BUG: soft lockup in vfs_rmdir
14 views
Skip to first unread message
syzbot
May 18, 2018, 7:25:04 PM5/18/18
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 82f9e2d5dba6 Merge branch 'bpf-af-xdp-cleanups'
git tree: bpf-next
console output: https://syzkaller.appspot.com/x/log.txt?x=169cb3cf800000
kernel config: https://syzkaller.appspot.com/x/.config?x=b632d8e2c2ab2c1
dashboard link: https://syzkaller.appspot.com/bug?extid=1d7a5bc38ae2b83da4eb
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [linux-...@vger.kernel.org linux-...@vger.kernel.org
vi...@zeniv.linux.org.uk]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1d7a5b...@syzkaller.appspotmail.com
syz-executor6[12379] is installing a program with bpf_probe_write_user
helper that may corrupt user memory!
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor0:4536]
Modules linked in:
irq event stamp: 14114646
hardirqs last enabled at (14114645): [<ffffffff81c6992f>]
seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline]
hardirqs last enabled at (14114645): [<ffffffff81c6992f>]
read_seqcount_begin include/linux/seqlock.h:164 [inline]
hardirqs last enabled at (14114645): [<ffffffff81c6992f>] read_seqbegin
include/linux/seqlock.h:433 [inline]
hardirqs last enabled at (14114645): [<ffffffff81c6992f>]
read_seqbegin_or_lock include/linux/seqlock.h:529 [inline]
hardirqs last enabled at (14114645): [<ffffffff81c6992f>]
d_walk+0x80f/0xc80 fs/dcache.c:1248
hardirqs last disabled at (14114646): [<ffffffff87800905>]
interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625
softirqs last enabled at (1282594): [<ffffffff87a00778>]
__do_softirq+0x778/0xaf5 kernel/softirq.c:311
softirqs last disabled at (1282537): [<ffffffff81475241>] invoke_softirq
kernel/softirq.c:365 [inline]
softirqs last disabled at (1282537): [<ffffffff81475241>]
irq_exit+0x1d1/0x200 kernel/softirq.c:405
CPU: 0 PID: 4536 Comm: syz-executor0 Not tainted 4.17.0-rc4+ #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:shrink_dcache_parent+0x194/0x230 fs/dcache.c:1487
RSP: 0018:ffff8801a842fb88 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000003 RBX: dffffc0000000000 RCX: ffffffff81c698a1
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000
RBP: ffff8801a842fc78 R08: ffff8801a8424340 R09: ffffed00330cc720
R10: ffffed00330cc720 R11: ffff880198663903 R12: ffff8801a842fc50
R13: ffff8801a842fc10 R14: 1ffff10035085f82 R15: ffffed0035085f85
FS: 00000000029dd940(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000029e6978 CR3: 00000001a8a9b000 CR4: 00000000001406f0
DR0: 00000000200001c0 DR1: 00000000200001c0 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
vfs_rmdir+0x202/0x470 fs/namei.c:3850
do_rmdir+0x523/0x610 fs/namei.c:3911
__do_sys_rmdir fs/namei.c:3929 [inline]
__se_sys_rmdir fs/namei.c:3927 [inline]
__x64_sys_rmdir+0x36/0x40 fs/namei.c:3927
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455777
RSP: 002b:00007ffdc9affcb8 EFLAGS: 00000206 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000455777
RDX: 0000000000000000 RSI: 00007ffdc9b01a60 RDI: 00007ffdc9b01a60
RBP: 00007ffdc9b01a60 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000206 R12: 00000000029de940
R13: 0000000000000000 R14: 00000000000002c8 R15: 000000000001dd55
Code: 89 ee 41 c7 44 24 d8 00 00 00 00 e8 67 f0 ff ff 41 0f b6 07 84 c0 74
04 3c 03 7e 6a 41 8b 44 24 d8 31 ff 89 c6 89 85 2c ff ff ff <e8> c7 8d b2
ff 8b 85 2c ff ff ff 85 c0 0f 85 05 ff ff ff e8 a4
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4538 Comm: syz-executor7 Not tainted 4.17.0-rc4+ #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__lock_release kernel/locking/lockdep.c:3682 [inline]
RIP: 0010:lock_release+0x24f/0xa10 kernel/locking/lockdep.c:3939
RSP: 0018:ffff8801a4a4f8a0 EFLAGS: 00000806
RAX: dffffc0000000000 RBX: 1ffff10034949f19 RCX: ffffed0034949f62
RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff8801a4a4f9d0 R08: 0000000000000000 R09: ffffed0033181344
R10: ffffffff8a713a20 R11: 0000000000000005 R12: ffff8801a4a4f9a8
R13: ffff880198c09a38 R14: ffff8801a4a423c0 R15: ffff8801a4a4f8e8
FS: 00000000015c1940(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000015ca978 CR3: 00000001a4a1f000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
_raw_spin_unlock+0x1a/0x30 kernel/locking/spinlock.c:176
spin_unlock include/linux/spinlock.h:350 [inline]
d_walk+0x451/0xc80 fs/dcache.c:1298
shrink_dcache_parent+0x179/0x230 fs/dcache.c:1486
vfs_rmdir+0x202/0x470 fs/namei.c:3850
do_rmdir+0x523/0x610 fs/namei.c:3911
__do_sys_rmdir fs/namei.c:3929 [inline]
__se_sys_rmdir fs/namei.c:3927 [inline]
__x64_sys_rmdir+0x36/0x40 fs/namei.c:3927
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455777
RSP: 002b:00007ffd73503c28 EFLAGS: 00000206 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000455777
RDX: 0000000000000000 RSI: 00007ffd735059d0 RDI: 00007ffd735059d0
RBP: 00007ffd735059d0 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000206 R12: 00000000015c2940
R13: 0000000000000000 R14: 00000000000002db R15: 000000000001dcf0
Code: 3c 03 0f 8e c3 06 00 00 49 c7 c2 20 3a 71 8a 45 8b 9e 30 08 00 00 48
b8 00 00 00 00 00 fc ff df 4c 89 d2 48 c1 ea 03 0f b6 14 02 <4c> 89 d0 83
e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 24 06 00 00
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot found the following crash on:
HEAD commit: 82f9e2d5dba6 Merge branch 'bpf-af-xdp-cleanups'
git tree: bpf-next
console output: https://syzkaller.appspot.com/x/log.txt?x=169cb3cf800000
kernel config: https://syzkaller.appspot.com/x/.config?x=b632d8e2c2ab2c1
dashboard link: https://syzkaller.appspot.com/bug?extid=1d7a5bc38ae2b83da4eb
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [linux-...@vger.kernel.org linux-...@vger.kernel.org
vi...@zeniv.linux.org.uk]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1d7a5b...@syzkaller.appspotmail.com
syz-executor6[12379] is installing a program with bpf_probe_write_user
helper that may corrupt user memory!
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor0:4536]
Modules linked in:
irq event stamp: 14114646
hardirqs last enabled at (14114645): [<ffffffff81c6992f>]
seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline]
hardirqs last enabled at (14114645): [<ffffffff81c6992f>]
read_seqcount_begin include/linux/seqlock.h:164 [inline]
hardirqs last enabled at (14114645): [<ffffffff81c6992f>] read_seqbegin
include/linux/seqlock.h:433 [inline]
hardirqs last enabled at (14114645): [<ffffffff81c6992f>]
read_seqbegin_or_lock include/linux/seqlock.h:529 [inline]
hardirqs last enabled at (14114645): [<ffffffff81c6992f>]
d_walk+0x80f/0xc80 fs/dcache.c:1248
hardirqs last disabled at (14114646): [<ffffffff87800905>]
interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625
softirqs last enabled at (1282594): [<ffffffff87a00778>]
__do_softirq+0x778/0xaf5 kernel/softirq.c:311
softirqs last disabled at (1282537): [<ffffffff81475241>] invoke_softirq
kernel/softirq.c:365 [inline]
softirqs last disabled at (1282537): [<ffffffff81475241>]
irq_exit+0x1d1/0x200 kernel/softirq.c:405
CPU: 0 PID: 4536 Comm: syz-executor0 Not tainted 4.17.0-rc4+ #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:shrink_dcache_parent+0x194/0x230 fs/dcache.c:1487
RSP: 0018:ffff8801a842fb88 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000003 RBX: dffffc0000000000 RCX: ffffffff81c698a1
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000
RBP: ffff8801a842fc78 R08: ffff8801a8424340 R09: ffffed00330cc720
R10: ffffed00330cc720 R11: ffff880198663903 R12: ffff8801a842fc50
R13: ffff8801a842fc10 R14: 1ffff10035085f82 R15: ffffed0035085f85
FS: 00000000029dd940(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000029e6978 CR3: 00000001a8a9b000 CR4: 00000000001406f0
DR0: 00000000200001c0 DR1: 00000000200001c0 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
vfs_rmdir+0x202/0x470 fs/namei.c:3850
do_rmdir+0x523/0x610 fs/namei.c:3911
__do_sys_rmdir fs/namei.c:3929 [inline]
__se_sys_rmdir fs/namei.c:3927 [inline]
__x64_sys_rmdir+0x36/0x40 fs/namei.c:3927
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455777
RSP: 002b:00007ffdc9affcb8 EFLAGS: 00000206 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000455777
RDX: 0000000000000000 RSI: 00007ffdc9b01a60 RDI: 00007ffdc9b01a60
RBP: 00007ffdc9b01a60 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000206 R12: 00000000029de940
R13: 0000000000000000 R14: 00000000000002c8 R15: 000000000001dd55
Code: 89 ee 41 c7 44 24 d8 00 00 00 00 e8 67 f0 ff ff 41 0f b6 07 84 c0 74
04 3c 03 7e 6a 41 8b 44 24 d8 31 ff 89 c6 89 85 2c ff ff ff <e8> c7 8d b2
ff 8b 85 2c ff ff ff 85 c0 0f 85 05 ff ff ff e8 a4
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4538 Comm: syz-executor7 Not tainted 4.17.0-rc4+ #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__lock_release kernel/locking/lockdep.c:3682 [inline]
RIP: 0010:lock_release+0x24f/0xa10 kernel/locking/lockdep.c:3939
RSP: 0018:ffff8801a4a4f8a0 EFLAGS: 00000806
RAX: dffffc0000000000 RBX: 1ffff10034949f19 RCX: ffffed0034949f62
RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff8801a4a4f9d0 R08: 0000000000000000 R09: ffffed0033181344
R10: ffffffff8a713a20 R11: 0000000000000005 R12: ffff8801a4a4f9a8
R13: ffff880198c09a38 R14: ffff8801a4a423c0 R15: ffff8801a4a4f8e8
FS: 00000000015c1940(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000015ca978 CR3: 00000001a4a1f000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
_raw_spin_unlock+0x1a/0x30 kernel/locking/spinlock.c:176
spin_unlock include/linux/spinlock.h:350 [inline]
d_walk+0x451/0xc80 fs/dcache.c:1298
shrink_dcache_parent+0x179/0x230 fs/dcache.c:1486
vfs_rmdir+0x202/0x470 fs/namei.c:3850
do_rmdir+0x523/0x610 fs/namei.c:3911
__do_sys_rmdir fs/namei.c:3929 [inline]
__se_sys_rmdir fs/namei.c:3927 [inline]
__x64_sys_rmdir+0x36/0x40 fs/namei.c:3927
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455777
RSP: 002b:00007ffd73503c28 EFLAGS: 00000206 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000455777
RDX: 0000000000000000 RSI: 00007ffd735059d0 RDI: 00007ffd735059d0
RBP: 00007ffd735059d0 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000206 R12: 00000000015c2940
R13: 0000000000000000 R14: 00000000000002db R15: 000000000001dcf0
Code: 3c 03 0f 8e c3 06 00 00 49 c7 c2 20 3a 71 8a 45 8b 9e 30 08 00 00 48
b8 00 00 00 00 00 fc ff df 4c 89 d2 48 c1 ea 03 0f b6 14 02 <4c> 89 d0 83
e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 24 06 00 00
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
Dmitry Vyukov
May 19, 2018, 5:29:04 AM5/19/18
to syzbot, 'Dmitry Vyukov' via syzkaller-upstream-moderation
False positive due to too low watchdog_thresh setting. Fixed now.
#syz invalid
> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-upstream-moderation/000000000000fac9f1056c8342c7%40google.com.
> For more options, visit https://groups.google.com/d/optout.
#syz invalid
> You received this message because you are subscribed to the Google Groups
> "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-upstream-moderation/000000000000fac9f1056c8342c7%40google.com.
> For more options, visit https://groups.google.com/d/optout.
Reply all
Reply to author
Forward
0 new messages