| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <66eddbd6.050a0220.3195df.0013.GAE@google.com> Date: Fri, 20 Sep 2024 13:32:22 -0700 From: syzbot <syzbot+572f6e36bc6ee6f16762@...kaller.appspotmail.com> To: a@...table.cc, b.a.t.m.a.n@...ts.open-mesh.org, davem@...emloft.net, edumazet@...gle.com, kadlec@...filter.org, kuba@...nel.org, linux-kernel@...r.kernel.org, mareklindner@...mailbox.ch, netdev@...r.kernel.org, netfilter-devel@...r.kernel.org, pabeni@...hat.com, pablo@...filter.org, sven@...fation.org, sw@...onwunderlich.de, syzkaller-bugs@...glegroups.com Subject: Re: [syzbot] [netfilter] BUG: soft lockup in batadv_iv_send_outstanding_bat_ogm_packet syzbot has found a reproducer for the following issue on: HEAD commit: a430d95c5efa Merge tag 'lsm-pr-20240911' of git://git.kern.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=17e87f00580000 kernel config: https://syzkaller.appspot.com/x/.config?x=44d46e514184cd24 dashboard link: https://syzkaller.appspot.com/bug?extid=572f6e36bc6ee6f16762 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1481cca9980000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14929607980000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/bdf130384fad/disk-a430d95c.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/c62ff195641a/vmlinux-a430d95c.xz kernel image: https://storage.googleapis.com/syzbot-assets/4069702199e2/bzImage-a430d95c.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+572f6e36bc6ee6f16762@...kaller.appspotmail.com rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P1119/1:b..l rcu: (detected by 0, t=10503 jiffies, g=23913, q=347 ncpus=2) task:kworker/u8:6 state:R running task stack:24576 pid:1119 tgid:1119 ppid:2 flags:0x00004000 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet Call Trace: <TASK> context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:6851 irqentry_exit+0x36/0x90 kernel/entry/common.c:354 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x1f2/0x560 kernel/locking/lockdep.c:5727 Code: c1 05 ea b0 98 7e 83 f8 01 0f 85 ea 02 00 00 9c 58 f6 c4 02 0f 85 d5 02 00 00 48 85 ed 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24 RSP: 0018:ffffc900045b7a70 EFLAGS: 00000206 RAX: dffffc0000000000 RBX: 1ffff920008b6f50 RCX: 0000000000000001 RDX: 0000000000000001 RSI: ffffffff8b4cddc0 RDI: ffffffff8bb118a0 RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff2d39ae0 R10: ffffffff969cd707 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffffffff8ddba6a0 R15: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:326 [inline] rcu_read_lock include/linux/rcupdate.h:838 [inline] batadv_iv_ogm_slide_own_bcast_window net/batman-adv/bat_iv_ogm.c:754 [inline] batadv_iv_ogm_schedule_buff+0x5ac/0x14d0 net/batman-adv/bat_iv_ogm.c:825 batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:868 [inline] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:861 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x31e/0x8d0 net/batman-adv/bat_iv_ogm.c:1712 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> rcu: rcu_preempt kthread starved for 10529 jiffies! g23913 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:27680 pid:17 tgid:17 ppid:2 flags:0x00004000 Call Trace: <TASK> context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_timeout+0x136/0x2a0 kernel/time/timer.c:2581 rcu_gp_fqs_loop+0x1eb/0xb00 kernel/rcu/tree.c:2034 rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2236 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-syzkaller-02574-ga430d95c5efa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:92 [inline] RIP: 0010:acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:112 Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 65 48 8b 05 78 a2 eb 74 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 68 56 a4 00 fb f4 <fa> c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffffff8da07d70 EFLAGS: 00000246 RAX: 0000000000004000 RBX: 0000000000000001 RCX: ffffffff8b181979 RDX: 0000000000000001 RSI: ffff8880212b3000 RDI: ffff8880212b3064 RBP: ffff8880212b3064 R08: 0000000000000001 R09: ffffed1017106fd9 R10: ffff8880b8837ecb R11: 0000000000000000 R12: ffff8880212be800 R13: ffffffff8e9faa20 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff2dde0dd58 CR3: 000000002ad40000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> </IRQ> <TASK> acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:702 cpuidle_enter_state+0xaa/0x4f0 drivers/cpuidle/cpuidle.c:264 cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:385 cpuidle_idle_call kernel/sched/idle.c:230 [inline] do_idle+0x313/0x3f0 kernel/sched/idle.c:326 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424 rest_init+0x16b/0x2b0 init/main.c:747 start_kernel+0x3e4/0x4d0 init/main.c:1105 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x148 </TASK> --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing.
Powered by blists - more mailing lists