syzbot


BUG: Bad rss-counter state (2)

Status: closed as invalid on 2018/02/01 12:07
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+d2c94208601929b6824360ec48c406c5afd72478@syzkaller.appspotmail.com
First crash: 2385d, last: 2379d
Similar bugs (9)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: Bad rss-counter state syz 20 2466d 2429d 0/27 closed as invalid on 2017/10/31 09:42
linux-4.19 BUG: Bad rss-counter state C error 18 999d 1544d 0/1 upstream: reported C repro on 2020/04/03 02:55
upstream BUG: Bad rss-counter state (4) C done unreliable 124 408d 1499d 0/27 auto-obsoleted due to no activity on 2023/08/23 09:04
linux-4.14 BUG: Bad rss-counter state (2) 4 1200d 1297d 0/1 auto-closed as invalid on 2021/07/10 23:34
linux-4.14 BUG: Bad rss-counter state 1 1656d 1656d 0/1 auto-closed as invalid on 2020/04/11 05:38
upstream BUG: Bad rss-counter state (5) C done 760 13m 43d 0/27 upstream: reported C repro on 2024/05/13 10:19
upstream BUG: Bad rss-counter state (3) C unreliable done 438 1793d 2259d 15/27 fixed on 2020/01/31 18:49
android-54 BUG: Bad rss-counter state C 5 6d01h 1506d 0/2 upstream: reported C repro on 2020/05/11 02:06
android-49 BUG: Bad rss-counter state 11325 1665d 1899d 0/3 auto-closed as invalid on 2020/03/03 11:04

Sample crash report:
BUG: Bad rss-counter state mm:0000000090a3b05f idx:0 val:10
audit: type=1326 audit(1513752497.392:467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7613 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a09 code=0x7ffc0000
audit: type=1326 audit(1513752497.407:468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7613 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=9 compat=0 ip=0x452a09 code=0x7ffc0000
audit: type=1326 audit(1513752497.407:469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7613 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a09 code=0x7ffc0000
audit: type=1326 audit(1513752497.410:470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7613 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=9 compat=0 ip=0x452a09 code=0x7ffc0000
audit: type=1326 audit(1513752497.410:471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7613 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a09 code=0x7ffc0000
audit: type=1326 audit(1513752497.410:472): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7613 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=9 compat=0 ip=0x452a09 code=0x7ffc0000
audit: type=1326 audit(1513752497.410:473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7613 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a09 code=0x7ffc0000
audit: type=1326 audit(1513752497.411:474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7613 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=257 compat=0 ip=0x452a09 code=0x7ffc0000
nla_parse: 11 callbacks suppressed
netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'.
BUG: Bad rss-counter state mm:00000000ea97c3c2 idx:0 val:10
netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'.
binder: 7718:7722 ioctl 40046205 0 returned -22
binder: 7718:7726 ioctl 40046205 0 returned -22
QAT: Invalid ioctl
QAT: Invalid ioctl
: renamed from sit0
device  entered promiscuous mode
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pig=7767 comm=syz-executor7
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pig=7801 comm=syz-executor2
Kernel panic - not syncing: corrupted stack end detected inside scheduler

CPU: 1 PID: 7846 Comm: syz-executor3 Not tainted 4.15.0-rc3-next-20171214+ #67
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xe9/0x14b lib/dump_stack.c:53
 panic+0x10e/0x2f8 kernel/panic.c:183
 schedule_debug kernel/sched/core.c:3191 [inline]
 __schedule+0xa85/0xaf0 kernel/sched/core.c:3300
 schedule+0x2e/0x90 kernel/sched/core.c:3435
 freezable_schedule include/linux/freezer.h:172 [inline]
 futex_wait_queue_me+0xe9/0x1a0 kernel/futex.c:2476
 futex_wait+0x11f/0x2a0 kernel/futex.c:2591
 do_futex+0x5a0/0xe80 kernel/futex.c:3473
 SYSC_futex kernel/futex.c:3533 [inline]
 SyS_futex+0x159/0x1e0 kernel/futex.c:3501
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x452a09
RSP: 002b:00007f91e55d2ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 000000000071bf58 RCX: 0000000000452a09
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000071bf80
RBP: 0000000000000384 R08: 0000000000000424 R09: 000000000071bf58
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006f2500
R13: 00000000ffffffff R14: 00007f91e55d36d4 R15: 0000000000000003
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/20 06:48 linux-next 6084b576dca2 2d836b1d .config console log report ci-upstream-next-kasan-gce
2017/12/20 01:55 linux-next 6084b576dca2 2d836b1d .config console log report ci-upstream-next-kasan-gce
2017/12/19 21:08 linux-next 6084b576dca2 af9163c7 .config console log report ci-upstream-next-kasan-gce
2017/12/19 14:59 linux-next 6084b576dca2 af9163c7 .config console log report ci-upstream-next-kasan-gce
2017/12/19 09:36 linux-next 6084b576dca2 1c4160ef .config console log report ci-upstream-next-kasan-gce
2017/12/18 22:19 linux-next 6084b576dca2 1c4160ef .config console log report ci-upstream-next-kasan-gce
2017/12/15 18:37 linux-next 6084b576dca2 ac20b98c .config console log report ci-upstream-next-kasan-gce
2017/12/15 01:35 linux-next 6084b576dca2 ac20b98c .config console log report ci-upstream-next-kasan-gce
2017/12/15 01:25 linux-next 6084b576dca2 ac20b98c .config console log report ci-upstream-next-kasan-gce
2017/12/14 11:38 linux-next 6084b576dca2 ac20b98c .config console log report ci-upstream-next-kasan-gce
2017/12/14 09:35 linux-next 6084b576dca2 ac20b98c .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.