Re: [syzbot] [kernel?] WARNING: ODEBUG bug in smpboot_thread_fn

Re: [syzbot] [kernel?] WARNING: ODEBUG bug in smpboot_thread_fn

[Thomas Gleixner]

On Mon, May 04 2026 at 05:23, syzbot wrote:

Cc'ed network/bridge people as that's clearly in their realm.

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    6d35786de281 Merge tag 'for-linus' of git://git.kernel.org..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=126bf21f980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f2e8ebfec4636d32
> dashboard link: https://syzkaller.appspot.com/bug?extid=ae231e0552fa77b26ea1
> compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/b3ab34c4c807/disk-6d35786d.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/03f465478178/vmlinux-6d35786d.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/29d261604425/bzImage-6d35786d.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ae231e0552fa77b26ea1@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> ODEBUG: free active (active state 0) object: ffff888033a47278 object type: timer_list hint: br_ip6_multicast_port_query_expired+0x0/0x380 net/bridge/br_multicast.c:-1

                                                                                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
An object which contains an active timer is RCU freed....

> WARNING: lib/debugobjects.c:632 at debug_print_object lib/debugobjects.c:629 [inline], CPU#1: rcuc/1/28
> WARNING: lib/debugobjects.c:632 at __debug_check_no_obj_freed lib/debugobjects.c:1116 [inline], CPU#1: rcuc/1/28
> WARNING: lib/debugobjects.c:632 at debug_check_no_obj_freed+0x405/0x550 lib/debugobjects.c:1146, CPU#1: rcuc/1/28
> Modules linked in:
> CPU: 1 UID: 0 PID: 28 Comm: rcuc/1 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
> Tainted: [L]=SOFTLOCKUP
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
> RIP: 0010:debug_print_object lib/debugobjects.c:629 [inline]
> RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1116 [inline]
> RIP: 0010:debug_check_no_obj_freed+0x44a/0x550 lib/debugobjects.c:1146
> Code: 89 44 24 20 e8 27 81 7f fd 48 8b 44 24 20 4c 8b 4d 00 4c 89 ef 48 c7 c6 a0 53 a7 8b 48 c7 c2 20 59 a7 8b 8b 0c 24 4d 89 f8 50 <67> 48 0f b9 3a 48 83 c4 08 4c 8b 6c 24 18 48 b9 00 00 00 00 00 fc
> RSP: 0018:ffffc90000a2fa90 EFLAGS: 00010246
> RAX: ffffffff89f32240 RBX: ffffffff99a8edc0 RCX: 0000000000000000
> RDX: ffffffff8ba75920 RSI: ffffffff8ba753a0 RDI: ffffffff8f933740
> RBP: ffffffff8b4f5380 R08: ffff888033a47278 R09: ffffffff8b4f6700
> R10: dffffc0000000000 R11: ffffffff81b0c180 R12: ffff888033a47400
> R13: ffffffff8f933740 R14: ffff888033a47000 R15: ffff888033a47278
> FS:  0000000000000000(0000) GS:ffff888126279000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fb873a4da08 CR3: 000000004cc78000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  slab_free_hook mm/slub.c:2620 [inline]
>  slab_free mm/slub.c:6250 [inline]
>  kfree+0x13e/0x6c0 mm/slub.c:6565
>  kobject_cleanup lib/kobject.c:689 [inline]
>  kobject_release lib/kobject.c:720 [inline]
>  kref_put include/linux/kref.h:65 [inline]
>  kobject_put+0x228/0x560 lib/kobject.c:737
>  rcu_do_batch kernel/rcu/tree.c:2617 [inline]
>  rcu_core kernel/rcu/tree.c:2869 [inline]
>  rcu_cpu_kthread+0x99e/0x1470 kernel/rcu/tree.c:2957
>  smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
>  kthread+0x388/0x470 kernel/kthread.c:436
>  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>

Re: [syzbot] [kernel?] WARNING: ODEBUG bug in smpboot_thread_fn

[Thomas Gleixner]

On Wed, May 06 2026 at 18:29, Thomas Gleixner wrote:
> On Mon, May 04 2026 at 05:23, syzbot wrote:
>>
>> ------------[ cut here ]------------
>> ODEBUG: free active (active state 0) object: ffff888033a47278 object type: timer_list hint: br_ip6_multicast_port_query_expired+0x0/0x380 net/bridge/br_multicast.c:-1
>
>                                                                                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> An object which contains an active timer is RCU freed....

Unlike the other timer in the same object, the own_query timer is not
shut down in br_multicast_port_ctx_deinit()

Something kike the below.

Thanks,

        tglx
---
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -2030,8 +2030,10 @@ void br_multicast_port_ctx_deinit(struct
 
 #if IS_ENABLED(CONFIG_IPV6)
 	timer_delete_sync(&pmctx->ip6_mc_router_timer);
+	timer_delete_sync(&pmctx->ip6_own_query_timer);
 #endif
 	timer_delete_sync(&pmctx->ip4_mc_router_timer);
+	timer_delete_sync(&pmctx->ip4_own_query_timer);
 
 	spin_lock_bh(&br->multicast_lock);
 	del |= br_ip6_multicast_rport_del(pmctx);

Re: [syzbot] [kernel?] WARNING: ODEBUG bug in smpboot_thread_fn

[Ido Schimmel]

On Thu, May 07, 2026 at 10:57:04AM +0200, Thomas Gleixner wrote:
> On Wed, May 06 2026 at 18:29, Thomas Gleixner wrote:
> > On Mon, May 04 2026 at 05:23, syzbot wrote:
> >>
> >> ------------[ cut here ]------------
> >> ODEBUG: free active (active state 0) object: ffff888033a47278 object type: timer_list hint: br_ip6_multicast_port_query_expired+0x0/0x380 net/bridge/br_multicast.c:-1
> >
> >                                                                                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > An object which contains an active timer is RCU freed....
> 
> Unlike the other timer in the same object, the own_query timer is not
> shut down in br_multicast_port_ctx_deinit()
> 
> Something kike the below.
> 
> Thanks,
> 
>         tglx
> ---
> --- a/net/bridge/br_multicast.c
> +++ b/net/bridge/br_multicast.c
> @@ -2030,8 +2030,10 @@ void br_multicast_port_ctx_deinit(struct
>  
>  #if IS_ENABLED(CONFIG_IPV6)
>  	timer_delete_sync(&pmctx->ip6_mc_router_timer);
> +	timer_delete_sync(&pmctx->ip6_own_query_timer);
>  #endif
>  	timer_delete_sync(&pmctx->ip4_mc_router_timer);
> +	timer_delete_sync(&pmctx->ip4_own_query_timer);
>  
>  	spin_lock_bh(&br->multicast_lock);
>  	del |= br_ip6_multicast_rport_del(pmctx);

Thanks for the report and the fix. It looks correct, but it's unclear to
me which commit to blame.

AFAICT, the trace tells us that the timer is pending (not executing)
when the object that contains it is RCU freed. However, it shouldn't be
possible for the timer to be pending at this stage since it is
deactivated when the port multicast context is disabled and it is only
reactivated if the context is not disabled.

So, I see two options:

1. We did not disable port multicast context.

2. We did disable the port multicast context, but the timer somehow got
reactivated.

I will look into it...

Re: [syzbot] [kernel?] WARNING: ODEBUG bug in smpboot_thread_fn

[Ido Schimmel]

On Thu, May 07, 2026 at 08:30:10PM +0300, Ido Schimmel wrote:
> On Thu, May 07, 2026 at 10:57:04AM +0200, Thomas Gleixner wrote:
> > On Wed, May 06 2026 at 18:29, Thomas Gleixner wrote:
> > > On Mon, May 04 2026 at 05:23, syzbot wrote:
> > >>
> > >> ------------[ cut here ]------------
> > >> ODEBUG: free active (active state 0) object: ffff888033a47278 object type: timer_list hint: br_ip6_multicast_port_query_expired+0x0/0x380 net/bridge/br_multicast.c:-1
> > >
> > >                                                                                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > An object which contains an active timer is RCU freed....
> > 
> > Unlike the other timer in the same object, the own_query timer is not
> > shut down in br_multicast_port_ctx_deinit()
> > 
> > Something kike the below.
> > 
> > Thanks,
> > 
> >         tglx
> > ---
> > --- a/net/bridge/br_multicast.c
> > +++ b/net/bridge/br_multicast.c
> > @@ -2030,8 +2030,10 @@ void br_multicast_port_ctx_deinit(struct
> >  
> >  #if IS_ENABLED(CONFIG_IPV6)
> >  	timer_delete_sync(&pmctx->ip6_mc_router_timer);
> > +	timer_delete_sync(&pmctx->ip6_own_query_timer);
> >  #endif
> >  	timer_delete_sync(&pmctx->ip4_mc_router_timer);
> > +	timer_delete_sync(&pmctx->ip4_own_query_timer);
> >  
> >  	spin_lock_bh(&br->multicast_lock);
> >  	del |= br_ip6_multicast_rport_del(pmctx);
> 
> Thanks for the report and the fix. It looks correct, but it's unclear to
> me which commit to blame.
> 
> AFAICT, the trace tells us that the timer is pending (not executing)
> when the object that contains it is RCU freed. However, it shouldn't be
> possible for the timer to be pending at this stage since it is
> deactivated when the port multicast context is disabled and it is only
> reactivated if the context is not disabled.
> 
> So, I see two options:
> 
> 1. We did not disable port multicast context.
> 
> 2. We did disable the port multicast context, but the timer somehow got
> reactivated.
> 
> I will look into it...

FYI, I found the problem (and a reproducer). I will try to send a fix
later this week