INFO: rcu detected stall in __perf_sw_event

Status: auto-closed as invalid on 2019/06/27 14:55
Reported-by: syzbot+1d69d5012af892fa8699@syzkaller.appspotmail.com
First crash: 2872d, last: 2785d
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: rcu detected stall in __perf_sw_event 1 2 2527d 2593d 0/1 auto-closed as invalid on 2020/01/11 01:03
linux-4.19 INFO: rcu detected stall in __perf_sw_event (2) 1 syz, C error 133 1261d 2398d 0/1 upstream: reported C repro on 2020/01/20 09:59
linux-4.14 INFO: rcu detected stall in __perf_sw_event 1 syz, C 3 1264d 2209d 0/1 upstream: reported C repro on 2020/07/27 06:04
android-49 INFO: rcu detected stall in __perf_sw_event 1 syz, C 23 2683d 2680d 0/3 public: reported C repro on 2019/04/13 00:00
upstream INFO: rcu detected stall in __perf_sw_event perf 1 syz done error 99 1926d 2745d 0/29 auto-obsoleted due to no activity on 2023/01/16 15:10

Sample crash report:
INFO: rcu_preempt self-detected stall on CPU
	1-...: (10499 ticks this GP) idle=15a/140000000000001/0 softirq=9668/9669 fqs=5209 
	 (t=10500 jiffies g=1729 c=1728 q=2808)
NMI backtrace for cpu 1
CPU: 1 PID: 6280 Comm: syz-executor3 Not tainted 4.14.91+ #30
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x11b lib/dump_stack.c:53
 nmi_cpu_backtrace.cold.0+0x47/0x85 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x121/0x146 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:158 [inline]
 rcu_dump_cpu_stacks+0x171/0x1bf kernel/rcu/tree.c:1396
 print_cpu_stall kernel/rcu/tree.c:1542 [inline]
 check_cpu_stall kernel/rcu/tree.c:1610 [inline]
 __rcu_pending kernel/rcu/tree.c:3382 [inline]
 rcu_pending kernel/rcu/tree.c:3444 [inline]
 rcu_check_callbacks.cold.56+0x478/0xd99 kernel/rcu/tree.c:2784
 update_process_times+0x24/0x60 kernel/time/timer.c:1588
 tick_sched_handle.isra.8+0x73/0x150 kernel/time/tick-sched.c:161
 tick_sched_timer+0x7e/0x160 kernel/time/tick-sched.c:1321
 __run_hrtimer kernel/time/hrtimer.c:1259 [inline]
 __hrtimer_run_queues+0x2d0/0xc10 kernel/time/hrtimer.c:1323
 hrtimer_interrupt+0x19a/0x440 kernel/time/hrtimer.c:1357
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline]
 smp_apic_timer_interrupt+0x13a/0x600 arch/x86/kernel/apic/apic.c:1062
 apic_timer_interrupt+0x84/0x90 arch/x86/entry/entry_64.S:787
 </IRQ>
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:60
RSP: 0018:ffff8881c58df2e8 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: ffff8881c58df5f8 RCX: 0000000000040000
RDX: ffffffff813e91c6 RSI: ffffc9000483d000 RDI: ffff8881d283dcd8
RBP: ffff8881d283dc50 R08: ffffed1038b93723 R09: ffffed1038b93722
R10: ffffed1038b93722 R11: ffff8881c5c9b917 R12: 0000000000000000
R13: 0000000000000008 R14: ffff8881c58df3c8 R15: dffffc0000000000
 __read_once_size include/linux/compiler.h:183 [inline]
 atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline]
 atomic_long_read include/asm-generic/atomic-long.h:45 [inline]
 perf_event_count kernel/events/core.c:3720 [inline]
 perf_output_read_group kernel/events/core.c:5872 [inline]
 perf_output_read+0x547/0xfb0 kernel/events/core.c:5909
 perf_output_sample+0x10dd/0x1780 kernel/events/core.c:5951
