linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* WARNING in port_delete
@ 2018-07-24  3:36 Dae R. Jeong
  2018-07-24  3:59 ` DaeRyong Jeong
  0 siblings, 1 reply; 9+ messages in thread
From: Dae R. Jeong @ 2018-07-24  3:36 UTC (permalink / raw)
  To: perex, tiwai, colin.king
  Cc: alsa-devel, linux-kernel, lifeasageek, kt0755, bammanag

Reporting the crash: WARNING in port_delete

This crash has been found in v4.18-rc3 using RaceFuzzer (a modified
version of Syzkaller), which we descrbie more at the end of this
report. Our analysis shows that the race occurs when invoking two close
syscalls concurrently.


The executed program is as follows:
r0 = open("/dev/snd/seq", 0x0, 0x0)
ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT, {{0x80}, "706f72943000000000000000000000000000000000000000000000000000000000233f770800000000000000000000000000000000000000001000", 0xffffffffffffffff, 0xfffffffffffffbff})
r1 = openat(AT_FDCWD, "/dev/sequencer2", 0x8402, 0x0)
close(r0)
close(r1)

and two threads executed the program as follows:
Thread0                                     Thread1
open("/dev/snd/seq")
ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT)
openat("/dev/sequencer2")
close(r0)                                   close(r1)

(Note that two close() syscalls were exeuted after openat() syscall, and
two close() syscalls were executed concurrently.)


Crash log:
==================================================================
WARNING: CPU: 1 PID: 32519 at /home/daeryong/workspace/race-fuzzer/kernels_repo/kernel_v4.18-rc3/sound/core/seq/seq_ports.c:275 port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 32519 Comm: syz-executor0 Not tainted 4.18.0-rc3 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x16e/0x22c lib/dump_stack.c:113
 panic+0x1a8/0x3a7 kernel/panic.c:184
 __warn+0x191/0x1a0 kernel/panic.c:536
 report_bug+0x132/0x1b0 lib/bug.c:186
 fixup_bug.part.10+0x28/0x50 arch/x86/kernel/traps.c:178
 fixup_bug arch/x86/kernel/traps.c:247 [inline]
 do_error_trap+0x284/0x2c0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
Code: 00 00 e8 b5 68 d2 fd 8b 83 58 01 00 00 85 c0 75 1d e8 86 5c ae fd 48 89 df e8 3e 52 d2 fd 31 c0 5b 41 5c 5d c3 e8 72 5c ae fd <0f> 0b eb c8 e8 69 5c ae fd 0f 0b eb da 0f 1f 44 00 00 55 48 89 e5 
RSP: 0018:ffff8801d635f900 EFLAGS: 00010216
RAX: 0000000000040000 RBX: ffff8801da196900 RCX: ffffffff839b86ee
RDX: 0000000000005e94 RSI: ffffc90002640000 RDI: ffff8801da196978
RBP: ffff8801d635f910 R08: 0000000000000098 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff839ba820
R13: ffff8801da196950 R14: ffff8801ed5bc080 R15: ffff8801da196958
 snd_seq_delete_port+0x2b0/0x2d0 sound/core/seq/seq_ports.c:303
 snd_seq_ioctl_delete_port+0x5b/0xa0 sound/core/seq/seq_clientmgr.c:1325
 snd_seq_kernel_client_ctl+0xd4/0xf0 sound/core/seq/seq_clientmgr.c:2361
 snd_seq_event_port_detach+0xcb/0x120 sound/core/seq/seq_ports.c:705
 delete_port+0x3a/0x70 sound/core/seq/oss/seq_oss_init.c:354
 snd_seq_oss_release+0x7c/0x90 sound/core/seq/oss/seq_oss_init.c:433
 odev_release+0x40/0x60 sound/core/seq/oss/seq_oss.c:153
 __fput+0x234/0x470 fs/file_table.c:209
 ____fput+0x15/0x20 fs/file_table.c:243
 task_work_run+0x15a/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:192 [inline]
 exit_to_usermode_loop+0x2a3/0x2b0 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x485/0x4b0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x456469
Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 
RSP: 002b:00007fe9a8936b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 000000000072bfa0 RCX: 0000000000456469
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000014
RBP: 0000000000000054 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe9a89376d4
R13: 00000000ffffffff R14: 00000000006f5880 R15: 0000000000000000
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


= About RaceFuzzer

RaceFuzzer is a customized version of Syzkaller, specifically tailored
to find race condition bugs in the Linux kernel. While we leverage
many different technique, the notable feature of RaceFuzzer is in
leveraging a custom hypervisor (QEMU/KVM) to interleave the
scheduling. In particular, we modified the hypervisor to intentionally
stall a per-core execution, which is similar to supporting per-core
breakpoint functionality. This allows RaceFuzzer to force the kernel
to deterministically trigger racy condition (which may rarely happen
in practice due to randomness in scheduling).

RaceFuzzer's C repro always pinpoints two racy syscalls. Since C
repro's scheduling synchronization should be performed at the user
space, its reproducibility is limited (reproduction may take from 1
second to 10 minutes (or even more), depending on a bug). This is
because, while RaceFuzzer precisely interleaves the scheduling at the
kernel's instruction level when finding this bug, C repro cannot fully
utilize such a feature. Please disregard all code related to
"should_hypercall" in the C repro, as this is only for our debugging
purposes using our own hypervisor.

^ permalink raw reply	[flat|nested] 9+ messages in thread
* WARNING in port_delete
@ 2018-07-11 19:55 syzbot
  2018-10-06 12:58 ` syzbot
  2019-04-01  7:58 ` syzbot
  0 siblings, 2 replies; 9+ messages in thread
From: syzbot @ 2018-07-11 19:55 UTC (permalink / raw)
  To: alsa-devel, colin.king, linux-kernel, perex, syzkaller-bugs, tiwai

Hello,

syzbot found the following crash on:

HEAD commit:    30c2c32d7f70 Merge tag 'drm-fixes-2018-07-10' of git://ano..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=139408c8400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=25856fac4e580aa7
dashboard link: https://syzkaller.appspot.com/bug?extid=e4c8abb920efa77bace9
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com

netlink: 8 bytes leftover after parsing attributes in process  
`syz-executor0'.
WARNING: CPU: 0 PID: 20823 at sound/core/seq/seq_ports.c:276  
port_delete+0x16e/0x1b0 sound/core/seq/seq_ports.c:276
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 20823 Comm: syz-executor4 Not tainted 4.18.0-rc4+ #140
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
  panic+0x238/0x4e7 kernel/panic.c:184
  __warn.cold.8+0x163/0x1ba kernel/panic.c:536
  report_bug+0x252/0x2d0 lib/bug.c:186
  fixup_bug arch/x86/kernel/traps.c:178 [inline]
  do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
  do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
  invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:port_delete+0x16e/0x1b0 sound/core/seq/seq_ports.c:276
Code: 00 00 31 ff 44 89 e6 e8 e0 f8 9d fb 45 85 e4 75 14 e8 c6 f7 9d fb 48  
89 df e8 4e a6 db fb 31 c0 5b 41 5c 5d c3 e8 b2 f7 9d fb <0f> 0b eb e3 e8  
a9 f7 9d fb 0f 0b eb 9b e8 d0 d1 db fb eb bd e8 c9
RSP: 0018:ffff88019b9f78d0 EFLAGS: 00010293
RAX: ffff8801c5f74100 RBX: ffff8801b053adc0 RCX: ffffffff85de13d0
RDX: 0000000000000000 RSI: ffffffff85de13ee RDI: 0000000000000005
RBP: ffff88019b9f78e0 R08: ffff8801c5f74100 R09: 0000000000000006
R10: ffff8801c5f74100 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8801b053ae10 R14: 1ffff1003373ef28 R15: ffff88019b95d6d0
  snd_seq_delete_port+0x3cb/0x4a0 sound/core/seq/seq_ports.c:303
  snd_seq_ioctl_delete_port+0xba/0x190 sound/core/seq/seq_clientmgr.c:1325
  snd_seq_kernel_client_ctl+0x15a/0x190 sound/core/seq/seq_clientmgr.c:2361
  snd_seq_event_port_detach+0xfb/0x160 sound/core/seq/seq_ports.c:705
  delete_port+0x7d/0xc0 sound/core/seq/oss/seq_oss_init.c:354
  snd_seq_oss_release+0xf2/0x130 sound/core/seq/oss/seq_oss_init.c:433
  odev_release+0x52/0x70 sound/core/seq/oss/seq_oss.c:153
  __fput+0x355/0x8b0 fs/file_table.c:209
  ____fput+0x15/0x20 fs/file_table.c:243
  task_work_run+0x1ec/0x2a0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:192 [inline]
  exit_to_usermode_loop+0x313/0x370 arch/x86/entry/common.c:166
  prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
  do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x40ff01
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48  
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48  
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:0000000000a3eab0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000015 RCX: 000000000040ff01
RDX: 0000000000000000 RSI: 00000000007328a0 RDI: 0000000000000014
RBP: 0000000000000013 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000a3e930 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000a3f160 R15: 00000000007034c0
Dumping ftrace buffer:
    (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with  
syzbot.

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2019-04-02 13:12 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-24  3:36 WARNING in port_delete Dae R. Jeong
2018-07-24  3:59 ` DaeRyong Jeong
2018-07-24  7:00   ` Takashi Iwai
     [not found]     ` <3e2c5bd7-daac-4af8-9419-20d775a0b063@Spark>
2018-07-24  7:23       ` Takashi Iwai
  -- strict thread matches above, loose matches on Subject: below --
2018-07-11 19:55 syzbot
2018-10-06 12:58 ` syzbot
2019-04-01  7:58 ` syzbot
2019-04-01 19:24   ` Paul E. McKenney
2019-04-02 13:12     ` Dmitry Vyukov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).