Date:   Sun, 17 Feb 2019 15:44:03 -0800
From:   syzbot <syzbot+a910a514846e27f15348@...kaller.appspotmail.com>
To:     coreteam@...filter.org, davem@...emloft.net, fw@...len.de,
        herbert@...dor.apana.org.au, kadlec@...ckhole.kfki.hu,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        netfilter-devel@...r.kernel.org, pablo@...filter.org,
        steffen.klassert@...unet.com, syzkaller-bugs@...glegroups.com
Subject: Re: INFO: rcu detected stall in netlink_sendmsg

syzbot has found a reproducer for the following crash on:

HEAD commit:    8d33316d5205 Merge branch 'x86-urgent-for-linus' of git://..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14d5f3bcc00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ee434566c893c7b1
dashboard link: https://syzkaller.appspot.com/bug?extid=a910a514846e27f15348
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13923b60c00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a910a514846e27f15348@...kaller.appspotmail.com

kernel msg: ebtables bug: please report to author: Entries_size never zero
kernel msg: ebtables bug: please report to author: Entries_size never zero
kernel msg: ebtables bug: please report to author: Entries_size never zero
kernel msg: ebtables bug: please report to author: Entries_size never zero
32-bit node address hash set to aa1414ac
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	1-....: (1 GPs behind) idle=5aa/1/0x4000000000000002  
softirq=10469/10470 fqs=5225
rcu: 	 (t=10500 jiffies g=6081 q=489)
NMI backtrace for cpu 1
CPU: 1 PID: 7809 Comm: syz-executor.3 Not tainted 5.0.0-rc6+ #76
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  <IRQ>
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x172/0x1f0 lib/dump_stack.c:113
  nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
  nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
  arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
  trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
  rcu_dump_cpu_stacks+0x183/0x1cf kernel/rcu/tree.c:1211
  print_cpu_stall kernel/rcu/tree.c:1348 [inline]
  check_cpu_stall kernel/rcu/tree.c:1422 [inline]
  rcu_pending kernel/rcu/tree.c:3018 [inline]
  rcu_check_callbacks.cold+0x500/0xa4a kernel/rcu/tree.c:2521
  update_process_times+0x32/0x80 kernel/time/timer.c:1635
  tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:161
  tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271
  __run_hrtimer kernel/time/hrtimer.c:1389 [inline]
  __hrtimer_run_queues+0x33e/0xde0 kernel/time/hrtimer.c:1451
  hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509
  local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
  smp_apic_timer_interrupt+0x120/0x570 arch/x86/kernel/apic/apic.c:1060
  apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
  </IRQ>
RIP: 0010:check_memory_region+0x21/0x190 mm/kasan/generic.c:190
Code: 2e 0f 1f 84 00 00 00 00 00 48 85 f6 0f 84 21 01 00 00 48 b8 ff ff ff  
ff ff 7f ff ff 55 0f b6 d2 48 39 c7 48 89 e5 41 55 41 54 <53> 0f 86 f6 00  
00 00 4c 8d 5c 37 ff 49 89 f8 48 b8 00 00 00 00 00
RSP: 0018:ffff88808b8fea60 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13
RAX: ffff7fffffffffff RBX: ffffe8ffffd2f348 RCX: ffffffff8157be27
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffe8ffffd2f348
RBP: ffff88808b8fea70 R08: 1ffffd1ffffa5e69 R09: fffff91ffffa5e6a
R10: fffff91ffffa5e69 R11: ffffe8ffffd2f34b R12: 0000000000000001
R13: 0000000000000003 R14: fffff91ffffa5e69 R15: 00000000000005e8
  kasan_check_read+0x11/0x20 mm/kasan/common.c:100
  atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
  virt_spin_lock arch/x86/include/asm/qspinlock.h:83 [inline]
  native_queued_spin_lock_slowpath+0xb7/0x970 kernel/locking/qspinlock.c:337
  pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:653 [inline]
  queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:50 [inline]
  queued_spin_lock include/asm-generic/qspinlock.h:90 [inline]
  do_raw_spin_lock+0x20e/0x2e0 kernel/locking/spinlock_debug.c:113
  __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
  _raw_spin_lock+0x37/0x40 kernel/locking/spinlock.c:144
  spin_lock include/linux/spinlock.h:329 [inline]
  nf_ct_add_to_unconfirmed_list net/netfilter/nf_conntrack_core.c:462  
[inline]
  init_conntrack.isra.0+0xa15/0x1180 net/netfilter/nf_conntrack_core.c:1437
  resolve_normal_ct net/netfilter/nf_conntrack_core.c:1479 [inline]
  nf_conntrack_in+0xa68/0x1070 net/netfilter/nf_conntrack_core.c:1585
  ipv4_conntrack_local+0x169/0x210 net/netfilter/nf_conntrack_proto.c:444
  nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline]
  nf_hook_slow+0xbf/0x1f0 net/netfilter/core.c:511
  nf_hook include/linux/netfilter.h:244 [inline]
  __ip_local_out+0x403/0x880 net/ipv4/ip_output.c:113
  ip_local_out+0x2d/0x1b0 net/ipv4/ip_output.c:122
  iptunnel_xmit+0x58e/0x980 net/ipv4/ip_tunnel_core.c:91
  udp_tunnel_xmit_skb+0x236/0x310 net/ipv4/udp_tunnel.c:200
  tipc_udp_xmit.isra.0+0x7fd/0xcc0 net/tipc/udp_media.c:181
  tipc_udp_send_msg+0x295/0x4a0 net/tipc/udp_media.c:247
  tipc_bearer_xmit_skb+0x172/0x360 net/tipc/bearer.c:503
  tipc_enable_bearer+0xac4/0xd20 net/tipc/bearer.c:328
  __tipc_nl_bearer_enable+0x2d1/0x3b0 net/tipc/bearer.c:899
  tipc_nl_bearer_enable+0x23/0x40 net/tipc/bearer.c:907
  genl_family_rcv_msg+0x6e1/0xd90 net/netlink/genetlink.c:601
  genl_rcv_msg+0xca/0x16c net/netlink/genetlink.c:626
  netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2477
  genl_rcv+0x29/0x40 net/netlink/genetlink.c:637
  netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
  netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1336
  netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1917
  sock_sendmsg_nosec net/socket.c:621 [inline]
  sock_sendmsg+0xdd/0x130 net/socket.c:631
  ___sys_sendmsg+0x806/0x930 net/socket.c:2114
  __sys_sendmsg+0x105/0x1d0 net/socket.c:2152
  __do_sys_sendmsg net/socket.c:2161 [inline]
  __se_sys_sendmsg net/socket.c:2159 [inline]
  __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2159
  do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457e29
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7  
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fafcebf0c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29
RDX: 0000000000000010 RSI: 00000000200000c0 RDI: 0000000000000009
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fafcebf16d4
R13: 00000000004c5210 R14: 00000000004d8fc8 R15: 00000000ffffffff

Powered by blists - more mailing lists