INFO: rcu detected stall in br_handle_frame

Status: auto-obsoleted due to no activity on 2024/12/04 21:21
Reported-by: syzbot+ac93e33cede5361d55c7@syzkaller.appspotmail.com
First crash: 791d, last: 709d
▶ ▼ Similar bugs (15)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in br_handle_frame (5) bridge 1 syz 24 634d 663d 28/29 fixed on 2024/11/12 23:31
linux-4.14 INFO: rcu detected stall in br_handle_frame (3) 1 1 2136d 2136d 0/1 auto-closed as invalid on 2021/01/28 07:46
upstream INFO: rcu detected stall in br_handle_frame 1 syz, C done 341 2516d 2521d 13/29 fixed on 2019/10/09 10:54
upstream INFO: rcu detected stall in br_handle_frame (2) net 1 syz, C done 2 2420d 2416d 15/29 fixed on 2020/02/18 14:31
upstream INFO: rcu detected stall in br_handle_frame (3) bridge 1 1 1845d 1845d 0/29 auto-closed as invalid on 2021/10/15 13:41
linux-4.14 INFO: rcu detected stall in br_handle_frame (2) 1 syz, C done 1 2421d 2421d 1/1 fixed on 2020/01/19 15:05
linux-4.14 INFO: rcu detected stall in br_handle_frame 1 syz, C done 15 2513d 2525d 1/1 fixed on 2019/12/07 19:24
linux-4.19 INFO: rcu detected stall in br_handle_frame (2) 1 syz, C error 31 1280d 2121d 0/1 upstream: reported C repro on 2020/10/14 18:56
linux-4.19 INFO: rcu detected stall in br_handle_frame 1 syz, C done 41 2513d 2525d 1/1 fixed on 2019/12/07 19:18
linux-6.1 INFO: rcu detected stall in br_handle_frame (2) 1 5 117d 303d 0/3 auto-obsoleted due to no activity on 2026/07/20 06:55
linux-5.15 INFO: rcu detected stall in br_handle_frame 1 syz, C inconclusive 3 259d 909d 0/3 upstream: reported C repro on 2024/02/08 13:52
upstream INFO: rcu detected stall in br_handle_frame (6) prio:normal netfilter bridge 1 syz, C error error 161 2d01h 204d 0/29 upstream: reported C repro on 2026/01/13 18:06
upstream INFO: rcu detected stall in br_handle_frame (4) kernel 1 1 1684d 1684d 0/29 closed as invalid on 2022/02/08 10:10
linux-6.6 INFO: rcu detected stall in br_handle_frame 1 21 28d 258d 0/2 upstream: reported on 2025/11/21 04:49
android-5-15 BUG: soft lockup in br_handle_frame 1 2 718d 724d 0/2 auto-obsoleted due to no activity on 2024/11/16 05:31

Sample crash report:
rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2652 jiffies s: 3021 root: 0x1/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 3803 Comm: syz.1.41 Not tainted 6.1.106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:static_key_false include/linux/jump_label.h:207 [inline]
RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:147 [inline]
RIP: 0010:wrmsr arch/x86/include/asm/msr.h:254 [inline]
RIP: 0010:native_apic_msr_write+0x35/0x50 arch/x86/include/asm/apic.h:206
Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 c3 89 f6 31 d2 e9 4f 61 29 03 66 2e 0f 1f 84 00 00 00 00 00
RSP: 0018:ffffc90000006088 EFLAGS: 00000046
RAX: 0000000000000096 RBX: ffffffff8cd89a20 RCX: 0000000000000838
RDX: 0000000000000000 RSI: 0000000000000096 RDI: 0000000000000838
RBP: 0000000000000096 R08: ffffffff817ce7fd R09: fffffbfff1d33a7e
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880b98271c0
R13: dffffc0000000000 R14: 0000000000000096 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e54216b680 CR3: 0000000027988000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 apic_write arch/x86/include/asm/apic.h:394 [inline]
 lapic_next_event+0x5b/0x70 arch/x86/kernel/apic/apic.c:478
 clockevents_program_event+0x1c5/0x310 kernel/time/clockevents.c:334
 hrtimer_interrupt+0x546/0x980 kernel/time/hrtimer.c:1825
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0x156/0x580 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x3e/0xb0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:unwind_next_frame+0xc7/0x2220 arch/x86/kernel/unwind_orc.c:436
Code: 89 bc 24 80 00 00 00 48 89 6c 24 28 bf 01 00 00 00 e8 ed bf 21 00 48 89 1c 24 48 83 c3 50 48 89 d8 48 c1 e8 03 48 89 44 24 40 <42> 80 3c 30 00 74 08 48 89 df e8 7a 79 a5 00 48 89 5c 24 20 48 8b
RSP: 0018:ffffc900000062e0 EFLAGS: 00000a06
RAX: 1ffff92000000c82 RBX: ffffc90000006410 RCX: ffffffff91f33103
RDX: dffffc0000000000 RSI: ffffffff81785aa3 RDI: 0000000000000001
RBP: 1ffff92000000c78 R08: 0000000000000026 R09: ffffc900000064b0
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88801fbad940
R13: ffffffff81785b50 R14: dffffc0000000000 R15: ffffffff81785aa3
 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 kmem_cache_free+0x292/0x510 mm/slub.c:3683
 skb_ext_del include/linux/skbuff.h:4693 [inline]
 nf_bridge_info_free net/bridge/br_netfilter_hooks.c:151 [inline]
 br_nf_dev_queue_xmit+0x4f0/0x1aa0 net/bridge/br_netfilter_hooks.c:866
 NF_HOOK+0x6e8/0x7a0 include/linux/netfilter.h:302
 br_nf_post_routing+0x9b6/0xde0 net/bridge/br_netfilter_hooks.c:969
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_slow+0xae/0x1e0 net/netfilter/core.c:614
 NF_HOOK+0x2a3/0x450 include/linux/netfilter.h:300
 br_forward_finish+0xe1/0x130 net/bridge/br_forward.c:66
 br_nf_forward_finish+0xa4e/0xff0 net/bridge/br_netfilter_hooks.c:680
 NF_HOOK+0x6e8/0x7a0 include/linux/netfilter.h:302
 br_nf_forward_ip+0xbdd/0x1090 net/bridge/br_netfilter_hooks.c:750
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_slow+0xae/0x1e0 net/netfilter/core.c:614
 NF_HOOK+0x2a3/0x450 include/linux/netfilter.h:300
 __br_forward+0x430/0x5f0 net/bridge/br_forward.c:115
 br_handle_frame_finish+0x15d0/0x1bf0 net/bridge/br_input.c:198
 br_nf_hook_thresh+0x46a/0x580 net/bridge/br_netfilter_hooks.c:1176
 br_nf_pre_routing_finish_ipv6+0xa92/0xdc0
 NF_HOOK include/linux/netfilter.h:302 [inline]
 br_nf_pre_routing_ipv6+0x354/0x740 net/bridge/br_netfilter_ipv6.c:243
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:260 [inline]
 br_handle_frame+0x991/0x1340 net/bridge/br_input.c:406
 __netif_receive_skb_core+0x13dd/0x41d0 net/core/dev.c:5422
 __netif_receive_skb_one_core net/core/dev.c:5526 [inline]
 __netif_receive_skb+0x11c/0x530 net/core/dev.c:5642
 process_backlog+0x381/0x760 net/core/dev.c:5970
 __napi_poll+0xc7/0x470 net/core/dev.c:6537
 napi_poll net/core/dev.c:6604 [inline]
 net_rx_action+0x70f/0xeb0 net/core/dev.c:6718
 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571
 __do_softirq kernel/softirq.c:605 [inline]
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:666
 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:rcu_read_unlock_special+0x84/0x540 kernel/rcu/tree_plugin.h:682
Code: f1 f1 f1 00 f2 f2 f2 49 89 04 17 66 41 c7 44 17 09 f3 f3 41 c6 44 17 0b f3 65 44 8b 25 1d 48 8e 7e 41 f7 c4 00 00 f0 00 74 45 <48> c7 44 24 20 0e 36 e0 45 4a c7 04 3a 00 00 00 00 66 42 c7 44 3a
RSP: 0018:ffffc90004fc6960 EFLAGS: 00000206
RAX: 109525817087a700 RBX: 1ffff920009f8d34 RCX: ffffffff816ae04a
RDX: dffffc0000000000 RSI: ffffffff8b0c0260 RDI: ffffffff8b5d62c0
RBP: ffffc90004fc6a40 R08: dffffc0000000000 R09: fffffbfff20e764b
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffff8d32fe00
R13: ffff88801fbadd98 R14: ffffc90004fc69a0 R15: 1ffff920009f8d30
 __rcu_read_unlock+0x92/0x100 kernel/rcu/tree_plugin.h:426
 rcu_read_unlock include/linux/rcupdate.h:823 [inline]
 is_bpf_text_address+0x27a/0x2a0 kernel/bpf/core.c:733
 kernel_text_address+0x9f/0xd0 kernel/extable.c:125
 __kernel_text_address+0x9/0x40 kernel/extable.c:79
 unwind_get_return_address+0x49/0x80 arch/x86/kernel/unwind_orc.c:323
 arch_stack_walk+0xf3/0x140 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:486
 call_rcu+0x163/0xa10 kernel/rcu/tree.c:2844
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x1447/0x4570 kernel/sched/core.c:6558
 preempt_schedule_common+0x83/0xd0 kernel/sched/core.c:6727
 preempt_schedule+0xd9/0xe0 kernel/sched/core.c:6751
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_unlock+0x36/0x40 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 zap_pte_range mm/memory.c:1515 [inline]
 zap_pmd_range mm/memory.c:1574 [inline]
 zap_pud_range mm/memory.c:1603 [inline]
 zap_p4d_range mm/memory.c:1624 [inline]
 unmap_page_range+0x2190/0x2740 mm/memory.c:1645
 unmap_vmas+0x48b/0x640 mm/memory.c:1730
 exit_mmap+0x252/0x9f0 mm/mmap.c:3227
 __mmput+0x115/0x3c0 kernel/fork.c:1199
 exit_mm+0x226/0x300 kernel/exit.c:565
 do_exit+0x9f6/0x26a0 kernel/exit.c:858
 do_group_exit+0x202/0x2b0 kernel/exit.c:1021
 get_signal+0x16f7/0x17d0 kernel/signal.c:2870
 arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:316
 exc_page_fault+0x1c0/0x620 arch/x86/mm/fault.c:1490
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0033:0x7f1cbfa3ae6e
Code: Unable to access opcode bytes at 0x7f1cbfa3ae44.
RSP: 002b:00007f1cc095df70 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 00007f1cbfbe8a9b RCX: 00007f1cbfbe9d3b
RDX: 00000000000031f4 RSI: 0000000000000000 RDI: 00007f1cbfbe8a9b
RBP: 00007f1cbfbe793e R08: 00007fff212660b0 R09: 0000000000000010
R10: 00007fff21266080 R11: 00000000000037ba R12: 00007f1cbfbe8aaf
R13: 0000000000000000 R14: 00007f1cbfd15f80 R15: 00007fff212211f8
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/26 21:20 linux-6.1.y ee5e09825b81 9aee4e0b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: rcu detected stall in br_handle_frame
2024/06/05 18:32 linux-6.1.y 88690811da69 5aa1a7c9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: rcu detected stall in br_handle_frame
* Struck through repros no longer work on HEAD.