syzbot


BUG: sleeping function called from invalid context in tipc_crypto_start

Status: fixed on 2022/03/08 16:11
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+73a4f2b28371d5526901@syzkaller.appspotmail.com
Fix commit: f845fe5819ef Revert "tipc: use consistent GFP flags"
First crash: 1093d, last: 1086d
Cause bisection: introduced by (bisect log) :
commit 86c3a3e964d910a62eeb277d60b2a60ebefa9feb
Author: Tadeusz Struk <tadeusz.struk@linaro.org>
Date: Thu Nov 11 20:59:16 2021 +0000

  tipc: use consistent GFP flags

Crash: BUG: sleeping function called from invalid context in tipc_crypto_start (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit f845fe5819efc4111c456c102f15db6d9ed3406e
Author: Hoang Le <hoang.h.le@dektech.com.au>
Date: Fri Dec 17 03:00:59 2021 +0000

  Revert "tipc: use consistent GFP flags"

  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] BUG: sleeping function called from invalid context in tipc_crypto_start 1 (3) 2022/01/20 12:47

Sample crash report:
tipc: Started in network mode
tipc: Node identity 00000000000000000000000000000001, cluster identity 4711
tipc: New replicast peer: 0000:0000:0000:0000:0000:0000:0000:0000
tipc: Enabled bearer <udp:syz0>, priority 10
BUG: sleeping function called from invalid context at include/linux/sched/mm.h:230
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3602, name: syz-executor269
preempt_count: 201, expected: 0
RCU nest depth: 0, expected: 0
4 locks held by syz-executor269/3602:
 #0: ffffffff8d39ead0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:802
 #1: ffffffff8d39eb88 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
 #1: ffffffff8d39eb88 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x3e0/0x580 net/netlink/genetlink.c:790
 #2: ffffffff8d30ca28 (rtnl_mutex){+.+.}-{3:3}, at: tipc_nl_node_set_key+0x7b/0xf70 net/tipc/node.c:3032
 #3: ffff888022c78068 (&tn->node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline]
 #3: ffff888022c78068 (&tn->node_list_lock){+...}-{2:2}, at: tipc_node_create+0x179/0x1f60 net/tipc/node.c:480
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 3602 Comm: syz-executor269 Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9538
 might_alloc include/linux/sched/mm.h:230 [inline]
 slab_pre_alloc_hook mm/slab.h:492 [inline]
 slab_alloc_node mm/slub.c:3148 [inline]
 slab_alloc mm/slub.c:3242 [inline]
 kmem_cache_alloc_trace+0x25d/0x2c0 mm/slub.c:3259
 kmalloc include/linux/slab.h:590 [inline]
 kzalloc include/linux/slab.h:724 [inline]
 tipc_crypto_start+0xc7/0xbe0 net/tipc/crypto.c:1477
 tipc_node_create+0xb42/0x1f60 net/tipc/node.c:536
 __tipc_nl_node_set_key net/tipc/node.c:2998 [inline]
 tipc_nl_node_set_key+0xd6d/0xf70 net/tipc/node.c:3033
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:731
 genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:792
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x904/0xdf0 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f88da929d99
Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdeb18c4c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f88da929d99
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000004
RBP: 00007f88da8ed800 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 00007f88da8ed890
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

=============================
[ BUG: Invalid wait context ]
5.16.0-rc4-syzkaller #0 Tainted: G        W        
-----------------------------
syz-executor269/3602 is trying to lock:
ffffffff8bc88328 (pcpu_alloc_mutex){+.+.}-{3:3}, at: pcpu_alloc+0xb12/0x1350 mm/percpu.c:1774
other info that might help us debug this:
context-{4:4}
4 locks held by syz-executor269/3602:
 #0: ffffffff8d39ead0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:802
 #1: ffffffff8d39eb88 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
 #1: ffffffff8d39eb88 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x3e0/0x580 net/netlink/genetlink.c:790
 #2: ffffffff8d30ca28 (rtnl_mutex){+.+.}-{3:3}, at: tipc_nl_node_set_key+0x7b/0xf70 net/tipc/node.c:3032
 #3: ffff888022c78068 (&tn->node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline]
 #3: ffff888022c78068 (&tn->node_list_lock){+...}-{2:2}, at: tipc_node_create+0x179/0x1f60 net/tipc/node.c:480
stack backtrace:
CPU: 1 PID: 3602 Comm: syz-executor269 Tainted: G        W         5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4678 [inline]
 check_wait_context kernel/locking/lockdep.c:4739 [inline]
 __lock_acquire.cold+0x213/0x3ab kernel/locking/lockdep.c:4977
 lock_acquire kernel/locking/lockdep.c:5637 [inline]
 lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602
 __mutex_lock_common kernel/locking/mutex.c:607 [inline]
 __mutex_lock+0x12f/0x12f0 kernel/locking/mutex.c:740
 pcpu_alloc+0xb12/0x1350 mm/percpu.c:1774
 tipc_crypto_start+0xf5/0xbe0 net/tipc/crypto.c:1491
 tipc_node_create+0xb42/0x1f60 net/tipc/node.c:536
 __tipc_nl_node_set_key net/tipc/node.c:2998 [inline]
 tipc_nl_node_set_key+0xd6d/0xf70 net/tipc/node.c:3033
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:731
 genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:792
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x904/0xdf0 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f88da929d99
Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdeb18c4c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f88da929d99
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000004
RBP: 00007f88da8ed800 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 00007f88da8ed890
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/12/13 18:21 net-old 28a2686c185e 49ca1f59 .config console log report syz C ci-upstream-net-this-kasan-gce BUG: sleeping function called from invalid context in tipc_crypto_start
2021/12/14 01:41 net-next-old a3c62a042237 5d14b1ea .config console log report syz C ci-upstream-net-kasan-gce BUG: sleeping function called from invalid context in tipc_crypto_start
2021/12/13 16:26 linux-next ea922272cbe5 49ca1f59 .config console log report syz C ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in tipc_crypto_start
2021/12/20 15:06 net-next-old 4b430f5c9680 021b36cb .config console log report info ci-upstream-net-kasan-gce BUG: sleeping function called from invalid context in tipc_crypto_start
2021/12/13 15:52 net-next-old 9b5bcb193a3b 49ca1f59 .config console log report info ci-upstream-net-kasan-gce BUG: sleeping function called from invalid context in tipc_crypto_start
2021/12/13 15:51 linux-next ea922272cbe5 49ca1f59 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in tipc_crypto_start
* Struck through repros no longer work on HEAD.