syzbot


BUG: soft lockup in umount_tree

Status: public: reported C repro on 2019/04/14 08:51
Reported-by: syzbot+1c79153afd6507ceb39d@syzkaller.appspotmail.com
First crash: 2326d, last: 2326d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 BUG: soft lockup in umount_tree 3 2318d 2334d 0/2 auto-closed as invalid on 2019/02/22 13:39

Sample crash report:
random: crng init done
NMI watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz-executor694:3996]
Modules linked in:
irq event stamp: 933704
hardirqs last  enabled at (933703): [<ffffffff839f9669>] restore_regs_and_iret+0x0/0x1d
hardirqs last disabled at (933704): [<ffffffff839fa62b>] apic_timer_interrupt+0x9b/0xb0 arch/x86/entry/entry_64.S:648
softirqs last  enabled at (921172): [<ffffffff839ffb1c>] __do_softirq+0x46c/0x937 kernel/softirq.c:310
softirqs last disabled at (921163): [<ffffffff8114b237>] invoke_softirq kernel/softirq.c:364 [inline]
softirqs last disabled at (921163): [<ffffffff8114b237>] irq_exit+0x147/0x190 kernel/softirq.c:405
CPU: 1 PID: 3996 Comm: syz-executor694 Not tainted 4.9.111-g03c70fe #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d8ac3000 task.stack: ffff8801b70a0000
RIP: 0010:[<ffffffff8160fc09>]  [<ffffffff8160fc09>] do_make_slave fs/pnode.c:84 [inline]
RIP: 0010:[<ffffffff8160fc09>]  [<ffffffff8160fc09>] change_mnt_propagation+0xa9/0xbd0 fs/pnode.c:130
RSP: 0018:ffff8801b70a7af0  EFLAGS: 00000246
RAX: ffff8801d8ac3000 RBX: ffff8801cda6e400 RCX: ffff8801cda6e468
RDX: 1ffff1003723a2c4 RSI: ffffffff8160fbe8 RDI: ffff8801b91d1620
RBP: ffff8801b70a7b50 R08: ffff8801cda6e468 R09: 0000000000000001
R10: 0000000000000000 R11: 1ffff1003b15872c R12: dffffc0000000000
R13: ffff8801b91d1600 R14: ffff8801d9c47340 R15: ffffed0039b4dc84
FS:  0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:00000000f7667b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f76cadb0 CR3: 00000001ca4fa000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801b70a7b20 ffffffff815db8af 0000000000000000 ffff8801cda6e4f0
 ffff8801cda6e420 ffff8801cda6e4e0 00040000b70a7b50 ffff8801cda6e490
 dffffc0000000000 ffff8801cda6e400 ffff8801d9c469a0 ffff8801b70a7bf0
Call Trace:
 [<ffffffff815dbfd6>] umount_tree+0x326/0x820 fs/namespace.c:1516
 [<ffffffff815e41e0>] attach_recursive_mnt+0x750/0x8f0 fs/namespace.c:2058
 [<ffffffff815e44ef>] graft_tree+0x16f/0x1f0 fs/namespace.c:2122
 [<ffffffff815e6eaf>] do_loopback fs/namespace.c:2243 [inline]
 [<ffffffff815e6eaf>] do_mount+0x1f5f/0x2740 fs/namespace.c:2829
 [<ffffffff8168c3ec>] C_SYSC_mount fs/compat.c:810 [inline]
 [<ffffffff8168c3ec>] compat_SyS_mount+0x4fc/0xff0 fs/compat.c:775
 [<ffffffff81006da7>] do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 [<ffffffff81006da7>] do_fast_syscall_32+0x2f7/0x870 arch/x86/entry/common.c:387
 [<ffffffff839fa3d0>] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137
Code: 4d 01 e7 eb 36 e8 28 ee d4 ff 49 8d 7d 20 48 89 fa 48 c1 ea 03 42 80 3c 22 00 0f 85 d7 08 00 00 41 80 3f 00 4d 8b b6 70 ff ff ff <0f> 85 b8 08 00 00 4c 3b 73 20 0f 84 1e 02 00 00 e8 f2 ed d4 ff 
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1 Comm: init Not tainted 4.9.111-g03c70fe #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d99b0000 task.stack: ffff8801d99b8000
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] rep_nop arch/x86/include/asm/processor.h:582 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] cpu_relax arch/x86/include/asm/processor.h:587 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] __read_seqcount_begin include/linux/seqlock.h:114 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] raw_read_seqcount_begin include/linux/seqlock.h:147 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] read_seqcount_begin include/linux/seqlock.h:164 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] read_seqbegin include/linux/seqlock.h:433 [inline]
RIP: 0010:[<ffffffff815a066b>] c [<ffffffff815a066b>] path_init+0x104b/0x1580 fs/namei.c:2189
RSP: 0018:ffff8801d99bfab0  EFLAGS: 00000293
RAX: ffff8801d99b0000 RBX: ffff8801d99bfbe0 RCX: 1ffffffff08c1bc8
RDX: 0000000000000000 RSI: ffffffff815a0669 RDI: 0000000000000246
RBP: ffff8801d99bfb48 R08: ffff8801d99b08e8 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff08c1bc8
R13: ffff8801d5ea331c R14: 0000000000000041 R15: ffffffff8460de40
FS:  00007f19913a77a0(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f7667db0 CR3: 00000001cd40c000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff815a3abac 0000000000000046c 0000000000000000c ffffffff81f1ccccc
 ffff8801d99b08c0c ffff8801d99b08c8c 0000000000000046c ffffffff843c3108c
 ffffffff81f1ceddc 0000000300000002c 0000000000000046c 0000000000000092c
Call Trace:
 [<ffffffff815a3aba>] path_lookupat.isra.41+0x2a/0x410 fs/namei.c:2277
 [<ffffffff815a96c7>] filename_lookup.part.55+0x177/0x370 fs/namei.c:2317
 [<ffffffff815a9a83>] filename_lookup fs/namei.c:2310 [inline]
 [<ffffffff815a9a83>] user_path_at_empty+0x53/0x70 fs/namei.c:2578
 [<ffffffff81580a66>] user_path_at include/linux/namei.h:55 [inline]
 [<ffffffff81580a66>] vfs_fstatat+0xc6/0x170 fs/stat.c:106
 [<ffffffff81581c16>] vfs_stat fs/stat.c:123 [inline]
 [<ffffffff81581c16>] SYSC_newstat+0x86/0xf0 fs/stat.c:270
 [<ffffffff8158201d>] SyS_newstat+0x1d/0x30 fs/stat.c:266
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f8cd3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: cf6 cc2 c01 c75 cda c41 c89 cd5 ce9 c21 cfa cff cff c48 cba c00 c00 c00 c00 c00 cfc cff cdf c49 c89 cc4 c49 c89 cc7 c49 cc1 cec c03 c49 c01 cd4 ce8 ca7 ce3 cdb cff cf3 c90 c<41> c0f cb6 c14 c24 c84 cd2 c74 c09 c80 cfa c03 c0f c8e c4c c04 c00 c00 c41 c8b c07 c

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/10 16:26 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 9fa03fa5 .config console log report syz C ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.