syzbot


BUG: sleeping function called from invalid context at net/core/sock.c:LINE (2)

Status: fixed on 2018/02/01 10:32
Subsystems: crypto
[Documentation on labels]
Reported-by: syzbot+8318ec2d461d10f73b5a54b6b164dc028f9dd9ef@syzkaller.appspotmail.com
Fix commit: 7d2c3f54e6f6 crypto: af_alg - remove locking in async callback
First crash: 2373d, last: 2371d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 BUG: sleeping function called from invalid context at net/core/sock.c:LINE C 308 2097d 1872d 0/3 public: reported C repro on 2019/04/12 00:00
upstream BUG: sleeping function called from invalid context at net/core/sock.c:LINE (3) net C 234 2288d 2291d 5/26 fixed on 2018/05/08 18:30
upstream BUG: sleeping function called from invalid context at net/core/sock.c:LINE crypto C 407 2373d 2412d 3/26 fixed on 2017/11/27 08:19

Sample crash report:
BUG: sleeping function called from invalid context at net/core/sock.c:2761
in_atomic(): 1, irqs_disabled(): 0, pid: 3632, name: kworker/1:3
netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'.
2 locks held by kworker/1:3/3632:
 #0:  ((wq_completion)"%s"name){+.+.}, at: [<ffffffff8147b244>] __write_once_size include/linux/compiler.h:212 [inline]
 #0:  ((wq_completion)"%s"name){+.+.}, at: [<ffffffff8147b244>] atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0:  ((wq_completion)"%s"name){+.+.}, at: [<ffffffff8147b244>] atomic_long_set include/asm-generic/atomic-long.h:57 [inline]
 #0:  ((wq_completion)"%s"name){+.+.}, at: [<ffffffff8147b244>] set_work_data kernel/workqueue.c:618 [inline]
 #0:  ((wq_completion)"%s"name){+.+.}, at: [<ffffffff8147b244>] set_work_pool_and_clear_pending kernel/workqueue.c:645 [inline]
 #0:  ((wq_completion)"%s"name){+.+.}, at: [<ffffffff8147b244>] process_one_work+0xad4/0x1be0 kernel/workqueue.c:2083
 #1:  ((work_completion)(&squeue->work)){+.+.}, at: [<ffffffff8147b29f>] process_one_work+0xb2f/0x1be0 kernel/workqueue.c:2087
CPU: 1 PID: 3632 Comm: kworker/1:3 Not tainted 4.15.0-rc1+ #197
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: pdecrypt padata_serial_worker
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060
 __might_sleep+0x95/0x190 kernel/sched/core.c:6013
 lock_sock_nested+0x37/0x110 net/core/sock.c:2761
 lock_sock include/net/sock.h:1465 [inline]
 af_alg_async_cb+0x86/0x1a0 crypto/af_alg.c:1039
 aead_request_complete include/crypto/internal/aead.h:75 [inline]
 pcrypt_aead_serial+0x75/0xa0 crypto/pcrypt.c:123
 padata_serial_worker+0x476/0x750 kernel/padata.c:348
 process_one_work+0xbfd/0x1be0 kernel/workqueue.c:2112
 worker_thread+0x223/0x1990 kernel/workqueue.c:2246
 kthread+0x37a/0x440 kernel/kthread.c:238
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:441
netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'.
device gre0 entered promiscuous mode
binder: 21326 RLIMIT_NICE not set
binder: BINDER_SET_CONTEXT_MGR already set
binder: 21322:21341 ioctl 40046207 0 returned -16
binder: 21326 RLIMIT_NICE not set
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
encrypted_key: insufficient parameters specified
encrypted_key: insufficient parameters specified
kvm [21334]: vcpu0, guest rIP: 0x9115 ignored wrmsr: 0x11e data 0x0
kvm [21334]: vcpu0, guest rIP: 0x9115 disabled perfctr wrmsr: 0xc2 data 0x0
kvm [21334]: vcpu0, guest rIP: 0x9115 disabled perfctr wrmsr: 0xc1 data 0x0
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
kauditd_printk_skb: 52 callbacks suppressed
audit: type=1326 audit(1511890448.625:3168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x7ffc0000
audit: type=1326 audit(1511890448.631:3169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x7ffc0000
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
audit: type=1326 audit(1511890448.632:3170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=175 compat=0 ip=0x4529d9 code=0x7ffc0000
audit: type=1326 audit(1511890448.633:3171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x7ffc0000
audit: type=1326 audit(1511890448.633:3172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x7ffc0000
audit: type=1326 audit(1511890448.633:3173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=9 compat=0 ip=0x4529d9 code=0x7ffc0000
audit: type=1326 audit(1511890448.633:3174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x7ffc0000
