WARNING: suspicious RCU usage in 4 (3)

6 views
Skip to first unread message

syzbot

unread,
Jan 21, 2021, 1:13:23 AM1/21/21
to syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 2762b48e Linux 4.14.216
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1106dd58d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=e8574522d7c28056
dashboard link: https://syzkaller.appspot.com/bug?extid=65127a13f7bf887e23a2
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+65127a...@syzkaller.appspotmail.com

=============================
WARNING: suspicious RCU usage
CPU: 0 PID: 19226 Comm: syz-executor.5 Not tainted 4.14.216-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
4.14.216-syzkaller #0 Not tainted
-----------------------------
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc mm/slab.c:3376 [inline]
kmem_cache_alloc+0x28e/0x3c0 mm/slab.c:3550
kmem_cache_zalloc include/linux/slab.h:651 [inline]
__kernfs_new_node+0x6f/0x470 fs/kernfs/dir.c:632
kernfs_new_node+0x7b/0xe0 fs/kernfs/dir.c:677
__kernfs_create_file+0x3d/0x320 fs/kernfs/file.c:989
sysfs_add_file_mode_ns+0x1e1/0x450 fs/sysfs/file.c:307
create_files fs/sysfs/group.c:64 [inline]
internal_create_group+0x22b/0x710 fs/sysfs/group.c:134
loop_sysfs_init drivers/block/loop.c:821 [inline]
loop_set_fd drivers/block/loop.c:946 [inline]
lo_ioctl+0x1137/0x1cd0 drivers/block/loop.c:1417
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x540/0x1830 block/ioctl.c:594
net/tipc/bearer.c:177 suspicious rcu_dereference_protected() usage!
block_ioctl+0xd9/0x120 fs/block_dev.c:1893
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292

other info that might help us debug this:

entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e087
RSP: 002b:00007f2b80084a18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045e087
RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005
RBP: 0000000000000000 R08: 00007f2b80084ac8 R09: 0000000000000000
R10: 00007f2b80084acc R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000004 R14: 0000000000000004 R15: 00000000200002d0
ntfs: (device loop5): parse_options(): The errors option requires an argument.

rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syz-executor.4/19232:
#0: (cb_lock){++++}, at: [<ffffffff85e0f845>] genl_rcv+0x15/0x40 net/netlink/genetlink.c:635
#1: (genl_mutex){+.+.}, at: [<ffffffff85e104a2>] genl_lock net/netlink/genetlink.c:33 [inline]
#1: (genl_mutex){+.+.}, at: [<ffffffff85e104a2>] genl_rcv_msg+0x112/0x140 net/netlink/genetlink.c:623

stack backtrace:
CPU: 1 PID: 19232 Comm: syz-executor.4 Not tainted 4.14.216-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
tipc_bearer_find+0x1ff/0x2f0 net/tipc/bearer.c:177
tipc_nl_compat_link_set+0x40b/0xb90 net/tipc/netlink_compat.c:807
__tipc_nl_compat_doit net/tipc/netlink_compat.c:316 [inline]
tipc_nl_compat_doit+0x192/0x5d0 net/tipc/netlink_compat.c:364
tipc_nl_compat_handle net/tipc/netlink_compat.c:1215 [inline]
tipc_nl_compat_recv+0xa0b/0xae0 net/tipc/netlink_compat.c:1297
genl_family_rcv_msg+0x572/0xb20 net/netlink/genetlink.c:600
genl_rcv_msg+0xaf/0x140 net/netlink/genetlink.c:625
netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2433
genl_rcv+0x24/0x40 net/netlink/genetlink.c:636
netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e219
RSP: 002b:00007f338a114c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219
RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000007
RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c
R13: 00007ffeb04a856f R14: 00007f338a1159c0 R15: 000000000119bf8c
ntfs: (device loop5): parse_options(): Unrecognized mount option errors�/ �{�ZWj>��� w�\3r}�
�P����A��)�V �1.
ntfs: (device loop5): parse_options(): Unrecognized mount option errors�/ �{�ZWj>��� w�\3r}�
�P����A��)�V �1.
ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size.
ntfs: (device loop5): parse_options(): Unrecognized mount option ./file0.
squashfs: SQUASHFS error: Can't find a SQUASHFS superblock on loop3
ntfs: (device loop5): parse_options(): The errors option requires an argument.
ntfs: (device loop5): parse_options(): The errors option requires an argument.
squashfs: SQUASHFS error: Can't find a SQUASHFS superblock on loop3
ntfs: (device loop5): parse_options(): The errors option requires an argument.
ntfs: (device loop5): parse_options(): Unrecognized mount option disable_eparse.
SQUASHFS error: squashfs_read_data failed to read block 0x0
squashfs: SQUASHFS error: unable to read squashfs_super_block
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
MTD: Attempt to mount non-MTD device "/dev/loop5"
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
romfs: VFS: Can't find a romfs filesystem on dev loop5.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
NILFS (loop1): couldn't find nilfs on the device
kauditd_printk_skb: 18 callbacks suppressed
audit: type=1804 audit(1611209558.642:20): pid=19766 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir815431819/syzkaller.bGUFSk/343/bus" dev="sda1" ino=15954 res=1
audit: type=1804 audit(1611209558.722:21): pid=19832 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir815431819/syzkaller.bGUFSk/343/bus" dev="sda1" ino=15954 res=1
audit: type=1804 audit(1611209558.732:22): pid=19832 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir815431819/syzkaller.bGUFSk/343/bus" dev="sda1" ino=15954 res=1
ntfs: (device loop5): parse_options(): Unrecognized mount option umaskY a.
ntfs: (device loop5): parse_options(): Unrecognized mount option disable_s Z�� � �p?�x �? ��d n�Hars.
ntfs: (device loop5): parse_options(): Unrecognized mount option umaskY a.
ntfs: (device loop5): parse_options(): Unrecognized mount option disable_s Z�� � �p?�x �? ��d n�Hars.
ntfs: (device loop5): parse_options(): Unrecognized mount option disabla_sparsy8|"���q.
syz-executor.2 uses obsolete (PF_INET,SOCK_PACKET)
ntfs: (device loop5): parse_options(): Unrecognized mount option disabla_sparsy8|"���q.
ntfs: (device loop5): parse_options(): Unrecognized mount option .
vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4)
vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(7)
vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
vhci_hcd: connection closed
vhci_hcd: stop threads
vhci_hcd: connection closed
vhci_hcd: release socket
vhci_hcd: disconnect device
vhci_hcd: stop threads
vhci_hcd: release socket
vhci_hcd: disconnect device
vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(3)
vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(5)
vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
vhci_hcd: connection closed
vhci_hcd: connection closed
vhci_hcd: stop threads
vhci_hcd: release socket
vhci_hcd: disconnect device
vhci_hcd: stop threads
vhci_hcd: release socket
vhci_hcd: disconnect device
nla_parse: 2 callbacks suppressed
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'.


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
May 21, 2021, 2:13:11 AM5/21/21
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages