WARNING: locking bug in __kernfs_remove (2)

8 views
Skip to first unread message

syzbot

unread,
Feb 8, 2022, 9:54:22 PM2/8/22
to syzkaller-upst...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 64a19591a293 riscv: fix misalgned trap vector base address
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes
console output: https://syzkaller.appspot.com/x/log.txt?x=1360be0c700000
kernel config: https://syzkaller.appspot.com/x/.config?x=c97d397514d2bc3b
dashboard link: https://syzkaller.appspot.com/bug?extid=f55db784c48adeaea093
compiler: riscv64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
userspace arch: riscv64
CC: [gre...@linuxfoundation.org linux-...@vger.kernel.org t...@kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f55db7...@syzkaller.appspotmail.com

device veth0_macvtap left promiscuous mode
device veth1_vlan left promiscuous mode
device veth0_vlan left promiscuous mode
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 1 PID: 6652 at kernel/locking/lockdep.c:203 hlock_class kernel/locking/lockdep.c:203 [inline]
WARNING: CPU: 1 PID: 6652 at kernel/locking/lockdep.c:203 hlock_class kernel/locking/lockdep.c:192 [inline]
WARNING: CPU: 1 PID: 6652 at kernel/locking/lockdep.c:203 check_wait_context kernel/locking/lockdep.c:4688 [inline]
WARNING: CPU: 1 PID: 6652 at kernel/locking/lockdep.c:203 __lock_acquire+0xb7c/0x2d84 kernel/locking/lockdep.c:4965
Modules linked in:
CPU: 1 PID: 6652 Comm: kworker/u4:6 Not tainted 5.15.0-rc1-syzkaller-00001-g64a19591a293 #0
Hardware name: riscv-virtio,qemu (DT)
Workqueue: netns cleanup_net
epc : hlock_class kernel/locking/lockdep.c:203 [inline]
epc : hlock_class kernel/locking/lockdep.c:192 [inline]
epc : check_wait_context kernel/locking/lockdep.c:4688 [inline]
epc : __lock_acquire+0xb7c/0x2d84 kernel/locking/lockdep.c:4965
ra : hlock_class kernel/locking/lockdep.c:203 [inline]
ra : hlock_class kernel/locking/lockdep.c:192 [inline]
ra : check_wait_context kernel/locking/lockdep.c:4688 [inline]
ra : __lock_acquire+0xb7c/0x2d84 kernel/locking/lockdep.c:4965
epc : ffffffff800d80cc ra : ffffffff800d80cc sp : ffffffe0229bf6b0
gp : ffffffff83f9a558 tp : ffffffe007f72f80 t0 : ffffffff83c62b60
t1 : ffffffc40b5bc914 t2 : 0000000000000000 s0 : ffffffe0229bf790
s1 : 0000000000001fff a0 : 0000000000000016 a1 : 00000000000f0000
a2 : 0000000000000002 a3 : ffffffff800e5d66 a4 : e57e64d13ac0ca00
a5 : e57e64d13ac0ca00 a6 : 0000000000f00000 a7 : ffffffe05ade48a3
s2 : 0000000084a4319d s3 : ffffffff83fb07c0 s4 : 0000000000000000
s5 : ffffffe007f73928 s6 : ffffffff83fb0590 s7 : ffffffe007f739d0
s8 : ffffffe007f72f80 s9 : 0000000000000994 s10: 0000000000001000
s11: 000000000004119d t3 : 000000002d2d2d2d t4 : ffffffc40b5bc914
t5 : ffffffc40b5bc915 t6 : ffffffe0229bf3b8
status: 0000000000000100 badaddr: 0000000000000000 cause: 0000000000000003
[<ffffffff800d80cc>] hlock_class kernel/locking/lockdep.c:203 [inline]
