 arch/x86/kernel/apic/apic.c:1107
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 </IRQ>
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:162 [inline]
RIP: 0010:unwind_next_frame+0x236/0x1df0 arch/x86/kernel/unwind_orc.c:446
Code: 53 ff 39 d0 0f 83 bc 12 00 00 48 ba 00 00 00 00 00 fc ff df 89 c6 48 8d 3c b5 2c 56 76 8b 49 89 f8 49 c1 e8 03 45 0f b6 04 10 <48> 89 fa 83 e2 07 83 c2 03 44 38 c2 7c 32 45 84 c0 74 2d 48 89 74
RSP: 0018:ffffc90017956088 EFLAGS: 00000a06 ORIG_RAX: ffffffffffffff13
RAX: 00000000000032fd RBX: 1ffff92002f2ac19 RCX: ffffffff8132fd9d
RDX: dffffc0000000000 RSI: 00000000000032fd RDI: ffffffff8b772220
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffc90017956240
R10: ffffc90017956277 R11: 000000000007001e R12: ffffc90017956260
R13: ffffc9001795624d R14: ffffc90017956268 R15: ffffc90017956218
 __unwind_start+0x594/0x940 arch/x86/kernel/unwind_orc.c:698
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 arch_stack_walk+0x5e/0xf0 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:123
 save_stack+0x1b/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc mm/kasan/common.c:494 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:467
 __kmalloc_reserve.isra.0+0x39/0xe0 net/core/skbuff.c:142
 pskb_expand_head+0x148/0x10b0 net/core/skbuff.c:1627
 netlink_trim+0x1ea/0x240 net/netlink/af_netlink.c:1285
 netlink_broadcast_filtered+0x5f/0xd40 net/netlink/af_netlink.c:1490
 netlink_broadcast net/netlink/af_netlink.c:1535 [inline]
 nlmsg_multicast include/net/netlink.h:1020 [inline]
 nlmsg_notify+0x90/0x250 net/netlink/af_netlink.c:2512
 rtmsg_fib+0x39c/0xe40 net/ipv4/fib_semantics.c:531
 fib_table_delete+0x671/0x9b0 net/ipv4/fib_trie.c:1714
 fib_magic.isra.0+0x355/0x510 net/ipv4/fib_frontend.c:1086
 fib_del_ifaddr+0x8c7/0x1290 net/ipv4/fib_frontend.c:1196
 fib_inetaddr_event+0xb4/0x20d net/ipv4/fib_frontend.c:1427
 notifier_call_chain+0xc0/0x230 kernel/notifier.c:83
 __blocking_notifier_call_chain kernel/notifier.c:284 [inline]
 __blocking_notifier_call_chain kernel/notifier.c:271 [inline]
 blocking_notifier_call_chain kernel/notifier.c:295 [inline]
 blocking_notifier_call_chain+0x85/0xa0 kernel/notifier.c:292
 __inet_del_ifa+0x460/0xf60 net/ipv4/devinet.c:428
 inet_del_ifa net/ipv4/devinet.c:465 [inline]
 inetdev_destroy net/ipv4/devinet.c:318 [inline]
 inetdev_event+0x9dc/0x1220 net/ipv4/devinet.c:1599
 notifier_call_chain+0xc0/0x230 kernel/notifier.c:83
 call_netdevice_notifiers_info net/core/dev.c:2016 [inline]
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2001
 call_netdevice_notifiers_mtu net/core/dev.c:2065 [inline]
 dev_set_mtu_ext+0x39f/0x5f0 net/core/dev.c:8407
 do_setlink+0x671/0x3680 net/core/rtnetlink.c:2568
 rtnl_group_changelink net/core/rtnetlink.c:3124 [inline]
 __rtnl_newlink+0xc94/0x1590 net/core/rtnetlink.c:3278
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3398
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5461
 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2469
 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
 netlink_unicast+0x537/0x740 net/netlink/af_netlink.c:1329
 netlink_sendmsg+0x882/0xe10 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e6/0x810 net/socket.c:2352
 ___sys_sendmsg+0x100/0x170 net/socket.c:2406
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439
 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline]
 do_fast_syscall_32+0x270/0xe90 arch/x86/entry/common.c:396
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/06 20:42 upstream 7ae77150d94d e6b89e4e .config console log report ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.