WARNING in sysfs_warn_dup

[syzbot]

Hello,

syzkaller hit the following crash on
6084b576dca2e898f5c101baef151f7bfdbb606d
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.

Unfortunately, I don't have any reproducer for this bug yet.


netlink: 9 bytes leftover after parsing attributes in process
`syz-executor3'.
sg_write: data in/out 822404280/197 bytes for SCSI command 0x12-- guessing
data in;
program syz-executor0 not setting count and/or reply_len properly
sg_write: data in/out 262364/161 bytes for SCSI command 0xff-- guessing
data in;
program syz-executor0 not setting count and/or reply_len properly
WARNING: CPU: 1 PID: 22282 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x60/0x80
fs/sysfs/dir.c:30
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 22282 Comm: syz-executor7 Not tainted 4.15.0-rc3-next-20171214+
#67
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xe9/0x14b lib/dump_stack.c:53
panic+0x10e/0x2f8 kernel/panic.c:183
__warn+0x14e/0x150 kernel/panic.c:547
report_bug+0x11e/0x1a0 lib/bug.c:184
fixup_bug.part.11+0x17/0x30 arch/x86/kernel/traps.c:177
fixup_bug arch/x86/kernel/traps.c:246 [inline]
do_error_trap+0x14a/0x180 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1079
RIP: 0010:sysfs_warn_dup+0x60/0x80 fs/sysfs/dir.c:30
RSP: 0018:ffffc90001b77a80 EFLAGS: 00010282
RAX: 0000000000000036 RBX: ffff8802135bf000 RCX: ffffffff8123dede
RDX: 0000000000010000 RSI: ffffc90001949000 RDI: ffff88021fd136f8
RBP: ffffc90001b77a98 R08: ffff88021fd1bd00 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801e1ae1d60
R13: ffff88021654cc80 R14: 0000000000000001 R15: ffffffffffffffef
sysfs_do_create_link_sd.isra.2+0xd8/0xf0 fs/sysfs/symlink.c:51
sysfs_do_create_link fs/sysfs/symlink.c:80 [inline]
sysfs_create_link+0x49/0x70 fs/sysfs/symlink.c:92
device_add_class_symlinks drivers/base/core.c:1601 [inline]
device_add+0x35f/0x840 drivers/base/core.c:1799
netdev_register_kobject+0xa2/0x190 net/core/net-sysfs.c:1604
register_netdevice+0x573/0x710 net/core/dev.c:7743
ip6_tnl_create2+0xef/0x1f0 net/ipv6/ip6_tunnel.c:269
ip6_tnl_create net/ipv6/ip6_tunnel.c:317 [inline]
ip6_tnl_locate+0x3f2/0x460 net/ipv6/ip6_tunnel.c:365
ip6_tnl_ioctl+0x240/0x560 net/ipv6/ip6_tunnel.c:1611
dev_ifsioc+0x175/0x520 net/core/dev_ioctl.c:354
dev_ioctl+0x548/0x7a0 net/core/dev_ioctl.c:589
sock_ioctl+0x150/0x320 net/socket.c:998
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0xaf/0x840 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x452a39
RSP: 002b:00007f7d802cac58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f7d802cb700 RCX: 0000000000452a39
RDX: 00000000207df000 RSI: 00000000000089f1 RDI: 0000000000000017
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000000
R13: 0000000000a6f7ff R14: 00007f7d802cb9c0 R15: 0000000000000000
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.
Please credit me with: Reported-by: syzbot <syzk...@googlegroups.com>

syzbot will keep track of this bug report.
Once a fix for this bug is merged into any tree, reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.

[Greg KH]

On Mon, Dec 18, 2017 at 08:57:01AM -0800, syzbot wrote:
> Hello,
>
> syzkaller hit the following crash on
> 6084b576dca2e898f5c101baef151f7bfdbb606d
> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
>
> Unfortunately, I don't have any reproducer for this bug yet.
>
>
> netlink: 9 bytes leftover after parsing attributes in process
> `syz-executor3'.
> sg_write: data in/out 822404280/197 bytes for SCSI command 0x12-- guessing
> data in;
> program syz-executor0 not setting count and/or reply_len properly
> sg_write: data in/out 262364/161 bytes for SCSI command 0xff-- guessing data
> in;
> program syz-executor0 not setting count and/or reply_len properly
> WARNING: CPU: 1 PID: 22282 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x60/0x80
> fs/sysfs/dir.c:30
> Kernel panic - not syncing: panic_on_warn set ...

Looks like a networking issue, it tried to create two sysfs directories
with the same name, which isn't a sysfs bug :)

thanks,

greg k-h

[Dmitry Vyukov]

+net/core/dev.c maintainers

Let's keep the footer as well, so that people know how to handle this report:

[Dmitry Vyukov]

On Tue, Dec 19, 2017 at 10:03 AM, Dmitry Vyukov <dvy...@google.com> wrote:
>
> On Tue, Dec 19, 2017 at 10:01 AM, Greg KH <gre...@linuxfoundation.org> wrote:
>>
>> On Mon, Dec 18, 2017 at 08:57:01AM -0800, syzbot wrote:
>> > Hello,
>> >
>> > syzkaller hit the following crash on
>> > 6084b576dca2e898f5c101baef151f7bfdbb606d
>> > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
>> > compiler: gcc (GCC) 7.1.1 20170620
>> > .config is attached
>> > Raw console output is attached.
>> >
>> > Unfortunately, I don't have any reproducer for this bug yet.
>> >
>> >
>> > netlink: 9 bytes leftover after parsing attributes in process
>> > `syz-executor3'.
>> > sg_write: data in/out 822404280/197 bytes for SCSI command 0x12-- guessing
>> > data in;
>> > program syz-executor0 not setting count and/or reply_len properly
>> > sg_write: data in/out 262364/161 bytes for SCSI command 0xff-- guessing data
>> > in;
>> > program syz-executor0 not setting count and/or reply_len properly
>> > WARNING: CPU: 1 PID: 22282 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x60/0x80
>> > fs/sysfs/dir.c:30
>> > Kernel panic - not syncing: panic_on_warn set ...
>>
>> Looks like a networking issue, it tried to create two sysfs directories
>> with the same name, which isn't a sysfs bug :)

Now as plain text:

[Dmitry Vyukov]

Also happens for wiphy_register (on upstream
a8750ddca918032d6349adbf9a4b6555e7db20da):

------------[ cut here ]------------
sysfs: cannot create duplicate filename
'/class/ieee80211/š§"­ût{§Ô­ðô Š!× ž 7… Š†õiùS6 È< »þ {_CK5äá ×ÝÊmô Be'
WARNING: CPU: 1 PID: 8233 at fs/sysfs/dir.c:31
sysfs_warn_dup+0x7e/0xa0 fs/sysfs/dir.c:30

Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 8233 Comm: syz-executor7 Not tainted 4.15.0-rc8+ #263

Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]

dump_stack+0x194/0x257 lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1dc/0x200 kernel/panic.c:547
report_bug+0x211/0x2d0 lib/bug.c:184
fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1085
RIP: 0010:sysfs_warn_dup+0x7e/0xa0 fs/sysfs/dir.c:30
RSP: 0018:ffff8801d00def20 EFLAGS: 00010286
RAX: dffffc0000000008 RBX: ffff8801c4ff2ac0 RCX: ffffffff8159dade
RDX: 000000000000cb4f RSI: ffffc9000192b000 RDI: ffff8801d00dec28
RBP: ffff8801d00def38 R08: 1ffff1003a01bd61 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801d976fa80
R13: ffff8801d833e380 R14: 0000000000000001 R15: ffffffffffffffef
sysfs_do_create_link_sd.isra.2+0xf3/0x110 fs/sysfs/symlink.c:51
sysfs_do_create_link fs/sysfs/symlink.c:80 [inline]
sysfs_create_link+0x65/0xc0 fs/sysfs/symlink.c:92
device_add_class_symlinks drivers/base/core.c:1603 [inline]
device_add+0x74a/0x1650 drivers/base/core.c:1801
wiphy_register+0x1468/0x2050 net/wireless/core.c:800
ieee80211_register_hw+0x1162/0x3100 net/mac80211/main.c:1038
mac80211_hwsim_new_radio+0x1b2e/0x2b90
drivers/net/wireless/mac80211_hwsim.c:2700
hwsim_new_radio_nl+0x5b7/0x7c0 drivers/net/wireless/mac80211_hwsim.c:3152
genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:599
genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:624
netlink_rcv_skb+0x224/0x470 net/netlink/af_netlink.c:2408
genl_rcv+0x28/0x40 net/netlink/genetlink.c:635
netlink_unicast_kernel net/netlink/af_netlink.c:1275 [inline]
netlink_unicast+0x4ee/0x700 net/netlink/af_netlink.c:1301
netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1864
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:648
___sys_sendmsg+0x767/0x8b0 net/socket.c:2028
__sys_sendmsg+0xe5/0x210 net/socket.c:2062
SYSC_sendmsg net/socket.c:2073 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2069
entry_SYSCALL_64_fastpath+0x29/0xa0



If you fix this, please add:
Reported-by: syzbot+1fdad4e2731bf0c1...@syzkaller.appspotmail.com
tag. It will help syzbot understand when the bug is fixed.

[Greg KH]

That's a wonderful filename :)

> WARNING: CPU: 1 PID: 8233 at fs/sysfs/dir.c:31
> sysfs_warn_dup+0x7e/0xa0 fs/sysfs/dir.c:30

As this is just sysfs saying "Hey dummy, you are trying to do something
foolish here", what would be the better thing for it to do?

Just printk(KERN_WARNING...) and then dump the stack?

It seems the WARN_ON() that is currently being used is being treated as
an "error" by your testing, when really it isn't, unless the caller can
not handle the error being passed back up to it by the sysfs core.
Which it should, but I don't think you are even giving it the chance as
you are:

> Kernel panic - not syncing: panic_on_warn set ...

Yup, panic_on_warn :(

ideas to make this easier for you?

thanks,

greg k-h

[Dmitry Vyukov]

pr_warn or pr_warn_once (optionally followed by dump_stack) would work
for syzbot.

Thanks!

[Greg KH]

This shouldn't be a _once() call, as it is called by things all over the
kernel, all with unique paths.

I'll go make up a patch for this, thanks.

greg k-h

[Greg KH]

From: Greg Kroah-Hartman <gre...@linuxfoundation.org>

It's not good to crash the machine if panic_on_warn() is set just
because someone made a stupid mistake of trying to create a sysfs file
with the same name of an existing one. This makes the automated testing
tools a lot harder to find the real bugs in the kernel.

So just print a warning out and dump the stack to get the attention of
the developer that they did something foolish. Then keep on trucking,
as this should not be a fatal error at all.

Reported-by: Dmitry Vyukov <dvy...@google.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---

Dmitry, does this look good to you? If so, I'll queue it up for
4.16-rc1.


diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 2b67bda2021b..3a36a48a4b3f 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -10,6 +10,7 @@
* Please see Documentation/filesystems/sysfs.txt for more information.
*/

+#define pr_fmt(fmt) "sysfs: " fmt
#undef DEBUG

#include <linux/fs.h>
@@ -27,8 +28,8 @@ void sysfs_warn_dup(struct kernfs_node *parent, const char *name)
if (buf)
kernfs_path(parent, buf, PATH_MAX);

- WARN(1, KERN_WARNING "sysfs: cannot create duplicate filename '%s/%s'\n",
- buf, name);
+ pr_warn("cannot create duplicate filename '%s/%s'\n", buf, name);
+ dump_stack();

kfree(buf);
}

[Dmitry Vyukov]

On Mon, Jan 22, 2018 at 3:57 PM, Greg KH <gre...@linuxfoundation.org> wrote:
> From: Greg Kroah-Hartman <gre...@linuxfoundation.org>
>
> It's not good to crash the machine if panic_on_warn() is set just
> because someone made a stupid mistake of trying to create a sysfs file
> with the same name of an existing one. This makes the automated testing
> tools a lot harder to find the real bugs in the kernel.
>
> So just print a warning out and dump the stack to get the attention of
> the developer that they did something foolish. Then keep on trucking,
> as this should not be a fatal error at all.
>
> Reported-by: Dmitry Vyukov <dvy...@google.com>
> Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
> ---
>
> Dmitry, does this look good to you? If so, I'll queue it up for
> 4.16-rc1.

Perfect! Looks good. syzbot reacts on "WARNING:" string (+ if kernel
panic due to panic_on_warn that's also obviously a problem).

[Dmitry Vyukov]

#syz fix: sysfs: turn WARN() into pr_warn()