syzbot


BUG: spinlock recursion in try_to_wake_up

Status: upstream: reported on 2024/04/09 16:00
Reported-by: syzbot+a9380a3d0946cadd1ccb@syzkaller.appspotmail.com
First crash: 76d, last: 76d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: spinlock recursion in try_to_wake_up mm C 2 72d 224d 0/27 upstream: reported C repro on 2023/11/13 21:09

Sample crash report:
BUG: spinlock recursion on CPU#0, syz-executor.1/3788
 lock: 0xffff8880b983aa00, .magic: dead4ead, .owner: syz-executor.1/3788, .owner_cpu: 0
CPU: 0 PID: 3788 Comm: syz-executor.1 Not tainted 6.1.84-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
 do_raw_spin_lock+0x21e/0x370 kernel/locking/spinlock_debug.c:114
 raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537
 raw_spin_rq_lock kernel/sched/sched.h:1354 [inline]
 rq_lock kernel/sched/sched.h:1644 [inline]
 ttwu_queue kernel/sched/core.c:3903 [inline]
 try_to_wake_up+0x5bd/0x12e0 kernel/sched/core.c:4228
 hrtimer_wakeup+0x5e/0x70 kernel/time/hrtimer.c:1940
 __run_hrtimer kernel/time/hrtimer.c:1686 [inline]
 __hrtimer_run_queues+0x5e5/0xe50 kernel/time/hrtimer.c:1750
 hrtimer_interrupt+0x392/0x980 kernel/time/hrtimer.c:1812
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0x156/0x580 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x8c/0xb0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:103 [inline]
RIP: 0010:__local_bh_enable_ip+0x16c/0x1f0 kernel/softirq.c:403
Code: 8a e8 58 26 36 09 65 66 8b 05 90 94 af 7e 66 85 c0 75 57 bf 01 00 00 00 e8 a1 38 0a 00 e8 7c 3c 3d 00 fb 65 8b 05 3c 64 ae 7e <85> c0 75 05 e8 7b 82 ac ff 48 c7 44 24 20 0e 36 e0 45 49 c7 04 1c
RSP: 0018:ffffc9000529e5a0 EFLAGS: 00000286
RAX: 0000000080000004 RBX: 1ffff92000a53cb8 RCX: 0000000000000005
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffffffff81540b04
RBP: ffffc9000529e658 R08: dffffc0000000000 R09: ffffed100b28e346
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 1ffff92000a53cbc R14: ffffc9000529e5e0 R15: 0000000000000201
 __sock_map_delete net/core/sock_map.c:426 [inline]
 sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
 bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e
 bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
 __bpf_prog_run include/linux/filter.h:603 [inline]
 bpf_prog_run include/linux/filter.h:610 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
 bpf_trace_run2+0x1fd/0x410 kernel/trace/bpf_trace.c:2312
 trace_contention_end+0x14c/0x190 include/trace/events/lock.h:122
 __pv_queued_spin_lock_slowpath+0x935/0xc50 kernel/locking/qspinlock.c:560
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline]
 queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 lockdep_lock+0x1a7/0x2a0 kernel/locking/lockdep.c:144
 graph_lock kernel/locking/lockdep.c:170 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3760 [inline]
 validate_chain+0x1d0/0x5950 kernel/locking/lockdep.c:3793
 __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
 update_cfs_rq_load_avg kernel/sched/fair.c:4026 [inline]
 __update_blocked_fair kernel/sched/fair.c:8706 [inline]
 update_blocked_averages+0x751/0x16a0 kernel/sched/fair.c:8812
 newidle_balance+0x4ae/0x10b0 kernel/sched/fair.c:11588
 pick_next_task_fair+0x27d/0xdc0 kernel/sched/fair.c:7893
 __pick_next_task kernel/sched/core.c:5868 [inline]
 pick_next_task kernel/sched/core.c:5943 [inline]
 __schedule+0x7a9/0x4550 kernel/sched/core.c:6522
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
 synchronize_rcu_expedited+0x360/0x930 kernel/rcu/tree_exp.h:962
 synchronize_rcu+0x11c/0x3f0 kernel/rcu/tree.c:3575
 rcu_sync_enter+0x1f6/0x340 kernel/rcu/sync.c:149
 percpu_down_write+0x69/0x2f0 kernel/locking/percpu-rwsem.c:231
 bp_constraints_lock+0xdd/0x1b0 kernel/events/hw_breakpoint.c:133
 reserve_bp_slot kernel/events/hw_breakpoint.c:625 [inline]
 register_perf_hw_breakpoint+0x8c/0x260 kernel/events/hw_breakpoint.c:746
 hw_breakpoint_event_init+0x89/0x110 kernel/events/hw_breakpoint.c:986
 perf_try_init_event+0x135/0x3e0 kernel/events/core.c:11498
 perf_init_event kernel/events/core.c:11562 [inline]
 perf_event_alloc+0xf66/0x2120 kernel/events/core.c:11853
 __do_sys_perf_event_open kernel/events/core.c:12389 [inline]
 __se_sys_perf_event_open+0x7d2/0x4960 kernel/events/core.c:12281
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f187807de69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1878dfd0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007f18781abf80 RCX: 00007f187807de69
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000020000180
RBP: 00007f18780ca47a R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f18781abf80 R15: 00007ffcd9407708
 </TASK>
----------------
Code disassembly (best guess):
   0:	8a e8                	mov    %al,%ch
   2:	58                   	pop    %rax
   3:	26 36 09 65 66       	es ss or %esp,0x66(%rbp)
   8:	8b 05 90 94 af 7e    	mov    0x7eaf9490(%rip),%eax        # 0x7eaf949e
   e:	66 85 c0             	test   %ax,%ax
  11:	75 57                	jne    0x6a
  13:	bf 01 00 00 00       	mov    $0x1,%edi
  18:	e8 a1 38 0a 00       	call   0xa38be
  1d:	e8 7c 3c 3d 00       	call   0x3d3c9e
  22:	fb                   	sti
  23:	65 8b 05 3c 64 ae 7e 	mov    %gs:0x7eae643c(%rip),%eax        # 0x7eae6466
* 2a:	85 c0                	test   %eax,%eax <-- trapping instruction
  2c:	75 05                	jne    0x33
  2e:	e8 7b 82 ac ff       	call   0xffac82ae
  33:	48 c7 44 24 20 0e 36 	movq   $0x45e0360e,0x20(%rsp)
  3a:	e0 45
  3c:	49                   	rex.WB
  3d:	c7                   	.byte 0xc7
  3e:	04 1c                	add    $0x1c,%al

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/09 15:59 linux-6.1.y 347385861c50 f3234354 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf BUG: spinlock recursion in try_to_wake_up
* Struck through repros no longer work on HEAD.