From: syzbot <syzbot+b66b5182718939fec09b@syzkaller.appspotmail.com>
To: andrealmeid@igalia.com, dave@stgolabs.net, dvhart@infradead.org,
linux-kernel@vger.kernel.org, mingo@redhat.com,
peterz@infradead.org, syzkaller-bugs@googlegroups.com,
tglx@linutronix.de
Subject: Re: [syzbot] [kernel?] INFO: rcu detected stall in sys_futex (7)
Date: Wed, 19 Feb 2025 18:57:23 -0800 [thread overview]
Message-ID: <67b69a13.050a0220.14d86d.0155.GAE@google.com> (raw)
In-Reply-To: <000000000000733bf2061ba58c4d@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 6537cfb395f3 Merge tag 'sound-6.14-rc4' of git://git.kerne..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17365ae4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f4f6914bcba459be
dashboard link: https://syzkaller.appspot.com/bug?extid=b66b5182718939fec09b
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b65ae4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/699131ad8762/disk-6537cfb3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/70eae7bb5752/vmlinux-6537cfb3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b2de8da174e5/bzImage-6537cfb3.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b66b5182718939fec09b@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 1-...!: (0 ticks this GP) idle=e2cc/1/0x4000000000000000 softirq=15501/15501 fqs=0
rcu: (detected by 0, t=10505 jiffies, g=7317, q=400 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6093 Comm: syz.2.21 Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:__lock_acquire+0xaa7/0x3c40 kernel/locking/lockdep.c:5211
Code: 48 83 fb ff 0f 85 03 0a 00 00 c7 84 24 84 00 00 00 01 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 c8 28 00 00 48 8b 54 24 30 49 89 1f 48 b8 00 00 00 00 00 fc
RSP: 0018:ffffc90000a18af0 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: fb268dbe5ff7dd64 RCX: ffffffff81966d32
RDX: 1ffff1100619c163 RSI: 0000000000000008 RDI: ffffffff96ec2cc0
RBP: 0000000000000040 R08: 0000000000000000 R09: fffffbfff2dd8598
R10: ffffffff96ec2cc7 R11: 0000000000000001 R12: ffffed100619c15d
R13: ffff888030ce0000 R14: 0000000000000002 R15: ffff888030ce0b18
FS: 00007fe83a63f6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000400000000600 CR3: 0000000079236000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<IRQ>
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
debug_object_deactivate+0x13b/0x370 lib/debugobjects.c:873
debug_hrtimer_deactivate kernel/time/hrtimer.c:460 [inline]
debug_deactivate kernel/time/hrtimer.c:502 [inline]
__run_hrtimer kernel/time/hrtimer.c:1769 [inline]
__hrtimer_run_queues+0x47c/0xae0 kernel/time/hrtimer.c:1865
hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1927
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
__sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1049
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 a6 f9 3c f6 48 89 df e8 fe 78 3d f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 85 4f 2e f6 65 8b 05 a6 33 aa 74 85 c0 74 16 5b
RSP: 0018:ffffc90003097b88 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffff88802d0fd290 RCX: 1ffffffff20c4171
RDX: 0000000000000000 RSI: ffffffff8b6ceca0 RDI: ffffffff8bd35480
RBP: 0000000000000283 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90624f17 R11: 0000000000000002 R12: ffff88802d0fc894
R13: ffff88802d0fd290 R14: ffff88802d0fc880 R15: ffffc90003097be8
class_raw_spinlock_irqsave_destructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0x949/0x1490 kernel/sched/core.c:4214
wake_up_process kernel/sched/core.c:4463 [inline]
wake_up_q+0x9c/0x160 kernel/sched/core.c:1075
futex_wake+0x43e/0x4e0 kernel/futex/waitwake.c:199
do_futex+0x1e5/0x350 kernel/futex/syscalls.c:107
__do_sys_futex kernel/futex/syscalls.c:179 [inline]
__se_sys_futex kernel/futex/syscalls.c:160 [inline]
__x64_sys_futex+0x1e1/0x4c0 kernel/futex/syscalls.c:160
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe83978cde9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe83a63f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007fe8399a5fa8 RCX: 00007fe83978cde9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe8399a5fac
RBP: 00007fe8399a5fa0 R08: 00007fe83a640000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe8399a5fac
R13: 0000000000000000 R14: 00007ffd885fcba0 R15: 00007ffd885fcc88
</TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10504 jiffies! g7317 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=1 timer-softirq=3496
rcu: rcu_preempt kthread starved for 10505 jiffies! g7317 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27456 pid:17 tgid:17 ppid:2 task_flags:0x208040 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5378 [inline]
__schedule+0xf43/0x5890 kernel/sched/core.c:6765
__schedule_loop kernel/sched/core.c:6842 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6857
schedule_timeout+0x124/0x280 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x1eb/0xb00 kernel/rcu/tree.c:2024
rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2226
kthread+0x3af/0x750 kernel/kthread.c:464
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2025-02-20 2:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-24 16:48 [syzbot] [kernel?] INFO: rcu detected stall in sys_futex (7) syzbot
2025-02-20 2:57 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=67b69a13.050a0220.14d86d.0155.GAE@google.com \
--to=syzbot+b66b5182718939fec09b@syzkaller.appspotmail.com \
--cc=andrealmeid@igalia.com \
--cc=dave@stgolabs.net \
--cc=dvhart@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.