WARNING: suspicious RCU usage in sel_write_load

9 views
Skip to first unread message

syzbot

unread,
Nov 8, 2019, 5:46:09 PM11/8/19
to syzkaller-a...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: f40abacc ANDROID: overlayfs: fix printk format
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=10f34f78e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=844cb28a0c5c98da
dashboard link: https://syzkaller.appspot.com/bug?extid=72228a18450104c918f6
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+72228a...@syzkaller.appspotmail.com

sel_write_load: 15 callbacks suppressed
SELinux: failed to load policy
warn_alloc: 4 callbacks suppressed
syz-executor.1: vmalloc: allocation failure: 0 bytes,
mode:0x14000c0(GFP_KERNEL), nodemask=(null)
=============================
WARNING: suspicious RCU usage
4.14.152+ #0 Not tainted
CPU: 0 PID: 12561 Comm: syz-executor.1 Not tainted 4.14.152+ #0
-----------------------------
./include/linux/radix-tree.h:238 suspicious rcu_dereference_check() usage!
Call Trace:

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xca/0x134 lib/dump_stack.c:53
2 locks held by syz-executor.0/12562:
warn_alloc.cold+0x91/0x1ab mm/page_alloc.c:3319
#0:
(
&sb->s_type->i_mutex_key#10
){+.+.}
, at: [<00000000223f64ce>] inode_lock include/linux/fs.h:724 [inline]
, at: [<00000000223f64ce>] shmem_add_seals+0x12b/0xf80 mm/shmem.c:2831
#1: (
&(&mapping->tree_lock)->rlock
){-.-.}
__vmalloc_node_range mm/vmalloc.c:1796 [inline]
__vmalloc_node_range+0x3b5/0x6d0 mm/vmalloc.c:1756
, at: [<000000000b44734f>] spin_lock_irq include/linux/spinlock.h:342
[inline]
, at: [<000000000b44734f>] shmem_tag_pins mm/shmem.c:2685 [inline]
, at: [<000000000b44734f>] shmem_wait_for_pins mm/shmem.c:2726 [inline]
, at: [<000000000b44734f>] shmem_add_seals+0x2e1/0xf80 mm/shmem.c:2843

stack backtrace:
__vmalloc_node mm/vmalloc.c:1825 [inline]
__vmalloc_node_flags mm/vmalloc.c:1839 [inline]
vmalloc+0x60/0x80 mm/vmalloc.c:1861
sel_write_load+0x199/0xfb0 security/selinux/selinuxfs.c:495
__vfs_write+0xf9/0x5a0 fs/read_write.c:482
vfs_write+0x17f/0x4d0 fs/read_write.c:546
SYSC_write fs/read_write.c:594 [inline]
SyS_write+0x102/0x250 fs/read_write.c:586
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a219
RSP: 002b:00007f8135316c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f81353176d4
R13: 00000000004cac50 R14: 00000000004e3180 R15: 00000000ffffffff
CPU: 1 PID: 12562 Comm: syz-executor.0 Not tainted 4.14.152+ #0
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xca/0x134 lib/dump_stack.c:53
radix_tree_deref_slot include/linux/radix-tree.h:238 [inline]
shmem_tag_pins mm/shmem.c:2687 [inline]
shmem_wait_for_pins mm/shmem.c:2726 [inline]
shmem_add_seals+0x9d2/0xf80 mm/shmem.c:2843
shmem_fcntl+0xea/0x120 mm/shmem.c:2878
do_fcntl+0x5c8/0xd20 fs/fcntl.c:421
SYSC_fcntl fs/fcntl.c:463 [inline]
SyS_fcntl+0xc6/0x100 fs/fcntl.c:448
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a219
RSP: 002b:00007fa29d775c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000048
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219
RDX: 0000000000000009 RSI: 0000000000000409 RDI: 0000000000000005
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa29d7766d4
R13: 00000000004c0c3d R14: 00000000004d3820 R15: 00000000ffffffff
warn_alloc_show_mem: 1 callbacks suppressed
Mem-Info:
active_anon:111081 inactive_anon:45 isolated_anon:0
active_file:4753 inactive_file:16152 isolated_file:0
unevictable:0 dirty:359 writeback:0 unstable:0
slab_reclaimable:8068 slab_unreclaimable:57987
mapped:50652 shmem:68 pagetables:1580 bounce:0
free:1386006 free_pcp:301 free_cma:0
Node 0 active_anon:444324kB inactive_anon:180kB active_file:19012kB
inactive_file:64608kB unevictable:0kB isolated(anon):0kB isolated(file):0kB
mapped:202708kB dirty:1436kB writeback:0kB shmem:272kB writeback_tmp:0kB
unstable:0kB all_unreclaimable? no
DMA32 free:3079672kB min:4792kB low:7868kB high:10944kB active_anon:0kB
inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB
writepending:0kB present:3145324kB managed:3079672kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB
free_cma:0kB
lowmem_reserve[]: 0 3437 3437
Normal free:2463984kB min:5480kB low:9000kB high:12520kB
active_anon:444524kB inactive_anon:180kB active_file:19012kB
inactive_file:64608kB unevictable:0kB writepending:1436kB present:4718592kB
managed:3521560kB mlocked:0kB kernel_stack:4640kB pagetables:6320kB
bounce:0kB free_pcp:884kB local_pcp:288kB free_cma:0kB
lowmem_reserve[]: 0 0 0
DMA32: 2*4kB (UM) 0*8kB 1*16kB (M) 1*32kB (U) 3*64kB (UM) 2*128kB (UM)
2*256kB (UM) 1*512kB (M) 2*1024kB (UM) 2*2048kB (UM) 750*4096kB (M) =
3079672kB
Normal: 2004*4kB (UME) 2448*8kB (UME) 971*16kB (UE) 246*32kB (UM) 120*64kB
(UM) 120*128kB (UME) 26*256kB (UM) 33*512kB (UM) 20*1024kB (UM) 3*2048kB
(M) 573*4096kB (UM) = 2471232kB
22732 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
315671 pages reserved
SELinux: failed to load policy
SELinux: failed to load policy
syz-executor.1: vmalloc: allocation failure: 0 bytes,
mode:0x14000c0(GFP_KERNEL), nodemask=(null)
CPU: 0 PID: 12613 Comm: syz-executor.1 Not tainted 4.14.152+ #0
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xca/0x134 lib/dump_stack.c:53
warn_alloc.cold+0x91/0x1ab mm/page_alloc.c:3319
__vmalloc_node_range mm/vmalloc.c:1796 [inline]
__vmalloc_node_range+0x3b5/0x6d0 mm/vmalloc.c:1756
__vmalloc_node mm/vmalloc.c:1825 [inline]
__vmalloc_node_flags mm/vmalloc.c:1839 [inline]
vmalloc+0x60/0x80 mm/vmalloc.c:1861
sel_write_load+0x199/0xfb0 security/selinux/selinuxfs.c:495
__vfs_write+0xf9/0x5a0 fs/read_write.c:482
vfs_write+0x17f/0x4d0 fs/read_write.c:546
SYSC_write fs/read_write.c:594 [inline]
SyS_write+0x102/0x250 fs/read_write.c:586
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a219
RSP: 002b:00007f8135316c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f81353176d4
R13: 00000000004cac50 R14: 00000000004e3180 R15: 00000000ffffffff
Mem-Info:
active_anon:106012 inactive_anon:44 isolated_anon:0
active_file:4753 inactive_file:16154 isolated_file:0
unevictable:0 dirty:363 writeback:0 unstable:0
slab_reclaimable:8153 slab_unreclaimable:57887
mapped:50698 shmem:16566 pagetables:1532 bounce:0
free:1391225 free_pcp:219 free_cma:0
Node 0 active_anon:424492kB inactive_anon:176kB active_file:19012kB
inactive_file:64816kB unevictable:0kB isolated(anon):0kB isolated(file):0kB
mapped:202792kB dirty:1452kB writeback:0kB shmem:66264kB writeback_tmp:0kB
unstable:0kB all_unreclaimable? no
DMA32 free:3079672kB min:4792kB low:7868kB high:10944kB active_anon:0kB
inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB
writepending:0kB present:3145324kB managed:3079672kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB
free_cma:0kB
lowmem_reserve[]: 0 3437 3437
Normal free:2482820kB min:5480kB low:9000kB high:12520kB
active_anon:426268kB inactive_anon:176kB active_file:19000kB
inactive_file:64720kB unevictable:0kB writepending:1452kB present:4718592kB
managed:3521560kB mlocked:0kB kernel_stack:4480kB pagetables:6040kB
bounce:0kB free_pcp:932kB local_pcp:616kB free_cma:0kB
lowmem_reserve[]: 0 0 0
DMA32: 2*4kB (UM) 0*8kB 1*16kB (M) 1*32kB (U) 3*64kB (UM) 2*128kB (UM)
2*256kB (UM) 1*512kB (M) 2*1024kB (UM) 2*2048kB (UM) 750*4096kB (M) =
3079672kB
Normal: 1917*4kB (UME) 3369*8kB (UME) 1780*16kB (UME) 483*32kB (UM)
194*64kB (UM) 5*128kB (U) 7*256kB (U) 29*512kB (UM) 20*1024kB (UM) 3*2048kB
(M) 573*4096kB (UM) = 2481884kB
37480 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
315671 pages reserved
syz-executor.1: vmalloc: allocation failure: 0 bytes,
mode:0x14000c0(GFP_KERNEL), nodemask=(null)
CPU: 1 PID: 12783 Comm: syz-executor.1 Not tainted 4.14.152+ #0
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xca/0x134 lib/dump_stack.c:53
warn_alloc.cold+0x91/0x1ab mm/page_alloc.c:3319
__vmalloc_node_range mm/vmalloc.c:1796 [inline]
__vmalloc_node_range+0x3b5/0x6d0 mm/vmalloc.c:1756
__vmalloc_node mm/vmalloc.c:1825 [inline]
__vmalloc_node_flags mm/vmalloc.c:1839 [inline]
vmalloc+0x60/0x80 mm/vmalloc.c:1861
sel_write_load+0x199/0xfb0 security/selinux/selinuxfs.c:495
__vfs_write+0xf9/0x5a0 fs/read_write.c:482
vfs_write+0x17f/0x4d0 fs/read_write.c:546
SYSC_write fs/read_write.c:594 [inline]
SyS_write+0x102/0x250 fs/read_write.c:586
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a219
RSP: 002b:00007f8135316c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f81353176d4
R13: 00000000004cac50 R14: 00000000004e3180 R15: 00000000ffffffff
Mem-Info:
active_anon:90694 inactive_anon:45 isolated_anon:0
active_file:4753 inactive_file:16159 isolated_file:0
unevictable:0 dirty:368 writeback:0 unstable:0
slab_reclaimable:8153 slab_unreclaimable:58212
mapped:59356 shmem:52 pagetables:1678 bounce:0
free:1397401 free_pcp:154 free_cma:0
Node 0 active_anon:363176kB inactive_anon:180kB active_file:17912kB
inactive_file:64636kB unevictable:5500kB isolated(anon):0kB
isolated(file):0kB mapped:239524kB dirty:1472kB writeback:0kB shmem:208kB
writeback_tmp:0kB unstable:0kB all_unreclaimable? no
DMA32 free:3079672kB min:4792kB low:7868kB high:10944kB active_anon:0kB
inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB
writepending:0kB present:3145324kB managed:3079672kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB
free_cma:0kB
lowmem_reserve[]: 0 3437 3437
Normal free:2483700kB min:5480kB low:9000kB high:12520kB
active_anon:363740kB inactive_anon:14532kB active_file:17664kB
inactive_file:64524kB unevictable:11092kB writepending:1488kB
present:4718592kB managed:3521560kB mlocked:11092kB kernel_stack:4928kB
pagetables:6848kB bounce:0kB free_pcp:564kB local_pcp:236kB free_cma:0kB
lowmem_reserve[]: 0 0 0
DMA32: 2*4kB (UM) 0*8kB 1*16kB (M) 1*32kB (U) 3*64kB (UM) 2*128kB (UM)
2*256kB (UM) 1*512kB (M) 2*1024kB (UM) 2*2048kB (UM) 750*4096kB (M) =
3079672kB
Normal: 33*4kB (E) 1300*8kB (UME) 1146*16kB (UME) 399*32kB (UM) 250*64kB
(UME) 128*128kB (UM) 25*256kB (UME) 33*512kB (UME) 22*1024kB (UME) 4*2048kB
(ME) 572*4096kB (UM) = 2470948kB
25506 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
315671 pages reserved
SELinux: failed to load policy
SELinux: failed to load policy
FAT-fs (loop3): Unrecognized mount option "G+v�" or missing value
SELinux: failed to load policy
FAT-fs (loop3): Unrecognized mount option "G+v�" or missing value
SELinux: failed to load policy
SELinux: failed to load policy
SELinux: failed to load policy
selinux_nlmsg_perm: 6 callbacks suppressed
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12881 comm=syz-executor.2
SELinux: failed to load policy
SELinux: failed to load policy
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12894 comm=syz-executor.2
SELinux: failed to load policy
SELinux: failed to load policy
netlink: 144 bytes leftover after parsing attributes in process
`syz-executor.5'.
netlink: 144 bytes leftover after parsing attributes in process
`syz-executor.5'.
netlink: 144 bytes leftover after parsing attributes in process
`syz-executor.3'.
netlink: 224 bytes leftover after parsing attributes in process
`syz-executor.3'.
netlink: 224 bytes leftover after parsing attributes in process
`syz-executor.3'.
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12933 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12933 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12933 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12933 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12933 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12933 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12933 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=12933 comm=syz-executor.3
SELinux: security_context_str_to_sid(user_u) failed for (dev bpf, type bpf)
errno=-22
SELinux: security_context_str_to_sid(user_u) failed for (dev bpf, type bpf)
errno=-22


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Mar 10, 2020, 8:03:07 PM3/10/20
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages