linux-kernel - Re: [syzbot] [mm?] INFO: rcu detected stall in exit_to_user_mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250729010657.3326-1-hdanton@sina.com>
Date: Tue, 29 Jul 2025 09:06:56 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+2642f347f7309b4880dc@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [mm?] INFO: rcu detected stall in exit_to_user_mode_loop

> Date: Mon, 28 Jul 2025 14:30:28 -0700	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    afd8c2c9e2e2 Merge branch 'ipv6-f6i-fib6_siblings-and-rt-f..
> git tree:       net
> console output: https://syzkaller.appspot.com/x/log.txt?x=13c71034580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a4bcc0a11b3192be
> dashboard link: https://syzkaller.appspot.com/bug?extid=2642f347f7309b4880dc
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17b284a2580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17c71034580000

#syz test upstream master

--- x/net/sched/sch_taprio.c
+++ y/net/sched/sch_taprio.c
@@ -918,7 +918,7 @@ static enum hrtimer_restart advance_sche
 	int num_tc = netdev_get_num_tc(dev);
 	struct sched_entry *entry, *next;
 	struct Qdisc *sch = q->root;
-	ktime_t end_time;
+	ktime_t end_time, now;
 	int tc;
 
 	spin_lock(&q->current_entry_lock);
@@ -980,6 +980,11 @@ first_run:
 	rcu_assign_pointer(q->current_entry, next);
 	spin_unlock(&q->current_entry_lock);
 
+	now = timer->base->get_time();
+	now = ktime_add_us(now, 2);
+	/* is end_time sane? */
+	if (ktime_after(now, end_time))
+		end_time = now;
 	hrtimer_set_expires(&q->advance_timer, end_time);
 
 	rcu_read_lock();
--