All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+14005fa30c9a07192934@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	tglx@linutronix.de
Subject: Re: BUG: corrupted list in account_entity_enqueue
Date: Wed, 02 Jan 2019 09:02:04 -0800	[thread overview]
Message-ID: <000000000000f9aaa5057e7c9ad5@google.com> (raw)
In-Reply-To: <0000000000001aea21057e4c1ab5@google.com>

syzbot has found a reproducer for the following crash on:

HEAD commit:    4cd1b60def51 Add linux-next specific files for 20190102
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=12b12dbf400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=3bf665f887bd3d7e
dashboard link: https://syzkaller.appspot.com/bug?extid=14005fa30c9a07192934
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10621f53400000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=154d0427400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+14005fa30c9a07192934@syzkaller.appspotmail.com

list_add corruption. next->prev should be prev (ffff8880ae72d8d8), but was  
0000000000000610. (next=ffff8880a94b64f0).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:23!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: -1958513720 Comm: \x10\x06 Not tainted 4.20.0-next-20190102 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:__list_add_valid.cold+0xf/0x3c lib/list_debug.c:23
Code: 34 fe eb d5 4c 89 e7 e8 3a 82 34 fe eb a3 4c 89 f7 e8 30 82 34 fe e9  
56 ff ff ff 4c 89 e1 48 c7 c7 40 98 81 88 e8 00 cb d6 fd <0f> 0b 48 89 f2  
4c 89 e1 4c 89 ee 48 c7 c7 80 99 81 88 e8 e9 ca d6
RSP: 0018:ffff8880ae707648 EFLAGS: 00010086
RAX: 0000000000000075 RBX: ffff8880a4783cc0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8167d786 RDI: ffffed1015ce0ebb
RBP: ffff8880ae707660 R08: 0000000000000075 R09: ffffed1015ce5021
R10: ffffed1015ce5020 R11: ffff8880ae728107 R12: ffff8880a94b64f0
R13: ffff8880a843a530 R14: ffff8880ae7076e8 R15: ffff8880a843a530
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000068 CR3: 00000000a43c7000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  <IRQ>
  __list_add include/linux/list.h:60 [inline]
  list_add include/linux/list.h:79 [inline]
  account_entity_enqueue+0x3a0/0x660 kernel/sched/fair.c:2678
  enqueue_entity+0x276/0x20b0 kernel/sched/fair.c:3902
  enqueue_task_fair+0x237/0x10c0 kernel/sched/fair.c:5133
  enqueue_task kernel/sched/core.c:730 [inline]
  activate_task+0x11d/0x470 kernel/sched/core.c:751
  ttwu_activate kernel/sched/core.c:1643 [inline]
  ttwu_do_activate+0xd4/0x1f0 kernel/sched/core.c:1702
  ttwu_queue kernel/sched/core.c:1847 [inline]
  try_to_wake_up+0x997/0x1480 kernel/sched/core.c:2057
  wake_up_process+0x10/0x20 kernel/sched/core.c:2129
  hrtimer_wakeup+0x48/0x60 kernel/time/hrtimer.c:1637
  __run_hrtimer kernel/time/hrtimer.c:1389 [inline]
  __hrtimer_run_queues+0x3a7/0x1050 kernel/time/hrtimer.c:1451
  hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509
  local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
  smp_apic_timer_interrupt+0x18d/0x760 arch/x86/kernel/apic/apic.c:1060
  apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
  </IRQ>
Modules linked in:
---[ end trace 21a00246ce9209ce ]---
RIP: 0010:__list_add_valid.cold+0xf/0x3c lib/list_debug.c:23
Code: 34 fe eb d5 4c 89 e7 e8 3a 82 34 fe eb a3 4c 89 f7 e8 30 82 34 fe e9  
56 ff ff ff 4c 89 e1 48 c7 c7 40 98 81 88 e8 00 cb d6 fd <0f> 0b 48 89 f2  
4c 89 e1 4c 89 ee 48 c7 c7 80 99 81 88 e8 e9 ca d6
RSP: 0018:ffff8880ae707648 EFLAGS: 00010086
RAX: 0000000000000075 RBX: ffff8880a4783cc0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8167d786 RDI: ffffed1015ce0ebb
RBP: ffff8880ae707660 R08: 0000000000000075 R09: ffffed1015ce5021
R10: ffffed1015ce5020 R11: ffff8880ae728107 R12: ffff8880a94b64f0
R13: ffff8880a843a530 R14: ffff8880ae7076e8 R15: ffff8880a843a530
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000068 CR3: 00000000a43c7000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


  reply	other threads:[~2019-01-02 17:02 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-12-31  7:10 BUG: corrupted list in account_entity_enqueue syzbot
2019-01-02 17:02 ` syzbot [this message]
2019-01-04 11:12   ` Dmitry Vyukov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=000000000000f9aaa5057e7c9ad5@google.com \
    --to=syzbot+14005fa30c9a07192934@syzkaller.appspotmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.