[syzbot] [kernel?] WARNING in _cpu_down

[syzbot] [kernel?] WARNING in _cpu_down

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    4ae12d8bd9a8 Merge tag 'kbuild-fixes-7.0-2' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=177cca02580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=163cf0fb07ea84d3
dashboard link: https://syzkaller.appspot.com/bug?extid=123e1b70473ce213f3af
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5ef14578e4fb/disk-4ae12d8b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7d3000c5cbb9/vmlinux-4ae12d8b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6106927c4009/bzImage-4ae12d8b.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+123e1b70473ce213f3af@syzkaller.appspotmail.com

smpboot: CPU 1 is now offline
smpboot: Booting Node 0 Processor 1 APIC 0x1
------------[ cut here ]------------
DEAD callback error for CPU1
WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614
Modules linked in:
CPU: 0 UID: 0 PID: 14614 Comm: syz.0.1960 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:_cpu_down+0x75c/0x1020 kernel/cpu.c:1463
Code: c5 7a f6 89 ee bf 91 00 00 00 e8 1f c0 7a f6 81 fd 91 00 00 00 0f 84 6b 02 00 00 e8 5e c5 7a f6 48 8d 3d 67 73 4f 05 44 89 ee <67> 48 0f b9 3a e9 3a fa ff ff 45 31 ff e9 32 fa ff ff e8 3d c5 7a
RSP: 0018:ffffc900048f7aa8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8880b85242e0 RCX: ffffffff8b8d4a31
RDX: ffff88802e158000 RSI: 0000000000000001 RDI: ffffffff90dcbdb0
RBP: 0000000000000092 R08: 0000000000000005 R09: 0000000000000091
R10: 0000000000000092 R11: 0000000000000001 R12: 00000000000000ed
R13: 0000000000000001 R14: 0000000000000001 R15: 00000000fffffff5
FS:  00007f0d3e4e06c0(0000) GS:ffff88812434b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001b19000 CR3: 0000000059358000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 cpu_down_maps_locked kernel/cpu.c:1483 [inline]
 cpu_down kernel/cpu.c:1491 [inline]
 cpu_device_down+0x82/0xc0 kernel/cpu.c:1508
 device_offline drivers/base/core.c:4196 [inline]
 device_offline+0x2a7/0x3c0 drivers/base/core.c:4180
 online_store+0xd1/0x180 drivers/base/core.c:2809
 dev_attr_store+0x58/0x80 drivers/base/core.c:2437
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:142
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1070 fs/read_write.c:688
 ksys_write+0x12a/0x250 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0d3d59c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0d3e4e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f0d3d816180 RCX: 00007f0d3d59c799
RDX: 000000000000000b RSI: 00002000000002c0 RDI: 0000000000000003
RBP: 00007f0d3d632bd9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0d3d816218 R14: 00007f0d3d816180 R15: 00007ffd5aeaf7e8
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	7a f6                	jp     0xfffffff8
   2:	89 ee                	mov    %ebp,%esi
   4:	bf 91 00 00 00       	mov    $0x91,%edi
   9:	e8 1f c0 7a f6       	call   0xf67ac02d
   e:	81 fd 91 00 00 00    	cmp    $0x91,%ebp
  14:	0f 84 6b 02 00 00    	je     0x285
  1a:	e8 5e c5 7a f6       	call   0xf67ac57d
  1f:	48 8d 3d 67 73 4f 05 	lea    0x54f7367(%rip),%rdi        # 0x54f738d
  26:	44 89 ee             	mov    %r13d,%esi
* 29:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2e:	e9 3a fa ff ff       	jmp    0xfffffa6d
  33:	45 31 ff             	xor    %r15d,%r15d
  36:	e9 32 fa ff ff       	jmp    0xfffffa6d
  3b:	e8                   	.byte 0xe8
  3c:	3d                   	.byte 0x3d
  3d:	c5                   	.byte 0xc5
  3e:	7a                   	.byte 0x7a


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [kernel?] WARNING in _cpu_down

[Thomas Gleixner]

On Mon, Mar 09 2026 at 10:57, syzbot wrote:
> syzbot found the following issue on:
>
> HEAD commit:    4ae12d8bd9a8 Merge tag 'kbuild-fixes-7.0-2' of git://git.k..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=177cca02580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=163cf0fb07ea84d3
> dashboard link: https://syzkaller.appspot.com/bug?extid=123e1b70473ce213f3af
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> smpboot: CPU 1 is now offline
> smpboot: Booting Node 0 Processor 1 APIC 0x1
> ------------[ cut here ]------------
> DEAD callback error for CPU1
> WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614

That means one of the hotplug state callbacks which are issued after a
CPU is dead returned an error. That's wrong. Those callbacks are not
supposed to fail as there is no way to rollback at that point.

A quick coccinelle search finds exactly one callback in that stage which
might return an error code:

      padata_cpu_dead()

Not sure how to fix that. I leave it to the padata folks ...

Thanks

        tglx

Re: [syzbot] [kernel?] WARNING in _cpu_down

[Daniel Jordan]

On Wed, Mar 11, 2026 at 08:56:36AM +0100, Thomas Gleixner wrote:
> On Mon, Mar 09 2026 at 10:57, syzbot wrote:
> > syzbot found the following issue on:
> >
> > HEAD commit:    4ae12d8bd9a8 Merge tag 'kbuild-fixes-7.0-2' of git://git.k..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=177cca02580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=163cf0fb07ea84d3
> > dashboard link: https://syzkaller.appspot.com/bug?extid=123e1b70473ce213f3af
> > compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> > smpboot: CPU 1 is now offline
> > smpboot: Booting Node 0 Processor 1 APIC 0x1
> > ------------[ cut here ]------------
> > DEAD callback error for CPU1
> > WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614
> 
> That means one of the hotplug state callbacks which are issued after a
> CPU is dead returned an error. That's wrong. Those callbacks are not
> supposed to fail as there is no way to rollback at that point.
> 
> A quick coccinelle search finds exactly one callback in that stage which
> might return an error code:
> 
>       padata_cpu_dead()
> 
> Not sure how to fix that. I leave it to the padata folks ...

CPUHP_PADATA_DEAD can go away entirely, and padata's callback from the
ONLINE section of hotplug can take care of teardown instead, the way it
used to before CPUHP_PADATA_DEAD got added.  That way the failure will
be allowed to happen.

It's memory allocation that might fail, and it's harder to avoid the
allocations than to move the callback to a different part of the hotplug
state machine.

I'll try it out.

Re: [syzbot] [kernel?] WARNING in _cpu_down

[Daniel Jordan]

On Wed, Mar 11, 2026 at 12:45:33PM -0400, Daniel Jordan wrote:
> On Wed, Mar 11, 2026 at 08:56:36AM +0100, Thomas Gleixner wrote:
> > On Mon, Mar 09 2026 at 10:57, syzbot wrote:
> > > syzbot found the following issue on:
> > >
> > > HEAD commit:    4ae12d8bd9a8 Merge tag 'kbuild-fixes-7.0-2' of git://git.k..
> > > git tree:       upstream
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=177cca02580000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=163cf0fb07ea84d3
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=123e1b70473ce213f3af
> > > compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> > > smpboot: CPU 1 is now offline
> > > smpboot: Booting Node 0 Processor 1 APIC 0x1
> > > ------------[ cut here ]------------
> > > DEAD callback error for CPU1
> > > WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614
> > 
> > That means one of the hotplug state callbacks which are issued after a
> > CPU is dead returned an error. That's wrong. Those callbacks are not
> > supposed to fail as there is no way to rollback at that point.
> > 
> > A quick coccinelle search finds exactly one callback in that stage which
> > might return an error code:
> > 
> >       padata_cpu_dead()
> > 
> > Not sure how to fix that. I leave it to the padata folks ...
> 
> CPUHP_PADATA_DEAD can go away entirely, and padata's callback from the
> ONLINE section of hotplug can take care of teardown instead, the way it
> used to before CPUHP_PADATA_DEAD got added.  That way the failure will
> be allowed to happen.
> 
> It's memory allocation that might fail, and it's harder to avoid the
> allocations than to move the callback to a different part of the hotplug
> state machine.
> 
> I'll try it out.

