KASAN: stack-out-of-bounds Read in select_idle_sibling
2 views
Skip to first unread message
syzbot
Dec 31, 2018, 8:51:03 PM12/31/18
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 00c569b567c7 Merge tag 'locks-v4.21-1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=111760e7400000
kernel config: https://syzkaller.appspot.com/x/.config?x=fbee5876573727cd
dashboard link: https://syzkaller.appspot.com/bug?extid=693eaecafce918155b25
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
userspace arch: i386
CC: [fwei...@gmail.com linux-...@vger.kernel.org
mi...@kernel.org tg...@linutronix.de]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+693eae...@syzkaller.appspotmail.com
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
BUG: KASAN: stack-out-of-bounds in __read_once_size
include/linux/compiler.h:191 [inline]
BUG: KASAN: stack-out-of-bounds in test_idle_cores kernel/sched/fair.c:6000
[inline]
BUG: KASAN: stack-out-of-bounds in select_idle_core
kernel/sched/fair.c:6047 [inline]
BUG: KASAN: stack-out-of-bounds in select_idle_sibling+0xbb1/0xdb0
kernel/sched/fair.c:6197
kasan: GPF could be caused by NULL-ptr deref or user memory access
Read of size 4 at addr ffff8880a9d9e508 by task syz-executor4/14331
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.20.0+ #296
CPU: 1 PID: 14331 Comm: syz-executor4 Not tainted 4.20.0+ #296
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:task_css include/linux/cgroup.h:477 [inline]
RIP: 0010:task_ca kernel/sched/cpuacct.c:43 [inline]
RIP: 0010:cpuacct_account_field+0x140/0x3d0 kernel/sched/cpuacct.c:365
Call Trace:
Code: 86 95 08 00 85 c0 74 0d 80 3d 27 db d1 08 00 0f 84 a4 01 00 00 49 8d
7e 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 4e 02 00 00 4d 8b 7e 10 49 81 ff c0 51 78 89 0f
<IRQ>
RSP: 0018:ffff8880ae6078a8 EFLAGS: 00010002
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d3/0x2c6 lib/dump_stack.c:113
RAX: dffffc0000000000 RBX: ffff8880ae607918 RCX: ffffffff81626af4
RDX: 000000000836b158 RSI: 0000000000000008 RDI: 0000000041b58ac3
RBP: ffff8880ae607940 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff0ddece8 R11: ffffffff86ef6747 R12: 0000000000827d1b
print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
R13: dffffc0000000000 R14: 0000000041b58ab3 R15: ffff8880a9e1c240
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
CR2: 0000000000000000 CR3: 0000000099316000 CR4: 00000000001426f0
__read_once_size include/linux/compiler.h:191 [inline]
test_idle_cores kernel/sched/fair.c:6000 [inline]
select_idle_core kernel/sched/fair.c:6047 [inline]
select_idle_sibling+0xbb1/0xdb0 kernel/sched/fair.c:6197
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
cgroup_account_cputime_field include/linux/cgroup.h:775 [inline]
task_group_account_field kernel/sched/cputime.c:108 [inline]
account_system_index_time+0x1e8/0x5d0 kernel/sched/cputime.c:171
select_task_rq_fair+0xa3b/0x3ad0 kernel/sched/fair.c:6652
irqtime_account_process_tick.isra.6+0x38e/0x490 kernel/sched/cputime.c:380
account_process_tick+0x282/0x350 kernel/sched/cputime.c:483
update_process_times+0x21/0x70 kernel/time/timer.c:1633
tick_sched_handle+0x9f/0x180 kernel/time/tick-sched.c:161
tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1271
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1060
select_task_rq kernel/sched/core.c:1536 [inline]
try_to_wake_up+0x4e7/0x1460 kernel/sched/core.c:2041
wake_up_process+0x10/0x20 kernel/sched/core.c:2129
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
hrtimer_wakeup+0x48/0x60 kernel/time/hrtimer.c:1637
</IRQ>
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1451
Modules linked in:
======================================================
WARNING: possible circular locking dependency detected
4.20.0+ #296 Not tainted
------------------------------------------------------
syz-executor4/14331 is trying to acquire lock:
00000000c889a69e ((console_sem).lock){-.-.}, at: down_trylock+0x13/0x70
kernel/locking/semaphore.c:136
but task is already holding lock:
00000000425f965b (report_lock){-...}, at: kasan_start_report
mm/kasan/report.c:170 [inline]
00000000425f965b (report_lock){-...}, at: kasan_report_error
mm/kasan/report.c:346 [inline]
00000000425f965b (report_lock){-...}, at: kasan_report+0x8b/0x110
mm/kasan/report.c:412
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (report_lock){-...}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:152
kasan_start_report mm/kasan/report.c:170 [inline]
kasan_report_error mm/kasan/report.c:346 [inline]
kasan_report+0x8b/0x110 mm/kasan/report.c:412
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
__read_once_size include/linux/compiler.h:191 [inline]
test_idle_cores kernel/sched/fair.c:6000 [inline]
select_idle_core kernel/sched/fair.c:6047 [inline]
select_idle_sibling+0xbb1/0xdb0 kernel/sched/fair.c:6197
select_task_rq_fair+0xa3b/0x3ad0 kernel/sched/fair.c:6652
select_task_rq kernel/sched/core.c:1536 [inline]
try_to_wake_up+0x4e7/0x1460 kernel/sched/core.c:2041
wake_up_process+0x10/0x20 kernel/sched/core.c:2129
hrtimer_wakeup+0x48/0x60 kernel/time/hrtimer.c:1637
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1060
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
bytes_is_nonzero mm/kasan/kasan.c:167 [inline]
memory_is_nonzero mm/kasan/kasan.c:184 [inline]
memory_is_poisoned_n mm/kasan/kasan.c:210 [inline]
memory_is_poisoned mm/kasan/kasan.c:241 [inline]
check_memory_region_inline mm/kasan/kasan.c:257 [inline]
check_memory_region+0x117/0x1b0 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 kernel/rcu/tree.c:305
rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:932
rcu_read_lock include/linux/rcupdate.h:608 [inline]
lock_page_memcg+0x210/0x350 mm/memcontrol.c:1862
page_remove_file_rmap mm/rmap.c:1215 [inline]
page_remove_rmap+0x855/0x1a30 mm/rmap.c:1300
zap_pte_range mm/memory.c:1091 [inline]
zap_pmd_range mm/memory.c:1193 [inline]
zap_pud_range mm/memory.c:1222 [inline]
zap_p4d_range mm/memory.c:1243 [inline]
unmap_page_range+0xf52/0x25b0 mm/memory.c:1264
unmap_single_vma+0x19b/0x310 mm/memory.c:1309
unmap_vmas+0x125/0x200 mm/memory.c:1339
exit_mmap+0x2be/0x590 mm/mmap.c:3156
__mmput kernel/fork.c:1050 [inline]
mmput+0x247/0x610 kernel/fork.c:1071
exit_mm kernel/exit.c:545 [inline]
do_exit+0xe74/0x26d0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x8b0/0x1980 kernel/signal.c:2517
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_32_irqs_on arch/x86/entry/common.c:341 [inline]
do_fast_syscall_32+0xcd5/0xfb2 arch/x86/entry/common.c:397
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
-> #1 (&p->pi_lock){-.-.}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:152
try_to_wake_up+0xdc/0x1460 kernel/sched/core.c:1965
wake_up_process+0x10/0x20 kernel/sched/core.c:2129
__up.isra.1+0x1c0/0x2a0 kernel/locking/semaphore.c:262
up+0x13c/0x1c0 kernel/locking/semaphore.c:187
__up_console_sem+0xbe/0x1b0 kernel/printk/printk.c:236
console_unlock+0x819/0x1180 kernel/printk/printk.c:2426
vprintk_emit+0x39c/0x990 kernel/printk/printk.c:1931
vprintk_default+0x28/0x30 kernel/printk/printk.c:1958
vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
printk+0xa7/0xcf kernel/printk/printk.c:1991
check_stack_usage kernel/exit.c:755 [inline]
do_exit.cold.19+0x57/0x16f kernel/exit.c:916
do_group_exit+0x177/0x440 kernel/exit.c:970
__do_sys_exit_group kernel/exit.c:981 [inline]
__se_sys_exit_group kernel/exit.c:979 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:979
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
-> #0 ((console_sem).lock){-.-.}:
lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3841
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:152
down_trylock+0x13/0x70 kernel/locking/semaphore.c:136
__down_trylock_console_sem+0xae/0x200 kernel/printk/printk.c:219
console_trylock+0x15/0xa0 kernel/printk/printk.c:2242
console_trylock_spinning kernel/printk/printk.c:1662 [inline]
vprintk_emit+0x37d/0x990 kernel/printk/printk.c:1930
vprintk_default+0x28/0x30 kernel/printk/printk.c:1958
vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
printk+0xa7/0xcf kernel/printk/printk.c:1991
kasan_start_report mm/kasan/report.c:171 [inline]
kasan_report_error mm/kasan/report.c:346 [inline]
kasan_report+0x9b/0x110 mm/kasan/report.c:412
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
__read_once_size include/linux/compiler.h:191 [inline]
test_idle_cores kernel/sched/fair.c:6000 [inline]
select_idle_core kernel/sched/fair.c:6047 [inline]
select_idle_sibling+0xbb1/0xdb0 kernel/sched/fair.c:6197
select_task_rq_fair+0xa3b/0x3ad0 kernel/sched/fair.c:6652
select_task_rq kernel/sched/core.c:1536 [inline]
try_to_wake_up+0x4e7/0x1460 kernel/sched/core.c:2041
wake_up_process+0x10/0x20 kernel/sched/core.c:2129
hrtimer_wakeup+0x48/0x60 kernel/time/hrtimer.c:1637
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1060
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
bytes_is_nonzero mm/kasan/kasan.c:167 [inline]
memory_is_nonzero mm/kasan/kasan.c:184 [inline]
memory_is_poisoned_n mm/kasan/kasan.c:210 [inline]
memory_is_poisoned mm/kasan/kasan.c:241 [inline]
check_memory_region_inline mm/kasan/kasan.c:257 [inline]
check_memory_region+0x117/0x1b0 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 kernel/rcu/tree.c:305
rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:932
rcu_read_lock include/linux/rcupdate.h:608 [inline]
lock_page_memcg+0x210/0x350 mm/memcontrol.c:1862
page_remove_file_rmap mm/rmap.c:1215 [inline]
page_remove_rmap+0x855/0x1a30 mm/rmap.c:1300
zap_pte_range mm/memory.c:1091 [inline]
zap_pmd_range mm/memory.c:1193 [inline]
zap_pud_range mm/memory.c:1222 [inline]
zap_p4d_range mm/memory.c:1243 [inline]
unmap_page_range+0xf52/0x25b0 mm/memory.c:1264
unmap_single_vma+0x19b/0x310 mm/memory.c:1309
unmap_vmas+0x125/0x200 mm/memory.c:1339
exit_mmap+0x2be/0x590 mm/mmap.c:3156
__mmput kernel/fork.c:1050 [inline]
mmput+0x247/0x610 kernel/fork.c:1071
exit_mm kernel/exit.c:545 [inline]
do_exit+0xe74/0x26d0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x8b0/0x1980 kernel/signal.c:2517
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_32_irqs_on arch/x86/entry/common.c:341 [inline]
do_fast_syscall_32+0xcd5/0xfb2 arch/x86/entry/common.c:397
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> &p->pi_lock --> report_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(report_lock);
lock(&p->pi_lock);
lock(report_lock);
lock((console_sem).lock);
*** DEADLOCK ***
5 locks held by syz-executor4/14331:
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at: spin_lock
include/linux/spinlock.h:329 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
zap_pte_range mm/memory.c:1052 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
zap_pmd_range mm/memory.c:1193 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
zap_pud_range mm/memory.c:1222 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
zap_p4d_range mm/memory.c:1243 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
unmap_page_range+0x98e/0x25b0 mm/memory.c:1264
#1: 000000003488ec63 (rcu_read_lock){....}, at: lock_page_memcg+0x0/0x350
mm/memcontrol.c:2909
#2: 00000000555727d6 (&p->pi_lock){-.-.}, at: try_to_wake_up+0xdc/0x1460
kernel/sched/core.c:1965
#3: 000000003488ec63 (rcu_read_lock){....}, at:
select_task_rq_fair+0x39a/0x3ad0 kernel/sched/fair.c:6605
#4: 00000000425f965b (report_lock){-...}, at: kasan_start_report
mm/kasan/report.c:170 [inline]
#4: 00000000425f965b (report_lock){-...}, at: kasan_report_error
mm/kasan/report.c:346 [inline]
#4: 00000000425f965b (report_lock){-...}, at: kasan_report+0x8b/0x110
mm/kasan/report.c:412
stack backtrace:
CPU: 1 PID: 14331 Comm: syz-executor4 Not tainted 4.20.0+ #296
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d3/0x2c6 lib/dump_stack.c:113
print_circular_bug.isra.34.cold.56+0x1bd/0x27d
kernel/locking/lockdep.c:1224
check_prev_add kernel/locking/lockdep.c:1866 [inline]
check_prevs_add kernel/locking/lockdep.c:1979 [inline]
validate_chain kernel/locking/lockdep.c:2350 [inline]
__lock_acquire+0x3360/0x4c20 kernel/locking/lockdep.c:3338
lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3841
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:152
down_trylock+0x13/0x70 kernel/locking/semaphore.c:136
__down_trylock_console_sem+0xae/0x200 kernel/printk/printk.c:219
console_trylock+0x15/0xa0 kernel/printk/printk.c:2242
console_trylock_spinning kernel/printk/printk.c:1662 [inline]
vprintk_emit+0x37d/0x990 kernel/printk/printk.c:1930
vprintk_default+0x28/0x30 kernel/printk/printk.c:1958
vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
printk+0xa7/0xcf kernel/printk/printk.c:1991
kasan_start_report mm/kasan/report.c:171 [inline]
kasan_report_error mm/kasan/report.c:346 [inline]
kasan_report+0x9b/0x110 mm/kasan/report.c:412
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
__read_once_size include/linux/compiler.h:191 [inline]
test_idle_cores kernel/sched/fair.c:6000 [inline]
select_idle_core kernel/sched/fair.c:6047 [inline]
select_idle_sibling+0xbb1/0xdb0 kernel/sched/fair.c:6197
select_task_rq_fair+0xa3b/0x3ad0 kernel/sched/fair.c:6652
select_task_rq kernel/sched/core.c:1536 [inline]
try_to_wake_up+0x4e7/0x1460 kernel/sched/core.c:2041
wake_up_process
Lost 168 message(s)!
---[ end trace a41d335fba94df44 ]---
RIP: 0010:task_css include/linux/cgroup.h:477 [inline]
RIP: 0010:task_ca kernel/sched/cpuacct.c:43 [inline]
RIP: 0010:cpuacct_account_field+0x140/0x3d0 kernel/sched/cpuacct.c:365
Code: 86 95 08 00 85 c0 74 0d 80 3d 27 db d1 08 00 0f 84 a4 01 00 00 49 8d
7e 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 4e 02 00 00 4d 8b 7e 10 49 81 ff c0 51 78 89 0f
RSP: 0018:ffff8880ae6078a8 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffff8880ae607918 RCX: ffffffff81626af4
RDX: 000000000836b158 RSI: 0000000000000008 RDI: 0000000041b58ac3
RBP: ffff8880ae607940 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff0ddece8 R11: ffffffff86ef6747 R12: 0000000000827d1b
R13: dffffc0000000000 R14: 0000000041b58ab3 R15: ffff8880a9e1c240
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1509
CR2: 0000000000000000 CR3: 0000000099316000 CR4: 00000000001426f0
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1060
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot found the following crash on:
HEAD commit: 00c569b567c7 Merge tag 'locks-v4.21-1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=111760e7400000
kernel config: https://syzkaller.appspot.com/x/.config?x=fbee5876573727cd
dashboard link: https://syzkaller.appspot.com/bug?extid=693eaecafce918155b25
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
userspace arch: i386
CC: [fwei...@gmail.com linux-...@vger.kernel.org
mi...@kernel.org tg...@linutronix.de]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+693eae...@syzkaller.appspotmail.com
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
BUG: KASAN: stack-out-of-bounds in __read_once_size
include/linux/compiler.h:191 [inline]
BUG: KASAN: stack-out-of-bounds in test_idle_cores kernel/sched/fair.c:6000
[inline]
BUG: KASAN: stack-out-of-bounds in select_idle_core
kernel/sched/fair.c:6047 [inline]
BUG: KASAN: stack-out-of-bounds in select_idle_sibling+0xbb1/0xdb0
kernel/sched/fair.c:6197
kasan: GPF could be caused by NULL-ptr deref or user memory access
Read of size 4 at addr ffff8880a9d9e508 by task syz-executor4/14331
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.20.0+ #296
CPU: 1 PID: 14331 Comm: syz-executor4 Not tainted 4.20.0+ #296
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:task_css include/linux/cgroup.h:477 [inline]
RIP: 0010:task_ca kernel/sched/cpuacct.c:43 [inline]
RIP: 0010:cpuacct_account_field+0x140/0x3d0 kernel/sched/cpuacct.c:365
Call Trace:
Code: 86 95 08 00 85 c0 74 0d 80 3d 27 db d1 08 00 0f 84 a4 01 00 00 49 8d
7e 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 4e 02 00 00 4d 8b 7e 10 49 81 ff c0 51 78 89 0f
<IRQ>
RSP: 0018:ffff8880ae6078a8 EFLAGS: 00010002
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d3/0x2c6 lib/dump_stack.c:113
RAX: dffffc0000000000 RBX: ffff8880ae607918 RCX: ffffffff81626af4
RDX: 000000000836b158 RSI: 0000000000000008 RDI: 0000000041b58ac3
RBP: ffff8880ae607940 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff0ddece8 R11: ffffffff86ef6747 R12: 0000000000827d1b
print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
R13: dffffc0000000000 R14: 0000000041b58ab3 R15: ffff8880a9e1c240
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
CR2: 0000000000000000 CR3: 0000000099316000 CR4: 00000000001426f0
__read_once_size include/linux/compiler.h:191 [inline]
test_idle_cores kernel/sched/fair.c:6000 [inline]
select_idle_core kernel/sched/fair.c:6047 [inline]
select_idle_sibling+0xbb1/0xdb0 kernel/sched/fair.c:6197
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
cgroup_account_cputime_field include/linux/cgroup.h:775 [inline]
task_group_account_field kernel/sched/cputime.c:108 [inline]
account_system_index_time+0x1e8/0x5d0 kernel/sched/cputime.c:171
select_task_rq_fair+0xa3b/0x3ad0 kernel/sched/fair.c:6652
irqtime_account_process_tick.isra.6+0x38e/0x490 kernel/sched/cputime.c:380
account_process_tick+0x282/0x350 kernel/sched/cputime.c:483
update_process_times+0x21/0x70 kernel/time/timer.c:1633
tick_sched_handle+0x9f/0x180 kernel/time/tick-sched.c:161
tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1271
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1060
select_task_rq kernel/sched/core.c:1536 [inline]
try_to_wake_up+0x4e7/0x1460 kernel/sched/core.c:2041
wake_up_process+0x10/0x20 kernel/sched/core.c:2129
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
hrtimer_wakeup+0x48/0x60 kernel/time/hrtimer.c:1637
</IRQ>
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1451
Modules linked in:
======================================================
WARNING: possible circular locking dependency detected
4.20.0+ #296 Not tainted
------------------------------------------------------
syz-executor4/14331 is trying to acquire lock:
00000000c889a69e ((console_sem).lock){-.-.}, at: down_trylock+0x13/0x70
kernel/locking/semaphore.c:136
but task is already holding lock:
00000000425f965b (report_lock){-...}, at: kasan_start_report
mm/kasan/report.c:170 [inline]
00000000425f965b (report_lock){-...}, at: kasan_report_error
mm/kasan/report.c:346 [inline]
00000000425f965b (report_lock){-...}, at: kasan_report+0x8b/0x110
mm/kasan/report.c:412
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (report_lock){-...}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:152
kasan_start_report mm/kasan/report.c:170 [inline]
kasan_report_error mm/kasan/report.c:346 [inline]
kasan_report+0x8b/0x110 mm/kasan/report.c:412
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
__read_once_size include/linux/compiler.h:191 [inline]
test_idle_cores kernel/sched/fair.c:6000 [inline]
select_idle_core kernel/sched/fair.c:6047 [inline]
select_idle_sibling+0xbb1/0xdb0 kernel/sched/fair.c:6197
select_task_rq_fair+0xa3b/0x3ad0 kernel/sched/fair.c:6652
select_task_rq kernel/sched/core.c:1536 [inline]
try_to_wake_up+0x4e7/0x1460 kernel/sched/core.c:2041
wake_up_process+0x10/0x20 kernel/sched/core.c:2129
hrtimer_wakeup+0x48/0x60 kernel/time/hrtimer.c:1637
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1060
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
bytes_is_nonzero mm/kasan/kasan.c:167 [inline]
memory_is_nonzero mm/kasan/kasan.c:184 [inline]
memory_is_poisoned_n mm/kasan/kasan.c:210 [inline]
memory_is_poisoned mm/kasan/kasan.c:241 [inline]
check_memory_region_inline mm/kasan/kasan.c:257 [inline]
check_memory_region+0x117/0x1b0 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 kernel/rcu/tree.c:305
rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:932
rcu_read_lock include/linux/rcupdate.h:608 [inline]
lock_page_memcg+0x210/0x350 mm/memcontrol.c:1862
page_remove_file_rmap mm/rmap.c:1215 [inline]
page_remove_rmap+0x855/0x1a30 mm/rmap.c:1300
zap_pte_range mm/memory.c:1091 [inline]
zap_pmd_range mm/memory.c:1193 [inline]
zap_pud_range mm/memory.c:1222 [inline]
zap_p4d_range mm/memory.c:1243 [inline]
unmap_page_range+0xf52/0x25b0 mm/memory.c:1264
unmap_single_vma+0x19b/0x310 mm/memory.c:1309
unmap_vmas+0x125/0x200 mm/memory.c:1339
exit_mmap+0x2be/0x590 mm/mmap.c:3156
__mmput kernel/fork.c:1050 [inline]
mmput+0x247/0x610 kernel/fork.c:1071
exit_mm kernel/exit.c:545 [inline]
do_exit+0xe74/0x26d0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x8b0/0x1980 kernel/signal.c:2517
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_32_irqs_on arch/x86/entry/common.c:341 [inline]
do_fast_syscall_32+0xcd5/0xfb2 arch/x86/entry/common.c:397
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
-> #1 (&p->pi_lock){-.-.}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:152
try_to_wake_up+0xdc/0x1460 kernel/sched/core.c:1965
wake_up_process+0x10/0x20 kernel/sched/core.c:2129
__up.isra.1+0x1c0/0x2a0 kernel/locking/semaphore.c:262
up+0x13c/0x1c0 kernel/locking/semaphore.c:187
__up_console_sem+0xbe/0x1b0 kernel/printk/printk.c:236
console_unlock+0x819/0x1180 kernel/printk/printk.c:2426
vprintk_emit+0x39c/0x990 kernel/printk/printk.c:1931
vprintk_default+0x28/0x30 kernel/printk/printk.c:1958
vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
printk+0xa7/0xcf kernel/printk/printk.c:1991
check_stack_usage kernel/exit.c:755 [inline]
do_exit.cold.19+0x57/0x16f kernel/exit.c:916
do_group_exit+0x177/0x440 kernel/exit.c:970
__do_sys_exit_group kernel/exit.c:981 [inline]
__se_sys_exit_group kernel/exit.c:979 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:979
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
-> #0 ((console_sem).lock){-.-.}:
lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3841
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:152
down_trylock+0x13/0x70 kernel/locking/semaphore.c:136
__down_trylock_console_sem+0xae/0x200 kernel/printk/printk.c:219
console_trylock+0x15/0xa0 kernel/printk/printk.c:2242
console_trylock_spinning kernel/printk/printk.c:1662 [inline]
vprintk_emit+0x37d/0x990 kernel/printk/printk.c:1930
vprintk_default+0x28/0x30 kernel/printk/printk.c:1958
vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
printk+0xa7/0xcf kernel/printk/printk.c:1991
kasan_start_report mm/kasan/report.c:171 [inline]
kasan_report_error mm/kasan/report.c:346 [inline]
kasan_report+0x9b/0x110 mm/kasan/report.c:412
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
__read_once_size include/linux/compiler.h:191 [inline]
test_idle_cores kernel/sched/fair.c:6000 [inline]
select_idle_core kernel/sched/fair.c:6047 [inline]
select_idle_sibling+0xbb1/0xdb0 kernel/sched/fair.c:6197