 __perf_event_output kernel/events/core.c:6261 [inline]
 perf_event_output_forward+0x121/0x230 kernel/events/core.c:6274
 __perf_event_overflow+0x116/0x320 kernel/events/core.c:7510
 perf_swevent_overflow+0x166/0x1f0 kernel/events/core.c:7586
 perf_swevent_event+0x19c/0x270 kernel/events/core.c:7619
 do_perf_sw_event kernel/events/core.c:7727 [inline]
 ___perf_sw_event+0x296/0x480 kernel/events/core.c:7758
 __perf_sw_event+0x3f/0x70 kernel/events/core.c:7770
 perf_sw_event include/linux/perf_event.h:1041 [inline]
 __do_page_fault+0x77f/0xb60 arch/x86/mm/fault.c:1466
 page_fault+0x22/0x50 arch/x86/entry/entry_64.S:1104
RIP: 0010:copy_user_enhanced_fast_string+0x7/0x10 arch/x86/lib/copy_user_64.S:181
RSP: 0018:ffff8881c58dfb98 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000100
RDX: 0000000000001000 RSI: 0000000020514000 RDI: ffff8881c9926f00
RBP: 0000000020513100 R08: 0000000000000000 R09: 0000000000000040
R10: ffffed1039324dff R11: ffff8881c9926fff R12: ffff8881c9926000
R13: 00007ffffffff000 R14: 0000000020514100 R15: ffff8881c9926000
 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:55 [inline]
 copyin+0x99/0xc0 lib/iov_iter.c:146
 copy_page_from_iter_iovec lib/iov_iter.c:290 [inline]
 copy_page_from_iter+0x320/0x7a0 lib/iov_iter.c:731
 pipe_write+0x21a/0xd30 fs/pipe.c:434
 call_write_iter include/linux/fs.h:1784 [inline]
 new_sync_write fs/read_write.c:471 [inline]
 __vfs_write+0x417/0x5c0 fs/read_write.c:484
 vfs_write+0x17f/0x4d0 fs/read_write.c:546
 SYSC_write fs/read_write.c:593 [inline]
 SyS_write+0xc2/0x1a0 fs/read_write.c:585
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4579b9
RSP: 002b:00007fe94d249c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004579b9
RDX: 00000000fffffdbc RSI: 0000000020000100 RDI: 000000000000000a
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe94d24a6d4
R13: 00000000004c367d R14: 00000000004db550 R15: 00000000ffffffff
INFO: rcu_sched self-detected stall on CPU
	1-...: (10491 ticks this GP) idle=15a/140000000000001/0 softirq=9669/9669 fqs=5217 
INFO: rcu_sched detected stalls on CPUs/tasks:
	
 (t=10538 jiffies g=1388 c=1387 q=121)
	1-...: (10491 ticks this GP) idle=15a/140000000000001/0 softirq=9669/9669 fqs=5217 
	
NMI backtrace for cpu 1
CPU: 1 PID: 6280 Comm: syz-executor3 Not tainted 4.14.91+ #30
(detected by 0, t=10538 jiffies, g=1388, c=1387, q=121)
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x11b lib/dump_stack.c:53
 nmi_cpu_backtrace.cold.0+0x47/0x85 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x121/0x146 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:158 [inline]
 rcu_dump_cpu_stacks+0x171/0x1bf kernel/rcu/tree.c:1396
 print_cpu_stall kernel/rcu/tree.c:1542 [inline]
 check_cpu_stall kernel/rcu/tree.c:1610 [inline]
 __rcu_pending kernel/rcu/tree.c:3382 [inline]
 rcu_pending kernel/rcu/tree.c:3444 [inline]
 rcu_check_callbacks.cold.56+0x478/0xd99 kernel/rcu/tree.c:2784
 update_process_times+0x24/0x60 kernel/time/timer.c:1588
 tick_sched_handle.isra.8+0x73/0x150 kernel/time/tick-sched.c:161
 tick_sched_timer+0x7e/0x160 kernel/time/tick-sched.c:1321
 __run_hrtimer kernel/time/hrtimer.c:1259 [inline]
 __hrtimer_run_queues+0x2d0/0xc10 kernel/time/hrtimer.c:1323
 hrtimer_interrupt+0x19a/0x440 kernel/time/hrtimer.c:1357
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline]
 smp_apic_timer_interrupt+0x13a/0x600 arch/x86/kernel/apic/apic.c:1062
 apic_timer_interrupt+0x84/0x90 arch/x86/entry/entry_64.S:787
 </IRQ>
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:60
RSP: 0018:ffff8881c58df2e8 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: ffff8881c58df5f8 RCX: 0000000000040000
RDX: ffffffff813e91c6 RSI: ffffc9000483d000 RDI: ffff8881d283dcd8
RBP: ffff8881d283dc50 R08: ffffed1038b93723 R09: ffffed1038b93722
R10: ffffed1038b93722 R11: ffff8881c5c9b917 R12: 0000000000000000
R13: 0000000000000008 R14: ffff8881c58df3c8 R15: dffffc0000000000
 __read_once_size include/linux/compiler.h:183 [inline]
 atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline]
 atomic_long_read include/asm-generic/atomic-long.h:45 [inline]
 perf_event_count kernel/events/core.c:3720 [inline]
 perf_output_read_group kernel/events/core.c:5872 [inline]
 perf_output_read+0x547/0xfb0 kernel/events/core.c:5909
 perf_output_sample+0x10dd/0x1780 kernel/events/core.c:5951
 __perf_event_output kernel/events/core.c:6261 [inline]
 perf_event_output_forward+0x121/0x230 kernel/events/core.c:6274
 __perf_event_overflow+0x116/0x320 kernel/events/core.c:7510
 perf_swevent_overflow+0x166/0x1f0 kernel/events/core.c:7586
 perf_swevent_event+0x19c/0x270 kernel/events/core.c:7619
 do_perf_sw_event kernel/events/core.c:7727 [inline]
 ___perf_sw_event+0x296/0x480 kernel/events/core.c:7758
 __perf_sw_event+0x3f/0x70 kernel/events/core.c:7770
 perf_sw_event include/linux/perf_event.h:1041 [inline]
 __do_page_fault+0x77f/0xb60 arch/x86/mm/fault.c:1466
 page_fault+0x22/0x50 arch/x86/entry/entry_64.S:1104
RIP: 0010:copy_user_enhanced_fast_string+0x7/0x10 arch/x86/lib/copy_user_64.S:181
RSP: 0018:ffff8881c58dfb98 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000100
RDX: 0000000000001000 RSI: 0000000020514000 RDI: ffff8881c9926f00
RBP: 0000000020513100 R08: 0000000000000000 R09: 0000000000000040
R10: ffffed1039324dff R11: ffff8881c9926fff R12: ffff8881c9926000
R13: 00007ffffffff000 R14: 0000000020514100 R15: ffff8881c9926000
 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:55 [inline]
 copyin+0x99/0xc0 lib/iov_iter.c:146
 copy_page_from_iter_iovec lib/iov_iter.c:290 [inline]
 copy_page_from_iter+0x320/0x7a0 lib/iov_iter.c:731
 pipe_write+0x21a/0xd30 fs/pipe.c:434
 call_write_iter include/linux/fs.h:1784 [inline]
 new_sync_write fs/read_write.c:471 [inline]
 __vfs_write+0x417/0x5c0 fs/read_write.c:484
 vfs_write+0x17f/0x4d0 fs/read_write.c:546
 SYSC_write fs/read_write.c:593 [inline]
 SyS_write+0xc2/0x1a0 fs/read_write.c:585
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4579b9
RSP: 002b:00007fe94d249c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004579b9
RDX: 00000000fffffdbc RSI: 0000000020000100 RDI: 000000000000000a
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe94d24a6d4
R13: 00000000004c367d R14: 00000000004db550 R15: 00000000ffffffff
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 6280 Comm: syz-executor3 Not tainted 4.14.91+ #30
task: ffff8881c5b69780 task.stack: ffff8881c58d8000
RIP: 0010:rep_nop arch/x86/include/asm/processor.h:655 [inline]
RIP: 0010:cpu_relax arch/x86/include/asm/processor.h:660 [inline]
RIP: 0010:virt_spin_lock arch/x86/include/asm/qspinlock.h:87 [inline]
RIP: 0010:native_queued_spin_lock_slowpath+0xc7/0x760 kernel/locking/qspinlock.c:313
RSP: 0018:ffff8881dbb07cd8 EFLAGS: 00000002
RAX: 0000000000000001 RBX: ffffffffa2cd8440 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 1ffffffff4607101
RBP: 0000000000000003 R08: 0000000000002d28 R09: ffffffffa3ce3120
R10: ffff8881c5b6a050 R11: 0000000000000001 R12: fffffbfff459b088
R13: 0000000000000001 R14: ffffffffa2cd8440 R15: ffffffffa2cd8440
FS:  00007fe94d24a700(0000) GS:ffff8881dbb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020514000 CR3: 00000001c6232002 CR4: 00000000001606a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:669 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:52 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:90 [inline]
 do_raw_spin_lock+0x139/0x1c0 kernel/locking/spinlock_debug.c:113
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]
 _raw_spin_lock_irqsave+0x49/0x50 kernel/locking/spinlock.c:160
 print_cpu_stall kernel/rcu/tree.c:1544 [inline]
 check_cpu_stall kernel/rcu/tree.c:1610 [inline]
 __rcu_pending kernel/rcu/tree.c:3382 [inline]
 rcu_pending kernel/rcu/tree.c:3444 [inline]
 rcu_check_callbacks.cold.56+0x480/0xd99 kernel/rcu/tree.c:2784
 update_process_times+0x24/0x60 kernel/time/timer.c:1588
 tick_sched_handle.isra.8+0x73/0x150 kernel/time/tick-sched.c:161
 tick_sched_timer+0x7e/0x160 kernel/time/tick-sched.c:1321
 __run_hrtimer kernel/time/hrtimer.c:1259 [inline]
 __hrtimer_run_queues+0x2d0/0xc10 kernel/time/hrtimer.c:1323
 hrtimer_interrupt+0x19a/0x440 kernel/time/hrtimer.c:1357
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline]
 smp_apic_timer_interrupt+0x13a/0x600 arch/x86/kernel/apic/apic.c:1062
 apic_timer_interrupt+0x84/0x90 arch/x86/entry/entry_64.S:787
 </IRQ>
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:60
RSP: 0018:ffff8881c58df2e8 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: ffff8881c58df5f8 RCX: 0000000000040000
RDX: ffffffff813e91c6 RSI: ffffc9000483d000 RDI: ffff8881d283dcd8
RBP: ffff8881d283dc50 R08: ffffed1038b93723 R09: ffffed1038b93722
R10: ffffed1038b93722 R11: ffff8881c5c9b917 R12: 0000000000000000
R13: 0000000000000008 R14: ffff8881c58df3c8 R15: dffffc0000000000
 __read_once_size include/linux/compiler.h:183 [inline]
 atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline]
 atomic_long_read include/asm-generic/atomic-long.h:45 [inline]
 perf_event_count kernel/events/core.c:3720 [inline]
 perf_output_read_group kernel/events/core.c:5872 [inline]
 perf_output_read+0x547/0xfb0 kernel/events/core.c:5909
 perf_output_sample+0x10dd/0x1780 kernel/events/core.c:5951
 __perf_event_output kernel/events/core.c:6261 [inline]
 perf_event_output_forward+0x121/0x230 kernel/events/core.c:6274
 __perf_event_overflow+0x116/0x320 kernel/events/core.c:7510
 perf_swevent_overflow+0x166/0x1f0 kernel/events/core.c:7586
 perf_swevent_event+0x19c/0x270 kernel/events/core.c:7619
 do_perf_sw_event kernel/events/core.c:7727 [inline]
 ___perf_sw_event+0x296/0x480 kernel/events/core.c:7758
 __perf_sw_event+0x3f/0x70 kernel/events/core.c:7770
 perf_sw_event include/linux/perf_event.h:1041 [inline]
 __do_page_fault+0x77f/0xb60 arch/x86/mm/fault.c:1466
 page_fault+0x22/0x50 arch/x86/entry/entry_64.S:1104
RIP: 0010:copy_user_enhanced_fast_string+0x7/0x10 arch/x86/lib/copy_user_64.S:181
RSP: 0018:ffff8881c58dfb98 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000100
RDX: 0000000000001000 RSI: 0000000020514000 RDI: ffff8881c9926f00
RBP: 0000000020513100 R08: 0000000000000000 R09: 0000000000000040
R10: ffffed1039324dff R11: ffff8881c9926fff R12: ffff8881c9926000
R13: 00007ffffffff000 R14: 0000000020514100 R15: ffff8881c9926000
 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:55 [inline]
 copyin+0x99/0xc0 lib/iov_iter.c:146
 copy_page_from_iter_iovec lib/iov_iter.c:290 [inline]
 copy_page_from_iter+0x320/0x7a0 lib/iov_iter.c:731
 pipe_write+0x21a/0xd30 fs/pipe.c:434
 call_write_iter include/linux/fs.h:1784 [inline]
 new_sync_write fs/read_write.c:471 [inline]
 __vfs_write+0x417/0x5c0 fs/read_write.c:484
 vfs_write+0x17f/0x4d0 fs/read_write.c:546
 SYSC_write fs/read_write.c:593 [inline]
 SyS_write+0xc2/0x1a0 fs/read_write.c:585
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4579b9
RSP: 002b:00007fe94d249c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004579b9
RDX: 00000000fffffdbc RSI: 0000000020000100 RDI: 000000000000000a
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe94d24a6d4
R13: 00000000004c367d R14: 00000000004db550 R15: 00000000ffffffff
Code: 04 24 40 38 c5 7c 08 84 c0 0f 85 91 05 00 00 8b 03 85 c0 75 14 f0 44 0f b1 2b 85 c0 75 df 5b 5d 41 5c 41 5d 41 5e 41 5f c3 f3 90 <eb> d0 81 fd 00 01 00 00 0f 84 40 04 00 00 89 ee 40 30 f6 85 f6

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/29 14:54 android-4.14 7d2d5fc1acda a40793d7 .config console log report ci-android-414-kasan-gce-root
2018/12/28 12:24 android-4.14 815e34f802d8 fc6ae81a .config console log report ci-android-414-kasan-gce-root
2018/12/26 21:35 android-4.14 815e34f802d8 e747ec98 .config console log report ci-android-414-kasan-gce-root
2018/12/25 01:40 android-4.14 815e34f802d8 8a41a0ad .config console log report ci-android-414-kasan-gce-root
2018/12/15 19:55 android-4.14 4ee7197c44f6 def91db3 .config console log report ci-android-414-kasan-gce-root
2018/12/03 10:31 android-4.14 d11d7f1ccfb1 819002b0 .config console log report ci-android-414-kasan-gce-root
2018/12/01 11:16 android-4.14 d11d7f1ccfb1 d8988561 .config console log report ci-android-414-kasan-gce-root
2018/11/29 23:39 android-4.14 51164110fa6e 66071e27 .config console log report ci-android-414-kasan-gce-root
2018/10/27 12:49 android-4.14 4ed22187defd 8efba39a .config console log report ci-android-414-kasan-gce-root
2018/10/27 12:22 android-4.14 4ed22187defd 8efba39a .config console log report ci-android-414-kasan-gce-root
2018/10/20 15:12 android-4.14 c556d1ffe528 ecb386fe .config console log report ci-android-414-kasan-gce-root
2018/10/18 21:09 android-4.14 0ff0788d6a66 9aba67b5 .config console log report ci-android-414-kasan-gce-root
2018/10/03 02:01 android-4.14 ff9973a5da5e 0f3e0261 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.