Potential fix is here:
    https://lore.kernel.org/all/20260312172959.471272-1-daniel.m.jordan@oracle.com/

Re: [syzbot] [kernel?] WARNING in _cpu_down

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    2d1373e4246d Merge tag 'for-7.0-rc4-tag' of git://git.kern..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16b93d52580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=64e78d99d9bf8b4c
dashboard link: https://syzkaller.appspot.com/bug?extid=123e1b70473ce213f3af
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d358ba580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=129dc4da580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2ccba0c603a6/disk-2d1373e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6aaccd7990b8/vmlinux-2d1373e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/78e3c8cc74dc/bzImage-2d1373e4.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+123e1b70473ce213f3af@syzkaller.appspotmail.com

smpboot: CPU 1 is now offline
smpboot: Booting Node 0 Processor 1 APIC 0x1
------------[ cut here ]------------
DEAD callback error for CPU1
WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.17/6077
Modules linked in:
CPU: 0 UID: 0 PID: 6077 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:_cpu_down+0x75c/0x1020 kernel/cpu.c:1463
Code: 5e 7a f6 89 ee bf 91 00 00 00 e8 df 58 7a f6 81 fd 91 00 00 00 0f 84 6b 02 00 00 e8 1e 5e 7a f6 48 8d 3d f7 f4 4e 05 44 89 ee <67> 48 0f b9 3a e9 3a fa ff ff 45 31 ff e9 32 fa ff ff e8 fd 5d 7a
RSP: 0000:ffffc90003007aa8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8880b85242e0 RCX: ffffffff8b8dba31
RDX: ffff888032059e80 RSI: 0000000000000001 RDI: ffffffff90dcaf40
RBP: 0000000000000092 R08: 0000000000000005 R09: 0000000000000091
R10: 0000000000000092 R11: 0000000000000001 R12: 00000000000000ed
R13: 0000000000000001 R14: 0000000000000001 R15: 00000000fffffff5
FS:  00007f99429dd6c0(0000) GS:ffff88812434a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff5c7ffd88 CR3: 00000000747b2000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 cpu_down_maps_locked kernel/cpu.c:1483 [inline]
 cpu_down kernel/cpu.c:1491 [inline]
 cpu_device_down+0x82/0xc0 kernel/cpu.c:1508
 device_offline drivers/base/core.c:4196 [inline]
 device_offline+0x2a7/0x3c0 drivers/base/core.c:4180
 online_store+0xd1/0x180 drivers/base/core.c:2809
 dev_attr_store+0x58/0x80 drivers/base/core.c:2437
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:142
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1070 fs/read_write.c:688
 ksys_write+0x12a/0x250 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f994339c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f99429dd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9943616090 RCX: 00007f994339c799
RDX: 000000000000000b RSI: 00002000000002c0 RDI: 0000000000000003
RBP: 00007f9943432c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9943616128 R14: 00007f9943616090 R15: 00007ffc2a4e69a8
 </TASK>
----------------
Code disassembly (best guess):
   0:	5e                   	pop    %rsi
   1:	7a f6                	jp     0xfffffff9
   3:	89 ee                	mov    %ebp,%esi
   5:	bf 91 00 00 00       	mov    $0x91,%edi
   a:	e8 df 58 7a f6       	call   0xf67a58ee
   f:	81 fd 91 00 00 00    	cmp    $0x91,%ebp
  15:	0f 84 6b 02 00 00    	je     0x286
  1b:	e8 1e 5e 7a f6       	call   0xf67a5e3e
  20:	48 8d 3d f7 f4 4e 05 	lea    0x54ef4f7(%rip),%rdi        # 0x54ef51e
  27:	44 89 ee             	mov    %r13d,%esi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e9 3a fa ff ff       	jmp    0xfffffa6e
  34:	45 31 ff             	xor    %r15d,%r15d
  37:	e9 32 fa ff ff       	jmp    0xfffffa6e
  3c:	e8                   	.byte 0xe8
  3d:	fd                   	std
  3e:	5d                   	pop    %rbp
  3f:	7a                   	.byte 0x7a


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.