WARNING: suspicious RCU usage in 4 (2)

5 views
Skip to first unread message

syzbot

unread,
Feb 21, 2020, 7:45:14 PM2/21/20
to syzkaller...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 98db2bf2 Linux 4.14.171
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=133b4c81e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=365f8162d5a0794b
dashboard link: https://syzkaller.appspot.com/bug?extid=92b6505bd379b3911616
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+92b650...@syzkaller.appspotmail.com

WARNING: suspicious RCU usage
CPU: 1 PID: 9339 Comm: syz-executor.4 Not tainted 4.14.171-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
4.14.171-syzkaller #0 Not tainted
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10f/0x159 lib/fault-inject.c:149
should_failslab+0xdb/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc mm/slab.c:3376 [inline]
kmem_cache_alloc+0x2d7/0x780 mm/slab.c:3550
-----------------------------
kmem_cache_zalloc include/linux/slab.h:651 [inline]
inode_alloc_security security/selinux/hooks.c:233 [inline]
selinux_inode_alloc_security+0xb6/0x2a0 security/selinux/hooks.c:2893
security_inode_alloc+0x94/0xd0 security/security.c:438
net/tipc/bearer.c:177 suspicious rcu_dereference_protected() usage!
inode_init_always+0x552/0xaf0 fs/inode.c:167
alloc_inode+0x81/0x180 fs/inode.c:216
new_inode_pseudo+0x19/0xf0 fs/inode.c:898
new_inode+0x1f/0x40 fs/inode.c:927
__ext4_new_inode+0x32c/0x4860 fs/ext4/ialloc.c:837

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
ext4_ext_migrate+0x3f5/0x1460 fs/ext4/migrate.c:477
2 locks held by syz-executor.5/9357:
#0:
ext4_ioctl+0xf21/0x3920 fs/ext4/ioctl.c:896
(
cb_lock
){++++}
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
, at: [<ffffffff853e21ca>] genl_rcv+0x1a/0x40 net/netlink/genetlink.c:635
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
#1:
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45c429
RSP: 002b:00007f2d8f018c78 EFLAGS: 00000246
(
ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2d8f0196d4 RCX: 000000000045c429
RDX: 0000000000000000 RSI: 0000000000006609 RDI: 0000000000000004
RBP: 000000000076bfc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007
R13: 00000000000005a0 R14: 00000000004c7f5a R15: 0000000000000001
genl_mutex){+.+.}, at: [<ffffffff853e5a19>] genl_lock net/netlink/genetlink.c:33 [inline]
genl_mutex){+.+.}, at: [<ffffffff853e5a19>] genl_rcv_msg+0x119/0x150 net/netlink/genetlink.c:623

stack backtrace:
CPU: 0 PID: 9357 Comm: syz-executor.5 Not tainted 4.14.171-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:4665
tipc_bearer_find+0x20a/0x300 net/tipc/bearer.c:177
tipc_nl_compat_link_set+0x433/0xbf0 net/tipc/netlink_compat.c:797
__tipc_nl_compat_doit net/tipc/netlink_compat.c:306 [inline]
tipc_nl_compat_doit+0x1a2/0x550 net/tipc/netlink_compat.c:354
tipc_nl_compat_handle net/tipc/netlink_compat.c:1205 [inline]
tipc_nl_compat_recv+0x9ec/0xb20 net/tipc/netlink_compat.c:1287
genl_family_rcv_msg+0x614/0xc30 net/netlink/genetlink.c:600
genl_rcv_msg+0xb4/0x150 net/netlink/genetlink.c:625
netlink_rcv_skb+0x14f/0x3c0 net/netlink/af_netlink.c:2432
genl_rcv+0x29/0x40 net/netlink/genetlink.c:636
netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
netlink_unicast+0x44d/0x650 net/netlink/af_netlink.c:1312
netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x70a/0x840 net/socket.c:2062
__sys_sendmsg+0xb9/0x140 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2103
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45c429
RSP: 002b:00007fda17e36c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fda17e376d4 RCX: 000000000045c429
RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000006
RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000009ca R14: 00000000004cc375 R15: 000000000076bf2c
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 9389 Comm: syz-executor.4 Not tainted 4.14.171-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10f/0x159 lib/fault-inject.c:149
should_failslab+0xdb/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc mm/slab.c:3376 [inline]
__do_kmalloc mm/slab.c:3718 [inline]
__kmalloc+0x71/0x7a0 mm/slab.c:3729
kmalloc include/linux/slab.h:493 [inline]
context_struct_to_string security/selinux/ss/services.c:1223 [inline]
context_struct_to_string+0x33a/0x630 security/selinux/ss/services.c:1195
security_sid_to_context_core+0x18a/0x200 security/selinux/ss/services.c:1294
security_sid_to_context_force+0x2b/0x40 security/selinux/ss/services.c:1319
selinux_inode_init_security+0x493/0x700 security/selinux/hooks.c:2977
security_inode_init_security security/security.c:481 [inline]
security_inode_init_security+0x18d/0x360 security/security.c:465
ext4_init_security+0x34/0x40 fs/ext4/xattr_security.c:57
__ext4_new_inode+0x3385/0x4860 fs/ext4/ialloc.c:1166
ext4_ext_migrate+0x3f5/0x1460 fs/ext4/migrate.c:477
ext4_ioctl+0xf21/0x3920 fs/ext4/ioctl.c:896
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45c429
RSP: 002b:00007f2d8f018c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2d8f0196d4 RCX: 000000000045c429
RDX: 0000000000000000 RSI: 0000000000006609 RDI: 0000000000000004
RBP: 000000000076bfc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007
R13: 00000000000005a0 R14: 00000000004c7f5a R15: 0000000000000002
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 9419 Comm: syz-executor.4 Not tainted 4.14.171-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10f/0x159 lib/fault-inject.c:149
should_failslab+0xdb/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc mm/slab.c:3376 [inline]
__do_kmalloc mm/slab.c:3718 [inline]
__kmalloc+0x2f0/0x7a0 mm/slab.c:3729
kmalloc include/linux/slab.h:493 [inline]
kzalloc include/linux/slab.h:661 [inline]
ext4_find_extent+0x709/0x960 fs/ext4/extents.c:900
finish_range+0x18c/0x430 fs/ext4/migrate.c:44
update_extent_range+0xa6/0x2b0 fs/ext4/migrate.c:110
update_ind_extent_range+0x170/0x1f0 fs/ext4/migrate.c:133
ext4_ext_migrate+0xd40/0x1460 fs/ext4/migrate.c:543
ext4_ioctl+0xf21/0x3920 fs/ext4/ioctl.c:896
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45c429
RSP: 002b:00007f2d8f018c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2d8f0196d4 RCX: 000000000045c429
RDX: 0000000000000000 RSI: 0000000000006609 RDI: 0000000000000004
RBP: 000000000076bfc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007
R13: 00000000000005a0 R14: 00000000004c7f5a R15: 0000000000000003
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 9467 Comm: syz-executor.4 Not tainted 4.14.171-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10f/0x159 lib/fault-inject.c:149
should_failslab+0xdb/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc mm/slab.c:3376 [inline]
__do_kmalloc mm/slab.c:3718 [inline]
__kmalloc+0x2f0/0x7a0 mm/slab.c:3729
kmalloc include/linux/slab.h:493 [inline]
kzalloc include/linux/slab.h:661 [inline]
ext4_find_extent+0x709/0x960 fs/ext4/extents.c:900
finish_range+0x18c/0x430 fs/ext4/migrate.c:44
update_extent_range+0xa6/0x2b0 fs/ext4/migrate.c:110
update_ind_extent_range+0x170/0x1f0 fs/ext4/migrate.c:133
ext4_ext_migrate+0xd40/0x1460 fs/ext4/migrate.c:543
ext4_ioctl+0xf21/0x3920 fs/ext4/ioctl.c:896
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45c429
RSP: 002b:00007f2d8f018c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2d8f0196d4 RCX: 000000000045c429
RDX: 0000000000000000 RSI: 0000000000006609 RDI: 0000000000000004
RBP: 000000000076bfc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007
R13: 00000000000005a0 R14: 00000000004c7f5a R15: 0000000000000004
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=9635 comm=syz-executor.3
audit: type=1400 audit(1582332290.864:52): avc: denied { setopt } for pid=9906 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Oct 30, 2020, 8:33:19 PM10/30/20
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages