* general protection fault in try_to_wake_up
@ 2018-03-29 16:01 syzbot
2018-03-29 16:32 ` Steven Rostedt
2018-04-03 8:50 ` Petr Mladek
0 siblings, 2 replies; 8+ messages in thread
From: syzbot @ 2018-03-29 16:01 UTC (permalink / raw)
To: linux-kernel, pmladek, rostedt, sergey.senozhatsky, syzkaller-bugs
Hello,
syzbot hit the following crash on upstream commit
bcfc1f4554662d8f2429ac8bd96064a59c149754 (Sat Mar 24 16:50:12 2018 +0000)
Merge tag 'pinctrl-v4.16-3' of
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
syzbot dashboard link:
https://syzkaller.appspot.com/bug?extid=d1fe9b7b917f2715c7d4
syzkaller reproducer:
https://syzkaller.appspot.com/x/repro.syz?id=4649457446551552
Raw console output:
https://syzkaller.appspot.com/x/log.txt?id=4909621332410368
Kernel config:
https://syzkaller.appspot.com/x/.config?id=-5034017172441945317
compiler: gcc (GCC) 7.1.1 20170620
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d1fe9b7b917f2715c7d4@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.
IPVS: ftp: loaded support on port[0] = 21
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4170 Comm: syz-executor0 Not tainted 4.16.0-rc6+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320
RSP: 0018:ffff8801db206f60 EFLAGS: 00010002
RAX: 078e0401078e0401 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 1ffff100389fe583 RSI: 0000000000000000 RDI: ffff8801c4ff2c18
RBP: ffff8801db2072f0 R08: ffffffff814d839c R09: 0000000000000001
R10: 0000000000000000 R11: ffff8801c4ff2c10 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000000 R15: ffff8801b793c440
FS: 00000000014fa940(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004cb4e0 CR3: 00000001b7980002 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x96/0xc0 kernel/locking/spinlock.c:152
try_to_wake_up+0xbc/0x15f0 kernel/sched/core.c:1989
default_wake_function+0x30/0x50 kernel/sched/core.c:3693
autoremove_wake_function+0x78/0x350 kernel/sched/wait.c:377
__wake_up_common+0x18e/0x780 kernel/sched/wait.c:97
__wake_up_common_lock+0x1b4/0x310 kernel/sched/wait.c:125
__wake_up+0xe/0x10 kernel/sched/wait.c:149
wake_up_klogd_work_func+0x4a/0x70 kernel/printk/printk.c:2869
irq_work_run_list+0x184/0x240 kernel/irq_work.c:155
irq_work_tick+0x136/0x1a0 kernel/irq_work.c:181
update_process_times+0x48/0x60 kernel/time/timer.c:1639
tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:162
tick_sched_timer+0x42/0x120 kernel/time/tick-sched.c:1194
__run_hrtimer kernel/time/hrtimer.c:1349 [inline]
__hrtimer_run_queues+0x39c/0xec0 kernel/time/hrtimer.c:1411
hrtimer_interrupt+0x2a5/0x6f0 kernel/time/hrtimer.c:1469
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
smp_apic_timer_interrupt+0x14a/0x700 arch/x86/kernel/apic/apic.c:1050
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:778
[inline]
RIP: 0010:console_unlock+0xb18/0xfb0 kernel/printk/printk.c:2403
RSP: 0018:ffff8801b79068d8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff12
RAX: ffff8801b793c440 RBX: 0000000000000200 RCX: ffffffff815a8d6f
RDX: 0000000000000000 RSI: 1ffff10036f279af RDI: 0000000000000293
RBP: ffff8801b7906a40 R08: 1ffff10036f20ce9 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff83ba15e0 R15: dffffc0000000000
vprintk_emit+0x5c3/0xb90 kernel/printk/printk.c:1907
vprintk_default+0x28/0x30 kernel/printk/printk.c:1947
vprintk_func+0x57/0xc0 kernel/printk/printk_safe.c:379
printk+0xaa/0xca kernel/printk/printk.c:1980
kasan_die_handler+0x3d/0x3f arch/x86/mm/kasan_init_64.c:248
notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
__atomic_notifier_call_chain kernel/notifier.c:183 [inline]
atomic_notifier_call_chain+0x77/0x140 kernel/notifier.c:193
notify_die+0x18c/0x280 kernel/notifier.c:549
do_general_protection+0x331/0x3e0 arch/x86/kernel/traps.c:558
general_protection+0x25/0x50 arch/x86/entry/entry_64.S:1150
RIP: 0010:find_entry.isra.14+0x9f/0x1d0 fs/proc/proc_sysctl.c:119
RSP: 0018:ffff8801b7906fc8 EFLAGS: 00010202
RAX: 00f1c08020f1c080 RBX: ffff8801c4f95058 RCX: ffffffff81d29eae
RDX: 0000000000000000 RSI: ffff8801b8991678 RDI: ffff8801c4f95070
RBP: ffff8801b7907008 R08: 1ffff10036f20d55 R09: 0000000000000004
R10: ffff8801b7906f70 R11: 0000000000000000 R12: ffff8801b89915f8
R13: dffffc0000000000 R14: 078e0401078e0401 R15: ffff8801b8991678
find_subdir+0xa8/0x170 fs/proc/proc_sysctl.c:923
get_subdir fs/proc/proc_sysctl.c:977 [inline]
__register_sysctl_table+0x6d5/0x10b0 fs/proc/proc_sysctl.c:1327
register_net_sysctl+0x29/0x30 net/sysctl_net.c:120
mpls_dev_sysctl_register+0x1cf/0x2e0 net/mpls/af_mpls.c:1369
mpls_add_dev net/mpls/af_mpls.c:1420 [inline]
mpls_dev_notify+0x2af/0x980 net/mpls/af_mpls.c:1542
notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
call_netdevice_notifiers net/core/dev.c:1725 [inline]
register_netdevice+0xd40/0x1020 net/core/dev.c:7929
register_netdev+0x1a/0x30 net/core/dev.c:8014
sit_init_net+0x384/0xa70 net/ipv6/sit.c:1852
ops_init+0x10a/0x570 net/core/net_namespace.c:118
setup_net+0x351/0x760 net/core/net_namespace.c:302
copy_net_ns+0x238/0x580 net/core/net_namespace.c:426
create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107
unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206
SYSC_unshare kernel/fork.c:2407 [inline]
SyS_unshare+0x653/0xfa0 kernel/fork.c:2357
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457327
RSP: 002b:00007ffdd0bf1928 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000457327
RDX: 0000000000000000 RSI: 00007ffdd0bf1900 RDI: 0000000040000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000410710
R13: 00000000004107a0 R14: 0000000000000000 R15: 0000000000000000
Code: 48 85 c0 4c 8b 9d e8 fc ff ff 8b 8d e0 fc ff ff 44 8b 8d d8 fc ff ff
4c 8b 85 d0 fc ff ff 44 8b 95 c8 fc ff ff 0f 84 9b 07 00 00 <f0> ff 80 38
01 00 00 49 8d bf 70 08 00 00 48 ba 00 00 00 00 00
RIP: __lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320 RSP:
ffff8801db206f60
---[ end trace b962f2b4a8ee2930 ]---
---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@googlegroups.com.
syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: general protection fault in try_to_wake_up
2018-03-29 16:01 general protection fault in try_to_wake_up syzbot
@ 2018-03-29 16:32 ` Steven Rostedt
2018-03-29 16:53 ` Dmitry Vyukov
2018-04-03 8:50 ` Petr Mladek
1 sibling, 1 reply; 8+ messages in thread
From: Steven Rostedt @ 2018-03-29 16:32 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, pmladek, sergey.senozhatsky, syzkaller-bugs
Not sure why we are being Cc'd on this crash.
On Thu, 29 Mar 2018 09:01:02 -0700
syzbot <syzbot+d1fe9b7b917f2715c7d4@syzkaller.appspotmail.com> wrote:
> Hello,
>
> syzbot hit the following crash on upstream commit
> bcfc1f4554662d8f2429ac8bd96064a59c149754 (Sat Mar 24 16:50:12 2018 +0000)
> Merge tag 'pinctrl-v4.16-3' of
> git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
> syzbot dashboard link:
> https://syzkaller.appspot.com/bug?extid=d1fe9b7b917f2715c7d4
>
> syzkaller reproducer:
> https://syzkaller.appspot.com/x/repro.syz?id=4649457446551552
> Raw console output:
> https://syzkaller.appspot.com/x/log.txt?id=4909621332410368
> Kernel config:
> https://syzkaller.appspot.com/x/.config?id=-5034017172441945317
> compiler: gcc (GCC) 7.1.1 20170620
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+d1fe9b7b917f2715c7d4@syzkaller.appspotmail.com
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
>
> IPVS: ftp: loaded support on port[0] = 21
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Modules linked in:
> CPU: 0 PID: 4170 Comm: syz-executor0 Not tainted 4.16.0-rc6+ #1
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:__lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320
Something is totally messed up here if you took a GPF in lockdep itself.
> RSP: 0018:ffff8801db206f60 EFLAGS: 00010002
> RAX: 078e0401078e0401 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: 1ffff100389fe583 RSI: 0000000000000000 RDI: ffff8801c4ff2c18
> RBP: ffff8801db2072f0 R08: ffffffff814d839c R09: 0000000000000001
> R10: 0000000000000000 R11: ffff8801c4ff2c10 R12: 0000000000000000
> R13: 0000000000000001 R14: 0000000000000000 R15: ffff8801b793c440
> FS: 00000000014fa940(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000004cb4e0 CR3: 00000001b7980002 CR4: 00000000001606f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <IRQ>
> lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
> __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> _raw_spin_lock_irqsave+0x96/0xc0 kernel/locking/spinlock.c:152
> try_to_wake_up+0xbc/0x15f0 kernel/sched/core.c:1989
> default_wake_function+0x30/0x50 kernel/sched/core.c:3693
> autoremove_wake_function+0x78/0x350 kernel/sched/wait.c:377
> __wake_up_common+0x18e/0x780 kernel/sched/wait.c:97
> __wake_up_common_lock+0x1b4/0x310 kernel/sched/wait.c:125
> __wake_up+0xe/0x10 kernel/sched/wait.c:149
> wake_up_klogd_work_func+0x4a/0x70 kernel/printk/printk.c:2869
> irq_work_run_list+0x184/0x240 kernel/irq_work.c:155
> irq_work_tick+0x136/0x1a0 kernel/irq_work.c:181
> update_process_times+0x48/0x60 kernel/time/timer.c:1639
> tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:162
> tick_sched_timer+0x42/0x120 kernel/time/tick-sched.c:1194
> __run_hrtimer kernel/time/hrtimer.c:1349 [inline]
> __hrtimer_run_queues+0x39c/0xec0 kernel/time/hrtimer.c:1411
> hrtimer_interrupt+0x2a5/0x6f0 kernel/time/hrtimer.c:1469
> local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
> smp_apic_timer_interrupt+0x14a/0x700 arch/x86/kernel/apic/apic.c:1050
> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
> </IRQ>
> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:778
> [inline]
> RIP: 0010:console_unlock+0xb18/0xfb0 kernel/printk/printk.c:2403
Perhaps this is the reason we are being Cc'd?
But this looks to be a side-effect of the first bug. If your box is
crashing within lockdep, I'm betting the system is hosed, and you will
get crashes in random locations after that.
I doubt this is a printk issue.
-- Steve
> RSP: 0018:ffff8801b79068d8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff12
> RAX: ffff8801b793c440 RBX: 0000000000000200 RCX: ffffffff815a8d6f
> RDX: 0000000000000000 RSI: 1ffff10036f279af RDI: 0000000000000293
> RBP: ffff8801b7906a40 R08: 1ffff10036f20ce9 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> R13: 0000000000000000 R14: ffffffff83ba15e0 R15: dffffc0000000000
> vprintk_emit+0x5c3/0xb90 kernel/printk/printk.c:1907
> vprintk_default+0x28/0x30 kernel/printk/printk.c:1947
> vprintk_func+0x57/0xc0 kernel/printk/printk_safe.c:379
> printk+0xaa/0xca kernel/printk/printk.c:1980
> kasan_die_handler+0x3d/0x3f arch/x86/mm/kasan_init_64.c:248
> notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
> __atomic_notifier_call_chain kernel/notifier.c:183 [inline]
> atomic_notifier_call_chain+0x77/0x140 kernel/notifier.c:193
> notify_die+0x18c/0x280 kernel/notifier.c:549
> do_general_protection+0x331/0x3e0 arch/x86/kernel/traps.c:558
> general_protection+0x25/0x50 arch/x86/entry/entry_64.S:1150
> RIP: 0010:find_entry.isra.14+0x9f/0x1d0 fs/proc/proc_sysctl.c:119
> RSP: 0018:ffff8801b7906fc8 EFLAGS: 00010202
> RAX: 00f1c08020f1c080 RBX: ffff8801c4f95058 RCX: ffffffff81d29eae
> RDX: 0000000000000000 RSI: ffff8801b8991678 RDI: ffff8801c4f95070
> RBP: ffff8801b7907008 R08: 1ffff10036f20d55 R09: 0000000000000004
> R10: ffff8801b7906f70 R11: 0000000000000000 R12: ffff8801b89915f8
> R13: dffffc0000000000 R14: 078e0401078e0401 R15: ffff8801b8991678
> find_subdir+0xa8/0x170 fs/proc/proc_sysctl.c:923
> get_subdir fs/proc/proc_sysctl.c:977 [inline]
> __register_sysctl_table+0x6d5/0x10b0 fs/proc/proc_sysctl.c:1327
> register_net_sysctl+0x29/0x30 net/sysctl_net.c:120
> mpls_dev_sysctl_register+0x1cf/0x2e0 net/mpls/af_mpls.c:1369
> mpls_add_dev net/mpls/af_mpls.c:1420 [inline]
> mpls_dev_notify+0x2af/0x980 net/mpls/af_mpls.c:1542
> notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
> __raw_notifier_call_chain kernel/notifier.c:394 [inline]
> raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
> call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
> call_netdevice_notifiers net/core/dev.c:1725 [inline]
> register_netdevice+0xd40/0x1020 net/core/dev.c:7929
> register_netdev+0x1a/0x30 net/core/dev.c:8014
> sit_init_net+0x384/0xa70 net/ipv6/sit.c:1852
> ops_init+0x10a/0x570 net/core/net_namespace.c:118
> setup_net+0x351/0x760 net/core/net_namespace.c:302
> copy_net_ns+0x238/0x580 net/core/net_namespace.c:426
> create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107
> unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206
> SYSC_unshare kernel/fork.c:2407 [inline]
> SyS_unshare+0x653/0xfa0 kernel/fork.c:2357
> do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
> entry_SYSCALL_64_after_hwframe+0x42/0xb7
> RIP: 0033:0x457327
> RSP: 002b:00007ffdd0bf1928 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000457327
> RDX: 0000000000000000 RSI: 00007ffdd0bf1900 RDI: 0000000040000000
> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000410710
> R13: 00000000004107a0 R14: 0000000000000000 R15: 0000000000000000
> Code: 48 85 c0 4c 8b 9d e8 fc ff ff 8b 8d e0 fc ff ff 44 8b 8d d8 fc ff ff
> 4c 8b 85 d0 fc ff ff 44 8b 95 c8 fc ff ff 0f 84 9b 07 00 00 <f0> ff 80 38
> 01 00 00 49 8d bf 70 08 00 00 48 ba 00 00 00 00 00
> RIP: __lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320 RSP:
> ffff8801db206f60
> ---[ end trace b962f2b4a8ee2930 ]---
>
>
> ---
> This bug is generated by a dumb bot. It may contain errors.
> See https://goo.gl/tpsmEJ for details.
> Direct all questions to syzkaller@googlegroups.com.
>
> syzbot will keep track of this bug report.
> If you forgot to add the Reported-by tag, once the fix for this bug is
> merged
> into any tree, please reply to this email with:
> #syz fix: exact-commit-title
> If you want to test a patch for this bug, please reply with:
> #syz test: git://repo/address.git branch
> and provide the patch inline or as an attachment.
> To mark this as a duplicate of another syzbot report, please reply with:
> #syz dup: exact-subject-of-another-report
> If it's a one-off invalid bug report, please reply with:
> #syz invalid
> Note: if the crash happens again, it will cause creation of a new bug
> report.
> Note: all commands must start from beginning of the line in the email body.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: general protection fault in try_to_wake_up
2018-03-29 16:32 ` Steven Rostedt
@ 2018-03-29 16:53 ` Dmitry Vyukov
2018-03-31 15:58 ` Dmitry Vyukov
0 siblings, 1 reply; 8+ messages in thread
From: Dmitry Vyukov @ 2018-03-29 16:53 UTC (permalink / raw)
To: Steven Rostedt
Cc: syzbot, LKML, Petr Mladek, Sergey Senozhatsky, syzkaller-bugs,
Eric Dumazet
On Thu, Mar 29, 2018 at 6:32 PM, Steven Rostedt <rostedt@goodmis.org> wrote:
>
> Not sure why we are being Cc'd on this crash.
>
> On Thu, 29 Mar 2018 09:01:02 -0700
> syzbot <syzbot+d1fe9b7b917f2715c7d4@syzkaller.appspotmail.com> wrote:
>
>> Hello,
>>
>> syzbot hit the following crash on upstream commit
>> bcfc1f4554662d8f2429ac8bd96064a59c149754 (Sat Mar 24 16:50:12 2018 +0000)
>> Merge tag 'pinctrl-v4.16-3' of
>> git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
>> syzbot dashboard link:
>> https://syzkaller.appspot.com/bug?extid=d1fe9b7b917f2715c7d4
>>
>> syzkaller reproducer:
>> https://syzkaller.appspot.com/x/repro.syz?id=4649457446551552
>> Raw console output:
>> https://syzkaller.appspot.com/x/log.txt?id=4909621332410368
>> Kernel config:
>> https://syzkaller.appspot.com/x/.config?id=-5034017172441945317
>> compiler: gcc (GCC) 7.1.1 20170620
>>
>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> Reported-by: syzbot+d1fe9b7b917f2715c7d4@syzkaller.appspotmail.com
>> It will help syzbot understand when the bug is fixed. See footer for
>> details.
>> If you forward the report, please keep this part and the footer.
>>
>> IPVS: ftp: loaded support on port[0] = 21
>> kasan: CONFIG_KASAN_INLINE enabled
>> kasan: GPF could be caused by NULL-ptr deref or user memory access
>> kasan: CONFIG_KASAN_INLINE enabled
>> kasan: GPF could be caused by NULL-ptr deref or user memory access
>> general protection fault: 0000 [#1] SMP KASAN
>> Dumping ftrace buffer:
>> (ftrace buffer empty)
>> Modules linked in:
>> CPU: 0 PID: 4170 Comm: syz-executor0 Not tainted 4.16.0-rc6+ #1
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
>> Google 01/01/2011
>> RIP: 0010:__lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320
>
> Something is totally messed up here if you took a GPF in lockdep itself.
>
>> RSP: 0018:ffff8801db206f60 EFLAGS: 00010002
>> RAX: 078e0401078e0401 RBX: 0000000000000000 RCX: 0000000000000000
>> RDX: 1ffff100389fe583 RSI: 0000000000000000 RDI: ffff8801c4ff2c18
>> RBP: ffff8801db2072f0 R08: ffffffff814d839c R09: 0000000000000001
>> R10: 0000000000000000 R11: ffff8801c4ff2c10 R12: 0000000000000000
>> R13: 0000000000000001 R14: 0000000000000000 R15: ffff8801b793c440
>> FS: 00000000014fa940(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00000000004cb4e0 CR3: 00000001b7980002 CR4: 00000000001606f0
>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> Call Trace:
>> <IRQ>
>> lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
>> __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
>> _raw_spin_lock_irqsave+0x96/0xc0 kernel/locking/spinlock.c:152
>> try_to_wake_up+0xbc/0x15f0 kernel/sched/core.c:1989
>> default_wake_function+0x30/0x50 kernel/sched/core.c:3693
>> autoremove_wake_function+0x78/0x350 kernel/sched/wait.c:377
>> __wake_up_common+0x18e/0x780 kernel/sched/wait.c:97
>> __wake_up_common_lock+0x1b4/0x310 kernel/sched/wait.c:125
>> __wake_up+0xe/0x10 kernel/sched/wait.c:149
>> wake_up_klogd_work_func+0x4a/0x70 kernel/printk/printk.c:2869
>> irq_work_run_list+0x184/0x240 kernel/irq_work.c:155
>> irq_work_tick+0x136/0x1a0 kernel/irq_work.c:181
>> update_process_times+0x48/0x60 kernel/time/timer.c:1639
>> tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:162
>> tick_sched_timer+0x42/0x120 kernel/time/tick-sched.c:1194
>> __run_hrtimer kernel/time/hrtimer.c:1349 [inline]
>> __hrtimer_run_queues+0x39c/0xec0 kernel/time/hrtimer.c:1411
>> hrtimer_interrupt+0x2a5/0x6f0 kernel/time/hrtimer.c:1469
>> local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
>> smp_apic_timer_interrupt+0x14a/0x700 arch/x86/kernel/apic/apic.c:1050
>> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
>> </IRQ>
>> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:778
>> [inline]
>> RIP: 0010:console_unlock+0xb18/0xfb0 kernel/printk/printk.c:2403
>
> Perhaps this is the reason we are being Cc'd?
>
> But this looks to be a side-effect of the first bug. If your box is
> crashing within lockdep, I'm betting the system is hosed, and you will
> get crashes in random locations after that.
>
> I doubt this is a printk issue.
Hi Steven,
You were CCed because this crash was attributed to
kernel/printk/printk.c (higher frames are in very common code, and
these are skipped for the purpose of bug attribution).
The box was perfectly fine before running the provided reproducer, the
kernel is not tainted and nothing was executed before this program
(except for common init code).
+Eric, from the reproducer this looks like the known bug in tun. Is
there any progress on that bug, it seems to cause a bunch of assorted
crashes.