select_task_rq_fair+0xa3b/0x3ad0 kernel/sched/fair.c:6652
select_task_rq kernel/sched/core.c:1536 [inline]
try_to_wake_up+0x4e7/0x1460 kernel/sched/core.c:2041
wake_up_process+0x10/0x20 kernel/sched/core.c:2129
hrtimer_wakeup+0x48/0x60 kernel/time/hrtimer.c:1637
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1060
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
bytes_is_nonzero mm/kasan/kasan.c:167 [inline]
memory_is_nonzero mm/kasan/kasan.c:184 [inline]
memory_is_poisoned_n mm/kasan/kasan.c:210 [inline]
memory_is_poisoned mm/kasan/kasan.c:241 [inline]
check_memory_region_inline mm/kasan/kasan.c:257 [inline]
check_memory_region+0x117/0x1b0 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 kernel/rcu/tree.c:305
rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:932
rcu_read_lock include/linux/rcupdate.h:608 [inline]
lock_page_memcg+0x210/0x350 mm/memcontrol.c:1862
page_remove_file_rmap mm/rmap.c:1215 [inline]
page_remove_rmap+0x855/0x1a30 mm/rmap.c:1300
zap_pte_range mm/memory.c:1091 [inline]
zap_pmd_range mm/memory.c:1193 [inline]
zap_pud_range mm/memory.c:1222 [inline]
zap_p4d_range mm/memory.c:1243 [inline]
unmap_page_range+0xf52/0x25b0 mm/memory.c:1264
unmap_single_vma+0x19b/0x310 mm/memory.c:1309
unmap_vmas+0x125/0x200 mm/memory.c:1339
exit_mmap+0x2be/0x590 mm/mmap.c:3156
__mmput kernel/fork.c:1050 [inline]
mmput+0x247/0x610 kernel/fork.c:1071
exit_mm kernel/exit.c:545 [inline]
do_exit+0xe74/0x26d0 kernel/exit.c:854
do_group_exit+0x177/0x440 kernel/exit.c:970
get_signal+0x8b0/0x1980 kernel/signal.c:2517
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_32_irqs_on arch/x86/entry/common.c:341 [inline]
do_fast_syscall_32+0xcd5/0xfb2 arch/x86/entry/common.c:397
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> &p->pi_lock --> report_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(report_lock);
lock(&p->pi_lock);
lock(report_lock);
lock((console_sem).lock);
*** DEADLOCK ***
5 locks held by syz-executor4/14331:
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at: spin_lock
include/linux/spinlock.h:329 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
zap_pte_range mm/memory.c:1052 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
zap_pmd_range mm/memory.c:1193 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
zap_pud_range mm/memory.c:1222 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
zap_p4d_range mm/memory.c:1243 [inline]
#0: 000000003fd18177 (&(ptlock_ptr(page))->rlock#2){+.+.}, at:
unmap_page_range+0x98e/0x25b0 mm/memory.c:1264
#1: 000000003488ec63 (rcu_read_lock){....}, at: lock_page_memcg+0x0/0x350
mm/memcontrol.c:2909
#2: 00000000555727d6 (&p->pi_lock){-.-.}, at: try_to_wake_up+0xdc/0x1460
kernel/sched/core.c:1965
#3: 000000003488ec63 (rcu_read_lock){....}, at:
select_task_rq_fair+0x39a/0x3ad0 kernel/sched/fair.c:6605
#4: 00000000425f965b (report_lock){-...}, at: kasan_start_report
mm/kasan/report.c:170 [inline]
#4: 00000000425f965b (report_lock){-...}, at: kasan_report_error
mm/kasan/report.c:346 [inline]
#4: 00000000425f965b (report_lock){-...}, at: kasan_report+0x8b/0x110
mm/kasan/report.c:412
stack backtrace:
CPU: 1 PID: 14331 Comm: syz-executor4 Not tainted 4.20.0+ #296
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d3/0x2c6 lib/dump_stack.c:113
print_circular_bug.isra.34.cold.56+0x1bd/0x27d
kernel/locking/lockdep.c:1224
check_prev_add kernel/locking/lockdep.c:1866 [inline]
check_prevs_add kernel/locking/lockdep.c:1979 [inline]
validate_chain kernel/locking/lockdep.c:2350 [inline]
__lock_acquire+0x3360/0x4c20 kernel/locking/lockdep.c:3338
lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3841
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:152
down_trylock+0x13/0x70 kernel/locking/semaphore.c:136
__down_trylock_console_sem+0xae/0x200 kernel/printk/printk.c:219
console_trylock+0x15/0xa0 kernel/printk/printk.c:2242
console_trylock_spinning kernel/printk/printk.c:1662 [inline]
vprintk_emit+0x37d/0x990 kernel/printk/printk.c:1930
vprintk_default+0x28/0x30 kernel/printk/printk.c:1958
vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
printk+0xa7/0xcf kernel/printk/printk.c:1991
kasan_start_report mm/kasan/report.c:171 [inline]
kasan_report_error mm/kasan/report.c:346 [inline]
kasan_report+0x9b/0x110 mm/kasan/report.c:412
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
__read_once_size include/linux/compiler.h:191 [inline]
test_idle_cores kernel/sched/fair.c:6000 [inline]
select_idle_core kernel/sched/fair.c:6047 [inline]
select_idle_sibling+0xbb1/0xdb0 kernel/sched/fair.c:6197
select_task_rq_fair+0xa3b/0x3ad0 kernel/sched/fair.c:6652
select_task_rq kernel/sched/core.c:1536 [inline]
try_to_wake_up+0x4e7/0x1460 kernel/sched/core.c:2041
wake_up_process
Lost 168 message(s)!
---[ end trace a41d335fba94df44 ]---
RIP: 0010:task_css include/linux/cgroup.h:477 [inline]
RIP: 0010:task_ca kernel/sched/cpuacct.c:43 [inline]
RIP: 0010:cpuacct_account_field+0x140/0x3d0 kernel/sched/cpuacct.c:365
Code: 86 95 08 00 85 c0 74 0d 80 3d 27 db d1 08 00 0f 84 a4 01 00 00 49 8d
7e 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 4e 02 00 00 4d 8b 7e 10 49 81 ff c0 51 78 89 0f
RSP: 0018:ffff8880ae6078a8 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffff8880ae607918 RCX: ffffffff81626af4
RDX: 000000000836b158 RSI: 0000000000000008 RDI: 0000000041b58ac3
RBP: ffff8880ae607940 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff0ddece8 R11: ffffffff86ef6747 R12: 0000000000827d1b
R13: dffffc0000000000 R14: 0000000041b58ab3 R15: ffff8880a9e1c240
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1509
CR2: 0000000000000000 CR3: 0000000099316000 CR4: 00000000001426f0
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1060
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
Dmitry Vyukov
Jan 4, 2019, 6:22:40 AM1/4/19
to syzbot, Stefano Brivio, 'Dmitry Vyukov' via syzkaller-upstream-moderation
On Tue, Jan 1, 2019 at 2:51 AM syzbot
<syzbot+693eae...@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 00c569b567c7 Merge tag 'locks-v4.21-1' of git://git.kernel..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=111760e7400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=fbee5876573727cd
> dashboard link: https://syzkaller.appspot.com/bug?extid=693eaecafce918155b25
> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
> userspace arch: i386
> CC: [fwei...@gmail.com linux-...@vger.kernel.org
> mi...@kernel.org tg...@linutronix.de]
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+693eae...@syzkaller.appspotmail.com
Presumably a random manifestation of the stack overflow/corruption:
<syzbot+693eae...@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 00c569b567c7 Merge tag 'locks-v4.21-1' of git://git.kernel..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=111760e7400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=fbee5876573727cd
> dashboard link: https://syzkaller.appspot.com/bug?extid=693eaecafce918155b25
> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
> userspace arch: i386
> CC: [fwei...@gmail.com linux-...@vger.kernel.org
> mi...@kernel.org tg...@linutronix.de]
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+693eae...@syzkaller.appspotmail.com
#syz dup: kernel panic: stack is corrupted in udp4_lib_lookup2
See https://groups.google.com/forum/#!msg/syzkaller-bugs/vr87kmG5qRI/31nOcuVsFgAJ
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/0000000000000edf35057e5bc3d8%40google.com.
> For more options, visit https://groups.google.com/d/optout.
Reply all
Reply to author
Forward
0 new messages