Re: [syzbot] [net?] BUG: soft lockup in sys_sendmsg (2)
From: Hillf Danton <hidden>
Date: 2025-09-02 06:47:05
Also in:
linux-block, linux-mm, lkml
Date: Mon, 01 Sep 2025 21:28:29 -0700 syzbot has found a reproducer for the following issue on:
This report makes no sense even with a reproducer because
HEAD commit: 7fa4d8dc380f Add linux-next specific files for 20250821 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=16094a42580000 kernel config: https://syzkaller.appspot.com/x/.config?x=ae76068823a236b3 dashboard link: https://syzkaller.appspot.com/bug?extid=4032319a6a907f69e985 compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15990312580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/63178c6ef3f8/disk-7fa4d8dc.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/c5c27b0841e0/vmlinux-7fa4d8dc.xz kernel image: https://storage.googleapis.com/syzbot-assets/9a8832715cca/bzImage-7fa4d8dc.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+4032319a6a907f69e985@syzkaller.appspotmail.com rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5234/1:b..l rcu: (detected by 1, t=10503 jiffies, g=7533, q=653 ncpus=2) task:udevd state:R running task stack:26096 pid:5234 tgid:5234 ppid:1 task_flags:0x400140 flags:0x00004002 Call Trace: <TASK> context_switch kernel/sched/core.c:5357 [inline] __schedule+0x1798/0x4cc0 kernel/sched/core.c:6961 preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7288 irqentry_exit+0x6f/0x90 kernel/entry/common.c:197 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] RIP: 0010:tif_test_bit include/linux/thread_info.h:192 [inline] RIP: 0010:tif_need_resched include/linux/thread_info.h:208 [inline] RIP: 0010:need_resched include/linux/sched.h:2211 [inline] RIP: 0010:preempt_schedule_common+0x11/0xd0 kernel/sched/core.c:7153 Code: 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 41 56 53 49 bf 00 00 00 00 00 fc ff df eb 0d <48> f7 03 08 00 00 00 0f 84 9b 00 00 00 65 ff 05 0b 76 5e 07 65 8b RSP: 0018:ffffc900030c7540 EFLAGS: 00000246 RAX: 1ffff11008494b40 RBX: ffff8880424a5a00 RCX: aa2a76cb3742ae00 RDX: 0000000000000000 RSI: ffffffff8c04e5e0 RDI: ffffffff8c04e5a0 RBP: ffffc900030c75d8 R08: ffffffff8fe52d37 R09: 1ffffffff1fca5a6 R10: dffffc0000000000 R11: fffffbfff1fca5a7 R12: dffffc0000000000 R13: ffff88807da4ce80 R14: ffff8880424a6ee0 R15: dffffc0000000000 preempt_schedule+0xae/0xc0 kernel/sched/core.c:7169 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xfd/0x110 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] __wake_up_common_lock+0x190/0x1f0 kernel/sched/wait.c:127 sock_def_readable+0x1fb/0x550 net/core/sock.c:3564 __netlink_sendskb net/netlink/af_netlink.c:1265 [inline] netlink_sendskb+0xa1/0x140 net/netlink/af_netlink.c:1271 netlink_unicast+0x397/0x9e0 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa3432a7407 RSP: 002b:00007ffded507800 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fa343a95880 RCX: 00007fa3432a7407 RDX: 0000000000000000 RSI: 00007ffded507860 RDI: 0000000000000004 RBP: 0000562320cd2f40 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00000000000000b2 R13: 0000562320cb09e0 R14: 0000000000000000 R15: 0000000000000000 </TASK> rcu: rcu_preempt kthread starved for 10543 jiffies! g7533 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28008 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 Call Trace: <TASK> context_switch kernel/sched/core.c:5357 [inline] __schedule+0x1798/0x4cc0 kernel/sched/core.c:6961 __schedule_loop kernel/sched/core.c:7043 [inline] schedule+0x165/0x360 kernel/sched/core.c:7058 schedule_timeout+0x12b/0x270 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x301/0x1540 kernel/rcu/tree.c:2083 rcu_gp_kthread+0x99/0x390 kernel/rcu/tree.c:2285 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x47c/0x820 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6072 Comm: syz.2.32 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:list_empty include/linux/list.h:381 [inline] RIP: 0010:plist_del+0x88/0x3f0 lib/plist.c:126 Code: 5e f0 3f f6 48 89 df e8 56 07 00 00 4d 8d 7e 08 4c 89 fd 48 c1 ed 03 42 80 7c 25 00 00 74 08 4c 89 ff e8 0b 9a a3 f6 4d 8b 2f <4d> 39 fd 74 6d 4d 8d 66 18 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 RSP: 0018:ffffc900030d76d0 EFLAGS: 00000046 RAX: ffffffff8b80e8df RBX: ffff8880b863a8e8 RCX: ffff888027c59e00 RDX: 0000000000000000 RSI: ffff8880b863a8e8 RDI: ffff8880b863a8e8 RBP: 1ffff11004f8b464 R08: ffff888140a911f7 R09: 1ffff1102815223e R10: dffffc0000000000 R11: ffffed102815223f R12: dffffc0000000000 R13: ffff888027c5a320 R14: ffff888027c5a318 R15: ffff888027c5a320 FS: 00007ffbb84b56c0(0000) GS:ffff8881257c4000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000058 CR3: 000000007dd24000 CR4: 00000000003526f0 Call Trace: <TASK> dequeue_pushable_task+0x2e/0x2d0 kernel/sched/rt.c:415 dequeue_task_rt+0x25e/0x790 kernel/sched/rt.c:1457
RT task can turn scheduler into the guy in the oval office if they like. That is why running syzbot with RT turned on wastes minutes at the first place.
block_task kernel/sched/core.c:2155 [inline] try_to_block_task kernel/sched/core.c:6585 [inline] __schedule+0x5f1/0x4cc0 kernel/sched/core.c:6896 __schedule_loop kernel/sched/core.c:7043 [inline] schedule+0x165/0x360 kernel/sched/core.c:7058 futex_do_wait kernel/futex/waitwake.c:358 [inline] __futex_wait+0x1c3/0x3e0 kernel/futex/waitwake.c:687 futex_wait+0x104/0x360 kernel/futex/waitwake.c:715 do_futex+0x333/0x420 kernel/futex/syscalls.c:102 __do_sys_futex kernel/futex/syscalls.c:179 [inline] __se_sys_futex+0x36f/0x400 kernel/futex/syscalls.c:160 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffbb758ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffbb84b50e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 00007ffbb77c5fa8 RCX: 00007ffbb758ebe9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ffbb77c5fa8 RBP: 00007ffbb77c5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffbb77c6038 R14: 00007ffea00f5430 R15: 00007ffea00f5518 </TASK> --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing.