syzbot


inconsistent lock state in free_huge_page

Status: upstream: reported C repro on 2021/01/03 08:22
Reported-by: syzbot+2bd7d01eead6a479fd4f@syzkaller.appspotmail.com
First crash: 1448d, last: 1178d
Fix bisection: failed (error log, bisect log)
  
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 inconsistent lock state in free_huge_page C error 3 1022d 1461d 0/1 upstream: reported C repro on 2020/12/21 08:05
Fix bisection attempts (7)
Created Duration User Patch Repo Result
2021/10/30 10:43 10m bisect fix linux-4.19.y error job log
2021/09/29 19:49 30m bisect fix linux-4.19.y OK (0) job log log
2021/08/30 19:14 34m bisect fix linux-4.19.y OK (0) job log log
2021/07/31 18:46 28m bisect fix linux-4.19.y OK (0) job log log
2021/07/01 18:19 25m bisect fix linux-4.19.y OK (0) job log log
2021/06/01 17:49 30m bisect fix linux-4.19.y OK (0) job log log
2021/02/24 19:20 26m bisect fix linux-4.19.y OK (0) job log log

Sample crash report:
================================
WARNING: inconsistent lock state
4.19.189-syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/1/18 [HC0[0]:SC1[1]:HE1:SE0] takes:
00000000a0359bbe (hugetlb_lock){+.?.}, at: spin_lock include/linux/spinlock.h:329 [inline]
00000000a0359bbe (hugetlb_lock){+.?.}, at: free_huge_page+0x482/0xd20 mm/hugetlb.c:1294
{SOFTIRQ-ON-W} state was registered at:
  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144
  spin_lock include/linux/spinlock.h:329 [inline]
  hugetlb_overcommit_handler+0x2d4/0x460 mm/hugetlb.c:3041
  proc_sys_call_handler.isra.0+0x1f3/0x3b0 fs/proc/proc_sysctl.c:597
  __vfs_write+0xf7/0x770 fs/read_write.c:485
  vfs_write+0x1f3/0x540 fs/read_write.c:549
  ksys_write+0x12b/0x2a0 fs/read_write.c:599
  do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
irq event stamp: 382126
hardirqs last  enabled at (382126): [<ffffffff81003ce4>] trace_hardirqs_on_thunk+0x1a/0x1c
hardirqs last disabled at (382125): [<ffffffff81003d00>] trace_hardirqs_off_thunk+0x1a/0x1c
softirqs last  enabled at (382088): [<ffffffff88400678>] __do_softirq+0x678/0x980 kernel/softirq.c:318
softirqs last disabled at (382093): [<ffffffff81392317>] run_ksoftirqd+0x57/0x110 kernel/softirq.c:653

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(hugetlb_lock);
  <Interrupt>
    lock(hugetlb_lock);

 *** DEADLOCK ***

3 locks held by ksoftirqd/1/18:
 #0: 000000002febf790 (rcu_read_lock){....}, at: __write_once_size include/linux/compiler.h:288 [inline]
 #0: 000000002febf790 (rcu_read_lock){....}, at: __skb_unlink include/linux/skbuff.h:1920 [inline]
 #0: 000000002febf790 (rcu_read_lock){....}, at: __skb_dequeue include/linux/skbuff.h:1936 [inline]
 #0: 000000002febf790 (rcu_read_lock){....}, at: process_backlog+0x1d0/0x700 net/core/dev.c:5846
 #1: 000000002febf790 (rcu_read_lock){....}, at: __skb_pull include/linux/skbuff.h:2153 [inline]
 #1: 000000002febf790 (rcu_read_lock){....}, at: ip_local_deliver_finish+0x139/0xc00 net/ipv4/ip_input.c:193
 #2: 00000000bae90b69 (slock-AF_INET/1){+.-.}, at: tcp_v4_rcv+0x29b7/0x3b80 net/ipv4/tcp_ipv4.c:1828

stack backtrace:
CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.19.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_usage_bug.cold+0x42e/0x570 kernel/locking/lockdep.c:2545
 valid_state kernel/locking/lockdep.c:2558 [inline]
 mark_lock_irq kernel/locking/lockdep.c:2752 [inline]
 mark_lock+0xc70/0x1160 kernel/locking/lockdep.c:3132
 mark_irqflags kernel/locking/lockdep.c:3010 [inline]
 __lock_acquire+0xdc4/0x3ff0 kernel/locking/lockdep.c:3373
 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144
 spin_lock include/linux/spinlock.h:329 [inline]
 free_huge_page+0x482/0xd20 mm/hugetlb.c:1294
 __put_page+0xe2/0x3a0 mm/swap.c:112
 put_page include/linux/mm.h:963 [inline]
 __skb_frag_unref include/linux/skbuff.h:2833 [inline]
 skb_release_data+0x2f3/0x920 net/core/skbuff.c:577
 skb_release_all net/core/skbuff.c:640 [inline]
 __kfree_skb+0x46/0x60 net/core/skbuff.c:654
 sk_wmem_free_skb include/net/sock.h:1466 [inline]
 tcp_rtx_queue_unlink_and_free include/net/tcp.h:1769 [inline]
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3156 [inline]
 tcp_ack+0x1d1e/0x51d0 net/ipv4/tcp_input.c:3691
 tcp_rcv_established+0x66b/0x1ea0 net/ipv4/tcp_input.c:5666
 tcp_v4_do_rcv+0x5d6/0x870 net/ipv4/tcp_ipv4.c:1547
 tcp_v4_rcv+0x2c03/0x3b80 net/ipv4/tcp_ipv4.c:1832
 ip_local_deliver_finish+0x495/0xc00 net/ipv4/ip_input.c:215
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip_local_deliver+0x188/0x500 net/ipv4/ip_input.c:256
 dst_input include/net/dst.h:461 [inline]
 ip_rcv_finish+0x1ca/0x2e0 net/ipv4/ip_input.c:414
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip_rcv+0xca/0x3c0 net/ipv4/ip_input.c:524
 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954
 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066
 process_backlog+0x241/0x700 net/core/dev.c:5848
 napi_poll net/core/dev.c:6272 [inline]
 net_rx_action+0x4ac/0xfb0 net/core/dev.c:6338
 __do_softirq+0x265/0x980 kernel/softirq.c:292
 run_ksoftirqd+0x57/0x110 kernel/softirq.c:653
 smpboot_thread_fn+0x655/0x9e0 kernel/smpboot.c:164
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/05/02 17:49 linux-4.19.y 97a8651cadce 77e2b668 .config console log report syz C ci2-linux-4-19 inconsistent lock state in free_huge_page
2021/01/25 19:01 linux-4.19.y 2263955bf7e7 52e37319 .config console log report syz C ci2-linux-4-19 inconsistent lock state in free_huge_page
2021/01/03 08:21 linux-4.19.y 3207316b3bee 79264ae3 .config console log report syz C ci2-linux-4-19
2021/04/09 04:42 linux-4.19.y b4454811f122 6a81331a .config console log report info ci2-linux-4-19 inconsistent lock state in free_huge_page
2021/03/16 19:29 linux-4.19.y 030194a5b292 fdb2bb2c .config console log report info ci2-linux-4-19 inconsistent lock state in free_huge_page
2021/03/03 19:05 linux-4.19.y 2d19be4653f5 06ed56cd .config console log report info ci2-linux-4-19 inconsistent lock state in free_huge_page
* Struck through repros no longer work on HEAD.