Dear Linux maintainers and reviewers:
We are reporting a Linux kernel bug titled **watchdog: BUG: soft lockup - CPU#1 stuck for 26s!**, discovered using a modified version of Syzkaller.
Linux version: v6.12-rc6:59b723cd2adbac2a34fc8e12c74ae26ae45bf230 (crash is also reproduced in the latest kernel version)
The test case and kernel config is in attach.
The KASAN report is (The full report is attached):
gfs2: fsid=syz:syz.s: Error parsing journal for spectator mount.
BTRFS info (device loop0): last unmount of filesystem 3a375e4e-b156-4d76-a2ad-16e198ce1409
loop0: detected capacity change from 0 to 1764
overlayfs: missing 'lowerdir'
watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [syz.6.240:5513]
Modules linked in:
irq event stamp: 258896
hardirqs last enabled at (258895): [<ffffffff85e5646b>] irqentry_exit+0x3b/0x90 kernel/entry/common.c:357
hardirqs last disabled at (258896): [<ffffffff85e54e1f>] sysvec_apic_timer_interrupt+0xf/0x80 arch/x86/kernel/apic/apic.c:1049
softirqs last enabled at (258894): [<ffffffff811abafc>] softirq_handle_end kernel/softirq.c:400 [inline]
softirqs last enabled at (258894): [<ffffffff811abafc>] handle_softirqs+0x50c/0x770 kernel/softirq.c:582
softirqs last disabled at (258885): [<ffffffff811ac494>] __do_softirq kernel/softirq.c:588 [inline]
softirqs last disabled at (258885): [<ffffffff811ac494>] invoke_softirq kernel/softirq.c:428 [inline]
softirqs last disabled at (258885): [<ffffffff811ac494>] __irq_exit_rcu kernel/softirq.c:637 [inline]
softirqs last disabled at (258885): [<ffffffff811ac494>] irq_exit_rcu+0x94/0xc0 kernel/softirq.c:649
CPU: 1 UID: 0 PID: 5513 Comm: syz.6.240 Not tainted 6.12.0-rc6 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:__sanitizer_cov_trace_pc+0x60/0x80 kernel/kcov.c:222
Code: 8b 82 ec 14 00 00 85 c0 75 05 c3 cc cc cc cc 8b 82 c8 14 00 00 83 f8 02 75 f0 48 8b 8a d0 14 00 00 8b 92 cc 14 00 00 48 8b 01 <48> 83 c06
RSP: 0018:ff1100012414faa8 EFLAGS: 00000246
RAX: 000000000003ffff RBX: 000000000003086d RCX: ffa00000032b2000
RDX: 0000000000040000 RSI: ffffffff82058f98 RDI: 0000000000000004
RBP: 000000003086df88 R08: 0000000000000000 R09: ffe21c0024c14600
R10: 0000000040000007 R11: 0000000000000000 R12: 000000000003086d
R13: ff1100015e32a110 R14: 0000000040000007 R15: 000000003086df81
FS: 00007f7da6d8e700(0000) GS:ff110004ca900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fed644ae6f4 CR3: 000000011549a002 CR4: 0000000000771ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 80000000
Call Trace:
<IRQ>
</IRQ>
<TASK>
__exfat_free_cluster+0x5a8/0x840 fs/exfat/fatent.c:187
exfat_free_cluster+0x7a/0x100 fs/exfat/fatent.c:232
__exfat_truncate+0x6b9/0x8a0 fs/exfat/file.c:235
exfat_evict_inode+0x263/0x340 fs/exfat/inode.c:683
evict+0x38b/0x8a0 fs/inode.c:725
iput_final fs/inode.c:1877 [inline]
iput fs/inode.c:1903 [inline]
iput+0x4d8/0x7a0 fs/inode.c:1889
do_unlinkat+0x563/0x6e0 fs/namei.c:4540
__do_sys_unlink fs/namei.c:4581 [inline]
__se_sys_unlink fs/namei.c:4579 [inline]
__x64_sys_unlink+0xc7/0x110 fs/namei.c:4579
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc1/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
We are reporting a Linux kernel bug titled **watchdog: BUG: soft lockup - CPU#1 stuck for 26s!**, discovered using a modified version of Syzkaller.
Linux version: v6.12-rc6:59b723cd2adbac2a34fc8e12c74ae26ae45bf230 (crash is also reproduced in the latest kernel version)
The test case and kernel config is in attach.
The KASAN report is (The full report is attached):
gfs2: fsid=syz:syz.s: Error parsing journal for spectator mount.
BTRFS info (device loop0): last unmount of filesystem 3a375e4e-b156-4d76-a2ad-16e198ce1409
loop0: detected capacity change from 0 to 1764
overlayfs: missing 'lowerdir'
watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [syz.6.240:5513]
Modules linked in:
irq event stamp: 258896
hardirqs last enabled at (258895): [<ffffffff85e5646b>] irqentry_exit+0x3b/0x90 kernel/entry/common.c:357
hardirqs last disabled at (258896): [<ffffffff85e54e1f>] sysvec_apic_timer_interrupt+0xf/0x80 arch/x86/kernel/apic/apic.c:1049
softirqs last enabled at (258894): [<ffffffff811abafc>] softirq_handle_end kernel/softirq.c:400 [inline]
softirqs last enabled at (258894): [<ffffffff811abafc>] handle_softirqs+0x50c/0x770 kernel/softirq.c:582
softirqs last disabled at (258885): [<ffffffff811ac494>] __do_softirq kernel/softirq.c:588 [inline]
softirqs last disabled at (258885): [<ffffffff811ac494>] invoke_softirq kernel/softirq.c:428 [inline]
softirqs last disabled at (258885): [<ffffffff811ac494>] __irq_exit_rcu kernel/softirq.c:637 [inline]
softirqs last disabled at (258885): [<ffffffff811ac494>] irq_exit_rcu+0x94/0xc0 kernel/softirq.c:649
CPU: 1 UID: 0 PID: 5513 Comm: syz.6.240 Not tainted 6.12.0-rc6 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:__sanitizer_cov_trace_pc+0x60/0x80 kernel/kcov.c:222
Code: 8b 82 ec 14 00 00 85 c0 75 05 c3 cc cc cc cc 8b 82 c8 14 00 00 83 f8 02 75 f0 48 8b 8a d0 14 00 00 8b 92 cc 14 00 00 48 8b 01 <48> 83 c06
RSP: 0018:ff1100012414faa8 EFLAGS: 00000246
RAX: 000000000003ffff RBX: 000000000003086d RCX: ffa00000032b2000
RDX: 0000000000040000 RSI: ffffffff82058f98 RDI: 0000000000000004
RBP: 000000003086df88 R08: 0000000000000000 R09: ffe21c0024c14600
R10: 0000000040000007 R11: 0000000000000000 R12: 000000000003086d
R13: ff1100015e32a110 R14: 0000000040000007 R15: 000000003086df81
FS: 00007f7da6d8e700(0000) GS:ff110004ca900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fed644ae6f4 CR3: 000000011549a002 CR4: 0000000000771ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 80000000
Call Trace:
<IRQ>
</IRQ>
<TASK>
__exfat_free_cluster+0x5a8/0x840 fs/exfat/fatent.c:187
exfat_free_cluster+0x7a/0x100 fs/exfat/fatent.c:232
__exfat_truncate+0x6b9/0x8a0 fs/exfat/file.c:235
exfat_evict_inode+0x263/0x340 fs/exfat/inode.c:683
evict+0x38b/0x8a0 fs/inode.c:725
iput_final fs/inode.c:1877 [inline]
iput fs/inode.c:1903 [inline]
iput+0x4d8/0x7a0 fs/inode.c:1889
do_unlinkat+0x563/0x6e0 fs/namei.c:4540
__do_sys_unlink fs/namei.c:4581 [inline]
__se_sys_unlink fs/namei.c:4579 [inline]
__x64_sys_unlink+0xc7/0x110 fs/namei.c:4579
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc1/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Attachment:
report0
Description: Binary data
Attachment:
repro.c
Description: Binary data
Attachment:
config
Description: Binary data
