syzbot


WARNING in enqueue_task_dl

Status: public: reported syz repro on 2019/04/10 16:04
Reported-by: syzbot+35d5769eecf8560635a6@syzkaller.appspotmail.com
First crash: 2139d, last: 2139d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 WARNING in enqueue_task_dl C inconclusive 1 1623d 1938d 0/1 upstream: reported C repro on 2019/07/20 08:10
upstream WARNING in enqueue_task_dl kernel C done 13 1604d 2181d 15/28 fixed on 2020/08/01 00:48
linux-4.19 WARNING in enqueue_task_dl syz done 1 1609d 1938d 1/1 fixed on 2020/07/13 20:03

Sample crash report:
audit: type=1400 audit(1546265523.718:12): avc:  denied  { read } for  pid=1946 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
sched: DL replenish lagged too much
------------[ cut here ]------------
WARNING: CPU: 0 PID: 2017 at kernel/sched/deadline.c:596 assert_clock_updated kernel/sched/sched.h:927 [inline]
WARNING: CPU: 0 PID: 2017 at kernel/sched/deadline.c:596 rq_clock kernel/sched/sched.h:933 [inline]
WARNING: CPU: 0 PID: 2017 at kernel/sched/deadline.c:596 update_dl_entity kernel/sched/deadline.c:827 [inline]
WARNING: CPU: 0 PID: 2017 at kernel/sched/deadline.c:596 enqueue_dl_entity kernel/sched/deadline.c:1369 [inline]
WARNING: CPU: 0 PID: 2017 at kernel/sched/deadline.c:596 enqueue_task_dl+0x1cc9/0x2ca0 kernel/sched/deadline.c:1446
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 2017 Comm: syz-executor0 Not tainted 4.14.91+ #1
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 panic+0x1d9/0x3c2 kernel/panic.c:182
 __warn.cold+0x2f/0x3b kernel/panic.c:546

======================================================
WARNING: possible circular locking dependency detected
4.14.91+ #1 Not tainted
------------------------------------------------------
syz-executor0/2017 is trying to acquire lock:
 ((console_sem).lock){-.-.}, at: [<ffffffff9b1ee89e>] down_trylock+0xe/0x60 kernel/locking/semaphore.c:136

but task is already holding lock:
 (&rq->lock){-.-.}, at: [<ffffffff9b1619f8>] task_rq_lock+0xc8/0x330 kernel/sched/core.c:126

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&rq->lock){-.-.}:

-> #1 (&p->pi_lock){-.-.}:

-> #0 ((console_sem).lock){-.-.}:

other info that might help us debug this:

Chain exists of:
  (console_sem).lock --> &p->pi_lock --> &rq->lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&rq->lock);
                               lock(&p->pi_lock);
                               lock(&rq->lock);
  lock((console_sem).lock);

 *** DEADLOCK ***

3 locks held by syz-executor0/2017:
 #0:  (rcu_read_lock){....}, at: [<ffffffff9b172990>] SYSC_sched_setattr kernel/sched/core.c:4512 [inline]
 #0:  (rcu_read_lock){....}, at: [<ffffffff9b172990>] SyS_sched_setattr+0x1d0/0x390 kernel/sched/core.c:4498
 #1:  (&p->pi_lock){-.-.}, at: [<ffffffff9b16199a>] task_rq_lock+0x6a/0x330 kernel/sched/core.c:124
 #2:  (&rq->lock){-.-.}, at: [<ffffffff9b1619f8>] task_rq_lock+0xc8/0x330 kernel/sched/core.c:126

stack backtrace:
CPU: 0 PID: 2017 Comm: syz-executor0 Not tainted 4.14.91+ #1
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258
Shutting down cpus with NMI
Kernel Offset: 0x1a000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/31 14:15 android-4.14 7d2d5fc1acda 2b42fdc8 .config console log report syz ci-android-414-kasan-gce-root
2018/12/31 13:51 android-4.14 7d2d5fc1acda 2b42fdc8 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.