WARNING: suspicious RCU usage in line6_pcm

WARNING: suspicious RCU usage in line6_pcm_acquire
Status: closed as dup on 2019/07/10 15:26
Reported-by: syzbot+06b7a5a8c4acc0445995@syzkaller.appspotmail.com
First crash: 999d, last: 967d

Duplicate of (1):
Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported
BUG: sleeping function called from invalid context in line6_pcm_acquire				119	967d	985d

Sample crash report:

=============================
WARNING: suspicious RCU usage
5.1.0-rc3+ #8 Not tainted
-----------------------------
include/linux/rcupdate.h:267 Illegal context switch in RCU read-side critical section!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
2 locks held by udevd/4554:
 #0: 0000000093355fd7 (rcu_read_lock){....}, at: __d_lookup+0x40/0x750 fs/dcache.c:2267
 #1: 000000005491ac79 ((&toneport->timer)){+.-.}, at: lockdep_copy_map include/linux/lockdep.h:170 [inline]
 #1: 000000005491ac79 ((&toneport->timer)){+.-.}, at: call_timer_fn+0xc9/0x5e0 kernel/time/timer.c:1315

stack backtrace:
CPU: 1 PID: 4554 Comm: udevd Not tainted 5.1.0-rc3+ #8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 rcu_preempt_sleep_check include/linux/rcupdate.h:267 [inline]
 rcu_preempt_sleep_check include/linux/rcupdate.h:265 [inline]
 ___might_sleep+0x1ac/0x270 kernel/sched/core.c:6155
 __mutex_lock_common kernel/locking/mutex.c:908 [inline]
 __mutex_lock+0xc8/0x12b0 kernel/locking/mutex.c:1072
 line6_pcm_acquire+0x30/0x210 sound/usb/line6/pcm.c:311
 call_timer_fn+0x15c/0x5e0 kernel/time/timer.c:1325
 expire_timers kernel/time/timer.c:1362 [inline]
 __run_timers kernel/time/timer.c:1681 [inline]
 __run_timers kernel/time/timer.c:1649 [inline]
 run_timer_softirq+0x586/0x1400 kernel/time/timer.c:1694
 __do_softirq+0x21f/0x8bc kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:374 [inline]
 irq_exit+0x17c/0x1a0 kernel/softirq.c:414
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xf1/0x490 arch/x86/kernel/apic/apic.c:1062
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
 </IRQ>
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:140 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x50 kernel/kcov.c:174
Code: 07 41 bc f4 ff ff ff e8 ca 41 eb ff 48 c7 05 26 b6 ea 07 00 00 00 00 e9 0b ec ff ff 90 48 8b 34 24 65 48 8b 04 25 c0 de 01 00 <65> 8b 15 dc 75 c5 7e 81 e2 00 01 1f 00 75 2b 8b 90 10 12 00 00 83
RSP: 0018:ffff8881cef4f718 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff13
RAX: ffff8881c58ec800 RBX: 0000000000000001 RCX: ffffffff816bad17
RDX: 0000000000000000 RSI: ffffffff816bac57 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffff8881c58ec800 R09: ffffed103b665738
R10: ffffed103b665737 R11: ffff8881db32b9bb R12: 0000000000000001
R13: 312d343a00312d31 R14: 000000009cdece30 R15: ffff8881cfa53ec0
 rcu_lock_release include/linux/rcupdate.h:215 [inline]
 rcu_read_unlock include/linux/rcupdate.h:649 [inline]
 __d_lookup+0x417/0x750 fs/dcache.c:2316
 lookup_fast+0x3ca/0x1100 fs/namei.c:1615
 walk_component+0xe3/0x1bc0 fs/namei.c:1804
 link_path_walk.part.0+0x902/0x1220 fs/namei.c:2139
 link_path_walk fs/namei.c:2267 [inline]
 path_lookupat.isra.0+0xe3/0x8d0 fs/namei.c:2315
 filename_lookup+0x1b0/0x410 fs/namei.c:2346
 user_path_at include/linux/namei.h:60 [inline]
 vfs_statx+0x113/0x1e0 fs/stat.c:187
 vfs_stat include/linux/fs.h:3177 [inline]
 __do_sys_newstat+0x96/0x120 fs/stat.c:341
 do_syscall_64+0xbd/0x500 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f9d31097c65
Code: 00 00 00 e8 5d 01 00 00 48 83 c4 18 c3 90 90 90 90 90 90 90 90 83 ff 01 48 89 f0 77 18 48 89 c7 48 89 d6 b8 04 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 17 f3 c3 90 48 8b 05 a1 51 2b 00 64 c7 00 16
RSP: 002b:00007ffc158dddf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 00000000010dd250 RCX: 00007f9d31097c65
RDX: 00007ffc158dde10 RSI: 00007ffc158dde10 RDI: 00007ffc158de2a0
RBP: 00000000010ee9f0 R08: 000000000041f4f1 R09: 00007f9d310ee7d0
R10: 303a312d312f312d R11: 0000000000000246 R12: 0000000000000004
R13: 00000000010ee9f7 R14: 00000000010dd250 R15: 000000000000000b
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908
in_atomic(): 1, irqs_disabled(): 0, pid: 4554, name: udevd
2 locks held by udevd/4554:
 #0: 0000000093355fd7 (rcu_read_lock){....}, at: __d_lookup+0x40/0x750 fs/dcache.c:2267
 #1: 000000005491ac79 ((&toneport->timer)){+.-.}, at: lockdep_copy_map include/linux/lockdep.h:170 [inline]
 #1: 000000005491ac79 ((&toneport->timer)){+.-.}, at: call_timer_fn+0xc9/0x5e0 kernel/time/timer.c:1315
CPU: 1 PID: 4554 Comm: udevd Not tainted 5.1.0-rc3+ #8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 ___might_sleep.cold+0x10f/0x129 kernel/sched/core.c:6190
 __mutex_lock_common kernel/locking/mutex.c:908 [inline]
 __mutex_lock+0xc8/0x12b0 kernel/locking/mutex.c:1072
 line6_pcm_acquire+0x30/0x210 sound/usb/line6/pcm.c:311
 call_timer_fn+0x15c/0x5e0 kernel/time/timer.c:1325
 expire_timers kernel/time/timer.c:1362 [inline]
 __run_timers kernel/time/timer.c:1681 [inline]
 __run_timers kernel/time/timer.c:1649 [inline]
 run_timer_softirq+0x586/0x1400 kernel/time/timer.c:1694
 __do_softirq+0x21f/0x8bc kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:374 [inline]
 irq_exit+0x17c/0x1a0 kernel/softirq.c:414
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xf1/0x490 arch/x86/kernel/apic/apic.c:1062
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
 </IRQ>
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:140 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x50 kernel/kcov.c:174
Code: 07 41 bc f4 ff ff ff e8 ca 41 eb ff 48 c7 05 26 b6 ea 07 00 00 00 00 e9 0b ec ff ff 90 48 8b 34 24 65 48 8b 04 25 c0 de 01 00 <65> 8b 15 dc 75 c5 7e 81 e2 00 01 1f 00 75 2b 8b 90 10 12 00 00 83
RSP: 0018:ffff8881cef4f718 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff13
RAX: ffff8881c58ec800 RBX: 0000000000000001 RCX: ffffffff816bad17
RDX: 0000000000000000 RSI: ffffffff816bac57 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffff8881c58ec800 R09: ffffed103b665738
R10: ffffed103b665737 R11: ffff8881db32b9bb R12: 0000000000000001
R13: 312d343a00312d31 R14: 000000009cdece30 R15: ffff8881cfa53ec0
 rcu_lock_release include/linux/rcupdate.h:215 [inline]
 rcu_read_unlock include/linux/rcupdate.h:649 [inline]
 __d_lookup+0x417/0x750 fs/dcache.c:2316
 lookup_fast+0x3ca/0x1100 fs/namei.c:1615
 walk_component+0xe3/0x1bc0 fs/namei.c:1804
 link_path_walk.part.0+0x902/0x1220 fs/namei.c:2139
 link_path_walk fs/namei.c:2267 [inline]
 path_lookupat.isra.0+0xe3/0x8d0 fs/namei.c:2315
 filename_lookup+0x1b0/0x410 fs/namei.c:2346
 user_path_at include/linux/namei.h:60 [inline]
 vfs_statx+0x113/0x1e0 fs/stat.c:187
 vfs_stat include/linux/fs.h:3177 [inline]
 __do_sys_newstat+0x96/0x120 fs/stat.c:341
 do_syscall_64+0xbd/0x500 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f9d31097c65
Code: 00 00 00 e8 5d 01 00 00 48 83 c4 18 c3 90 90 90 90 90 90 90 90 83 ff 01 48 89 f0 77 18 48 89 c7 48 89 d6 b8 04 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 17 f3 c3 90 48 8b 05 a1 51 2b 00 64 c7 00 16
RSP: 002b:00007ffc158dddf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 00000000010dd250 RCX: 00007f9d31097c65
RDX: 00007ffc158dde10 RSI: 00007ffc158dde10 RDI: 00007ffc158de2a0
RBP: 00000000010ee9f0 R08: 000000000041f4f1 R09: 00007f9d310ee7d0
R10: 303a312d312f312d R11: 0000000000000246 R12: 0000000000000004
R13: 00000000010ee9f7 R14: 00000000010dd250 R15: 000000000000000b
==================================================================
BUG: KASAN: null-ptr-deref in memset include/linux/string.h:337 [inline]
BUG: KASAN: null-ptr-deref in submit_audio_out_urb+0x919/0x1780 sound/usb/line6/playback.c:246
Write of size 176 at addr 0000000000000010 by task udevd/4554

CPU: 1 PID: 4554 Comm: udevd Tainted: G        W         5.1.0-rc3+ #8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 kasan_report.cold+0x5/0x35 mm/kasan/report.c:321
 memset+0x20/0x40 mm/kasan/common.c:115
 memset include/linux/string.h:337 [inline]
 submit_audio_out_urb+0x919/0x1780 sound/usb/line6/playback.c:246
 line6_submit_audio_out_all_urbs+0xc9/0x120 sound/usb/line6/playback.c:295
 line6_stream_start+0x156/0x1f0 sound/usb/line6/pcm.c:199
 line6_pcm_acquire+0x134/0x210 sound/usb/line6/pcm.c:322
 call_timer_fn+0x15c/0x5e0 kernel/time/timer.c:1325
 expire_timers kernel/time/timer.c:1362 [inline]
 __run_timers kernel/time/timer.c:1681 [inline]
 __run_timers kernel/time/timer.c:1649 [inline]
 run_timer_softirq+0x586/0x1400 kernel/time/timer.c:1694
 __do_softirq+0x21f/0x8bc kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:374 [inline]
 irq_exit+0x17c/0x1a0 kernel/softirq.c:414
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xf1/0x490 arch/x86/kernel/apic/apic.c:1062
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
 </IRQ>
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:140 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x50 kernel/kcov.c:174
Code: 07 41 bc f4 ff ff ff e8 ca 41 eb ff 48 c7 05 26 b6 ea 07 00 00 00 00 e9 0b ec ff ff 90 48 8b 34 24 65 48 8b 04 25 c0 de 01 00 <65> 8b 15 dc 75 c5 7e 81 e2 00 01 1f 00 75 2b 8b 90 10 12 00 00 83
RSP: 0018:ffff8881cef4f718 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff13
RAX: ffff8881c58ec800 RBX: 0000000000000001 RCX: ffffffff816bad17
RDX: 0000000000000000 RSI: ffffffff816bac57 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffff8881c58ec800 R09: ffffed103b665738
R10: ffffed103b665737 R11: ffff8881db32b9bb R12: 0000000000000001
R13: 312d343a00312d31 R14: 000000009cdece30 R15: ffff8881cfa53ec0
 rcu_lock_release include/linux/rcupdate.h:215 [inline]
 rcu_read_unlock include/linux/rcupdate.h:649 [inline]
 __d_lookup+0x417/0x750 fs/dcache.c:2316
 lookup_fast+0x3ca/0x1100 fs/namei.c:1615
 walk_component+0xe3/0x1bc0 fs/namei.c:1804
 link_path_walk.part.0+0x902/0x1220 fs/namei.c:2139
 link_path_walk fs/namei.c:2267 [inline]
 path_lookupat.isra.0+0xe3/0x8d0 fs/namei.c:2315
 filename_lookup+0x1b0/0x410 fs/namei.c:2346
 user_path_at include/linux/namei.h:60 [inline]
 vfs_statx+0x113/0x1e0 fs/stat.c:187
 vfs_stat include/linux/fs.h:3177 [inline]
 __do_sys_newstat+0x96/0x120 fs/stat.c:341
 do_syscall_64+0xbd/0x500 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f9d31097c65
Code: 00 00 00 e8 5d 01 00 00 48 83 c4 18 c3 90 90 90 90 90 90 90 90 83 ff 01 48 89 f0 77 18 48 89 c7 48 89 d6 b8 04 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 17 f3 c3 90 48 8b 05 a1 51 2b 00 64 c7 00 16
RSP: 002b:00007ffc158dddf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 00000000010dd250 RCX: 00007f9d31097c65
RDX: 00007ffc158dde10 RSI: 00007ffc158dde10 RDI: 00007ffc158de2a0
RBP: 00000000010ee9f0 R08: 000000000041f4f1 R09: 00007f9d310ee7d0
R10: 303a312d312f312d R11: 0000000000000246 R12: 0000000000000004
R13: 00000000010ee9f7 R14: 00000000010dd250 R15: 000000000000000b
==================================================================

Crashes (13):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report
ci2-upstream-usb	2019/05/26 16:24	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	85c57315	.config	log	report
ci2-upstream-usb	2019/05/19 01:43	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	5a4461b0	.config	log	report
ci2-upstream-usb	2019/05/06 13:02	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	d28f4ce5	.config	log	report
ci2-upstream-usb	2019/05/06 00:24	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	d28f4ce5	.config	log	report
ci2-upstream-usb	2019/05/05 02:40	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	d28f4ce5	.config	log	report
ci2-upstream-usb	2019/05/02 20:09	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	e9039493	.config	log	report
ci2-upstream-usb	2019/05/02 01:03	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	7516d9fa	.config	log	report
ci2-upstream-usb	2019/05/01 13:32	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	618456b4	.config	log	report
ci2-upstream-usb	2019/04/28 17:42	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	b617407b	.config	log	report
ci2-upstream-usb	2019/04/26 10:53	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	b617407b	.config	log	report
ci2-upstream-usb	2019/04/26 09:27	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	b617407b	.config	log	report
ci2-upstream-usb	2019/04/25 16:26	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	f46aabc8	.config	log	report
ci2-upstream-usb	2019/04/25 07:46	https://github.com/google/kasan.git usb-fuzzer	43151d6c3fce	8e3c52b1	.config	log	report