syzbot


WARNING: locking bug in rto_push_irq_work_func

Status: upstream: reported on 2024/10/14 23:55
Subsystems: fs net
[Documentation on labels]
Reported-by: syzbot+da051a9137a15fa8ecdf@syzkaller.appspotmail.com
First crash: 127d, last: 42d
Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [kernel?] KASAN: wild-memory-access Read in rto_push_irq_work_func 1 (2) 2024/11/26 14:42
[syzbot] [kernel?] WARNING: locking bug in rto_push_irq_work_func 0 (1) 2024/10/14 23:55
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: wild-memory-access Read in rto_push_irq_work_func kernel 1 102d 80d 0/28 auto-obsoleted due to no activity on 2025/02/12 13:48

Sample crash report:
=============================
[ BUG: Invalid wait context ]
6.13.0-rc5-syzkaller-00161-g63676eefb7a0 #0 Not tainted
-----------------------------
syz.2.1375/11736 is trying to lock:
ffff8880b863e8d8 (&dev->vblank_time_lock){-.-.}-{3:3}, at: raw_spin_rq_lock_nested+0xb0/0x140 kernel/sched/core.c:606
other info that might help us debug this:
context-{2:2}
2 locks held by syz.2.1375/11736:
 #0: ffff88807e8cf438 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x254/0x320 fs/file.c:1191
 #1: ffff888052024420 (sb_writers#29){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2964 [inline]
 #1: ffff888052024420 (sb_writers#29){.+.+}-{0:0}, at: vfs_write+0x225/0xd30 fs/read_write.c:675
stack backtrace:
CPU: 0 UID: 0 PID: 11736 Comm: syz.2.1375 Not tainted 6.13.0-rc5-syzkaller-00161-g63676eefb7a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline]
 check_wait_context kernel/locking/lockdep.c:4898 [inline]
 __lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5176
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
 _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
 raw_spin_rq_lock_nested+0xb0/0x140 kernel/sched/core.c:606
 raw_spin_rq_lock kernel/sched/sched.h:1523 [inline]
 rto_push_irq_work_func+0x86/0x350 kernel/sched/rt.c:2248
 irq_work_single+0x136/0x240 kernel/irq_work.c:221
 __flush_smp_call_function_queue+0x9e4/0x1620 kernel/smp.c:574
 __sysvec_call_function_single+0xb8/0x430 arch/x86/kernel/smp.c:271
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0x9e/0xc0 arch/x86/kernel/smp.c:266
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5853
Code: 2b 00 74 08 4c 89 f7 e8 6a 2b 8b 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc900102e7b20 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff9200205cf70 RCX: ffff888030650ad8
RDX: dffffc0000000000 RSI: ffffffff8c0aaae0 RDI: ffffffff8c5fb0e0
RBP: ffffc900102e7c80 R08: ffffffff96b4470f R09: 1ffffffff2d688e1
R10: dffffc0000000000 R11: fffffbfff2d688e2 R12: 1ffff9200205cf6c
R13: dffffc0000000000 R14: ffffc900102e7b80 R15: 0000000000000246
 percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
 __sb_start_write include/linux/fs.h:1725 [inline]
 sb_start_write+0x4d/0x1c0 include/linux/fs.h:1861
 file_start_write include/linux/fs.h:2964 [inline]
 vfs_write+0x225/0xd30 fs/read_write.c:675
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9daed85d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9dafbe2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9daef76080 RCX: 00007f9daed85d29
RDX: 0000000000000012 RSI: 0000000020000100 RDI: 000000000000000b
RBP: 00007f9daee01b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9daef76080 R15: 00007fffdd18fc58
 </TASK>
BUG: unable to handle page fault for address: fffffbfff3f8171b
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffe4067 P4D 23ffe4067 PUD 23ffe3067 PMD 0 
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 11736 Comm: syz.2.1375 Not tainted 6.13.0-rc5-syzkaller-00161-g63676eefb7a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x82/0x290 mm/kasan/generic.c:189
Code: 01 00 00 00 00 fc ff df 4f 8d 3c 31 4c 89 fd 4c 29 dd 48 83 fd 10 7f 29 48 85 ed 0f 84 3e 01 00 00 4c 89 cd 48 f7 d5 48 01 dd <41> 80 3b 00 0f 85 c9 01 00 00 49 ff c3 48 ff c5 75 ee e9 1e 01 00
RSP: 0018:ffffc90000007be0 EFLAGS: 00010086
RAX: 000000000172ce01 RBX: 1ffffffff3f8171b RCX: ffffffff817ad1b4
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff9fc0b8d8
RBP: ffffffffffffffff R08: ffffffff9fc0b8df R09: 1ffffffff3f8171b
R10: dffffc0000000000 R11: fffffbfff3f8171b R12: ffff888030650ac4
R13: ffff888030650000 R14: dffffc0000000001 R15: fffffbfff3f8171c
FS:  00007f9dafbe26c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff3f8171b CR3: 000000007bdfe000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 __lock_acquire+0xc94/0x2100 kernel/locking/lockdep.c:5196
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
 _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
 raw_spin_rq_lock_nested+0xb0/0x140 kernel/sched/core.c:606
 raw_spin_rq_lock kernel/sched/sched.h:1523 [inline]
 rto_push_irq_work_func+0x86/0x350 kernel/sched/rt.c:2248
 irq_work_single+0x136/0x240 kernel/irq_work.c:221
 __flush_smp_call_function_queue+0x9e4/0x1620 kernel/smp.c:574
 __sysvec_call_function_single+0xb8/0x430 arch/x86/kernel/smp.c:271
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0x9e/0xc0 arch/x86/kernel/smp.c:266
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5853
Code: 2b 00 74 08 4c 89 f7 e8 6a 2b 8b 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc900102e7b20 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff9200205cf70 RCX: ffff888030650ad8
RDX: dffffc0000000000 RSI: ffffffff8c0aaae0 RDI: ffffffff8c5fb0e0
RBP: ffffc900102e7c80 R08: ffffffff96b4470f R09: 1ffffffff2d688e1
R10: dffffc0000000000 R11: fffffbfff2d688e2 R12: 1ffff9200205cf6c
R13: dffffc0000000000 R14: ffffc900102e7b80 R15: 0000000000000246
 percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
 __sb_start_write include/linux/fs.h:1725 [inline]
 sb_start_write+0x4d/0x1c0 include/linux/fs.h:1861
 file_start_write include/linux/fs.h:2964 [inline]
 vfs_write+0x225/0xd30 fs/read_write.c:675
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9daed85d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9dafbe2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9daef76080 RCX: 00007f9daed85d29
RDX: 0000000000000012 RSI: 0000000020000100 RDI: 000000000000000b
RBP: 00007f9daee01b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9daef76080 R15: 00007fffdd18fc58
 </TASK>
Modules linked in:
CR2: fffffbfff3f8171b
---[ end trace 0000000000000000 ]---
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x82/0x290 mm/kasan/generic.c:189
Code: 01 00 00 00 00 fc ff df 4f 8d 3c 31 4c 89 fd 4c 29 dd 48 83 fd 10 7f 29 48 85 ed 0f 84 3e 01 00 00 4c 89 cd 48 f7 d5 48 01 dd <41> 80 3b 00 0f 85 c9 01 00 00 49 ff c3 48 ff c5 75 ee e9 1e 01 00
RSP: 0018:ffffc90000007be0 EFLAGS: 00010086
RAX: 000000000172ce01 RBX: 1ffffffff3f8171b RCX: ffffffff817ad1b4
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff9fc0b8d8
RBP: ffffffffffffffff R08: ffffffff9fc0b8df R09: 1ffffffff3f8171b
R10: dffffc0000000000 R11: fffffbfff3f8171b R12: ffff888030650ac4
R13: ffff888030650000 R14: dffffc0000000001 R15: fffffbfff3f8171c
FS:  00007f9dafbe26c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff3f8171b CR3: 000000007bdfe000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	2b 00                	sub    (%rax),%eax
   2:	74 08                	je     0xc
   4:	4c 89 f7             	mov    %r14,%rdi
   7:	e8 6a 2b 8b 00       	call   0x8b2b76
   c:	f6 44 24 61 02       	testb  $0x2,0x61(%rsp)
  11:	0f 85 85 01 00 00    	jne    0x19c
  17:	41 f7 c7 00 02 00 00 	test   $0x200,%r15d
  1e:	74 01                	je     0x21
  20:	fb                   	sti
  21:	48 c7 44 24 40 0e 36 	movq   $0x45e0360e,0x40(%rsp)
  28:	e0 45
* 2a:	4b c7 44 25 00 00 00 	movq   $0x0,0x0(%r13,%r12,1) <-- trapping instruction
  31:	00 00
  33:	43 c7 44 25 09 00 00 	movl   $0x0,0x9(%r13,%r12,1)
  3a:	00 00
  3c:	43                   	rex.XB
  3d:	c7                   	.byte 0xc7
  3e:	44                   	rex.R
  3f:	25                   	.byte 0x25

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/04 08:50 upstream 63676eefb7a0 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: locking bug in rto_push_irq_work_func
2024/11/08 09:29 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: locking bug in rto_push_irq_work_func
2024/10/10 23:44 upstream eb952c47d154 8fbfc0c8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: locking bug in rto_push_irq_work_func
* Struck through repros no longer work on HEAD.