WARNING in __vb2_queue_cancel

Status: upstream: reported C repro on 2019/04/20 12:06
Reported-by: syzbot+48005d53f4cee47f763f@syzkaller.appspotmail.com
First crash: 2687d, last: 2272d
Fix bisection the fix commit could be any of (bisect log):
  3ffe1e79c174 Linux 4.14.138
  4139fb08c05f Linux 4.14.187
   
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 WARNING in __vb2_queue_cancel -1 syz, C done 11 2471d 2682d 1/1 fixed on 2019/12/23 10:03
upstream WARNING in __vb2_queue_cancel -1 syz, C done error 1009 2468d 2860d 0/29 auto-obsoleted due to no activity on 2022/12/16 19:59
▶ ▼ Last patch testing requests (6)
Created Duration User Patch Repo Result
2023/01/23 22:32 15m retest repro linux-4.14.y report log
2023/01/23 19:32 12m retest repro linux-4.14.y report log
2023/01/23 18:32 10m retest repro linux-4.14.y report log
2022/09/06 15:27 11m retest repro linux-4.14.y report log
2022/09/06 14:27 10m retest repro linux-4.14.y report log
2022/09/06 13:27 9m retest repro linux-4.14.y report log
▶ ▼ Fix bisection attempts (8)
Created Duration User Patch Repo Result
2020/07/08 22:35 34m bisect fix linux-4.14.y OK (2) job log
2020/06/08 22:06 28m bisect fix linux-4.14.y OK (0) job log log
2020/05/09 21:34 32m bisect fix linux-4.14.y OK (0) job log log
2020/04/09 21:05 28m bisect fix linux-4.14.y OK (0) job log log
2020/03/10 20:36 28m bisect fix linux-4.14.y OK (0) job log log
2020/02/09 20:08 27m bisect fix linux-4.14.y OK (0) job log log
2020/01/10 19:41 27m bisect fix linux-4.14.y OK (0) job log log
2019/12/11 18:59 27m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7180 at drivers/media/v4l2-core/videobuf2-core.c:1663 __vb2_queue_cancel+0x5a3/0x890 drivers/media/v4l2-core/videobuf2-core.c:1663
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 7180 Comm: syz-executor340 Not tainted 4.14.138 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x138/0x19c lib/dump_stack.c:53
 panic+0x1f2/0x426 kernel/panic.c:182
 __warn.cold+0x2f/0x36 kernel/panic.c:546
 report_bug+0x216/0x254 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:177 [inline]
 fixup_bug arch/x86/kernel/traps.c:172 [inline]
 do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963
RIP: 0010:__vb2_queue_cancel+0x5a3/0x890 drivers/media/v4l2-core/videobuf2-core.c:1663
RSP: 0018:ffff888092917ae0 EFLAGS: 00010297
RAX: ffff8880a51c8280 RBX: ffffffff842c4020 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88809e4b3e2e
RBP: ffff888092917b50 R08: dffffc0000000000 R09: ffffffff88ca65a0
R10: ffff888092917a40 R11: ffff8880a51c8280 R12: ffff88809e4b5d64
R13: ffff88809e4b5e38 R14: ffff88809e4b5e40 R15: ffff88809e4b5b60
 vb2_core_streamoff+0x52/0x110 drivers/media/v4l2-core/videobuf2-core.c:1788
 __vb2_cleanup_fileio+0x78/0x150 drivers/media/v4l2-core/videobuf2-core.c:2313
 vb2_core_queue_release+0x1d/0x80 drivers/media/v4l2-core/videobuf2-core.c:2040
 vb2_queue_release drivers/media/v4l2-core/videobuf2-v4l2.c:669 [inline]
 _vb2_fop_release+0x1cf/0x2a0 drivers/media/v4l2-core/videobuf2-v4l2.c:840
 vb2_fop_release+0x75/0xc0 drivers/media/v4l2-core/videobuf2-v4l2.c:854
 vivid_fop_release+0x180/0x3f0 drivers/media/platform/vivid/vivid-core.c:486
 v4l2_release+0xf9/0x190 drivers/media/v4l2-core/v4l2-dev.c:446
 __fput+0x275/0x7a0 fs/file_table.c:210
 ____fput+0x16/0x20 fs/file_table.c:244
 task_work_run+0x114/0x190 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x7df/0x2c10 kernel/exit.c:874
 do_group_exit+0x111/0x330 kernel/exit.c:977
 SYSC_exit_group kernel/exit.c:988 [inline]
 SyS_exit_group+0x1d/0x20 kernel/exit.c:986
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x443b88
RSP: 002b:00007ffc248827e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443b88
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004c34f0 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d5180 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/08/15 21:12 linux-4.14.y 3ffe1e79c174 faeffb00 .config console log report syz C ci2-linux-4-14
2019/06/16 00:58 linux-4.14.y a74d0e937a3a 442206d7 .config console log report syz C ci2-linux-4-14
2019/04/20 11:06 linux-4.14.y 68d7a45eec10 b0e8efcb .config console log report syz C ci2-linux-4-14
2019/10/08 14:52 linux-4.14.y 42327896f194 137e37ca .config console log report ci2-linux-4-14
2019/09/16 03:50 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/08/31 16:04 linux-4.14.y 01fd1694b93c bad3cce2 .config console log report ci2-linux-4-14
2019/08/29 23:02 linux-4.14.y 01fd1694b93c cd626f3b .config console log report ci2-linux-4-14
2019/07/24 01:58 linux-4.14.y ff33472c282e de453f34 .config console log report ci2-linux-4-14
2019/06/22 15:30 linux-4.14.y a5758c531177 34bf9440 .config console log report ci2-linux-4-14
2019/06/22 07:54 linux-4.14.y a5758c531177 34bf9440 .config console log report ci2-linux-4-14
2019/06/18 08:14 linux-4.14.y e861d0673eb8 e3f76baa .config console log report ci2-linux-4-14
2019/06/16 14:09 linux-4.14.y a74d0e937a3a 442206d7 .config console log report ci2-linux-4-14
2019/06/15 00:28 linux-4.14.y 2bf3258a12af 442206d7 .config console log report ci2-linux-4-14
2019/06/14 00:44 linux-4.14.y 2bf3258a12af d25bb7ad .config console log report ci2-linux-4-14
2019/06/13 12:50 linux-4.14.y 2bf3258a12af 3f4e812b .config console log report ci2-linux-4-14
2019/04/28 09:03 linux-4.14.y fa5941f45d7e b617407b .config console log report ci2-linux-4-14
* Struck through repros no longer work on HEAD.