[<ffffffff800d80cc>] hlock_class kernel/locking/lockdep.c:192 [inline]
[<ffffffff800d80cc>] check_wait_context kernel/locking/lockdep.c:4688 [inline]
[<ffffffff800d80cc>] __lock_acquire+0xb7c/0x2d84 kernel/locking/lockdep.c:4965
[<ffffffff800dafd4>] lock_acquire.part.0+0x15a/0x37c kernel/locking/lockdep.c:5625
[<ffffffff800db23a>] lock_acquire+0x44/0x5a kernel/locking/lockdep.c:5598
[<ffffffff805b92f2>] kernfs_drain fs/kernfs/dir.c:470 [inline]
[<ffffffff805b92f2>] __kernfs_remove+0x686/0x730 fs/kernfs/dir.c:1339
[<ffffffff805bb55c>] kernfs_remove_by_name_ns+0x52/0xb8 fs/kernfs/dir.c:1532
[<ffffffff805c1094>] kernfs_remove_by_name include/linux/kernfs.h:598 [inline]
[<ffffffff805c1094>] remove_files+0x66/0xf8 fs/sysfs/group.c:28
[<ffffffff805c118a>] sysfs_remove_group+0x64/0xee fs/sysfs/group.c:289
[<ffffffff805c2198>] sysfs_remove_groups fs/sysfs/group.c:313 [inline]
[<ffffffff805c2198>] sysfs_remove_groups+0x50/0x78 fs/sysfs/group.c:305
[<ffffffff80fd9560>] device_remove_groups drivers/base/core.c:2445 [inline]
[<ffffffff80fd9560>] device_remove_attrs+0xf4/0x10a drivers/base/core.c:2651
[<ffffffff80fdc16c>] device_del+0x2d4/0x6ce drivers/base/core.c:3545
[<ffffffff82293bc2>] netdev_unregister_kobject+0xf4/0x104 net/core/net-sysfs.c:1921
[<ffffffff822101d6>] unregister_netdevice_many+0x9b8/0xec0 net/core/dev.c:11066
[<ffffffff82210b6e>] default_device_exit_batch+0x228/0x258 net/core/dev.c:11569
[<ffffffff821ef57a>] ops_exit_list+0xb2/0xcc net/core/net_namespace.c:171
[<ffffffff821f0cf2>] cleanup_net+0x3ca/0x6b2 net/core/net_namespace.c:591
[<ffffffff80064612>] process_one_work+0x5e4/0xf5c kernel/workqueue.c:2297
[<ffffffff800652e0>] worker_thread+0x356/0x8e6 kernel/workqueue.c:2444
[<ffffffff800770a8>] kthread+0x25c/0x2c6 kernel/kthread.c:319
[<ffffffff800051aa>] ret_from_exception+0x0/0x14
irq event stamp: 305553
hardirqs last enabled at (305553): [<ffffffff803f293c>] kasan_quarantine_put+0x194/0x1f6 mm/kasan/quarantine.c:220
hardirqs last disabled at (305552): [<ffffffff803f284c>] kasan_quarantine_put+0xa4/0x1f6 mm/kasan/quarantine.c:193
softirqs last enabled at (305512): [<ffffffff82be4e78>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (305512): [<ffffffff82be4e78>] __do_softirq+0x5f8/0x8dc kernel/softirq.c:587
softirqs last disabled at (305505): [<ffffffff80036abc>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (305505): [<ffffffff80036abc>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (305505): [<ffffffff80036abc>] __irq_exit_rcu+0x142/0x1f8 kernel/softirq.c:636
---[ end trace ffa6dadad644eee5 ]---
==================================================================
BUG: KASAN: null-ptr-deref in check_wait_context kernel/locking/lockdep.c:4688 [inline]
BUG: KASAN: null-ptr-deref in __lock_acquire+0x2b8/0x2d84 kernel/locking/lockdep.c:4965
Read of size 1 at addr 00000000000000b8 by task kworker/u4:6/6652

CPU: 1 PID: 6652 Comm: kworker/u4:6 Tainted: G W 5.15.0-rc1-syzkaller-00001-g64a19591a293 #0
Hardware name: riscv-virtio,qemu (DT)
Workqueue: netns cleanup_net
Call Trace:
[<ffffffff8000957e>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:112
==================================================================
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8
Oops [#1]
Modules linked in:
CPU: 1 PID: 6652 Comm: kworker/u4:6 Tainted: G B W 5.15.0-rc1-syzkaller-00001-g64a19591a293 #0
Hardware name: riscv-virtio,qemu (DT)
Workqueue: netns cleanup_net
epc : check_wait_context kernel/locking/lockdep.c:4688 [inline]
epc : __lock_acquire+0x2bc/0x2d84 kernel/locking/lockdep.c:4965
ra : check_wait_context kernel/locking/lockdep.c:4688 [inline]
ra : __lock_acquire+0x2b8/0x2d84 kernel/locking/lockdep.c:4965
epc : ffffffff800d780c ra : ffffffff800d7808 sp : ffffffe0229bf6b0
gp : ffffffff83f9a558 tp : ffffffe007f72f80 t0 : ffffffff852b6bd7
t1 : ffffffc7f07f366c t2 : 0000000000000000 s0 : ffffffe0229bf790
s1 : 0000000000000000 a0 : ffffffe007f739f0 a1 : 0000000000000007
a2 : 1ffffffc00fee5f0 a3 : ffffffff82be4084 a4 : 0000000000000000
a5 : ffffffe007f73f80 a6 : 0000000000f00000 a7 : ffffffff83f9b363
s2 : 0000000084a4319d s3 : ffffffff83fb07c0 s4 : 0000000000000000
s5 : ffffffe007f73928 s6 : ffffffff83fb0590 s7 : ffffffe007f739d0
s8 : ffffffe007f72f80 s9 : 0000000000000994 s10: 0000000000001000
s11: 000000000004119d t3 : 000000000000003d t4 : ffffffc7f07f366c
t5 : ffffffc7f07f366d t6 : ffffffe0229bf328
status: 0000000000000100 badaddr: 00000000000000b8 cause: 000000000000000d
[<ffffffff800d780c>] hlock_class kernel/locking/lockdep.c:194 [inline]
[<ffffffff800d780c>] check_wait_context kernel/locking/lockdep.c:4689 [inline]
[<ffffffff800d780c>] __lock_acquire+0x2bc/0x2d84 kernel/locking/lockdep.c:4965
[<ffffffff800dafd4>] lock_acquire.part.0+0x15a/0x37c kernel/locking/lockdep.c:5625
[<ffffffff800db23a>] lock_acquire+0x44/0x5a kernel/locking/lockdep.c:5598
[<ffffffff805b92f2>] kernfs_drain fs/kernfs/dir.c:470 [inline]
[<ffffffff805b92f2>] __kernfs_remove+0x686/0x730 fs/kernfs/dir.c:1339
[<ffffffff805bb55c>] kernfs_remove_by_name_ns+0x52/0xb8 fs/kernfs/dir.c:1532
[<ffffffff805c1094>] kernfs_remove_by_name include/linux/kernfs.h:598 [inline]
[<ffffffff805c1094>] remove_files+0x66/0xf8 fs/sysfs/group.c:28
[<ffffffff805c118a>] sysfs_remove_group+0x64/0xee fs/sysfs/group.c:289
[<ffffffff805c2198>] sysfs_remove_groups fs/sysfs/group.c:313 [inline]
[<ffffffff805c2198>] sysfs_remove_groups+0x50/0x78 fs/sysfs/group.c:305
[<ffffffff80fd9560>] device_remove_groups drivers/base/core.c:2445 [inline]
[<ffffffff80fd9560>] device_remove_attrs+0xf4/0x10a drivers/base/core.c:2651
[<ffffffff80fdc16c>] device_del+0x2d4/0x6ce drivers/base/core.c:3545
[<ffffffff82293bc2>] netdev_unregister_kobject+0xf4/0x104 net/core/net-sysfs.c:1921
[<ffffffff822101d6>] unregister_netdevice_many+0x9b8/0xec0 net/core/dev.c:11066
[<ffffffff82210b6e>] default_device_exit_batch+0x228/0x258 net/core/dev.c:11569
[<ffffffff821ef57a>] ops_exit_list+0xb2/0xcc net/core/net_namespace.c:171
[<ffffffff821f0cf2>] cleanup_net+0x3ca/0x6b2 net/core/net_namespace.c:591
[<ffffffff80064612>] process_one_work+0x5e4/0xf5c kernel/workqueue.c:2297
[<ffffffff800652e0>] worker_thread+0x356/0x8e6 kernel/workqueue.c:2444
[<ffffffff800770a8>] kthread+0x25c/0x2c6 kernel/kthread.c:319
[<ffffffff800051aa>] ret_from_exception+0x0/0x14
---[ end trace ffa6dadad644eee6 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
May 5, 2022, 10:45:15 PM5/5/22
to syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages