syzbot

 sign-in | mailing list | source | docs
🐞 Open [712]
🐞 Fixed [297]
🐞 Invalid [838]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

WARNING in __vb2_queue_cancel

Status: fixed on 2019/12/23 10:03
Reported-by: syzbot+b167378e6d839357cdf7@syzkaller.appspotmail.com
Fix commit: 467052f6ea5a media: vivid: Fix wrong locking that causes race conditions on streaming stop
First crash: 2414d, last: 2203d
Fix bisection: fixed by (bisect log) :
commit 467052f6ea5a51524992e43f02b543550495c391
Author: Alexander Popov <alex.popov@linux.com>
Date: Sun Nov 3 22:17:19 2019 +0000

  media: vivid: Fix wrong locking that causes race conditions on streaming stop

  
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 WARNING in __vb2_queue_cancel -1 C inconclusive 16 2003d 2419d 0/1 upstream: reported C repro on 2019/04/20 12:06
upstream WARNING in __vb2_queue_cancel -1 C done error 1009 2200d 2592d 0/29 auto-obsoleted due to no activity on 2022/12/16 19:59

Sample crash report:
audit: type=1400 audit(1574458178.125:36): avc:  denied  { map } for  pid=7807 comm="syz-executor003" path="/root/syz-executor003453826" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7826 at drivers/media/common/videobuf2/videobuf2-core.c:1690 __vb2_queue_cancel.cold+0x11/0x213 drivers/media/common/videobuf2/videobuf2-core.c:1690
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 7826 Comm: syz-executor003 Not tainted 4.19.85-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 panic+0x26a/0x50e kernel/panic.c:186
 __warn.cold+0x20/0x53 kernel/panic.c:541
 report_bug+0x263/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037
RIP: 0010:__vb2_queue_cancel.cold+0x11/0x213 drivers/media/common/videobuf2/videobuf2-core.c:1690
Code: 48 c7 c7 a0 7d c0 87 e8 5b cf b0 fc 0f 0b 41 bc ea ff ff ff e9 f6 49 ff ff e8 a5 6a c6 fc 48 c7 c7 a0 7d c0 87 e8 3d cf b0 fc <0f> 0b 49 8d 85 28 02 00 00 48 89 45 a0 48 c1 e8 03 48 89 c2 b8 ff
RSP: 0018:ffff88809817fae8 EFLAGS: 00010282
RAX: 0000000000000024 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815595d6 RDI: ffffed101302ff4f
RBP: ffff88809817fb58 R08: 0000000000000024 R09: ffffed1015d05079
R10: ffffed1015d05078 R11: ffff8880ae8283c7 R12: ffff88809e635e3c
R13: ffff88809e635bf8 R14: ffff88809e635ed8 R15: ffff88809e635ed0
 vb2_core_streamoff+0x60/0x150 drivers/media/common/videobuf2/videobuf2-core.c:1816
 __vb2_cleanup_fileio+0x78/0x170 drivers/media/common/videobuf2/videobuf2-core.c:2343
 vb2_core_queue_release+0x20/0x80 drivers/media/common/videobuf2/videobuf2-core.c:2070
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:671 [inline]
 _vb2_fop_release+0x1cf/0x2a0 drivers/media/common/videobuf2/videobuf2-v4l2.c:842
 vb2_fop_release+0x75/0xc0 drivers/media/common/videobuf2/videobuf2-v4l2.c:856
 vivid_fop_release+0x18e/0x430 drivers/media/platform/vivid/vivid-core.c:474
 v4l2_release+0xf9/0x1a0 drivers/media/v4l2-core/v4l2-dev.c:448
 __fput+0x2dd/0x8b0 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x145/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x994/0x2fa0 kernel/exit.c:876
 do_group_exit+0x135/0x370 kernel/exit.c:979
 __do_sys_exit_group kernel/exit.c:990 [inline]
 __se_sys_exit_group kernel/exit.c:988 [inline]
 __x64_sys_exit_group+0x44/0x50 kernel/exit.c:988
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x443b78
Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00
RSP: 002b:00007ffc9e970d48 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443b78
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004c34f0 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d5180 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/22 21:32 linux-4.19.y c63ee2939dc1 598ca6c8 .config console log report syz C ci2-linux-4-19
2019/08/16 00:33 linux-4.19.y 893af1c79e42 faeffb00 .config console log report syz C ci2-linux-4-19
2019/06/07 11:40 linux-4.19.y e109a984cf38 698773cb .config console log report syz C ci2-linux-4-19
2019/04/25 09:12 linux-4.19.y c98875d930e9 8e3c52b1 .config console log report syz C ci2-linux-4-19
2019/09/18 05:00 linux-4.19.y db2d0b7c1dde 03e0d245 .config console log report ci2-linux-4-19
2019/09/01 20:18 linux-4.19.y 97ab07e11fbf bad3cce2 .config console log report ci2-linux-4-19
2019/06/19 04:24 linux-4.19.y 6500aa436df4 34bf9440 .config console log report ci2-linux-4-19
2019/06/18 07:49 linux-4.19.y 6500aa436df4 442206d7 .config console log report ci2-linux-4-19
2019/06/15 13:07 linux-4.19.y 7aa823a959e1 442206d7 .config console log report ci2-linux-4-19
2019/06/07 02:28 linux-4.19.y e109a984cf38 698773cb .config console log report ci2-linux-4-19
2019/05/01 02:15 linux-4.19.y 19bb613acb9a 618456b4 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.