From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932903AbdJ3Txp (ORCPT ); Mon, 30 Oct 2017 15:53:45 -0400 Received: from mail-io0-f194.google.com ([209.85.223.194]:49869 "EHLO mail-io0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932087AbdJ3Txn (ORCPT ); Mon, 30 Oct 2017 15:53:43 -0400 X-Google-Smtp-Source: ABhQp+SAUXzMBw8jxxKT+dgcyWdSpYbNj5fY97roo5AdfHYXLEyn041SDq3nIB4E9ZVSnkWVk+Ttdnb5e8SuBs9BkKo= MIME-Version: 1.0 In-Reply-To: <001a113a67502e70f4055cc8dc92@google.com> References: <001a113a67502e70f4055cc8dc92@google.com> From: Dmitry Vyukov Date: Mon, 30 Oct 2017 22:53:21 +0300 Message-ID: Subject: Re: WARNING in get_pi_state To: syzbot Cc: dvhart@infradead.org, LKML , Ingo Molnar , Peter Zijlstra , syzkaller-bugs@googlegroups.com, Thomas Gleixner Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Oct 30, 2017 at 10:44 PM, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 8fd0520d9cec0896d48d3921bc642a9ee81eae0c > git://git.cmpxchg.org/linux-mmots.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > C reproducer is attached > syzkaller reproducer is attached. See https://goo.gl/kgGztJ > for information about syzkaller reproducers Also happened on more recent commits, including upstream 0787643a5f6aad1f0cdeb305f7fe492b71943ea4: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 6170 at kernel/futex.c:818 get_pi_state+0x15b/0x190 kernel/futex.c:818 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 6170 Comm: syz-executor1 Not tainted 4.14.0-rc5+ #142 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 panic+0x1e4/0x417 kernel/panic.c:181 __warn+0x1c4/0x1d9 kernel/panic.c:542 report_bug+0x211/0x2d0 lib/bug.c:183 fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:178 do_trap_no_signal arch/x86/kernel/traps.c:212 [inline] do_trap+0x260/0x390 arch/x86/kernel/traps.c:261 do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:298 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:311 invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:905 RIP: 0010:get_pi_state+0x15b/0x190 kernel/futex.c:818 RSP: 0018:ffff8801cddbf1a0 EFLAGS: 00010097 RAX: ffff8801c9d662c0 RBX: 0000000000000000 RCX: 1ffff10039bb7e39 RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff8801d04f4d40 RBP: ffff8801cddbf230 R08: 0000000000000001 R09: 1ffff10039bb7e26 R10: ffff8801cddbf0f8 R11: 0000000000000002 R12: 1ffff10039bb7e35 R13: ffff8801d04f4d40 R14: 1ffff10039bb7e39 R15: ffff8801d04f4df0 exit_pi_state_list+0x556/0x7a0 kernel/futex.c:932 mm_release+0x46d/0x590 kernel/fork.c:1148 exit_mm kernel/exit.c:499 [inline] do_exit+0x481/0x1ad0 kernel/exit.c:852 do_group_exit+0x149/0x400 kernel/exit.c:968 get_signal+0x73f/0x16d0 kernel/signal.c:2334 do_signal+0x94/0x1ee0 arch/x86/kernel/signal.c:808 exit_to_usermode_loop+0x214/0x310 arch/x86/entry/common.c:158 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath+0x42f/0x510 arch/x86/entry/common.c:266 entry_SYSCALL_64_fastpath+0xbc/0xbe RIP: 0033:0x452719 RSP: 002b:00007effb0461be8 EFLAGS: 00000212 ORIG_RAX: 00000000000000ca RAX: 0000000000000000 RBX: 0000000000758190 RCX: 0000000000452719 RDX: 0000000000000004 RSI: 000080000000000b RDI: 000000002000cffc RBP: 000000000000008f R08: 0000000020048000 R09: 0000000000000000 R10: 0000000020edfff0 R11: 0000000000000212 R12: 00000000006eee08 R13: 00000000ffffffff R14: 00007effb04626d4 R15: 0000000000000004 > WARNING: CPU: 1 PID: 24353 at kernel/futex.c:818 get_pi_state+0x15b/0x190 > kernel/futex.c:818 > Kernel panic - not syncing: panic_on_warn set ... > > CPU: 1 PID: 24353 Comm: syzkaller121915 Not tainted 4.14.0-rc2-mm1+ #10 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:16 [inline] > dump_stack+0x194/0x257 lib/dump_stack.c:52 > panic+0x1e4/0x417 kernel/panic.c:181 > __warn+0x1c4/0x1d9 kernel/panic.c:542 > report_bug+0x211/0x2d0 lib/bug.c:183 > fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:178 > do_trap_no_signal arch/x86/kernel/traps.c:212 [inline] > do_trap+0x260/0x390 arch/x86/kernel/traps.c:261 > do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:298 > do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:311 > invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:905 > RIP: 0010:get_pi_state+0x15b/0x190 kernel/futex.c:818 > RSP: 0018:ffff8801bf2a77a8 EFLAGS: 00010097 > RAX: ffff8801cb2d05c0 RBX: 0000000000000000 RCX: 1ffff10037e54efa > RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff8801d892cd40 > RBP: ffff8801bf2a7838 R08: ffff8801cb2d1880 R09: 1ffff10037e54edf > R10: ffff8801cb2d05c0 R11: 0000000000000002 R12: 1ffff10037e54ef6 > R13: ffff8801d892cd40 R14: 1ffff10037e54efa R15: ffff8801d892ce00 > exit_pi_state_list+0x556/0x7a0 kernel/futex.c:932 > mm_release+0x46d/0x590 kernel/fork.c:1191 > exit_mm kernel/exit.c:499 [inline] > do_exit+0x481/0x1b00 kernel/exit.c:852 > SYSC_exit kernel/exit.c:937 [inline] > SyS_exit+0x22/0x30 kernel/exit.c:935 > entry_SYSCALL_64_fastpath+0x1f/0xbe > RIP: 0033:0x40337e > RSP: 002b:00007fdd99af2d20 EFLAGS: 00000246 ORIG_RAX: 000000000000003c > RAX: ffffffffffffffda RBX: 00007fdd99af3700 RCX: 000000000040337e > RDX: 000000000000003c RSI: 00000000007fb000 RDI: 0000000000000000 > RBP: 0000000000000086 R08: 0000000020048000 R09: 0000000000000000 > R10: 000000002000b000 R11: 0000000000000246 R12: 0000000000000000 > R13: 00007ffcfc38d0bf R14: 00007fdd99af39c0 R15: 0000000000000000 > > > --- > This bug is generated by a dumb bot. It may contain errors. > See https://goo.gl/tpsmEJ for details. > Direct all questions to syzkaller@googlegroups.com. > > syzbot will keep track of this bug report. > Once a fix for this bug is committed, please reply to this email with: > #syz fix: exact-commit-title > To mark this as a duplicate of another syzbot report, please reply with: > #syz dup: exact-subject-of-another-report > If it's a one-off invalid bug report, please reply with: > #syz invalid > Note: if the crash happens again, it will cause creation of a new bug > report. > > -- > You received this message because you are subscribed to the Google Groups > "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/syzkaller-bugs/001a113a67502e70f4055cc8dc92%40google.com. > For more options, visit https://groups.google.com/d/optout.