Hello,
syzbot found the following crash on:
HEAD commit: 740617b2 ANDROID: cuttlefish_defconfig: Enable CONFIG_PSI
git tree: android-4.14
console output:
https://syzkaller.appspot.com/x/log.txt?x=1258bd93200000
kernel config:
https://syzkaller.appspot.com/x/.config?x=e5b10334e557f439
dashboard link:
https://syzkaller.appspot.com/bug?extid=2eca4218d91d1b3dc7ff
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:
https://syzkaller.appspot.com/x/repro.syz?x=17f38e8b200000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by:
syzbot+2eca42...@syzkaller.appspotmail.com
random: cc1: uninitialized urandom read (8 bytes read)
audit: type=1400 audit(1553322826.509:9): avc: denied { map } for
pid=1802 comm="syz-execprog" path="/root/syzkaller-shm925405876" dev="sda1"
ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
Can't find any breakpoint slot
------------[ cut here ]------------
WARNING: CPU: 0 PID: 2746 at arch/x86/kernel/hw_breakpoint.c:121
arch_install_hw_breakpoint.cold+0x13/0x1f
arch/x86/kernel/hw_breakpoint.c:121
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 2746 Comm: syz-executor.2 Not tainted 4.14.107+ #34
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x10e lib/dump_stack.c:53
panic+0x1d9/0x3c2 kernel/panic.c:182
__warn.cold+0x2f/0x3b kernel/panic.c:546
======================================================
WARNING: possible circular locking dependency detected
4.14.107+ #34 Not tainted
------------------------------------------------------
syz-executor.2/2746 is trying to acquire lock:
((console_sem).lock){-...}, at: [<ffffffffa8beff9e>] down_trylock+0xe/0x60
kernel/locking/semaphore.c:136
but task is already holding lock:
(&ctx->lock){....}, at: [<ffffffffa8df85f5>] perf_ctx_lock
kernel/events/core.c:157 [inline]
(&ctx->lock){....}, at: [<ffffffffa8df85f5>] perf_event_context_sched_in
kernel/events/core.c:3265 [inline]
(&ctx->lock){....}, at: [<ffffffffa8df85f5>]
__perf_event_task_sched_in+0x2a5/0x420 kernel/events/core.c:3323
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&ctx->lock){....}:
-> #2 (&rq->lock){-.-.}:
-> #1 (&p->pi_lock){-.-.}:
-> #0 ((console_sem).lock){-...}:
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> &rq->lock --> &ctx->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ctx->lock);
lock(&rq->lock);
lock(&ctx->lock);
lock((console_sem).lock);
*** DEADLOCK ***
2 locks held by syz-executor.2/2746:
#0: (&cpuctx_lock){....}, at: [<ffffffffa8df85e4>] perf_ctx_lock
kernel/events/core.c:155 [inline]
#0: (&cpuctx_lock){....}, at: [<ffffffffa8df85e4>]
perf_event_context_sched_in kernel/events/core.c:3265 [inline]
#0: (&cpuctx_lock){....}, at: [<ffffffffa8df85e4>]
__perf_event_task_sched_in+0x294/0x420 kernel/events/core.c:3323
#1: (&ctx->lock){....}, at: [<ffffffffa8df85f5>] perf_ctx_lock
kernel/events/core.c:157 [inline]
#1: (&ctx->lock){....}, at: [<ffffffffa8df85f5>]
perf_event_context_sched_in kernel/events/core.c:3265 [inline]
#1: (&ctx->lock){....}, at: [<ffffffffa8df85f5>]
__perf_event_task_sched_in+0x2a5/0x420 kernel/events/core.c:3323
stack backtrace:
CPU: 0 PID: 2746 Comm: syz-executor.2 Not tainted 4.14.107+ #34
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x10e lib/dump_stack.c:53
print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258
Kernel Offset: 0x27a00000 from 0xffffffff81000000 (relocation range:
0xffffffff80000000-0xffffffffbfffffff)
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches