INFO: task hung in tty_open (2)
4 views
Skip to first unread message
syzbot
Jan 13, 2023, 9:16:04 AM1/13/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: c4215ee4771b Linux 4.14.302
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1323da36480000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a9988fe055c9527
dashboard link: https://syzkaller.appspot.com/bug?extid=801e4bfa67cb4ceacd52
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c93ba055d204/disk-c4215ee4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bfbc929a33c1/vmlinux-c4215ee4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/444658051770/bzImage-c4215ee4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+801e4b...@syzkaller.appspotmail.com
FAT-fs (loop3): Unrecognized mount option "ni��s" or missing value
INFO: task syz-executor.0:19839 blocked for more than 140 seconds.
Not tainted 4.14.302-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D26984 19839 7998 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
tty_open_by_driver drivers/tty/tty_io.c:1937 [inline]
tty_open+0x31f/0x8b0 drivers/tty/tty_io.c:2021
chrdev_open+0x23c/0x6d0 fs/char_dev.c:423
do_dentry_open+0x44b/0xec0 fs/open.c:777
vfs_open+0x105/0x220 fs/open.c:888
do_last fs/namei.c:3428 [inline]
path_openat+0x628/0x2970 fs/namei.c:3571
do_filp_open+0x179/0x3c0 fs/namei.c:3605
do_sys_open+0x296/0x410 fs/open.c:1081
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f419c8e1254
RSP: 002b:00007f419aea0ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f419ca4ef80 RCX: 00007f419c8e1254
RDX: 0000000000000002 RSI: 00007f419aea0d40 RDI: 00000000ffffff9c
RBP: 00007f419aea0d40 R08: 0000000000000000 R09: 000000000000000e
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002
R13: 00007ffd8d59052f R14: 00007f419aea1300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/1533:
#0: (tasklist_lock){.+.+}, at: [<ffffffff8702b3a4>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548
1 lock held by in:imklog/7704:
#0: (&f->f_pos_lock){+.+.}, at: [<ffffffff818d8f8b>] __fdget_pos+0x1fb/0x2b0 fs/file.c:819
2 locks held by kworker/u4:5/9299:
#0: ("events_unbound"){+.+.}, at: [<ffffffff81366130>] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2088
#1: ((&sub_info->work)){+.+.}, at: [<ffffffff81366166>] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092
3 locks held by syz-executor.3/19831:
#0: (&hdev->req_lock){+.+.}, at: [<ffffffff8661cb38>] hci_dev_do_close+0xa8/0xd80 net/bluetooth/hci_core.c:1589
#1: (&hdev->lock){+.+.}, at: [<ffffffff8661ccf4>] hci_dev_do_close+0x264/0xd80 net/bluetooth/hci_core.c:1628
#2: (uevent_sock_mutex){+.+.}, at: [<ffffffff86fece05>] kobject_uevent_env+0x755/0xf30 lib/kobject_uevent.c:460
4 locks held by syz-executor.1/19841:
#0: (&hdev->req_lock){+.+.}, at: [<ffffffff8661cb38>] hci_dev_do_close+0xa8/0xd80 net/bluetooth/hci_core.c:1589
#1: (&hdev->lock){+.+.}, at: [<ffffffff8661ccf4>] hci_dev_do_close+0x264/0xd80 net/bluetooth/hci_core.c:1628
#2: (hci_cb_list_lock){+.+.}, at: [<ffffffff8663250a>] hci_disconn_cfm include/net/bluetooth/hci_core.h:1228 [inline]
#2: (hci_cb_list_lock){+.+.}, at: [<ffffffff8663250a>] hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1393
#3: (rcu_preempt_state.exp_mutex){+.+.}, at: [<ffffffff81471452>] exp_funnel_lock kernel/rcu/tree_exp.h:272 [inline]
#3: (rcu_preempt_state.exp_mutex){+.+.}, at: [<ffffffff81471452>] _synchronize_rcu_expedited+0x2c2/0x770 kernel/rcu/tree_exp.h:596
1 lock held by syz-executor.0/19839:
#0: (tty_mutex){+.+.}, at: [<ffffffff8354cadf>] tty_open_by_driver drivers/tty/tty_io.c:1937 [inline]
#0: (tty_mutex){+.+.}, at: [<ffffffff8354cadf>] tty_open+0x31f/0x8b0 drivers/tty/tty_io.c:2021
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 1533 Comm: khungtaskd Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x13a/0x180 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
watchdog+0x5b9/0xb40 kernel/hung_task.c:274
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 19847 Comm: syz-executor.4 Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff88806b388200 task.stack: ffff8880b07c8000
RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:100
RSP: 0018:ffff8880ba407ba0 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: ffffffff88ccc000 RCX: 0000000000000020
RDX: 1ffffffff119981d RSI: 0000000000000130 RDI: 0000000000000380
RBP: ffff8880ba4282c0 R08: ffff88823fff7018 R09: ffff88823fff700f
R10: ffff88823fff7017 R11: 0000008654e848c9 R12: 0000000000000130
R13: 0000000000000003 R14: 0000008509909741 R15: 68c61c99ba842ecd
FS: 00007f98c4cd3700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5aee606100 CR3: 00000000ab2ff000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
apic_write arch/x86/include/asm/apic.h:385 [inline]
lapic_next_event+0x53/0x80 arch/x86/kernel/apic/apic.c:468
clockevents_program_event+0x1f1/0x2d0 kernel/time/clockevents.c:339
tick_program_event+0x78/0xd0 kernel/time/tick-oneshot.c:47
hrtimer_interrupt+0x336/0x5e0 kernel/time/hrtimer.c:1334
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline]
smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1104
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796
RIP: 0010:__kmalloc_node_track_caller+0x9/0x70 mm/slab.c:3695
RSP: 0018:ffff8880ba407d90 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff10
RAX: ffff88806b388200 RBX: 0000000000000000 RCX: ffffffff865fd5c1
RDX: 00000000ffffffff RSI: 0000000001090220 RDI: 00000000000001c0
RBP: 00000000000001c0 R08: 0000000000000140 R09: 0000000000000003
R10: 0000000000000000 R11: ffff88806b388200 R12: 0000000001080020
R13: 00000000ffffffff R14: ffff88823a8223c0 R15: ffff88804bb22b40
__kmalloc_reserve net/core/skbuff.c:137 [inline]
__alloc_skb+0x96/0x510 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:980 [inline]
bcm_can_tx+0x1c1/0x690 net/can/bcm.c:301
bcm_tx_timeout_tsklet+0x179/0x320 net/can/bcm.c:428
tasklet_action+0x195/0x340 kernel/softirq.c:513
__do_softirq+0x24d/0x9ff kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796
</IRQ>
RIP: 0010:shift_maxindex lib/radix-tree.c:264 [inline]
RIP: 0010:node_maxindex lib/radix-tree.c:269 [inline]
RIP: 0010:radix_tree_load_root lib/radix-tree.c:608 [inline]
RIP: 0010:__radix_tree_lookup+0x9d/0x2e0 lib/radix-tree.c:1040
RSP: 0018:ffff8880b07cf8b8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: ffff8880807bc3c1 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000016 RDI: ffff88809318d070
RBP: ffff8880807bc3c0 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000000000 R11: ffff88806b388200 R12: 0000000000000040
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88809318cc00
radix_tree_delete_item+0x89/0x1a0 lib/radix-tree.c:2043
idr_remove_ext include/linux/idr.h:144 [inline]
idr_remove include/linux/idr.h:149 [inline]
ipc_rmid+0x5e/0x130 ipc/util.c:428
shm_rmid ipc/shm.c:225 [inline]
shm_destroy+0x2e5/0x600 ipc/shm.c:280
do_shm_rmid+0x10b/0x190 ipc/shm.c:103
free_ipcs+0x8c/0x170 ipc/namespace.c:124
shm_exit_ns+0x1f/0x40 ipc/shm.c:109
free_ipc_ns ipc/namespace.c:134 [inline]
put_ipc_ns.part.0+0x3f/0x120 ipc/namespace.c:164
put_ipc_ns+0x2f/0x40 ipc/namespace.c:166
free_nsproxy+0xbd/0x1f0 kernel/nsproxy.c:180
switch_task_namespaces+0x8f/0xb0 kernel/nsproxy.c:229
do_exit+0xa3f/0x2850 kernel/exit.c:867
do_group_exit+0x100/0x2e0 kernel/exit.c:965
get_signal+0x38d/0x1ca0 kernel/signal.c:2412
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f98c67610c9
RSP: 002b:00007f98c4cd3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: 0000000000000007 RBX: 00007f98c6880f80 RCX: 00007f98c67610c9
RDX: 0000000000000084 RSI: 0000000000000801 RDI: 000000000000000a
RBP: 00007f98c67bcae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff8b652cbf R14: 00007f98c4cd3300 R15: 0000000000022000
Code: 83 3d 3c e6 0b 0a 01 7f 02 5d c3 89 ef 5d e9 9f 88 df 05 48 c7 c7 00 84 2e 8b e8 f4 7c 5c 00 eb df 66 90 89 ff 89 b7 00 c0 5f ff <c3> 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: c4215ee4771b Linux 4.14.302
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1323da36480000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a9988fe055c9527
dashboard link: https://syzkaller.appspot.com/bug?extid=801e4bfa67cb4ceacd52
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c93ba055d204/disk-c4215ee4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bfbc929a33c1/vmlinux-c4215ee4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/444658051770/bzImage-c4215ee4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+801e4b...@syzkaller.appspotmail.com
FAT-fs (loop3): Unrecognized mount option "ni��s" or missing value
INFO: task syz-executor.0:19839 blocked for more than 140 seconds.
Not tainted 4.14.302-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0 D26984 19839 7998 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2811 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3387
schedule+0x8d/0x1b0 kernel/sched/core.c:3431
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489
__mutex_lock_common kernel/locking/mutex.c:833 [inline]
__mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893
tty_open_by_driver drivers/tty/tty_io.c:1937 [inline]
tty_open+0x31f/0x8b0 drivers/tty/tty_io.c:2021
chrdev_open+0x23c/0x6d0 fs/char_dev.c:423
do_dentry_open+0x44b/0xec0 fs/open.c:777
vfs_open+0x105/0x220 fs/open.c:888
do_last fs/namei.c:3428 [inline]
path_openat+0x628/0x2970 fs/namei.c:3571
do_filp_open+0x179/0x3c0 fs/namei.c:3605
do_sys_open+0x296/0x410 fs/open.c:1081
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f419c8e1254
RSP: 002b:00007f419aea0ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f419ca4ef80 RCX: 00007f419c8e1254
RDX: 0000000000000002 RSI: 00007f419aea0d40 RDI: 00000000ffffff9c
RBP: 00007f419aea0d40 R08: 0000000000000000 R09: 000000000000000e
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002
R13: 00007ffd8d59052f R14: 00007f419aea1300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/1533:
#0: (tasklist_lock){.+.+}, at: [<ffffffff8702b3a4>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548
1 lock held by in:imklog/7704:
#0: (&f->f_pos_lock){+.+.}, at: [<ffffffff818d8f8b>] __fdget_pos+0x1fb/0x2b0 fs/file.c:819
2 locks held by kworker/u4:5/9299:
#0: ("events_unbound"){+.+.}, at: [<ffffffff81366130>] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2088
#1: ((&sub_info->work)){+.+.}, at: [<ffffffff81366166>] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092
3 locks held by syz-executor.3/19831:
#0: (&hdev->req_lock){+.+.}, at: [<ffffffff8661cb38>] hci_dev_do_close+0xa8/0xd80 net/bluetooth/hci_core.c:1589
#1: (&hdev->lock){+.+.}, at: [<ffffffff8661ccf4>] hci_dev_do_close+0x264/0xd80 net/bluetooth/hci_core.c:1628
#2: (uevent_sock_mutex){+.+.}, at: [<ffffffff86fece05>] kobject_uevent_env+0x755/0xf30 lib/kobject_uevent.c:460
4 locks held by syz-executor.1/19841:
#0: (&hdev->req_lock){+.+.}, at: [<ffffffff8661cb38>] hci_dev_do_close+0xa8/0xd80 net/bluetooth/hci_core.c:1589
#1: (&hdev->lock){+.+.}, at: [<ffffffff8661ccf4>] hci_dev_do_close+0x264/0xd80 net/bluetooth/hci_core.c:1628
#2: (hci_cb_list_lock){+.+.}, at: [<ffffffff8663250a>] hci_disconn_cfm include/net/bluetooth/hci_core.h:1228 [inline]
#2: (hci_cb_list_lock){+.+.}, at: [<ffffffff8663250a>] hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1393
#3: (rcu_preempt_state.exp_mutex){+.+.}, at: [<ffffffff81471452>] exp_funnel_lock kernel/rcu/tree_exp.h:272 [inline]
#3: (rcu_preempt_state.exp_mutex){+.+.}, at: [<ffffffff81471452>] _synchronize_rcu_expedited+0x2c2/0x770 kernel/rcu/tree_exp.h:596
1 lock held by syz-executor.0/19839:
#0: (tty_mutex){+.+.}, at: [<ffffffff8354cadf>] tty_open_by_driver drivers/tty/tty_io.c:1937 [inline]
#0: (tty_mutex){+.+.}, at: [<ffffffff8354cadf>] tty_open+0x31f/0x8b0 drivers/tty/tty_io.c:2021
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 1533 Comm: khungtaskd Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x13a/0x180 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
watchdog+0x5b9/0xb40 kernel/hung_task.c:274
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 19847 Comm: syz-executor.4 Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff88806b388200 task.stack: ffff8880b07c8000
RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:100
RSP: 0018:ffff8880ba407ba0 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: ffffffff88ccc000 RCX: 0000000000000020
RDX: 1ffffffff119981d RSI: 0000000000000130 RDI: 0000000000000380
RBP: ffff8880ba4282c0 R08: ffff88823fff7018 R09: ffff88823fff700f
R10: ffff88823fff7017 R11: 0000008654e848c9 R12: 0000000000000130
R13: 0000000000000003 R14: 0000008509909741 R15: 68c61c99ba842ecd
FS: 00007f98c4cd3700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5aee606100 CR3: 00000000ab2ff000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
apic_write arch/x86/include/asm/apic.h:385 [inline]
lapic_next_event+0x53/0x80 arch/x86/kernel/apic/apic.c:468
clockevents_program_event+0x1f1/0x2d0 kernel/time/clockevents.c:339
tick_program_event+0x78/0xd0 kernel/time/tick-oneshot.c:47
hrtimer_interrupt+0x336/0x5e0 kernel/time/hrtimer.c:1334
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline]
smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1104
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796
RIP: 0010:__kmalloc_node_track_caller+0x9/0x70 mm/slab.c:3695
RSP: 0018:ffff8880ba407d90 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff10
RAX: ffff88806b388200 RBX: 0000000000000000 RCX: ffffffff865fd5c1
RDX: 00000000ffffffff RSI: 0000000001090220 RDI: 00000000000001c0
RBP: 00000000000001c0 R08: 0000000000000140 R09: 0000000000000003
R10: 0000000000000000 R11: ffff88806b388200 R12: 0000000001080020
R13: 00000000ffffffff R14: ffff88823a8223c0 R15: ffff88804bb22b40
__kmalloc_reserve net/core/skbuff.c:137 [inline]
__alloc_skb+0x96/0x510 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:980 [inline]
bcm_can_tx+0x1c1/0x690 net/can/bcm.c:301
bcm_tx_timeout_tsklet+0x179/0x320 net/can/bcm.c:428
tasklet_action+0x195/0x340 kernel/softirq.c:513
__do_softirq+0x24d/0x9ff kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796
</IRQ>
RIP: 0010:shift_maxindex lib/radix-tree.c:264 [inline]
RIP: 0010:node_maxindex lib/radix-tree.c:269 [inline]
RIP: 0010:radix_tree_load_root lib/radix-tree.c:608 [inline]
RIP: 0010:__radix_tree_lookup+0x9d/0x2e0 lib/radix-tree.c:1040
RSP: 0018:ffff8880b07cf8b8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: ffff8880807bc3c1 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000016 RDI: ffff88809318d070
RBP: ffff8880807bc3c0 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000000000 R11: ffff88806b388200 R12: 0000000000000040
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88809318cc00
radix_tree_delete_item+0x89/0x1a0 lib/radix-tree.c:2043
idr_remove_ext include/linux/idr.h:144 [inline]
idr_remove include/linux/idr.h:149 [inline]
ipc_rmid+0x5e/0x130 ipc/util.c:428
shm_rmid ipc/shm.c:225 [inline]
shm_destroy+0x2e5/0x600 ipc/shm.c:280
do_shm_rmid+0x10b/0x190 ipc/shm.c:103
free_ipcs+0x8c/0x170 ipc/namespace.c:124
shm_exit_ns+0x1f/0x40 ipc/shm.c:109
free_ipc_ns ipc/namespace.c:134 [inline]
put_ipc_ns.part.0+0x3f/0x120 ipc/namespace.c:164
put_ipc_ns+0x2f/0x40 ipc/namespace.c:166
free_nsproxy+0xbd/0x1f0 kernel/nsproxy.c:180
switch_task_namespaces+0x8f/0xb0 kernel/nsproxy.c:229
do_exit+0xa3f/0x2850 kernel/exit.c:867
do_group_exit+0x100/0x2e0 kernel/exit.c:965
get_signal+0x38d/0x1ca0 kernel/signal.c:2412
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f98c67610c9
RSP: 002b:00007f98c4cd3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: 0000000000000007 RBX: 00007f98c6880f80 RCX: 00007f98c67610c9
RDX: 0000000000000084 RSI: 0000000000000801 RDI: 000000000000000a
RBP: 00007f98c67bcae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff8b652cbf R14: 00007f98c4cd3300 R15: 0000000000022000
Code: 83 3d 3c e6 0b 0a 01 7f 02 5d c3 89 ef 5d e9 9f 88 df 05 48 c7 c7 00 84 2e 8b e8 f4 7c 5c 00 eb df 66 90 89 ff 89 b7 00 c0 5f ff <c3> 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
Reply all
Reply to author
Forward
0 new messages