BUG: corrupted list in insert_work

[Tadeusz Struk]

#syz test: https://android.googlesource.com/kernel/common android12-5.10

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 414e6c8e941c ANDROID: fix up abi issue with struct snd_pcm..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=13140a27700000
kernel config: https://syzkaller.appspot.com/x/.config?x=c82cd64ef7210f0c
dashboard link: https://syzkaller.appspot.com/bug?extid=e42ae441c3b10acf9e9d
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15714dc3700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=166f6887700000

The issue was bisected to:

commit 0d6882dd158e559b291a2d1b045a65bc2fa4fc58
Author: Maxime Ripard <max...@cerno.tech>
Date: Sat Feb 19 12:07:55 2022 +0000

ARM: boot: dts: bcm2711: Fix HVS register range

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12bd5e9b700000
final oops: https://syzkaller.appspot.com/x/report.txt?x=11bd5e9b700000
console output: https://syzkaller.appspot.com/x/log.txt?x=16bd5e9b700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e42ae4...@syzkaller.appspotmail.com
Fixes: 0d6882dd158e ("ARM: boot: dts: bcm2711: Fix HVS register range")

list_add corruption. prev->next should be next (ffff8881f715c060), but was ffff88810e794870. (prev=ffff88810e794870).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:28!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 397 Comm: kworker/1:2 Tainted: G W 5.10.109-syzkaller-00693-g414e6c8e941c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: cgroup_destroy css_free_rwork_fn
RIP: 0010:__list_add_valid+0xbb/0xc0 lib/list_debug.c:26
Code: 48 c7 c7 e0 c3 49 85 4c 89 e6 4c 89 f1 31 c0 e8 e2 9b 01 ff 0f 0b 48 c7 c7 a0 c4 49 85 4c 89 f6 4c 89 e1 31 c0 e8 cc 9b 01 ff <0f> 0b 0f 1f 00 55 48 89 e5 41 57 41 56 41 54 53 49 89 fe 49 bc 00
RSP: 0018:ffffc900001609e0 EFLAGS: 00010046
RAX: 0000000000000075 RBX: ffff8881f715c068 RCX: af2b18e851678f00
RDX: 0000000080000102 RSI: 0000000080000102 RDI: 0000000000000000
RBP: ffffc90000160a08 R08: ffffffff815454d8 R09: 0000000000000003
R10: fffff5200002c091 R11: 0000000000000004 R12: ffff88810e794870
R13: dffffc0000000000 R14: ffff8881f715c060 R15: ffff88810e794870
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555ad8380 CR3: 000000011d102000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__list_add include/linux/list.h:67 [inline]
list_add_tail include/linux/list.h:100 [inline]
insert_work+0x107/0x330 kernel/workqueue.c:1352
__queue_work+0x951/0xda0 kernel/workqueue.c:1514
queue_work_on+0xef/0x150 kernel/workqueue.c:1541
queue_work include/linux/workqueue.h:513 [inline]
css_release+0xae/0xc0 kernel/cgroup/cgroup.c:5146
percpu_ref_put_many include/linux/percpu-refcount.h:322 [inline]
percpu_ref_put include/linux/percpu-refcount.h:338 [inline]
percpu_ref_call_confirm_rcu lib/percpu-refcount.c:162 [inline]
percpu_ref_switch_to_atomic_rcu+0x5a0/0x5b0 lib/percpu-refcount.c:199
rcu_do_batch+0x4cd/0xb40 kernel/rcu/tree.c:2485
rcu_core+0x822/0x10a0 kernel/rcu/tree.c:2722
rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2735
__do_softirq+0x27e/0x598 kernel/softirq.c:305
asm_call_irq_on_stack+0xf/0x20
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
do_softirq kernel/softirq.c:355 [inline]
__local_bh_enable_ip+0x158/0x170 kernel/softirq.c:190
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
_raw_spin_unlock_bh+0x51/0x60 kernel/locking/spinlock.c:207
spin_unlock_bh include/linux/spinlock.h:399 [inline]
cgroup_idr_remove kernel/cgroup/cgroup.c:343 [inline]
css_free_rwork_fn+0x106/0x680 kernel/cgroup/cgroup.c:5050
process_one_work+0x6b4/0xfb0 kernel/workqueue.c:2296
worker_thread+0xb15/0x1600 kernel/workqueue.c:2442
kthread+0x371/0x390 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Modules linked in:
---[ end trace 2c8d7c89d484fe8a ]---
RIP: 0010:__list_add_valid+0xbb/0xc0 lib/list_debug.c:26
Code: 48 c7 c7 e0 c3 49 85 4c 89 e6 4c 89 f1 31 c0 e8 e2 9b 01 ff 0f 0b 48 c7 c7 a0 c4 49 85 4c 89 f6 4c 89 e1 31 c0 e8 cc 9b 01 ff <0f> 0b 0f 1f 00 55 48 89 e5 41 57 41 56 41 54 53 49 89 fe 49 bc 00
RSP: 0018:ffffc900001609e0 EFLAGS: 00010046
RAX: 0000000000000075 RBX: ffff8881f715c068 RCX: af2b18e851678f00
RDX: 0000000080000102 RSI: 0000000080000102 RDI: 0000000000000000
RBP: ffffc90000160a08 R08: ffffffff815454d8 R09: 0000000000000003
R10: fffff5200002c091 R11: 0000000000000004 R12: ffff88810e794870
R13: dffffc0000000000 R14: ffff8881f715c060 R15: ffff88810e794870
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555ad8380 CR3: 000000011d102000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Tadeusz Struk]

On 4/7/22 09:56, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 414e6c8e941c ANDROID: fix up abi issue with struct snd_pcm..
> git tree: android12-5.10-lts
> console output: https://syzkaller.appspot.com/x/log.txt?x=13140a27700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c82cd64ef7210f0c
> dashboard link: https://syzkaller.appspot.com/bug?extid=e42ae441c3b10acf9e9d
> compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15714dc3700000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=166f6887700000
>
> The issue was bisected to:
>
> commit 0d6882dd158e559b291a2d1b045a65bc2fa4fc58
> Author: Maxime Ripard <max...@cerno.tech>
> Date: Sat Feb 19 12:07:55 2022 +0000
>
> ARM: boot: dts: bcm2711: Fix HVS register range
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12bd5e9b700000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=11bd5e9b700000
> console output: https://syzkaller.appspot.com/x/log.txt?x=16bd5e9b700000

The bisect doesn't look right. This change has nothing to do with
the ext4 code running on x86_64.

commit 0d6882dd158e559b291a2d1b045a65bc2fa4fc58

ARM: boot: dts: bcm2711: Fix HVS register range

diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi
index 55ec83bde5a6..e46a3f4ad350 100644
--- a/arch/arm/boot/dts/bcm2711.dtsi
+++ b/arch/arm/boot/dts/bcm2711.dtsi
@@ -290,6 +290,7 @@ pixelvalve4: pixelvalve@7e216000 {

hvs: hvs@7e400000 {
compatible = "brcm,bcm2711-hvs";
+ reg = <0x7e400000 0x8000>;
interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
};

[Tadeusz Struk]

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+e42ae4...@syzkaller.appspotmail.com

Tested on:

commit: 3c06a5ce ANDROID: Split ANDROID_STRUCT_PADDING into se..
git tree: https://android.googlesource.com/kernel/common android12-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=97fcf0b9b4761f62
dashboard link: https://syzkaller.appspot.com/bug?extid=e42ae441c3b10acf9e9d
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

[Tadeusz Struk]

#syz fix: https://android.googlesource.com/kernel/common android12-5.10

[Tadeusz Struk]

On 4/7/22 17:00, syzbot wrote:

#syz unfix

[Tadeusz Struk]

#syz test: https://android.googlesource.com/kernel/common android12-5.10-lts

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: corrupted list in insert_work

list_add corruption. prev->next should be next (ffff8881f735c060), but was ffff8881f73fa070. (prev=ffff8881f73fa070).

