possible deadlock in ftrace_profile_set_filter
44 views
Skip to first unread message
syzbot
Oct 30, 2017, 3:36:11 PM10/30/17
to syzkaller-upst...@googlegroups.com
Hello,
syzkaller hit the following crash on
c97efd59aceb150e11f0f4bfe1cd5057df4f38f2
git://git.cmpxchg.org/linux-mmots.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
CC: [linux-...@vger.kernel.org mi...@redhat.com ros...@goodmis.org]
======================================================
WARNING: possible circular locking dependency detected
4.13.0-mm1+ #3 Not tainted
------------------------------------------------------
syz-executor2/3999 is trying to acquire lock:
(event_mutex){+.+.}, at: [<ffffffff8176757a>]
ftrace_profile_set_filter+0x7a/0x270 kernel/trace/trace_events_filter.c:2266
but task is already holding lock:
(&ctx->mutex){+.+.}, at: [<ffffffff8180943c>]
perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #8 (&ctx->mutex){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210
perf_event_ctx_lock kernel/events/core.c:1223 [inline]
perf_read+0xb9/0x970 kernel/events/core.c:4584
do_loop_readv_writev fs/read_write.c:670 [inline]
do_iter_read+0x3db/0x5b0 fs/read_write.c:894
vfs_readv+0x121/0x1c0 fs/read_write.c:956
kernel_readv fs/splice.c:361 [inline]
default_file_splice_read+0x508/0xae0 fs/splice.c:432
do_splice_to+0x110/0x170 fs/splice.c:896
do_splice fs/splice.c:1189 [inline]
SYSC_splice fs/splice.c:1418 [inline]
SyS_splice+0x11a8/0x1630 fs/splice.c:1398
entry_SYSCALL_64_fastpath+0x1f/0xbe
-> #7 (&pipe->mutex/1){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
pipe_lock_nested fs/pipe.c:66 [inline]
pipe_lock+0x56/0x70 fs/pipe.c:74
iter_file_splice_write+0x264/0xf50 fs/splice.c:715
do_splice_from fs/splice.c:867 [inline]
do_splice fs/splice.c:1163 [inline]
SYSC_splice fs/splice.c:1418 [inline]
SyS_splice+0x7d5/0x1630 fs/splice.c:1398
entry_SYSCALL_64_fastpath+0x1f/0xbe
-> #6 (sb_writers){.+.+}:
percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:35
[inline]
percpu_down_read include/linux/percpu-rwsem.h:58 [inline]
__sb_start_write+0x18f/0x290 fs/super.c:1340
sb_start_write include/linux/fs.h:1514 [inline]
mnt_want_write+0x3f/0xb0 fs/namespace.c:386
filename_create+0x12b/0x520 fs/namei.c:3629
kern_path_create+0x33/0x40 fs/namei.c:3675
handle_create+0xc0/0x760 drivers/base/devtmpfs.c:202
-> #5 ((complete)&req.done){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
complete_acquire include/linux/completion.h:39 [inline]
__wait_for_common kernel/sched/completion.c:108 [inline]
wait_for_common kernel/sched/completion.c:122 [inline]
wait_for_completion+0xc8/0x770 kernel/sched/completion.c:143
devtmpfs_create_node+0x32b/0x4a0 drivers/base/devtmpfs.c:114
device_add+0x120f/0x1640 drivers/base/core.c:1824
device_create_groups_vargs+0x1f3/0x250 drivers/base/core.c:2430
device_create_vargs drivers/base/core.c:2470 [inline]
device_create+0xda/0x110 drivers/base/core.c:2506
msr_device_create+0x26/0x40 arch/x86/kernel/msr.c:188
cpuhp_invoke_callback+0x256/0x14d0 kernel/cpu.c:145
cpuhp_thread_fun+0x265/0x520 kernel/cpu.c:434
smpboot_thread_fn+0x489/0x850 kernel/smpboot.c:164
kthread+0x39c/0x470 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
-> #4 (cpuhp_state){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
cpuhp_invoke_ap_callback kernel/cpu.c:467 [inline]
cpuhp_issue_call+0x1a2/0x3e0 kernel/cpu.c:1308
__cpuhp_setup_state_cpuslocked+0x2d6/0x5f0 kernel/cpu.c:1455
__cpuhp_setup_state+0xb0/0x140 kernel/cpu.c:1484
cpuhp_setup_state include/linux/cpuhotplug.h:177 [inline]
page_writeback_init+0x4d/0x71 mm/page-writeback.c:2082
pagecache_init+0x48/0x4f mm/filemap.c:871
start_kernel+0x6c1/0x754 init/main.c:690
x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:377
x86_64_start_kernel+0x87/0x8a arch/x86/kernel/head64.c:358
verify_cpu+0x0/0xfb
-> #3 (cpuhp_state_mutex){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
__cpuhp_setup_state_cpuslocked+0x5b/0x5f0 kernel/cpu.c:1430
__cpuhp_setup_state+0xb0/0x140 kernel/cpu.c:1484
cpuhp_setup_state_nocalls include/linux/cpuhotplug.h:205 [inline]
kvm_guest_init+0x1f3/0x20f arch/x86/kernel/kvm.c:488
setup_arch+0x1899/0x1ab3 arch/x86/kernel/setup.c:1294
start_kernel+0xa5/0x754 init/main.c:530
x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:377
x86_64_start_kernel+0x87/0x8a arch/x86/kernel/head64.c:358
verify_cpu+0x0/0xfb
-> #2 (cpu_hotplug_lock.rw_sem){++++}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:35
[inline]
percpu_down_read include/linux/percpu-rwsem.h:58 [inline]
cpus_read_lock+0x42/0x90 kernel/cpu.c:218
static_key_slow_inc+0x9d/0x3c0 kernel/jump_label.c:123
tracepoint_add_func kernel/tracepoint.c:223 [inline]
tracepoint_probe_register_prio+0x80d/0x9a0 kernel/tracepoint.c:283
tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304
trace_event_reg+0x167/0x320 kernel/trace/trace_events.c:305
perf_trace_event_reg kernel/trace/trace_event_perf.c:122 [inline]
perf_trace_event_init kernel/trace/trace_event_perf.c:197 [inline]
perf_trace_init+0x4f9/0xab0 kernel/trace/trace_event_perf.c:221
perf_tp_event_init+0x7d/0xf0 kernel/events/core.c:8037
perf_try_init_event+0xc9/0x1f0 kernel/events/core.c:9261
perf_init_event kernel/events/core.c:9299 [inline]
perf_event_alloc+0x1c5b/0x2a00 kernel/events/core.c:9558
SYSC_perf_event_open+0x84e/0x2e00 kernel/events/core.c:10013
SyS_perf_event_open+0x39/0x50 kernel/events/core.c:9899
entry_SYSCALL_64_fastpath+0x1f/0xbe
-> #1 (tracepoints_mutex){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
tracepoint_probe_register_prio+0xa0/0x9a0 kernel/tracepoint.c:279
tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304
trace_event_reg+0x167/0x320 kernel/trace/trace_events.c:305
perf_trace_event_reg kernel/trace/trace_event_perf.c:122 [inline]
perf_trace_event_init kernel/trace/trace_event_perf.c:197 [inline]
perf_trace_init+0x4f9/0xab0 kernel/trace/trace_event_perf.c:221
perf_tp_event_init+0x7d/0xf0 kernel/events/core.c:8037
perf_try_init_event+0xc9/0x1f0 kernel/events/core.c:9261
perf_init_event kernel/events/core.c:9299 [inline]
perf_event_alloc+0x1c5b/0x2a00 kernel/events/core.c:9558
SYSC_perf_event_open+0x84e/0x2e00 kernel/events/core.c:10013
SyS_perf_event_open+0x39/0x50 kernel/events/core.c:9899
entry_SYSCALL_64_fastpath+0x1f/0xbe
-> #0 (event_mutex){+.+.}:
check_prev_add+0x865/0x1520 kernel/locking/lockdep.c:1894
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
ftrace_profile_set_filter+0x7a/0x270
kernel/trace/trace_events_filter.c:2266
perf_event_set_filter kernel/events/core.c:8622 [inline]
_perf_ioctl kernel/events/core.c:4785 [inline]
perf_ioctl+0x1026/0x1360 kernel/events/core.c:4822
vfs_ioctl fs/ioctl.c:45 [inline]
do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
SYSC_ioctl fs/ioctl.c:700 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
entry_SYSCALL_64_fastpath+0x1f/0xbe
other info that might help us debug this:
Chain exists of:
event_mutex --> &pipe->mutex/1 --> &ctx->mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ctx->mutex);
lock(&pipe->mutex/1);
lock(&ctx->mutex);
lock(event_mutex);
*** DEADLOCK ***
1 lock held by syz-executor2/3999:
#0: (&ctx->mutex){+.+.}, at: [<ffffffff8180943c>]
perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210
stack backtrace:
CPU: 1 PID: 3999 Comm: syz-executor2 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
print_circular_bug+0x503/0x710 kernel/locking/lockdep.c:1259
check_prev_add+0x865/0x1520 kernel/locking/lockdep.c:1894
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
ftrace_profile_set_filter+0x7a/0x270
kernel/trace/trace_events_filter.c:2266
perf_event_set_filter kernel/events/core.c:8622 [inline]
_perf_ioctl kernel/events/core.c:4785 [inline]
perf_ioctl+0x1026/0x1360 kernel/events/core.c:4822
vfs_ioctl fs/ioctl.c:45 [inline]
do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
SYSC_ioctl fs/ioctl.c:700 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x451e59
RSP: 002b:00007f92997edc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59
RDX: 0000000020368fc0 RSI: 0000000040082406 RDI: 0000000000000006
RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000
R13: 0000000000a6f7ef R14: 00007f92997ee9c0 R15: 0000000000000000
*** Guest State ***
CR0: actual=0x0000000080000031, shadow=0x0000000060000010,
gh_mask=fffffffffffffff7
CR4: actual=0x0000000000002051, shadow=0x0000000000000000,
gh_mask=ffffffffffffe871
CR3 = 0x00000000fffbc000
RSP = 0x000000000000fffa RIP = 0x0000000000000000
RFLAGS=0x00023000 DR7 = 0x0000000000000400
Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000
CS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
DS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
SS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
ES: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
FS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
GS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
GDTR: limit=0x0000ffff, base=0x0000000000000000
LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000
IDTR: limit=0x0000ffff, base=0x0000000000000000
TR: sel=0x0000, attr=0x0008b, limit=0x00002088, base=0x0000000000000000
EFER = 0x0000000000000000 PAT = 0x0007040600070406
DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000
Interruptibility = 00000000 ActivityState = 00000000
*** Host State ***
RIP = 0xffffffff811b8c6f RSP = 0xffff8801c807f4c8
CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040
FSBase=00007fae80c86700 GSBase=ffff8801db300000 TRBase=ffff8801db323100
GDTBase=ffffffffff576000 IDTBase=ffffffffff57b000
CR0=0000000080050033 CR3=00000001c4a04000 CR4=00000000001426e0
Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff84d41eb0
EFER = 0x0000000000000d01 PAT = 0x0000000000000000
*** Control State ***
PinBased=0000003f CPUBased=b6a1edfa SecondaryExec=00000043
EntryControls=0000d1ff ExitControls=0023efff
ExceptionBitmap=ffffbfff PFECmask=00000000 PFECmatch=00000000
VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000
VMExit: intr_info=00000000 errcode=00000000 ilen=00000000
reason=80000021 qualification=0000000000000000
IDTVectoring: info=00000000 errcode=00000000
TSC Offset = 0xffffffe675408abf
TPR Threshold = 0x00
EPT pointer = 0x00000001cacd801e
QAT: Invalid ioctl
audit: type=1326 audit(1504712915.573:2): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4000 comm="syz-executor0"
exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
RSP = 0x000000000000fffa RIP = 0x0000000000000000
RFLAGS=0x00023000 DR7 = 0x0000000000000400
Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000
CS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
DS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
SS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
ES: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
FS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
GS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
GDTR: limit=0x0000ffff, base=0x0000000000000000
LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000
IDTR: limit=0x0000ffff, base=0x0000000000000000
TR: sel=0x0000, attr=0x0008b, limit=0x00002088, base=0x0000000000000000
EFER = 0x0000000000000000 PAT = 0x0007040600070406
DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000
Interruptibility = 00000000 ActivityState = 00000000
*** Host State ***
RIP = 0xffffffff811b8c6f RSP = 0xffff8801c46074c8
CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040
FSBase=00007fae80d0f700 GSBase=ffff8801db200000 TRBase=ffff8801db223100
GDTBase=ffffffffff577000 IDTBase=ffffffffff57b000
CR0=0000000080050033 CR3=00000001c4a04000 CR4=00000000001426f0
Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff84d41eb0
EFER = 0x0000000000000d01 PAT = 0x0000000000000000
*** Control State ***
PinBased=0000003f CPUBased=b6a1edfa SecondaryExec=00000043
EntryControls=0000d1ff ExitControls=0023efff
ExceptionBitmap=ffffbfff PFECmask=00000000 PFECmatch=00000000
VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000
VMExit: intr_info=00000000 errcode=00000000 ilen=00000000
reason=80000021 qualification=0000000000000000
IDTVectoring: info=00000000 errcode=00000000
TSC Offset = 0xffffffe68daa64fc
TPR Threshold = 0x00
EPT pointer = 0x00000001c419e01e
device lo left promiscuous mode
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
device lo entered promiscuous mode
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
device lo left promiscuous mode
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
sctp: [Deprecated]: syz-executor7 (pid 4203) Use of struct sctp_assoc_value
in delayed_ack socket option.
Use struct sctp_sack_info instead
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606
sclass=netlink_route_socket pig=4207 comm=syz-executor3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606
sclass=netlink_route_socket pig=4200 comm=syz-executor3
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
sctp: [Deprecated]: syz-executor7 (pid 4203) Use of int in maxseg socket
option.
Use struct sctp_assoc_value instead
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606
sclass=netlink_route_socket pig=4235 comm=syz-executor3
netlink: 6 bytes leftover after parsing attributes in process
`syz-executor2'.
netlink: 6 bytes leftover after parsing attributes in process
`syz-executor2'.
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606
sclass=netlink_route_socket pig=4248 comm=syz-executor3
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=29
sclass=netlink_tcpdiag_socket pig=4258 comm=syz-executor7
audit: type=1326 audit(1504712918.242:3): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4267 comm="syz-executor5"
exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=29
sclass=netlink_tcpdiag_socket pig=4275 comm=syz-executor7
audit: type=1326 audit(1504712918.318:4): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4267 comm="syz-executor5"
exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
TCP: request_sock_TCP: Possible SYN flooding on port 20012. Sending
cookies. Check SNMP counters.
audit: type=1326 audit(1504712919.273:5): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4489 comm="syz-executor2"
exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
audit: type=1326 audit(1504712919.346:6): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4489 comm="syz-executor2"
exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
netlink: 5 bytes leftover after parsing attributes in process
`syz-executor3'.
netlink: 5 bytes leftover after parsing attributes in process
`syz-executor3'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 1 PID: 4619 Comm: syz-executor6 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_failslab+0xec/0x120 mm/failslab.c:31
slab_pre_alloc_hook mm/slab.h:422 [inline]
slab_alloc mm/slab.c:3383 [inline]
__do_kmalloc mm/slab.c:3723 [inline]
__kmalloc_track_caller+0x5f/0x760 mm/slab.c:3740
memdup_user+0x2c/0x90 mm/util.c:164
map_delete_elem kernel/bpf/syscall.c:623 [inline]
SYSC_bpf kernel/bpf/syscall.c:1471 [inline]
SyS_bpf+0x2186/0x4c50 kernel/bpf/syscall.c:1443
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x451e59
RSP: 002b:00007f10aa7a1c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59
RDX: 0000000000000010 RSI: 000000002096d000 RDI: 0000000000000003
RBP: 00007f10aa7a1a10 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b69f7
R13: 00007f10aa7a1b48 R14: 00000000004b6a07 R15: 0000000000000000
TCP: request_sock_TCPv6: Possible SYN flooding on port 20009. Sending
cookies. Check SNMP counters.
netlink: 8 bytes leftover after parsing attributes in process
`syz-executor5'.
netlink: 8 bytes leftover after parsing attributes in process
`syz-executor5'.
9pnet_virtio: no channels available for device ./bus
netlink: 1 bytes leftover after parsing attributes in process
`syz-executor3'.
9pnet_virtio: no channels available for device ./bus
netlink: 1 bytes leftover after parsing attributes in process
`syz-executor3'.
sock: process `syz-executor3' is using obsolete getsockopt SO_BSDCOMPAT
syz-executor2 (4872) used greatest stack depth: 14904 bytes left
rfkill: input handler disabled
rfkill: input handler enabled
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20017. Sending
cookies. Check SNMP counters.
do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app
do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 1
CPU: 0 PID: 5176 Comm: syz-executor1 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_fail_alloc_page mm/page_alloc.c:2915 [inline]
prepare_alloc_pages mm/page_alloc.c:4151 [inline]
__alloc_pages_nodemask+0x338/0xd80 mm/page_alloc.c:4187
alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2035
alloc_pages include/linux/gfp.h:505 [inline]
skb_page_frag_refill+0x358/0x5f0 net/core/sock.c:2196
tun_build_skb.isra.42+0x13f/0x1450 drivers/net/tun.c:1283
tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007f845a55fc10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 0000000000000036 RSI: 0000000020002000 RDI: 0000000000000015
RBP: 00007f845a55fa10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007f845a55fb48 R14: 00000000004b6a07 R15: 0000000000000000
xprt_adjust_timeout: rq_timeout = 0!
xprt_adjust_timeout: rq_timeout = 0!
sctp: [Deprecated]: syz-executor7 (pid 5276) Use of int in maxseg socket
option.
Use struct sctp_assoc_value instead
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 5307 Comm: syz-executor4 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_fail_alloc_page mm/page_alloc.c:2915 [inline]
prepare_alloc_pages mm/page_alloc.c:4151 [inline]
__alloc_pages_nodemask+0x338/0xd80 mm/page_alloc.c:4187
alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2035
alloc_pages include/linux/gfp.h:505 [inline]
skb_page_frag_refill+0x358/0x5f0 net/core/sock.c:2196
tun_build_skb.isra.42+0x13f/0x1450 drivers/net/tun.c:1283
tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007fae80d0ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015
RBP: 00007fae80d0ea10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007fae80d0eb48 R14: 00000000004b6a07 R15: 0000000000000000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 5319 Comm: syz-executor4 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_failslab+0xec/0x120 mm/failslab.c:31
slab_pre_alloc_hook mm/slab.h:422 [inline]
slab_alloc mm/slab.c:3383 [inline]
kmem_cache_alloc+0x47/0x760 mm/slab.c:3559
__build_skb+0x9d/0x450 net/core/skbuff.c:284
build_skb+0x6f/0x260 net/core/skbuff.c:316
tun_build_skb.isra.42+0x692/0x1450 drivers/net/tun.c:1336
tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007fae80d0ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015
RBP: 00007fae80d0ea10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007fae80d0eb48 R14: 00000000004b6a07 R15: 0000000000000000
sctp: [Deprecated]: syz-executor7 (pid 5325) Use of int in maxseg socket
option.
Use struct sctp_assoc_value instead
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 5337 Comm: syz-executor4 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_failslab+0xec/0x120 mm/failslab.c:31
slab_pre_alloc_hook mm/slab.h:422 [inline]
slab_alloc mm/slab.c:3383 [inline]
kmem_cache_alloc+0x47/0x760 mm/slab.c:3559
reqsk_alloc include/net/request_sock.h:88 [inline]
inet_reqsk_alloc+0xad/0x570 net/ipv4/tcp_input.c:6192
tcp_conn_request+0x657/0x3410 net/ipv4/tcp_input.c:6291
tcp_v6_conn_request+0x212/0x270 net/ipv6/tcp_ipv6.c:1015
tcp_rcv_state_process+0x8ff/0x4d10 net/ipv4/tcp_input.c:5878
tcp_v6_do_rcv+0x739/0x11b0 net/ipv6/tcp_ipv6.c:1325
tcp_v6_rcv+0x1f92/0x27f0 net/ipv6/tcp_ipv6.c:1502
ip6_input_finish+0x36f/0x16d0 net/ipv6/ip6_input.c:284
NF_HOOK include/linux/netfilter.h:249 [inline]
ip6_input+0xe9/0x560 net/ipv6/ip6_input.c:327
dst_input include/net/dst.h:478 [inline]
ip6_rcv_finish+0x1a9/0x7a0 net/ipv6/ip6_input.c:71
NF_HOOK include/linux/netfilter.h:249 [inline]
ipv6_rcv+0xff0/0x2190 net/ipv6/ip6_input.c:208
__netif_receive_skb_core+0x19af/0x33d0 net/core/dev.c:4418
__netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4456
netif_receive_skb_internal+0x10b/0x5e0 net/core/dev.c:4527
netif_receive_skb+0xae/0x390 net/core/dev.c:4551
tun_rx_batched.isra.43+0x5ed/0x860 drivers/net/tun.c:1218
tun_get_user+0x11dd/0x2150 drivers/net/tun.c:1539
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007fae80d0ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015
RBP: 00007fae80d0ea10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007fae80d0eb48 R14: 00000000004b6a07 R15: 0000000000000000
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: tcp_parse_options: Illegal window scaling value 64 > 14 received
netlink: 5 bytes leftover after parsing attributes in process
`syz-executor3'.
TCP: tcp_parse_options: Illegal window scaling value 64 > 14 received
netlink: 5 bytes leftover after parsing attributes in process
`syz-executor3'.
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 5608 Comm: syz-executor5 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_fail_alloc_page mm/page_alloc.c:2915 [inline]
prepare_alloc_pages mm/page_alloc.c:4151 [inline]
__alloc_pages_nodemask+0x338/0xd80 mm/page_alloc.c:4187
alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2035
alloc_pages include/linux/gfp.h:505 [inline]
skb_page_frag_refill+0x358/0x5f0 net/core/sock.c:2196
tun_build_skb.isra.42+0x13f/0x1450 drivers/net/tun.c:1283
tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007fc6afc91c10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015
RBP: 00007fc6afc91a10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007fc6afc91b48 R14: 00000000004b6a07 R15: 0000000000000000
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20029. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20017. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.
syzbot will keep track of this bug report.
Once a fix for this bug is committed, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
To upstream this report, please reply with:
#syz upstream
syzkaller hit the following crash on
c97efd59aceb150e11f0f4bfe1cd5057df4f38f2
git://git.cmpxchg.org/linux-mmots.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
CC: [linux-...@vger.kernel.org mi...@redhat.com ros...@goodmis.org]
======================================================
WARNING: possible circular locking dependency detected
4.13.0-mm1+ #3 Not tainted
------------------------------------------------------
syz-executor2/3999 is trying to acquire lock:
(event_mutex){+.+.}, at: [<ffffffff8176757a>]
ftrace_profile_set_filter+0x7a/0x270 kernel/trace/trace_events_filter.c:2266
but task is already holding lock:
(&ctx->mutex){+.+.}, at: [<ffffffff8180943c>]
perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #8 (&ctx->mutex){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210
perf_event_ctx_lock kernel/events/core.c:1223 [inline]
perf_read+0xb9/0x970 kernel/events/core.c:4584
do_loop_readv_writev fs/read_write.c:670 [inline]
do_iter_read+0x3db/0x5b0 fs/read_write.c:894
vfs_readv+0x121/0x1c0 fs/read_write.c:956
kernel_readv fs/splice.c:361 [inline]
default_file_splice_read+0x508/0xae0 fs/splice.c:432
do_splice_to+0x110/0x170 fs/splice.c:896
do_splice fs/splice.c:1189 [inline]
SYSC_splice fs/splice.c:1418 [inline]
SyS_splice+0x11a8/0x1630 fs/splice.c:1398
entry_SYSCALL_64_fastpath+0x1f/0xbe
-> #7 (&pipe->mutex/1){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
pipe_lock_nested fs/pipe.c:66 [inline]
pipe_lock+0x56/0x70 fs/pipe.c:74
iter_file_splice_write+0x264/0xf50 fs/splice.c:715
do_splice_from fs/splice.c:867 [inline]
do_splice fs/splice.c:1163 [inline]
SYSC_splice fs/splice.c:1418 [inline]
SyS_splice+0x7d5/0x1630 fs/splice.c:1398
entry_SYSCALL_64_fastpath+0x1f/0xbe
-> #6 (sb_writers){.+.+}:
percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:35
[inline]
percpu_down_read include/linux/percpu-rwsem.h:58 [inline]
__sb_start_write+0x18f/0x290 fs/super.c:1340
sb_start_write include/linux/fs.h:1514 [inline]
mnt_want_write+0x3f/0xb0 fs/namespace.c:386
filename_create+0x12b/0x520 fs/namei.c:3629
kern_path_create+0x33/0x40 fs/namei.c:3675
handle_create+0xc0/0x760 drivers/base/devtmpfs.c:202
-> #5 ((complete)&req.done){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
complete_acquire include/linux/completion.h:39 [inline]
__wait_for_common kernel/sched/completion.c:108 [inline]
wait_for_common kernel/sched/completion.c:122 [inline]
wait_for_completion+0xc8/0x770 kernel/sched/completion.c:143
devtmpfs_create_node+0x32b/0x4a0 drivers/base/devtmpfs.c:114
device_add+0x120f/0x1640 drivers/base/core.c:1824
device_create_groups_vargs+0x1f3/0x250 drivers/base/core.c:2430
device_create_vargs drivers/base/core.c:2470 [inline]
device_create+0xda/0x110 drivers/base/core.c:2506
msr_device_create+0x26/0x40 arch/x86/kernel/msr.c:188
cpuhp_invoke_callback+0x256/0x14d0 kernel/cpu.c:145
cpuhp_thread_fun+0x265/0x520 kernel/cpu.c:434
smpboot_thread_fn+0x489/0x850 kernel/smpboot.c:164
kthread+0x39c/0x470 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
-> #4 (cpuhp_state){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
cpuhp_invoke_ap_callback kernel/cpu.c:467 [inline]
cpuhp_issue_call+0x1a2/0x3e0 kernel/cpu.c:1308
__cpuhp_setup_state_cpuslocked+0x2d6/0x5f0 kernel/cpu.c:1455
__cpuhp_setup_state+0xb0/0x140 kernel/cpu.c:1484
cpuhp_setup_state include/linux/cpuhotplug.h:177 [inline]
page_writeback_init+0x4d/0x71 mm/page-writeback.c:2082
pagecache_init+0x48/0x4f mm/filemap.c:871
start_kernel+0x6c1/0x754 init/main.c:690
x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:377
x86_64_start_kernel+0x87/0x8a arch/x86/kernel/head64.c:358
verify_cpu+0x0/0xfb
-> #3 (cpuhp_state_mutex){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
__cpuhp_setup_state_cpuslocked+0x5b/0x5f0 kernel/cpu.c:1430
__cpuhp_setup_state+0xb0/0x140 kernel/cpu.c:1484
cpuhp_setup_state_nocalls include/linux/cpuhotplug.h:205 [inline]
kvm_guest_init+0x1f3/0x20f arch/x86/kernel/kvm.c:488
setup_arch+0x1899/0x1ab3 arch/x86/kernel/setup.c:1294
start_kernel+0xa5/0x754 init/main.c:530
x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:377
x86_64_start_kernel+0x87/0x8a arch/x86/kernel/head64.c:358
verify_cpu+0x0/0xfb
-> #2 (cpu_hotplug_lock.rw_sem){++++}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:35
[inline]
percpu_down_read include/linux/percpu-rwsem.h:58 [inline]
cpus_read_lock+0x42/0x90 kernel/cpu.c:218
static_key_slow_inc+0x9d/0x3c0 kernel/jump_label.c:123
tracepoint_add_func kernel/tracepoint.c:223 [inline]
tracepoint_probe_register_prio+0x80d/0x9a0 kernel/tracepoint.c:283
tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304
trace_event_reg+0x167/0x320 kernel/trace/trace_events.c:305
perf_trace_event_reg kernel/trace/trace_event_perf.c:122 [inline]
perf_trace_event_init kernel/trace/trace_event_perf.c:197 [inline]
perf_trace_init+0x4f9/0xab0 kernel/trace/trace_event_perf.c:221
perf_tp_event_init+0x7d/0xf0 kernel/events/core.c:8037
perf_try_init_event+0xc9/0x1f0 kernel/events/core.c:9261
perf_init_event kernel/events/core.c:9299 [inline]
perf_event_alloc+0x1c5b/0x2a00 kernel/events/core.c:9558
SYSC_perf_event_open+0x84e/0x2e00 kernel/events/core.c:10013
SyS_perf_event_open+0x39/0x50 kernel/events/core.c:9899
entry_SYSCALL_64_fastpath+0x1f/0xbe
-> #1 (tracepoints_mutex){+.+.}:
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
tracepoint_probe_register_prio+0xa0/0x9a0 kernel/tracepoint.c:279
tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304
trace_event_reg+0x167/0x320 kernel/trace/trace_events.c:305
perf_trace_event_reg kernel/trace/trace_event_perf.c:122 [inline]
perf_trace_event_init kernel/trace/trace_event_perf.c:197 [inline]
perf_trace_init+0x4f9/0xab0 kernel/trace/trace_event_perf.c:221
perf_tp_event_init+0x7d/0xf0 kernel/events/core.c:8037
perf_try_init_event+0xc9/0x1f0 kernel/events/core.c:9261
perf_init_event kernel/events/core.c:9299 [inline]
perf_event_alloc+0x1c5b/0x2a00 kernel/events/core.c:9558
SYSC_perf_event_open+0x84e/0x2e00 kernel/events/core.c:10013
SyS_perf_event_open+0x39/0x50 kernel/events/core.c:9899
entry_SYSCALL_64_fastpath+0x1f/0xbe
-> #0 (event_mutex){+.+.}:
check_prev_add+0x865/0x1520 kernel/locking/lockdep.c:1894
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
ftrace_profile_set_filter+0x7a/0x270
kernel/trace/trace_events_filter.c:2266
perf_event_set_filter kernel/events/core.c:8622 [inline]
_perf_ioctl kernel/events/core.c:4785 [inline]
perf_ioctl+0x1026/0x1360 kernel/events/core.c:4822
vfs_ioctl fs/ioctl.c:45 [inline]
do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
SYSC_ioctl fs/ioctl.c:700 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
entry_SYSCALL_64_fastpath+0x1f/0xbe
other info that might help us debug this:
Chain exists of:
event_mutex --> &pipe->mutex/1 --> &ctx->mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ctx->mutex);
lock(&pipe->mutex/1);
lock(&ctx->mutex);
lock(event_mutex);
*** DEADLOCK ***
1 lock held by syz-executor2/3999:
#0: (&ctx->mutex){+.+.}, at: [<ffffffff8180943c>]
perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210
stack backtrace:
CPU: 1 PID: 3999 Comm: syz-executor2 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
print_circular_bug+0x503/0x710 kernel/locking/lockdep.c:1259
check_prev_add+0x865/0x1520 kernel/locking/lockdep.c:1894
check_prevs_add kernel/locking/lockdep.c:2020 [inline]
validate_chain kernel/locking/lockdep.c:2469 [inline]
__lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
ftrace_profile_set_filter+0x7a/0x270
kernel/trace/trace_events_filter.c:2266
perf_event_set_filter kernel/events/core.c:8622 [inline]
_perf_ioctl kernel/events/core.c:4785 [inline]
perf_ioctl+0x1026/0x1360 kernel/events/core.c:4822
vfs_ioctl fs/ioctl.c:45 [inline]
do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
SYSC_ioctl fs/ioctl.c:700 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x451e59
RSP: 002b:00007f92997edc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59
RDX: 0000000020368fc0 RSI: 0000000040082406 RDI: 0000000000000006
RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000
R13: 0000000000a6f7ef R14: 00007f92997ee9c0 R15: 0000000000000000
*** Guest State ***
CR0: actual=0x0000000080000031, shadow=0x0000000060000010,
gh_mask=fffffffffffffff7
CR4: actual=0x0000000000002051, shadow=0x0000000000000000,
gh_mask=ffffffffffffe871
CR3 = 0x00000000fffbc000
RSP = 0x000000000000fffa RIP = 0x0000000000000000
RFLAGS=0x00023000 DR7 = 0x0000000000000400
Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000
CS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
DS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
SS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
ES: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
FS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
GS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
GDTR: limit=0x0000ffff, base=0x0000000000000000
LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000
IDTR: limit=0x0000ffff, base=0x0000000000000000
TR: sel=0x0000, attr=0x0008b, limit=0x00002088, base=0x0000000000000000
EFER = 0x0000000000000000 PAT = 0x0007040600070406
DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000
Interruptibility = 00000000 ActivityState = 00000000
*** Host State ***
RIP = 0xffffffff811b8c6f RSP = 0xffff8801c807f4c8
CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040
FSBase=00007fae80c86700 GSBase=ffff8801db300000 TRBase=ffff8801db323100
GDTBase=ffffffffff576000 IDTBase=ffffffffff57b000
CR0=0000000080050033 CR3=00000001c4a04000 CR4=00000000001426e0
Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff84d41eb0
EFER = 0x0000000000000d01 PAT = 0x0000000000000000
*** Control State ***
PinBased=0000003f CPUBased=b6a1edfa SecondaryExec=00000043
EntryControls=0000d1ff ExitControls=0023efff
ExceptionBitmap=ffffbfff PFECmask=00000000 PFECmatch=00000000
VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000
VMExit: intr_info=00000000 errcode=00000000 ilen=00000000
reason=80000021 qualification=0000000000000000
IDTVectoring: info=00000000 errcode=00000000
TSC Offset = 0xffffffe675408abf
TPR Threshold = 0x00
EPT pointer = 0x00000001cacd801e
QAT: Invalid ioctl
audit: type=1326 audit(1504712915.573:2): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4000 comm="syz-executor0"
exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
RSP = 0x000000000000fffa RIP = 0x0000000000000000
RFLAGS=0x00023000 DR7 = 0x0000000000000400
Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000
CS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
DS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
SS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
ES: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
FS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
GS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000
GDTR: limit=0x0000ffff, base=0x0000000000000000
LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000
IDTR: limit=0x0000ffff, base=0x0000000000000000
TR: sel=0x0000, attr=0x0008b, limit=0x00002088, base=0x0000000000000000
EFER = 0x0000000000000000 PAT = 0x0007040600070406
DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000
Interruptibility = 00000000 ActivityState = 00000000
*** Host State ***
RIP = 0xffffffff811b8c6f RSP = 0xffff8801c46074c8
CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040
FSBase=00007fae80d0f700 GSBase=ffff8801db200000 TRBase=ffff8801db223100
GDTBase=ffffffffff577000 IDTBase=ffffffffff57b000
CR0=0000000080050033 CR3=00000001c4a04000 CR4=00000000001426f0
Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff84d41eb0
EFER = 0x0000000000000d01 PAT = 0x0000000000000000
*** Control State ***
PinBased=0000003f CPUBased=b6a1edfa SecondaryExec=00000043
EntryControls=0000d1ff ExitControls=0023efff
ExceptionBitmap=ffffbfff PFECmask=00000000 PFECmatch=00000000
VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000
VMExit: intr_info=00000000 errcode=00000000 ilen=00000000
reason=80000021 qualification=0000000000000000
IDTVectoring: info=00000000 errcode=00000000
TSC Offset = 0xffffffe68daa64fc
TPR Threshold = 0x00
EPT pointer = 0x00000001c419e01e
device lo left promiscuous mode
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
device lo entered promiscuous mode
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
device lo left promiscuous mode
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
sctp: [Deprecated]: syz-executor7 (pid 4203) Use of struct sctp_assoc_value
in delayed_ack socket option.
Use struct sctp_sack_info instead
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606
sclass=netlink_route_socket pig=4207 comm=syz-executor3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606
sclass=netlink_route_socket pig=4200 comm=syz-executor3
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
sctp: [Deprecated]: syz-executor7 (pid 4203) Use of int in maxseg socket
option.
Use struct sctp_assoc_value instead
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606
sclass=netlink_route_socket pig=4235 comm=syz-executor3
netlink: 6 bytes leftover after parsing attributes in process
`syz-executor2'.
netlink: 6 bytes leftover after parsing attributes in process
`syz-executor2'.
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606
sclass=netlink_route_socket pig=4248 comm=syz-executor3
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=29
sclass=netlink_tcpdiag_socket pig=4258 comm=syz-executor7
audit: type=1326 audit(1504712918.242:3): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4267 comm="syz-executor5"
exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=29
sclass=netlink_tcpdiag_socket pig=4275 comm=syz-executor7
audit: type=1326 audit(1504712918.318:4): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4267 comm="syz-executor5"
exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
TCP: request_sock_TCP: Possible SYN flooding on port 20012. Sending
cookies. Check SNMP counters.
audit: type=1326 audit(1504712919.273:5): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4489 comm="syz-executor2"
exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
audit: type=1326 audit(1504712919.346:6): auid=4294967295 uid=0 gid=0
ses=4294967295 subj=kernel pid=4489 comm="syz-executor2"
exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0
ip=0x451e59 code=0xffff0000
netlink: 5 bytes leftover after parsing attributes in process
`syz-executor3'.
netlink: 5 bytes leftover after parsing attributes in process
`syz-executor3'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 1 PID: 4619 Comm: syz-executor6 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_failslab+0xec/0x120 mm/failslab.c:31
slab_pre_alloc_hook mm/slab.h:422 [inline]
slab_alloc mm/slab.c:3383 [inline]
__do_kmalloc mm/slab.c:3723 [inline]
__kmalloc_track_caller+0x5f/0x760 mm/slab.c:3740
memdup_user+0x2c/0x90 mm/util.c:164
map_delete_elem kernel/bpf/syscall.c:623 [inline]
SYSC_bpf kernel/bpf/syscall.c:1471 [inline]
SyS_bpf+0x2186/0x4c50 kernel/bpf/syscall.c:1443
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x451e59
RSP: 002b:00007f10aa7a1c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59
RDX: 0000000000000010 RSI: 000000002096d000 RDI: 0000000000000003
RBP: 00007f10aa7a1a10 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b69f7
R13: 00007f10aa7a1b48 R14: 00000000004b6a07 R15: 0000000000000000
TCP: request_sock_TCPv6: Possible SYN flooding on port 20009. Sending
cookies. Check SNMP counters.
netlink: 8 bytes leftover after parsing attributes in process
`syz-executor5'.
netlink: 8 bytes leftover after parsing attributes in process
`syz-executor5'.
9pnet_virtio: no channels available for device ./bus
netlink: 1 bytes leftover after parsing attributes in process
`syz-executor3'.
9pnet_virtio: no channels available for device ./bus
netlink: 1 bytes leftover after parsing attributes in process
`syz-executor3'.
sock: process `syz-executor3' is using obsolete getsockopt SO_BSDCOMPAT
syz-executor2 (4872) used greatest stack depth: 14904 bytes left
rfkill: input handler disabled
rfkill: input handler enabled
TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20017. Sending
cookies. Check SNMP counters.
do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app
do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 1
CPU: 0 PID: 5176 Comm: syz-executor1 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_fail_alloc_page mm/page_alloc.c:2915 [inline]
prepare_alloc_pages mm/page_alloc.c:4151 [inline]
__alloc_pages_nodemask+0x338/0xd80 mm/page_alloc.c:4187
alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2035
alloc_pages include/linux/gfp.h:505 [inline]
skb_page_frag_refill+0x358/0x5f0 net/core/sock.c:2196
tun_build_skb.isra.42+0x13f/0x1450 drivers/net/tun.c:1283
tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007f845a55fc10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 0000000000000036 RSI: 0000000020002000 RDI: 0000000000000015
RBP: 00007f845a55fa10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007f845a55fb48 R14: 00000000004b6a07 R15: 0000000000000000
xprt_adjust_timeout: rq_timeout = 0!
xprt_adjust_timeout: rq_timeout = 0!
sctp: [Deprecated]: syz-executor7 (pid 5276) Use of int in maxseg socket
option.
Use struct sctp_assoc_value instead
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 5307 Comm: syz-executor4 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_fail_alloc_page mm/page_alloc.c:2915 [inline]
prepare_alloc_pages mm/page_alloc.c:4151 [inline]
__alloc_pages_nodemask+0x338/0xd80 mm/page_alloc.c:4187
alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2035
alloc_pages include/linux/gfp.h:505 [inline]
skb_page_frag_refill+0x358/0x5f0 net/core/sock.c:2196
tun_build_skb.isra.42+0x13f/0x1450 drivers/net/tun.c:1283
tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007fae80d0ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015
RBP: 00007fae80d0ea10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007fae80d0eb48 R14: 00000000004b6a07 R15: 0000000000000000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 5319 Comm: syz-executor4 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_failslab+0xec/0x120 mm/failslab.c:31
slab_pre_alloc_hook mm/slab.h:422 [inline]
slab_alloc mm/slab.c:3383 [inline]
kmem_cache_alloc+0x47/0x760 mm/slab.c:3559
__build_skb+0x9d/0x450 net/core/skbuff.c:284
build_skb+0x6f/0x260 net/core/skbuff.c:316
tun_build_skb.isra.42+0x692/0x1450 drivers/net/tun.c:1336
tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007fae80d0ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015
RBP: 00007fae80d0ea10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007fae80d0eb48 R14: 00000000004b6a07 R15: 0000000000000000
sctp: [Deprecated]: syz-executor7 (pid 5325) Use of int in maxseg socket
option.
Use struct sctp_assoc_value instead
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 5337 Comm: syz-executor4 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_failslab+0xec/0x120 mm/failslab.c:31
slab_pre_alloc_hook mm/slab.h:422 [inline]
slab_alloc mm/slab.c:3383 [inline]
kmem_cache_alloc+0x47/0x760 mm/slab.c:3559
reqsk_alloc include/net/request_sock.h:88 [inline]
inet_reqsk_alloc+0xad/0x570 net/ipv4/tcp_input.c:6192
tcp_conn_request+0x657/0x3410 net/ipv4/tcp_input.c:6291
tcp_v6_conn_request+0x212/0x270 net/ipv6/tcp_ipv6.c:1015
tcp_rcv_state_process+0x8ff/0x4d10 net/ipv4/tcp_input.c:5878
tcp_v6_do_rcv+0x739/0x11b0 net/ipv6/tcp_ipv6.c:1325
tcp_v6_rcv+0x1f92/0x27f0 net/ipv6/tcp_ipv6.c:1502
ip6_input_finish+0x36f/0x16d0 net/ipv6/ip6_input.c:284
NF_HOOK include/linux/netfilter.h:249 [inline]
ip6_input+0xe9/0x560 net/ipv6/ip6_input.c:327
dst_input include/net/dst.h:478 [inline]
ip6_rcv_finish+0x1a9/0x7a0 net/ipv6/ip6_input.c:71
NF_HOOK include/linux/netfilter.h:249 [inline]
ipv6_rcv+0xff0/0x2190 net/ipv6/ip6_input.c:208
__netif_receive_skb_core+0x19af/0x33d0 net/core/dev.c:4418
__netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4456
netif_receive_skb_internal+0x10b/0x5e0 net/core/dev.c:4527
netif_receive_skb+0xae/0x390 net/core/dev.c:4551
tun_rx_batched.isra.43+0x5ed/0x860 drivers/net/tun.c:1218
tun_get_user+0x11dd/0x2150 drivers/net/tun.c:1539
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007fae80d0ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015
RBP: 00007fae80d0ea10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007fae80d0eb48 R14: 00000000004b6a07 R15: 0000000000000000
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: tcp_parse_options: Illegal window scaling value 64 > 14 received
netlink: 5 bytes leftover after parsing attributes in process
`syz-executor3'.
TCP: tcp_parse_options: Illegal window scaling value 64 > 14 received
netlink: 5 bytes leftover after parsing attributes in process
`syz-executor3'.
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 5608 Comm: syz-executor5 Not tainted 4.13.0-mm1+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
fail_dump lib/fault-inject.c:51 [inline]
should_fail+0x8c0/0xa40 lib/fault-inject.c:149
should_fail_alloc_page mm/page_alloc.c:2915 [inline]
prepare_alloc_pages mm/page_alloc.c:4151 [inline]
__alloc_pages_nodemask+0x338/0xd80 mm/page_alloc.c:4187
alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2035
alloc_pages include/linux/gfp.h:505 [inline]
skb_page_frag_refill+0x358/0x5f0 net/core/sock.c:2196
tun_build_skb.isra.42+0x13f/0x1450 drivers/net/tun.c:1283
tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441
tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565
call_write_iter include/linux/fs.h:1744 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x68a/0x970 fs/read_write.c:470
vfs_write+0x18f/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x40c2c1
RSP: 002b:00007fc6afc91c10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1
RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015
RBP: 00007fc6afc91a10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7
R13: 00007fc6afc91b48 R14: 00000000004b6a07 R15: 0000000000000000
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20029. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20017. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending
cookies. Check SNMP counters.
---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.
syzbot will keep track of this bug report.
Once a fix for this bug is committed, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
To upstream this report, please reply with:
#syz upstream
Dmitry Vyukov
Oct 30, 2017, 3:48:52 PM10/30/17
to syzbot, 'Dmitry Vyukov' via syzkaller-upstream-moderation
debug with 8 mutex in the cycle?...
Happened only 2 times in september, at least we need a new report
#syz invalid
On Mon, Oct 30, 2017 at 10:36 PM, syzbot
<bot+157d0a1a9b300d40d1...@syzkaller.appspotmail.com>
wrote:
> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-upstream-m...@googlegroups.com.
> To post to this group, send email to
> syzkaller-upst...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-upstream-moderation/001a114498f620e045055cc8c038%40google.com.
> For more options, visit https://groups.google.com/d/optout.
Happened only 2 times in september, at least we need a new report
#syz invalid
On Mon, Oct 30, 2017 at 10:36 PM, syzbot
<bot+157d0a1a9b300d40d1...@syzkaller.appspotmail.com>
wrote:
> You received this message because you are subscribed to the Google Groups
> "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-upstream-m...@googlegroups.com.
> To post to this group, send email to
> syzkaller-upst...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-upstream-moderation/001a114498f620e045055cc8c038%40google.com.
> For more options, visit https://groups.google.com/d/optout.
Reply all
Reply to author
Forward
0 new messages