syzbot

 sign-in | mailing list | source | docs
🐞 Open [984] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12475] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: trying to register non-static key in io_cqring_ev_posted (3)

Status: fixed on 2020/07/17 17:58
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+8c91f5d054e998721c57@syzkaller.appspotmail.com
Fix commit: 583863ed9181 io_uring: initialize ctx->sqo_wait earlier
First crash: 1434d, last: 1431d
Cause bisection: introduced by (bisect log) :
commit b41e98524e424d104aa7851d54fd65820759875a
Author: Jens Axboe <axboe@kernel.dk>
Date: Mon Feb 17 16:52:41 2020 +0000

  io_uring: add per-task callback handler

Crash: INFO: trying to register non-static key in io_cqring_ev_posted (log)
Repro: C syz .config
  
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[PATCH 5.4 00/38] 5.4.45-rc1 review 43 (43) 2020/06/06 16:26
[PATCH 5.6 00/43] 5.6.17-rc1 review 50 (50) 2020/06/06 16:12
[PATCH AUTOSEL 5.4 01/26] ARC: Fix ICCM & DCCM runtime size checks 27 (27) 2020/05/31 21:19
[PATCH AUTOSEL 5.6 01/47] ARC: Fix ICCM & DCCM runtime size checks 47 (47) 2020/05/28 11:56
INFO: trying to register non-static key in io_cqring_ev_posted (3) 1 (2) 2020/05/17 15:19
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: trying to register non-static key in io_cqring_ev_posted (2) fs C done 42 1443d 1480d 15/26 fixed on 2020/05/10 10:42
upstream INFO: trying to register non-static key in io_cqring_ev_posted fs C done 6 1605d 1617d 15/26 fixed on 2019/12/13 00:31

Sample crash report:
RSP: 002b:00007fffb1fb9aa8 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441319
RDX: 0000000000000001 RSI: 0000000020000140 RDI: 000000000000047b
RBP: 0000000000010475 R08: 0000000000000001 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402260
R13: 00000000004022f0 R14: 0000000000000000 R15: 0000000000000000
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 1 PID: 7090 Comm: syz-executor222 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 assign_lock_key kernel/locking/lockdep.c:913 [inline]
 register_lock_class+0x1664/0x1760 kernel/locking/lockdep.c:1225
 __lock_acquire+0x104/0x4c50 kernel/locking/lockdep.c:4234
 lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x8c/0xbf kernel/locking/spinlock.c:159
 __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122
 io_cqring_ev_posted+0xa5/0x1e0 fs/io_uring.c:1160
 io_poll_remove_all fs/io_uring.c:4357 [inline]
 io_ring_ctx_wait_and_kill+0x2bc/0x5a0 fs/io_uring.c:7305
 io_uring_create fs/io_uring.c:7843 [inline]
 io_uring_setup+0x115e/0x22b0 fs/io_uring.c:7870
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x441319
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffb1fb9aa8 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441319
RDX: 0000000000000001 RSI: 0000000020000140 RDI: 000000000000047b
RBP: 0000000000010475 R08: 0000000000000001 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402260
R13: 00000000004022f0 R14: 0000000000000000 R15: 0000000000000000
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 7090 Comm: syz-executor222 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:232 [inline]
RIP: 0010:__wake_up_common+0xdc/0x600 kernel/sched/wait.c:86
Code: b9 04 00 00 4c 8b 43 40 49 83 e8 18 49 8d 78 18 48 39 fd 0f 84 d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 e3 04 00 00 49 bd 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffffc90001677c20 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: ffff8880a6081120 RCX: 1ffffffff1517002
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000
RBP: ffff8880a6081160 R08: ffffffffffffffe8 R09: ffffc90001677cb8
R10: 0000000000000003 R11: fffff520002cef7e R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000003 R15: 0000000000000000
FS:  000000000136f880(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 00000000936b4000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:123
 io_cqring_ev_posted+0xa5/0x1e0 fs/io_uring.c:1160
 io_poll_remove_all fs/io_uring.c:4357 [inline]
 io_ring_ctx_wait_and_kill+0x2bc/0x5a0 fs/io_uring.c:7305
 io_uring_create fs/io_uring.c:7843 [inline]
 io_uring_setup+0x115e/0x22b0 fs/io_uring.c:7870
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x441319
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffb1fb9aa8 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441319
RDX: 0000000000000001 RSI: 0000000020000140 RDI: 000000000000047b
RBP: 0000000000010475 R08: 0000000000000001 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402260
R13: 00000000004022f0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace bf24b131500537a6 ]---
RIP: 0010:__read_once_size include/linux/compiler.h:232 [inline]
RIP: 0010:__wake_up_common+0xdc/0x600 kernel/sched/wait.c:86
Code: b9 04 00 00 4c 8b 43 40 49 83 e8 18 49 8d 78 18 48 39 fd 0f 84 d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 e3 04 00 00 49 bd 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffffc90001677c20 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: ffff8880a6081120 RCX: 1ffffffff1517002
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000
RBP: ffff8880a6081160 R08: ffffffffffffffe8 R09: ffffc90001677cb8
R10: 0000000000000003 R11: fffff520002cef7e R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000003 R15: 0000000000000000
FS:  000000000136f880(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 00000000936b4000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/16 17:32 linux-next ac935d227366 37bccd4e .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/05/19 18:53 linux-next ac935d227366 6d882fd2 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/05/16 16:54 linux-next ac935d227366 37bccd4e .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.