------------[ cut here ]------------
kernel BUG at lib/list_debug.c:28!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN

CPU: 1 PID: 18 Comm: ksoftirqd/1 Tainted: G W 5.10.109-syzkaller-05997-g414e6c8e941c #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

RIP: 0010:__list_add_valid+0xc6/0xd0 lib/list_debug.c:26
Code: 48 c7 c7 c0 ca 43 85 4c 89 e6 4c 89 f1 31 c0 e8 6d d4 3f 02 0f 0b 48 c7 c7 80 cb 43 85 4c 89 f6 4c 89 e1 31 c0 e8 57 d4 3f 02 <0f> 0b 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 54 53 49
RSP: 0018:ffffc900001377e0 EFLAGS: 00010046
RAX: 0000000000000075 RBX: ffff8881f735c068 RCX: db9c921012289d00
RDX: 0000000080000101 RSI: 0000000080000101 RDI: 0000000000000000
RBP: ffffc90000137808 R08: ffffffff8153b3c8 R09: ffffed103ee6a5d8
R10: ffffed103ee6a5d8 R11: 1ffff1103ee6a5d7 R12: ffff8881f73fa070
R13: dffffc0000000000 R14: ffff8881f735c060 R15: ffff8881f73fa070
FS: 0000000000000000(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f380363ccc0 CR3: 000000010a1ff000 CR4: 00000000003506a0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

__list_add include/linux/list.h:67 [inline]
list_add_tail include/linux/list.h:100 [inline]
insert_work+0x107/0x330 kernel/workqueue.c:1352

__queue_work+0x971/0xd30 kernel/workqueue.c:1514
queue_work_on+0xf2/0x150 kernel/workqueue.c:1541

queue_work include/linux/workqueue.h:513 [inline]
css_release+0xae/0xc0 kernel/cgroup/cgroup.c:5146
percpu_ref_put_many include/linux/percpu-refcount.h:322 [inline]
percpu_ref_put include/linux/percpu-refcount.h:338 [inline]
percpu_ref_call_confirm_rcu lib/percpu-refcount.c:162 [inline]

percpu_ref_switch_to_atomic_rcu+0x5a2/0x5b0 lib/percpu-refcount.c:199
rcu_do_batch+0x4f8/0xbc0 kernel/rcu/tree.c:2485
rcu_core+0x59b/0xe30 kernel/rcu/tree.c:2722
rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2735
__do_softirq+0x27e/0x596 kernel/softirq.c:305
run_ksoftirqd+0x23/0x30 kernel/softirq.c:667
smpboot_thread_fn+0x551/0x930 kernel/smpboot.c:164
kthread+0x349/0x3d0 kernel/kthread.c:313

ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Modules linked in:

---[ end trace 28f614c52c1e301c ]---
RIP: 0010:__list_add_valid+0xc6/0xd0 lib/list_debug.c:26
Code: 48 c7 c7 c0 ca 43 85 4c 89 e6 4c 89 f1 31 c0 e8 6d d4 3f 02 0f 0b 48 c7 c7 80 cb 43 85 4c 89 f6 4c 89 e1 31 c0 e8 57 d4 3f 02 <0f> 0b 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 54 53 49
RSP: 0018:ffffc900001377e0 EFLAGS: 00010046

RAX: 0000000000000075 RBX: ffff8881f735c068 RCX: db9c921012289d00
RDX: 0000000080000101 RSI: 0000000080000101 RDI: 0000000000000000
RBP: ffffc90000137808 R08: ffffffff8153b3c8 R09: ffffed103ee6a5d8
R10: ffffed103ee6a5d8 R11: 1ffff1103ee6a5d7 R12: ffff8881f73fa070
R13: dffffc0000000000 R14: ffff8881f735c060 R15: ffff8881f73fa070
FS: 0000000000000000(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f380363ccc0 CR3: 000000010a1ff000 CR4: 00000000003506a0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Tested on:

commit: 414e6c8e ANDROID: fix up abi issue with struct snd_pcm..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=10d7040d700000
kernel config: https://syzkaller.appspot.com/x/.config?x=c07bd67f8db1d96b

[syzbot]

syzbot suspects this issue was fixed by commit:

commit d007f49ab789bee8ed76021830b49745d5feaf61
Author: Al Viro <vi...@zeniv.linux.org.uk>
Date: Wed May 18 06:13:40 2022 +0000

percpu_ref_init(): clean ->percpu_count_ref on failure

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10c66b6b080000
start commit: ebc9fb07d294 ANDROID: random: fix CRC issues with the merge
git tree: android12-5.10-lts
kernel config: https://syzkaller.appspot.com/x/.config?x=32c952ff4a8ff8c1
dashboard link: https://syzkaller.appspot.com/bug?extid=e42ae441c3b10acf9e9d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172a9074080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10456caa080000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: percpu_ref_init(): clean ->percpu_count_ref on failure