general protection fault in __queue_work
0 views
Skip to first unread message
syzbot
Dec 17, 2018, 1:11:05 AM12/17/18
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: e782410ed237 r8169: improve spurious interrupt detection
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16e99393400000
kernel config: https://syzkaller.appspot.com/x/.config?x=d9655b05acfc97ff
dashboard link: https://syzkaller.appspot.com/bug?extid=31cd70b7ae878e974afd
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [b...@redhat.com b...@alien8.de douly...@cn.fujitsu.com
h...@zytor.com konra...@oracle.com linux-...@vger.kernel.org
mi...@redhat.com pu...@hygon.cn tg...@linutronix.de vba...@suse.cz
ville....@linux.intel.com x...@kernel.org]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+31cd70...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 12208 Comm: syz-executor4 Not tainted 4.20.0-rc6+ #346
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:strcmp+0x5a/0xb0 lib/string.c:329
Code: c1 e8 03 83 e2 07 42 0f b6 04 30 38 d0 7f 04 84 c0 75 55 41 0f b6 5c
24 ff 4c 8d 6e 01 48 89 f0 48 89 f2 48 c1 e8 03 83 e2 07 <42> 0f b6 04 30
38 d0 7f 04 84 c0 75 27 41 3a 5d ff 74 ae 19 c0 48
RSP: 0000:ffff8881dae06c18 EFLAGS: 00010046
RAX: 000000001ffffbff RBX: 0000000000000026 RCX: 1ffffffff1599547
RDX: 0000000000000000 RSI: 00000000ffffdff8 RDI: ffffffff8860e380
RBP: ffff8881dae06c40 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed103b5c0df7 R11: 0000000000000003 R12: ffffffff8860e381
R13: 00000000ffffdff9 R14: dffffc0000000000 R15: dffffc0000000000
FS: 0000000001265940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000040d3d0 CR3: 00000001c11fd000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
count_matching_names kernel/locking/lockdep.c:642 [inline]
register_lock_class+0x11ba/0x29b0 kernel/locking/lockdep.c:795
__lock_acquire+0x184/0x4c20 kernel/locking/lockdep.c:3227
lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144
spin_lock include/linux/spinlock.h:329 [inline]
__queue_work+0xc1b/0x1440 kernel/workqueue.c:1414
delayed_work_timer_fn+0x5d/0x90 kernel/workqueue.c:1500
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1359 [inline]
__run_timers+0x723/0xc70 kernel/time/timer.c:1682
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
__do_softirq+0x308/0xb7e kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x17f/0x1c0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1061
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x4b/0x50 kernel/kcov.c:111
Code: 90 d8 12 00 00 83 fa 02 75 20 48 8b 88 e0 12 00 00 8b 80 dc 12 00 00
48 8b 11 48 83 c2 01 48 39 d0 76 07 48 89 34 d1 48 89 11 <5d> c3 0f 1f 00
55 40 0f b6 d6 40 0f b6 f7 31 ff 48 89 e5 48 8b 4d
RSP: 0000:ffff888190e77510 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff888190e8e040 RBX: 0000000000000001 RCX: ffffffff819d8d93
RDX: 0000000000000000 RSI: ffffffff819d8d9c RDI: 0000000000000005
RBP: ffff888190e77510 R08: ffff888190e8e040 R09: ffffed103b5c5b5f
R10: 0000000000000004 R11: ffff8881dae2dafb R12: ffffea0006f51600
R13: ffff888190e775f0 R14: ffff888190e77950 R15: dffffc0000000000
xa_entry include/linux/xarray.h:848 [inline]
xas_next_entry include/linux/xarray.h:1273 [inline]
filemap_map_pages+0xbcc/0x1a20 mm/filemap.c:2549
do_fault_around mm/memory.c:3369 [inline]
do_read_fault mm/memory.c:3403 [inline]
do_fault mm/memory.c:3534 [inline]
handle_pte_fault mm/memory.c:3765 [inline]
__handle_mm_fault+0x45a6/0x5be0 mm/memory.c:3889
handle_mm_fault+0x54f/0xc70 mm/memory.c:3926
do_user_addr_fault arch/x86/mm/fault.c:1423 [inline]
__do_page_fault+0x5e8/0xe60 arch/x86/mm/fault.c:1489
do_page_fault+0xf2/0x7e0 arch/x86/mm/fault.c:1520
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143
RIP: 0033:0x40d3d0
Code: Bad RIP value.
RSP: 002b:00007ffe33c91778 EFLAGS: 00010202
RAX: 0000000000a44cc8 RBX: 00007ffe33c91780 RCX: 0000000000411e93
RDX: 000000000040d3d0 RSI: 0000000000000018 RDI: 0000000001265c20
RBP: 00007ffe33c917c0 R08: 0000000000000001 R09: 0000000001265940
R10: 0000000001265c10 R11: 0000000000000202 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000004
Modules linked in:
---[ end trace 72fb8f49ce1ec3b3 ]---
RIP: 0010:strcmp+0x5a/0xb0 lib/string.c:329
Code: c1 e8 03 83 e2 07 42 0f b6 04 30 38 d0 7f 04 84 c0 75 55 41 0f b6 5c
24 ff 4c 8d 6e 01 48 89 f0 48 89 f2 48 c1 e8 03 83 e2 07 <42> 0f b6 04 30
38 d0 7f 04 84 c0 75 27 41 3a 5d ff 74 ae 19 c0 48
RSP: 0000:ffff8881dae06c18 EFLAGS: 00010046
RAX: 000000001ffffbff RBX: 0000000000000026 RCX: 1ffffffff1599547
RDX: 0000000000000000 RSI: 00000000ffffdff8 RDI: ffffffff8860e380
RBP: ffff8881dae06c40 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed103b5c0df7 R11: 0000000000000003 R12: ffffffff8860e381
R13: 00000000ffffdff9 R14: dffffc0000000000 R15: dffffc0000000000
FS: 0000000001265940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000040d3a6 CR3: 00000001c11fd000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot found the following crash on:
HEAD commit: e782410ed237 r8169: improve spurious interrupt detection
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16e99393400000
kernel config: https://syzkaller.appspot.com/x/.config?x=d9655b05acfc97ff
dashboard link: https://syzkaller.appspot.com/bug?extid=31cd70b7ae878e974afd
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [b...@redhat.com b...@alien8.de douly...@cn.fujitsu.com
h...@zytor.com konra...@oracle.com linux-...@vger.kernel.org
mi...@redhat.com pu...@hygon.cn tg...@linutronix.de vba...@suse.cz
ville....@linux.intel.com x...@kernel.org]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+31cd70...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 12208 Comm: syz-executor4 Not tainted 4.20.0-rc6+ #346
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:strcmp+0x5a/0xb0 lib/string.c:329
Code: c1 e8 03 83 e2 07 42 0f b6 04 30 38 d0 7f 04 84 c0 75 55 41 0f b6 5c
24 ff 4c 8d 6e 01 48 89 f0 48 89 f2 48 c1 e8 03 83 e2 07 <42> 0f b6 04 30
38 d0 7f 04 84 c0 75 27 41 3a 5d ff 74 ae 19 c0 48
RSP: 0000:ffff8881dae06c18 EFLAGS: 00010046
RAX: 000000001ffffbff RBX: 0000000000000026 RCX: 1ffffffff1599547
RDX: 0000000000000000 RSI: 00000000ffffdff8 RDI: ffffffff8860e380
RBP: ffff8881dae06c40 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed103b5c0df7 R11: 0000000000000003 R12: ffffffff8860e381
R13: 00000000ffffdff9 R14: dffffc0000000000 R15: dffffc0000000000
FS: 0000000001265940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000040d3d0 CR3: 00000001c11fd000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
count_matching_names kernel/locking/lockdep.c:642 [inline]
register_lock_class+0x11ba/0x29b0 kernel/locking/lockdep.c:795
__lock_acquire+0x184/0x4c20 kernel/locking/lockdep.c:3227
lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144
spin_lock include/linux/spinlock.h:329 [inline]
__queue_work+0xc1b/0x1440 kernel/workqueue.c:1414
delayed_work_timer_fn+0x5d/0x90 kernel/workqueue.c:1500
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1359 [inline]
__run_timers+0x723/0xc70 kernel/time/timer.c:1682
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
__do_softirq+0x308/0xb7e kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x17f/0x1c0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1061
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x4b/0x50 kernel/kcov.c:111
Code: 90 d8 12 00 00 83 fa 02 75 20 48 8b 88 e0 12 00 00 8b 80 dc 12 00 00
48 8b 11 48 83 c2 01 48 39 d0 76 07 48 89 34 d1 48 89 11 <5d> c3 0f 1f 00
55 40 0f b6 d6 40 0f b6 f7 31 ff 48 89 e5 48 8b 4d
RSP: 0000:ffff888190e77510 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff888190e8e040 RBX: 0000000000000001 RCX: ffffffff819d8d93
RDX: 0000000000000000 RSI: ffffffff819d8d9c RDI: 0000000000000005
RBP: ffff888190e77510 R08: ffff888190e8e040 R09: ffffed103b5c5b5f
R10: 0000000000000004 R11: ffff8881dae2dafb R12: ffffea0006f51600
R13: ffff888190e775f0 R14: ffff888190e77950 R15: dffffc0000000000
xa_entry include/linux/xarray.h:848 [inline]
xas_next_entry include/linux/xarray.h:1273 [inline]
filemap_map_pages+0xbcc/0x1a20 mm/filemap.c:2549
do_fault_around mm/memory.c:3369 [inline]
do_read_fault mm/memory.c:3403 [inline]
do_fault mm/memory.c:3534 [inline]
handle_pte_fault mm/memory.c:3765 [inline]
__handle_mm_fault+0x45a6/0x5be0 mm/memory.c:3889
handle_mm_fault+0x54f/0xc70 mm/memory.c:3926
do_user_addr_fault arch/x86/mm/fault.c:1423 [inline]
__do_page_fault+0x5e8/0xe60 arch/x86/mm/fault.c:1489
do_page_fault+0xf2/0x7e0 arch/x86/mm/fault.c:1520
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143
RIP: 0033:0x40d3d0
Code: Bad RIP value.
RSP: 002b:00007ffe33c91778 EFLAGS: 00010202
RAX: 0000000000a44cc8 RBX: 00007ffe33c91780 RCX: 0000000000411e93
RDX: 000000000040d3d0 RSI: 0000000000000018 RDI: 0000000001265c20
RBP: 00007ffe33c917c0 R08: 0000000000000001 R09: 0000000001265940
R10: 0000000001265c10 R11: 0000000000000202 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000004
Modules linked in:
---[ end trace 72fb8f49ce1ec3b3 ]---
RIP: 0010:strcmp+0x5a/0xb0 lib/string.c:329
Code: c1 e8 03 83 e2 07 42 0f b6 04 30 38 d0 7f 04 84 c0 75 55 41 0f b6 5c
24 ff 4c 8d 6e 01 48 89 f0 48 89 f2 48 c1 e8 03 83 e2 07 <42> 0f b6 04 30
38 d0 7f 04 84 c0 75 27 41 3a 5d ff 74 ae 19 c0 48
RSP: 0000:ffff8881dae06c18 EFLAGS: 00010046
RAX: 000000001ffffbff RBX: 0000000000000026 RCX: 1ffffffff1599547
RDX: 0000000000000000 RSI: 00000000ffffdff8 RDI: ffffffff8860e380
RBP: ffff8881dae06c40 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed103b5c0df7 R11: 0000000000000003 R12: ffffffff8860e381
R13: 00000000ffffdff9 R14: dffffc0000000000 R15: dffffc0000000000
FS: 0000000001265940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000040d3a6 CR3: 00000001c11fd000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
Dmitry Vyukov
Mar 7, 2019, 1:24:54 PM3/7/19
to syzbot, 'Dmitry Vyukov' via syzkaller-upstream-moderation
#syz upstream
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/0000000000005b796c057d31a538%40google.com.
> For more options, visit https://groups.google.com/d/optout.
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/0000000000005b796c057d31a538%40google.com.
> For more options, visit https://groups.google.com/d/optout.
Reply all
Reply to author
Forward
0 new messages