audit: type=1326 audit(1511890448.633:3175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x7ffc0000
audit: type=1326 audit(1511890448.635:3176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=186 compat=0 ip=0x4529d9 code=0x7ffc0000
audit: type=1326 audit(1511890448.635:3177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=21488 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x7ffc0000
binder: BINDER_SET_CONTEXT_MGR already set
binder: 21586:21588 ioctl 40046207 0 returned -16
binder: 21586:21600 transaction failed 29201/-22, size 0--1556441380301985772 line 2870
binder_alloc: binder_alloc_mmap_handler: 21586 20000000-20002000 already mapped failed -16
binder: BINDER_SET_CONTEXT_MGR already set
binder: 21586:21600 ioctl 40046207 0 returned -16
binder: BINDER_SET_CONTEXT_MGR already set
binder: 21586:21614 ioctl 40046207 0 returned -16
binder_alloc: 21586: binder_alloc_buf, no vma
binder: 21586:21600 transaction failed 29189/-3, size 0--1556441380301985772 line 2870
loop_reread_partitions: partition scan of loop0 (2°]€fI¸Òæ¶Ì”B±!S,›ùDÏ') failed (rc=-13)
binder: 21635:21637 ioctl 4b44 2000b000 returned -22
binder: 21635:21637 got reply transaction with no transaction stack
binder: 21635:21637 transaction failed 29201/-71, size 88-64 line 2670
binder: 21635:21637 IncRefs 0 refcount change on invalid ref 4 ret -22
binder: 21635:21637 BC_ACQUIRE_DONE uffffffffffffffff no match
binder: 21635:21637 BC_INCREFS_DONE uffffffffffffffff no match
binder: 21635:21637 ioctl c0306201 20005000 returned -14
binder: undelivered TRANSACTION_ERROR: 29189
binder: undelivered TRANSACTION_ERROR: 29201
rpcbind: RPC call returned error 22
rpcbind: RPC call returned error 22

Crashes (185):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/11/28 17:34 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce
2017/11/28 15:30 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce
2017/11/29 01:32 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/29 00:52 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/29 00:48 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/29 00:17 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/29 00:12 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 23:26 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 23:09 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 22:55 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 22:27 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 22:05 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 21:09 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 21:05 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 20:46 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 20:07 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 19:42 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 19:19 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 12:45 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 12:25 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 11:58 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 10:56 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 09:55 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 09:41 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 08:43 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 08:35 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 07:51 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 07:50 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 06:19 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 06:00 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 05:47 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 05:27 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 05:26 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 05:16 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 04:53 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 04:50 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 03:36 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 00:27 mmots 1ea8d039f9ed afba0b55 .config console log report ci-upstream-mmots-kasan-gce
2017/11/27 23:42 mmots 1ea8d039f9ed afba0b55 .config console log report ci-upstream-mmots-kasan-gce
2017/11/27 23:41 mmots 1ea8d039f9ed afba0b55 .config console log report ci-upstream-mmots-kasan-gce
* Struck through repros no longer work on HEAD.