>> RSP: 0018:ffff8801b79068d8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff12
>> RAX: ffff8801b793c440 RBX: 0000000000000200 RCX: ffffffff815a8d6f
>> RDX: 0000000000000000 RSI: 1ffff10036f279af RDI: 0000000000000293
>> RBP: ffff8801b7906a40 R08: 1ffff10036f20ce9 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
>> R13: 0000000000000000 R14: ffffffff83ba15e0 R15: dffffc0000000000
>> vprintk_emit+0x5c3/0xb90 kernel/printk/printk.c:1907
>> vprintk_default+0x28/0x30 kernel/printk/printk.c:1947
>> vprintk_func+0x57/0xc0 kernel/printk/printk_safe.c:379
>> printk+0xaa/0xca kernel/printk/printk.c:1980
>> kasan_die_handler+0x3d/0x3f arch/x86/mm/kasan_init_64.c:248
>> notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
>> __atomic_notifier_call_chain kernel/notifier.c:183 [inline]
>> atomic_notifier_call_chain+0x77/0x140 kernel/notifier.c:193
>> notify_die+0x18c/0x280 kernel/notifier.c:549
>> do_general_protection+0x331/0x3e0 arch/x86/kernel/traps.c:558
>> general_protection+0x25/0x50 arch/x86/entry/entry_64.S:1150
>> RIP: 0010:find_entry.isra.14+0x9f/0x1d0 fs/proc/proc_sysctl.c:119
>> RSP: 0018:ffff8801b7906fc8 EFLAGS: 00010202
>> RAX: 00f1c08020f1c080 RBX: ffff8801c4f95058 RCX: ffffffff81d29eae
>> RDX: 0000000000000000 RSI: ffff8801b8991678 RDI: ffff8801c4f95070
>> RBP: ffff8801b7907008 R08: 1ffff10036f20d55 R09: 0000000000000004
>> R10: ffff8801b7906f70 R11: 0000000000000000 R12: ffff8801b89915f8
>> R13: dffffc0000000000 R14: 078e0401078e0401 R15: ffff8801b8991678
>> find_subdir+0xa8/0x170 fs/proc/proc_sysctl.c:923
>> get_subdir fs/proc/proc_sysctl.c:977 [inline]
>> __register_sysctl_table+0x6d5/0x10b0 fs/proc/proc_sysctl.c:1327
>> register_net_sysctl+0x29/0x30 net/sysctl_net.c:120
>> mpls_dev_sysctl_register+0x1cf/0x2e0 net/mpls/af_mpls.c:1369
>> mpls_add_dev net/mpls/af_mpls.c:1420 [inline]
>> mpls_dev_notify+0x2af/0x980 net/mpls/af_mpls.c:1542
>> notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
>> __raw_notifier_call_chain kernel/notifier.c:394 [inline]
>> raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
>> call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
>> call_netdevice_notifiers net/core/dev.c:1725 [inline]
>> register_netdevice+0xd40/0x1020 net/core/dev.c:7929
>> register_netdev+0x1a/0x30 net/core/dev.c:8014
>> sit_init_net+0x384/0xa70 net/ipv6/sit.c:1852
>> ops_init+0x10a/0x570 net/core/net_namespace.c:118
>> setup_net+0x351/0x760 net/core/net_namespace.c:302
>> copy_net_ns+0x238/0x580 net/core/net_namespace.c:426
>> create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107
>> unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206
>> SYSC_unshare kernel/fork.c:2407 [inline]
>> SyS_unshare+0x653/0xfa0 kernel/fork.c:2357
>> do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
>> entry_SYSCALL_64_after_hwframe+0x42/0xb7
>> RIP: 0033:0x457327
>> RSP: 002b:00007ffdd0bf1928 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000457327
>> RDX: 0000000000000000 RSI: 00007ffdd0bf1900 RDI: 0000000040000000
>> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
>> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000410710
>> R13: 00000000004107a0 R14: 0000000000000000 R15: 0000000000000000
>> Code: 48 85 c0 4c 8b 9d e8 fc ff ff 8b 8d e0 fc ff ff 44 8b 8d d8 fc ff ff
>> 4c 8b 85 d0 fc ff ff 44 8b 95 c8 fc ff ff 0f 84 9b 07 00 00 <f0> ff 80 38
>> 01 00 00 49 8d bf 70 08 00 00 48 ba 00 00 00 00 00
>> RIP: __lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320 RSP:
>> ffff8801db206f60
>> ---[ end trace b962f2b4a8ee2930 ]---
>>
>>
>> ---
>> This bug is generated by a dumb bot. It may contain errors.
>> See https://goo.gl/tpsmEJ for details.
>> Direct all questions to syzkaller@googlegroups.com.
>>
>> syzbot will keep track of this bug report.
>> If you forgot to add the Reported-by tag, once the fix for this bug is
>> merged
>> into any tree, please reply to this email with:
>> #syz fix: exact-commit-title
>> If you want to test a patch for this bug, please reply with:
>> #syz test: git://repo/address.git branch
>> and provide the patch inline or as an attachment.
>> To mark this as a duplicate of another syzbot report, please reply with:
>> #syz dup: exact-subject-of-another-report
>> If it's a one-off invalid bug report, please reply with:
>> #syz invalid
>> Note: if the crash happens again, it will cause creation of a new bug
>> report.
>> Note: all commands must start from beginning of the line in the email body.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20180329123225.3a8fd6f5%40gandalf.local.home.
> For more options, visit https://groups.google.com/d/optout.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: general protection fault in try_to_wake_up
2018-03-29 16:53 ` Dmitry Vyukov
@ 2018-03-31 15:58 ` Dmitry Vyukov
0 siblings, 0 replies; 8+ messages in thread
From: Dmitry Vyukov @ 2018-03-31 15:58 UTC (permalink / raw)
To: Steven Rostedt
Cc: syzbot, LKML, Petr Mladek, Sergey Senozhatsky, syzkaller-bugs,
Eric Dumazet
On Thu, Mar 29, 2018 at 6:53 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> On Thu, Mar 29, 2018 at 6:32 PM, Steven Rostedt <rostedt@goodmis.org> wrote:
>>
>> Not sure why we are being Cc'd on this crash.
>>
>> On Thu, 29 Mar 2018 09:01:02 -0700
>> syzbot <syzbot+d1fe9b7b917f2715c7d4@syzkaller.appspotmail.com> wrote:
>>
>>> Hello,
>>>
>>> syzbot hit the following crash on upstream commit
>>> bcfc1f4554662d8f2429ac8bd96064a59c149754 (Sat Mar 24 16:50:12 2018 +0000)
>>> Merge tag 'pinctrl-v4.16-3' of
>>> git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
>>> syzbot dashboard link:
>>> https://syzkaller.appspot.com/bug?extid=d1fe9b7b917f2715c7d4
>>>
>>> syzkaller reproducer:
>>> https://syzkaller.appspot.com/x/repro.syz?id=4649457446551552
>>> Raw console output:
>>> https://syzkaller.appspot.com/x/log.txt?id=4909621332410368
>>> Kernel config:
>>> https://syzkaller.appspot.com/x/.config?id=-5034017172441945317
>>> compiler: gcc (GCC) 7.1.1 20170620
>>>
>>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>>> Reported-by: syzbot+d1fe9b7b917f2715c7d4@syzkaller.appspotmail.com
>>> It will help syzbot understand when the bug is fixed. See footer for
>>> details.
>>> If you forward the report, please keep this part and the footer.
>>>
>>> IPVS: ftp: loaded support on port[0] = 21
>>> kasan: CONFIG_KASAN_INLINE enabled
>>> kasan: GPF could be caused by NULL-ptr deref or user memory access
>>> kasan: CONFIG_KASAN_INLINE enabled
>>> kasan: GPF could be caused by NULL-ptr deref or user memory access
>>> general protection fault: 0000 [#1] SMP KASAN
>>> Dumping ftrace buffer:
>>> (ftrace buffer empty)
>>> Modules linked in:
>>> CPU: 0 PID: 4170 Comm: syz-executor0 Not tainted 4.16.0-rc6+ #1
>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
>>> Google 01/01/2011
>>> RIP: 0010:__lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320
>>
>> Something is totally messed up here if you took a GPF in lockdep itself.
>>
>>> RSP: 0018:ffff8801db206f60 EFLAGS: 00010002
>>> RAX: 078e0401078e0401 RBX: 0000000000000000 RCX: 0000000000000000
>>> RDX: 1ffff100389fe583 RSI: 0000000000000000 RDI: ffff8801c4ff2c18
>>> RBP: ffff8801db2072f0 R08: ffffffff814d839c R09: 0000000000000001
>>> R10: 0000000000000000 R11: ffff8801c4ff2c10 R12: 0000000000000000
>>> R13: 0000000000000001 R14: 0000000000000000 R15: ffff8801b793c440
>>> FS: 00000000014fa940(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 00000000004cb4e0 CR3: 00000001b7980002 CR4: 00000000001606f0
>>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>>> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>>> Call Trace:
>>> <IRQ>
>>> lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
>>> __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
>>> _raw_spin_lock_irqsave+0x96/0xc0 kernel/locking/spinlock.c:152
>>> try_to_wake_up+0xbc/0x15f0 kernel/sched/core.c:1989
>>> default_wake_function+0x30/0x50 kernel/sched/core.c:3693
>>> autoremove_wake_function+0x78/0x350 kernel/sched/wait.c:377
>>> __wake_up_common+0x18e/0x780 kernel/sched/wait.c:97
>>> __wake_up_common_lock+0x1b4/0x310 kernel/sched/wait.c:125
>>> __wake_up+0xe/0x10 kernel/sched/wait.c:149
>>> wake_up_klogd_work_func+0x4a/0x70 kernel/printk/printk.c:2869
>>> irq_work_run_list+0x184/0x240 kernel/irq_work.c:155
>>> irq_work_tick+0x136/0x1a0 kernel/irq_work.c:181
>>> update_process_times+0x48/0x60 kernel/time/timer.c:1639
>>> tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:162
>>> tick_sched_timer+0x42/0x120 kernel/time/tick-sched.c:1194
>>> __run_hrtimer kernel/time/hrtimer.c:1349 [inline]
>>> __hrtimer_run_queues+0x39c/0xec0 kernel/time/hrtimer.c:1411
>>> hrtimer_interrupt+0x2a5/0x6f0 kernel/time/hrtimer.c:1469
>>> local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
>>> smp_apic_timer_interrupt+0x14a/0x700 arch/x86/kernel/apic/apic.c:1050
>>> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
>>> </IRQ>
>>> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:778
>>> [inline]
>>> RIP: 0010:console_unlock+0xb18/0xfb0 kernel/printk/printk.c:2403
>>
>> Perhaps this is the reason we are being Cc'd?
>>
>> But this looks to be a side-effect of the first bug. If your box is
>> crashing within lockdep, I'm betting the system is hosed, and you will
>> get crashes in random locations after that.
>>
>> I doubt this is a printk issue.
>
> Hi Steven,
>
> You were CCed because this crash was attributed to
> kernel/printk/printk.c (higher frames are in very common code, and
> these are skipped for the purpose of bug attribution).
>
> The box was perfectly fine before running the provided reproducer, the
> kernel is not tainted and nothing was executed before this program
> (except for common init code).
>
> +Eric, from the reproducer this looks like the known bug in tun. Is
> there any progress on that bug, it seems to cause a bunch of assorted
> crashes.
#syz fix: vlan: Fix vlan insertion for packets without ethernet header
>>> RSP: 0018:ffff8801b79068d8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff12
>>> RAX: ffff8801b793c440 RBX: 0000000000000200 RCX: ffffffff815a8d6f
>>> RDX: 0000000000000000 RSI: 1ffff10036f279af RDI: 0000000000000293
>>> RBP: ffff8801b7906a40 R08: 1ffff10036f20ce9 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
>>> R13: 0000000000000000 R14: ffffffff83ba15e0 R15: dffffc0000000000
>>> vprintk_emit+0x5c3/0xb90 kernel/printk/printk.c:1907
>>> vprintk_default+0x28/0x30 kernel/printk/printk.c:1947
>>> vprintk_func+0x57/0xc0 kernel/printk/printk_safe.c:379
>>> printk+0xaa/0xca kernel/printk/printk.c:1980
>>> kasan_die_handler+0x3d/0x3f arch/x86/mm/kasan_init_64.c:248
>>> notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
>>> __atomic_notifier_call_chain kernel/notifier.c:183 [inline]
>>> atomic_notifier_call_chain+0x77/0x140 kernel/notifier.c:193
>>> notify_die+0x18c/0x280 kernel/notifier.c:549
>>> do_general_protection+0x331/0x3e0 arch/x86/kernel/traps.c:558
>>> general_protection+0x25/0x50 arch/x86/entry/entry_64.S:1150
>>> RIP: 0010:find_entry.isra.14+0x9f/0x1d0 fs/proc/proc_sysctl.c:119
>>> RSP: 0018:ffff8801b7906fc8 EFLAGS: 00010202
>>> RAX: 00f1c08020f1c080 RBX: ffff8801c4f95058 RCX: ffffffff81d29eae
>>> RDX: 0000000000000000 RSI: ffff8801b8991678 RDI: ffff8801c4f95070
>>> RBP: ffff8801b7907008 R08: 1ffff10036f20d55 R09: 0000000000000004
>>> R10: ffff8801b7906f70 R11: 0000000000000000 R12: ffff8801b89915f8
>>> R13: dffffc0000000000 R14: 078e0401078e0401 R15: ffff8801b8991678
>>> find_subdir+0xa8/0x170 fs/proc/proc_sysctl.c:923
>>> get_subdir fs/proc/proc_sysctl.c:977 [inline]
>>> __register_sysctl_table+0x6d5/0x10b0 fs/proc/proc_sysctl.c:1327
>>> register_net_sysctl+0x29/0x30 net/sysctl_net.c:120
>>> mpls_dev_sysctl_register+0x1cf/0x2e0 net/mpls/af_mpls.c:1369
>>> mpls_add_dev net/mpls/af_mpls.c:1420 [inline]
>>> mpls_dev_notify+0x2af/0x980 net/mpls/af_mpls.c:1542
>>> notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
>>> __raw_notifier_call_chain kernel/notifier.c:394 [inline]
>>> raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
>>> call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
>>> call_netdevice_notifiers net/core/dev.c:1725 [inline]
>>> register_netdevice+0xd40/0x1020 net/core/dev.c:7929
>>> register_netdev+0x1a/0x30 net/core/dev.c:8014
>>> sit_init_net+0x384/0xa70 net/ipv6/sit.c:1852
>>> ops_init+0x10a/0x570 net/core/net_namespace.c:118
>>> setup_net+0x351/0x760 net/core/net_namespace.c:302
>>> copy_net_ns+0x238/0x580 net/core/net_namespace.c:426
>>> create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107
>>> unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206
>>> SYSC_unshare kernel/fork.c:2407 [inline]
>>> SyS_unshare+0x653/0xfa0 kernel/fork.c:2357
>>> do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
>>> entry_SYSCALL_64_after_hwframe+0x42/0xb7
>>> RIP: 0033:0x457327
>>> RSP: 002b:00007ffdd0bf1928 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
>>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000457327
>>> RDX: 0000000000000000 RSI: 00007ffdd0bf1900 RDI: 0000000040000000
>>> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
>>> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000410710
>>> R13: 00000000004107a0 R14: 0000000000000000 R15: 0000000000000000
>>> Code: 48 85 c0 4c 8b 9d e8 fc ff ff 8b 8d e0 fc ff ff 44 8b 8d d8 fc ff ff
>>> 4c 8b 85 d0 fc ff ff 44 8b 95 c8 fc ff ff 0f 84 9b 07 00 00 <f0> ff 80 38
>>> 01 00 00 49 8d bf 70 08 00 00 48 ba 00 00 00 00 00
>>> RIP: __lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320 RSP:
>>> ffff8801db206f60
>>> ---[ end trace b962f2b4a8ee2930 ]---
>>>
>>>
>>> ---
>>> This bug is generated by a dumb bot. It may contain errors.
>>> See https://goo.gl/tpsmEJ for details.
>>> Direct all questions to syzkaller@googlegroups.com.
>>>
>>> syzbot will keep track of this bug report.
>>> If you forgot to add the Reported-by tag, once the fix for this bug is
>>> merged
>>> into any tree, please reply to this email with:
>>> #syz fix: exact-commit-title
>>> If you want to test a patch for this bug, please reply with:
>>> #syz test: git://repo/address.git branch
>>> and provide the patch inline or as an attachment.
>>> To mark this as a duplicate of another syzbot report, please reply with:
>>> #syz dup: exact-subject-of-another-report
>>> If it's a one-off invalid bug report, please reply with:
>>> #syz invalid
>>> Note: if the crash happens again, it will cause creation of a new bug
>>> report.
>>> Note: all commands must start from beginning of the line in the email body.
>>
>> --
>> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
>> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
>> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20180329123225.3a8fd6f5%40gandalf.local.home.
>> For more options, visit https://groups.google.com/d/optout.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: general protection fault in try_to_wake_up
2018-03-29 16:01 general protection fault in try_to_wake_up syzbot
2018-03-29 16:32 ` Steven Rostedt
@ 2018-04-03 8:50 ` Petr Mladek
2018-04-03 8:56 ` Petr Mladek
2018-04-03 9:13 ` Peter Zijlstra
1 sibling, 2 replies; 8+ messages in thread
From: Petr Mladek @ 2018-04-03 8:50 UTC (permalink / raw)
To: syzbot
Cc: linux-kernel, rostedt, sergey.senozhatsky, syzkaller-bugs,
Andy Lutomirski, Peter Zijlstra, Thomas Gleixner,
Borislav Petkov, H. Peter Anvin, Ingo Molnar, x86
On Thu 2018-03-29 09:01:02, syzbot wrote:
> Hello,
>
> syzbot hit the following crash on upstream commit
> bcfc1f4554662d8f2429ac8bd96064a59c149754 (Sat Mar 24 16:50:12 2018 +0000)
> Merge tag 'pinctrl-v4.16-3' of
> git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
> syzbot dashboard link:
> https://syzkaller.appspot.com/bug?extid=d1fe9b7b917f2715c7d4
>
> syzkaller reproducer:
> https://syzkaller.appspot.com/x/repro.syz?id=4649457446551552
> Raw console output:
> https://syzkaller.appspot.com/x/log.txt?id=4909621332410368
> Kernel config:
> https://syzkaller.appspot.com/x/.config?id=-5034017172441945317
> compiler: gcc (GCC) 7.1.1 20170620
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+d1fe9b7b917f2715c7d4@syzkaller.appspotmail.com
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
>
> IPVS: ftp: loaded support on port[0] = 21
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
This is already 2nd level fault. I wonder if KASAN or lockdep should
have already been disabled at this point. Adding some more people
into CC.
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Modules linked in:
> CPU: 0 PID: 4170 Comm: syz-executor0 Not tainted 4.16.0-rc6+ #1
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:__lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320
> RSP: 0018:ffff8801db206f60 EFLAGS: 00010002
> RAX: 078e0401078e0401 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: 1ffff100389fe583 RSI: 0000000000000000 RDI: ffff8801c4ff2c18
> RBP: ffff8801db2072f0 R08: ffffffff814d839c R09: 0000000000000001
> R10: 0000000000000000 R11: ffff8801c4ff2c10 R12: 0000000000000000
> R13: 0000000000000001 R14: 0000000000000000 R15: ffff8801b793c440
> FS: 00000000014fa940(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000004cb4e0 CR3: 00000001b7980002 CR4: 00000000001606f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <IRQ>
> lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
> __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> _raw_spin_lock_irqsave+0x96/0xc0 kernel/locking/spinlock.c:152
> try_to_wake_up+0xbc/0x15f0 kernel/sched/core.c:1989
> default_wake_function+0x30/0x50 kernel/sched/core.c:3693
> autoremove_wake_function+0x78/0x350 kernel/sched/wait.c:377
> __wake_up_common+0x18e/0x780 kernel/sched/wait.c:97
> __wake_up_common_lock+0x1b4/0x310 kernel/sched/wait.c:125
> __wake_up+0xe/0x10 kernel/sched/wait.c:149
> wake_up_klogd_work_func+0x4a/0x70 kernel/printk/printk.c:2869
> irq_work_run_list+0x184/0x240 kernel/irq_work.c:155
> irq_work_tick+0x136/0x1a0 kernel/irq_work.c:181
> update_process_times+0x48/0x60 kernel/time/timer.c:1639
> tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:162
> tick_sched_timer+0x42/0x120 kernel/time/tick-sched.c:1194
> __run_hrtimer kernel/time/hrtimer.c:1349 [inline]
> __hrtimer_run_queues+0x39c/0xec0 kernel/time/hrtimer.c:1411
> hrtimer_interrupt+0x2a5/0x6f0 kernel/time/hrtimer.c:1469
> local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
> smp_apic_timer_interrupt+0x14a/0x700 arch/x86/kernel/apic/apic.c:1050
> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
> </IRQ>
> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:778
> [inline]
> RIP: 0010:console_unlock+0xb18/0xfb0 kernel/printk/printk.c:2403
> RSP: 0018:ffff8801b79068d8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff12
> RAX: ffff8801b793c440 RBX: 0000000000000200 RCX: ffffffff815a8d6f
> RDX: 0000000000000000 RSI: 1ffff10036f279af RDI: 0000000000000293
> RBP: ffff8801b7906a40 R08: 1ffff10036f20ce9 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> R13: 0000000000000000 R14: ffffffff83ba15e0 R15: dffffc0000000000
> vprintk_emit+0x5c3/0xb90 kernel/printk/printk.c:1907
raw_spin_lock() succeeded here. Therefore lockdep was still working
at this stage.
> vprintk_default+0x28/0x30 kernel/printk/printk.c:1947
> vprintk_func+0x57/0xc0 kernel/printk/printk_safe.c:379
> printk+0xaa/0xca kernel/printk/printk.c:1980
> kasan_die_handler+0x3d/0x3f arch/x86/mm/kasan_init_64.c:248
> notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
> __atomic_notifier_call_chain kernel/notifier.c:183 [inline]
> atomic_notifier_call_chain+0x77/0x140 kernel/notifier.c:193
> notify_die+0x18c/0x280 kernel/notifier.c:549
It must have been general protection fault as well.
Best Regards,
Petr
> do_general_protection+0x331/0x3e0 arch/x86/kernel/traps.c:558
> general_protection+0x25/0x50 arch/x86/entry/entry_64.S:1150
> RIP: 0010:find_entry.isra.14+0x9f/0x1d0 fs/proc/proc_sysctl.c:119
> RSP: 0018:ffff8801b7906fc8 EFLAGS: 00010202
> RAX: 00f1c08020f1c080 RBX: ffff8801c4f95058 RCX: ffffffff81d29eae
> RDX: 0000000000000000 RSI: ffff8801b8991678 RDI: ffff8801c4f95070
> RBP: ffff8801b7907008 R08: 1ffff10036f20d55 R09: 0000000000000004
> R10: ffff8801b7906f70 R11: 0000000000000000 R12: ffff8801b89915f8
> R13: dffffc0000000000 R14: 078e0401078e0401 R15: ffff8801b8991678
> find_subdir+0xa8/0x170 fs/proc/proc_sysctl.c:923
> get_subdir fs/proc/proc_sysctl.c:977 [inline]
> __register_sysctl_table+0x6d5/0x10b0 fs/proc/proc_sysctl.c:1327
> register_net_sysctl+0x29/0x30 net/sysctl_net.c:120
> mpls_dev_sysctl_register+0x1cf/0x2e0 net/mpls/af_mpls.c:1369
> mpls_add_dev net/mpls/af_mpls.c:1420 [inline]
> mpls_dev_notify+0x2af/0x980 net/mpls/af_mpls.c:1542
> notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
> __raw_notifier_call_chain kernel/notifier.c:394 [inline]
> raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
> call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
> call_netdevice_notifiers net/core/dev.c:1725 [inline]
> register_netdevice+0xd40/0x1020 net/core/dev.c:7929
> register_netdev+0x1a/0x30 net/core/dev.c:8014
> sit_init_net+0x384/0xa70 net/ipv6/sit.c:1852
> ops_init+0x10a/0x570 net/core/net_namespace.c:118
> setup_net+0x351/0x760 net/core/net_namespace.c:302
> copy_net_ns+0x238/0x580 net/core/net_namespace.c:426
> create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107
> unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206
> SYSC_unshare kernel/fork.c:2407 [inline]
> SyS_unshare+0x653/0xfa0 kernel/fork.c:2357
> do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
> entry_SYSCALL_64_after_hwframe+0x42/0xb7
> RIP: 0033:0x457327
> RSP: 002b:00007ffdd0bf1928 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000457327
> RDX: 0000000000000000 RSI: 00007ffdd0bf1900 RDI: 0000000040000000
> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000410710
> R13: 00000000004107a0 R14: 0000000000000000 R15: 0000000000000000
> Code: 48 85 c0 4c 8b 9d e8 fc ff ff 8b 8d e0 fc ff ff 44 8b 8d d8 fc ff ff
> 4c 8b 85 d0 fc ff ff 44 8b 95 c8 fc ff ff 0f 84 9b 07 00 00 <f0> ff 80 38 01
> 00 00 49 8d bf 70 08 00 00 48 ba 00 00 00 00 00
> RIP: __lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320 RSP:
> ffff8801db206f60
> ---[ end trace b962f2b4a8ee2930 ]---
>
>
> ---
> This bug is generated by a dumb bot. It may contain errors.
> See https://goo.gl/tpsmEJ for details.
> Direct all questions to syzkaller@googlegroups.com.
>
> syzbot will keep track of this bug report.
> If you forgot to add the Reported-by tag, once the fix for this bug is
> merged
> into any tree, please reply to this email with:
> #syz fix: exact-commit-title
> If you want to test a patch for this bug, please reply with:
> #syz test: git://repo/address.git branch
> and provide the patch inline or as an attachment.
> To mark this as a duplicate of another syzbot report, please reply with:
> #syz dup: exact-subject-of-another-report
> If it's a one-off invalid bug report, please reply with:
> #syz invalid
> Note: if the crash happens again, it will cause creation of a new bug
> report.
> Note: all commands must start from beginning of the line in the email body.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: general protection fault in try_to_wake_up
2018-04-03 8:50 ` Petr Mladek
@ 2018-04-03 8:56 ` Petr Mladek
2018-04-03 9:13 ` Peter Zijlstra
1 sibling, 0 replies; 8+ messages in thread
From: Petr Mladek @ 2018-04-03 8:56 UTC (permalink / raw)
To: syzbot
Cc: linux-kernel, rostedt, sergey.senozhatsky, syzkaller-bugs,
Andy Lutomirski, Peter Zijlstra, Thomas Gleixner,
Borislav Petkov, H. Peter Anvin, Ingo Molnar, x86, Eric Dumazet,
Dmitry Vyukov
On Tue 2018-04-03 10:50:02, Petr Mladek wrote:
> On Thu 2018-03-29 09:01:02, syzbot wrote:
> > Hello,
> >
> > syzbot hit the following crash on upstream commit
> > bcfc1f4554662d8f2429ac8bd96064a59c149754 (Sat Mar 24 16:50:12 2018 +0000)
> > Merge tag 'pinctrl-v4.16-3' of
> > git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
> > syzbot dashboard link:
> > https://syzkaller.appspot.com/bug?extid=d1fe9b7b917f2715c7d4
> >
> > syzkaller reproducer:
> > https://syzkaller.appspot.com/x/repro.syz?id=4649457446551552
> > Raw console output:
> > https://syzkaller.appspot.com/x/log.txt?id=4909621332410368
> > Kernel config:
> > https://syzkaller.appspot.com/x/.config?id=-5034017172441945317
> > compiler: gcc (GCC) 7.1.1 20170620
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+d1fe9b7b917f2715c7d4@syzkaller.appspotmail.com
> > It will help syzbot understand when the bug is fixed. See footer for
> > details.
> > If you forward the report, please keep this part and the footer.
> >
> > IPVS: ftp: loaded support on port[0] = 21
> > kasan: CONFIG_KASAN_INLINE enabled
> > kasan: GPF could be caused by NULL-ptr deref or user memory access
> > kasan: CONFIG_KASAN_INLINE enabled
> > kasan: GPF could be caused by NULL-ptr deref or user memory access
> > general protection fault: 0000 [#1] SMP KASAN
>
> This is already 2nd level fault. I wonder if KASAN or lockdep should
> have already been disabled at this point. Adding some more people
> into CC.
Ah, there seem to be more related reports, see
https://lkml.kernel.org/r/CACT4Y+ZJ2QD7MPy4hB-M=mz2LuVu3bRbLg1QdY=z=+Su1QWMqg@mail.gmail.com
I am sorry for the noise. My mail client did not put the other replies
in a single thread from some reasons.
Best Regards,
Petr
>
> > Dumping ftrace buffer:
> > (ftrace buffer empty)
> > Modules linked in:
> > CPU: 0 PID: 4170 Comm: syz-executor0 Not tainted 4.16.0-rc6+ #1
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > RIP: 0010:__lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320
> > RSP: 0018:ffff8801db206f60 EFLAGS: 00010002
> > RAX: 078e0401078e0401 RBX: 0000000000000000 RCX: 0000000000000000
> > RDX: 1ffff100389fe583 RSI: 0000000000000000 RDI: ffff8801c4ff2c18
> > RBP: ffff8801db2072f0 R08: ffffffff814d839c R09: 0000000000000001
> > R10: 0000000000000000 R11: ffff8801c4ff2c10 R12: 0000000000000000
> > R13: 0000000000000001 R14: 0000000000000000 R15: ffff8801b793c440
> > FS: 00000000014fa940(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 00000000004cb4e0 CR3: 00000001b7980002 CR4: 00000000001606f0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> > <IRQ>
> > lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
> > __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> > _raw_spin_lock_irqsave+0x96/0xc0 kernel/locking/spinlock.c:152
> > try_to_wake_up+0xbc/0x15f0 kernel/sched/core.c:1989
> > default_wake_function+0x30/0x50 kernel/sched/core.c:3693
> > autoremove_wake_function+0x78/0x350 kernel/sched/wait.c:377
> > __wake_up_common+0x18e/0x780 kernel/sched/wait.c:97
> > __wake_up_common_lock+0x1b4/0x310 kernel/sched/wait.c:125
> > __wake_up+0xe/0x10 kernel/sched/wait.c:149
> > wake_up_klogd_work_func+0x4a/0x70 kernel/printk/printk.c:2869
> > irq_work_run_list+0x184/0x240 kernel/irq_work.c:155
> > irq_work_tick+0x136/0x1a0 kernel/irq_work.c:181
> > update_process_times+0x48/0x60 kernel/time/timer.c:1639
> > tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:162
> > tick_sched_timer+0x42/0x120 kernel/time/tick-sched.c:1194
> > __run_hrtimer kernel/time/hrtimer.c:1349 [inline]
> > __hrtimer_run_queues+0x39c/0xec0 kernel/time/hrtimer.c:1411
> > hrtimer_interrupt+0x2a5/0x6f0 kernel/time/hrtimer.c:1469
> > local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
> > smp_apic_timer_interrupt+0x14a/0x700 arch/x86/kernel/apic/apic.c:1050
> > apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
> > </IRQ>
> > RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:778
> > [inline]
> > RIP: 0010:console_unlock+0xb18/0xfb0 kernel/printk/printk.c:2403
> > RSP: 0018:ffff8801b79068d8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff12
> > RAX: ffff8801b793c440 RBX: 0000000000000200 RCX: ffffffff815a8d6f
> > RDX: 0000000000000000 RSI: 1ffff10036f279af RDI: 0000000000000293
> > RBP: ffff8801b7906a40 R08: 1ffff10036f20ce9 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> > R13: 0000000000000000 R14: ffffffff83ba15e0 R15: dffffc0000000000
> > vprintk_emit+0x5c3/0xb90 kernel/printk/printk.c:1907
>
> raw_spin_lock() succeeded here. Therefore lockdep was still working
> at this stage.
>
> > vprintk_default+0x28/0x30 kernel/printk/printk.c:1947
> > vprintk_func+0x57/0xc0 kernel/printk/printk_safe.c:379
> > printk+0xaa/0xca kernel/printk/printk.c:1980
> > kasan_die_handler+0x3d/0x3f arch/x86/mm/kasan_init_64.c:248
> > notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
> > __atomic_notifier_call_chain kernel/notifier.c:183 [inline]
> > atomic_notifier_call_chain+0x77/0x140 kernel/notifier.c:193
> > notify_die+0x18c/0x280 kernel/notifier.c:549
>
> It must have been general protection fault as well.
> Best Regards,
> Petr
>
> > do_general_protection+0x331/0x3e0 arch/x86/kernel/traps.c:558
> > general_protection+0x25/0x50 arch/x86/entry/entry_64.S:1150
> > RIP: 0010:find_entry.isra.14+0x9f/0x1d0 fs/proc/proc_sysctl.c:119
> > RSP: 0018:ffff8801b7906fc8 EFLAGS: 00010202
> > RAX: 00f1c08020f1c080 RBX: ffff8801c4f95058 RCX: ffffffff81d29eae
> > RDX: 0000000000000000 RSI: ffff8801b8991678 RDI: ffff8801c4f95070
> > RBP: ffff8801b7907008 R08: 1ffff10036f20d55 R09: 0000000000000004
> > R10: ffff8801b7906f70 R11: 0000000000000000 R12: ffff8801b89915f8
> > R13: dffffc0000000000 R14: 078e0401078e0401 R15: ffff8801b8991678
> > find_subdir+0xa8/0x170 fs/proc/proc_sysctl.c:923
> > get_subdir fs/proc/proc_sysctl.c:977 [inline]
> > __register_sysctl_table+0x6d5/0x10b0 fs/proc/proc_sysctl.c:1327
> > register_net_sysctl+0x29/0x30 net/sysctl_net.c:120
> > mpls_dev_sysctl_register+0x1cf/0x2e0 net/mpls/af_mpls.c:1369
> > mpls_add_dev net/mpls/af_mpls.c:1420 [inline]
> > mpls_dev_notify+0x2af/0x980 net/mpls/af_mpls.c:1542
> > notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
> > __raw_notifier_call_chain kernel/notifier.c:394 [inline]
> > raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
> > call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
> > call_netdevice_notifiers net/core/dev.c:1725 [inline]
> > register_netdevice+0xd40/0x1020 net/core/dev.c:7929
> > register_netdev+0x1a/0x30 net/core/dev.c:8014
> > sit_init_net+0x384/0xa70 net/ipv6/sit.c:1852
> > ops_init+0x10a/0x570 net/core/net_namespace.c:118
> > setup_net+0x351/0x760 net/core/net_namespace.c:302
> > copy_net_ns+0x238/0x580 net/core/net_namespace.c:426
> > create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107
> > unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206
> > SYSC_unshare kernel/fork.c:2407 [inline]
> > SyS_unshare+0x653/0xfa0 kernel/fork.c:2357
> > do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
> > entry_SYSCALL_64_after_hwframe+0x42/0xb7
> > RIP: 0033:0x457327
> > RSP: 002b:00007ffdd0bf1928 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
> > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000457327
> > RDX: 0000000000000000 RSI: 00007ffdd0bf1900 RDI: 0000000040000000
> > RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
> > R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000410710
> > R13: 00000000004107a0 R14: 0000000000000000 R15: 0000000000000000
> > Code: 48 85 c0 4c 8b 9d e8 fc ff ff 8b 8d e0 fc ff ff 44 8b 8d d8 fc ff ff
> > 4c 8b 85 d0 fc ff ff 44 8b 95 c8 fc ff ff 0f 84 9b 07 00 00 <f0> ff 80 38 01
> > 00 00 49 8d bf 70 08 00 00 48 ba 00 00 00 00 00
> > RIP: __lock_acquire+0x209/0x3e00 kernel/locking/lockdep.c:3320 RSP:
> > ffff8801db206f60
> > ---[ end trace b962f2b4a8ee2930 ]---
> >
> >
> > ---
> > This bug is generated by a dumb bot. It may contain errors.
> > See https://goo.gl/tpsmEJ for details.
> > Direct all questions to syzkaller@googlegroups.com.
> >
> > syzbot will keep track of this bug report.
> > If you forgot to add the Reported-by tag, once the fix for this bug is
> > merged
> > into any tree, please reply to this email with:
> > #syz fix: exact-commit-title
> > If you want to test a patch for this bug, please reply with:
> > #syz test: git://repo/address.git branch
> > and provide the patch inline or as an attachment.
> > To mark this as a duplicate of another syzbot report, please reply with:
> > #syz dup: exact-subject-of-another-report
> > If it's a one-off invalid bug report, please reply with:
> > #syz invalid
> > Note: if the crash happens again, it will cause creation of a new bug
> > report.
> > Note: all commands must start from beginning of the line in the email body.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: general protection fault in try_to_wake_up
2018-04-03 8:50 ` Petr Mladek
2018-04-03 8:56 ` Petr Mladek
@ 2018-04-03 9:13 ` Peter Zijlstra
2018-04-03 9:29 ` Petr Mladek
1 sibling, 1 reply; 8+ messages in thread
From: Peter Zijlstra @ 2018-04-03 9:13 UTC (permalink / raw)
To: Petr Mladek
Cc: syzbot, linux-kernel, rostedt, sergey.senozhatsky,
syzkaller-bugs, Andy Lutomirski, Thomas Gleixner,
Borislav Petkov, H. Peter Anvin, Ingo Molnar, x86
On Tue, Apr 03, 2018 at 10:50:03AM +0200, Petr Mladek wrote:
> raw_spin_lock() succeeded here. Therefore lockdep was still working
> at this stage.
What does the success of raw_spin_lock() have to do with lockdep ?
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: general protection fault in try_to_wake_up
2018-04-03 9:13 ` Peter Zijlstra
@ 2018-04-03 9:29 ` Petr Mladek
0 siblings, 0 replies; 8+ messages in thread
From: Petr Mladek @ 2018-04-03 9:29 UTC (permalink / raw)
To: Peter Zijlstra
Cc: syzbot, linux-kernel, rostedt, sergey.senozhatsky,
syzkaller-bugs, Andy Lutomirski, Thomas Gleixner,
Borislav Petkov, H. Peter Anvin, Ingo Molnar, x86, Dmitry Vyukov,
Eric Dumazet
On Tue 2018-04-03 11:13:33, Peter Zijlstra wrote:
> On Tue, Apr 03, 2018 at 10:50:03AM +0200, Petr Mladek wrote:
> > raw_spin_lock() succeeded here. Therefore lockdep was still working
> > at this stage.
>
> What does the success of raw_spin_lock() have to do with lockdep ?
It means that also lockdep succeeded there. Therefore the general
protection fault in __lock_acquire() was specific to the spinlock
taken by try_to_wake_up(). I though that it might had been an useful
information.
Anyway, the other replay from Dmitry suggested that it was a known
bug, see
https://lkml.kernel.org/r/CACT4Y+ZJ2QD7MPy4hB-M=mz2LuVu3bRbLg1QdY=z=+Su1QWMqg@mail.gmail.com
Best Regards,
Petr
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2018-04-03 9:29 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-29 16:01 general protection fault in try_to_wake_up syzbot
2018-03-29 16:32 ` Steven Rostedt
2018-03-29 16:53 ` Dmitry Vyukov
2018-03-31 15:58 ` Dmitry Vyukov
2018-04-03 8:50 ` Petr Mladek
2018-04-03 8:56 ` Petr Mladek
2018-04-03 9:13 ` Peter Zijlstra
2018-04-03 9:29 ` Petr Mladek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).