syzbot


WARNING: ODEBUG bug in __do_softirq

Status: public: reported syz repro on 2019/04/14 09:28
Reported-by: syzbot+f514d906fe3e52fbdf90@syzkaller.appspotmail.com
First crash: 2253d, last: 2253d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: ODEBUG bug in __do_softirq afs C done error 31 1143d 2469d 0/28 auto-obsoleted due to no activity on 2023/04/16 13:00
linux-4.19 WARNING: ODEBUG bug in __do_softirq 2 1168d 1267d 0/1 auto-closed as invalid on 2022/01/08 08:22
linux-5.15 WARNING: ODEBUG bug in __do_softirq origin:lts-only C done 1 555d 556d 3/3 fixed on 2023/06/15 21:37

Sample crash report:
audit: type=1400 audit(1537486905.494:5): avc:  denied  { associate } for  pid=2179 comm="syz-executor0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
------------[ cut here ]------------
WARNING: CPU: 1 PID: 2179 at lib/debugobjects.c:263 debug_print_object+0x181/0x210 lib/debugobjects.c:260
ODEBUG: free active (active state 0) object type: timer_list hint: igmp_timer_expire+0x0/0x3d0 net/ipv4/igmp.c:178
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 2179 Comm: syz-executor0 Not tainted 4.9.128+ #41
 ffff8801db707b40 ffffffff81af2469 ffffffff82838ba0 00000000ffffffff
 0000000000000000 0000000000000001 0000000000000107 ffff8801db707c00
 ffffffff813df985 0000000041b58ab3 ffffffff82c2896b ffffffff813df7c6
Call Trace:
 <IRQ> [  791.428271]  [<ffffffff81af2469>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ> [  791.428271]  [<ffffffff81af2469>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff813df985>] panic+0x1bf/0x39f kernel/panic.c:179
 [<ffffffff813dfc54>] __warn.cold.9+0xc1/0x17f kernel/panic.c:542
 [<ffffffff810d95d2>] warn_slowpath_fmt+0xc2/0x100 kernel/panic.c:565
 [<ffffffff81b56ee1>] debug_print_object+0x181/0x210 lib/debugobjects.c:260
 [<ffffffff81b596ee>] __debug_check_no_obj_freed lib/debugobjects.c:720 [inline]
 [<ffffffff81b596ee>] debug_check_no_obj_freed+0x4ae/0x890 lib/debugobjects.c:749
 [<ffffffff814d06dd>] slab_free_hook mm/slub.c:1348 [inline]
 [<ffffffff814d06dd>] slab_free_freelist_hook mm/slub.c:1377 [inline]
 [<ffffffff814d06dd>] slab_free mm/slub.c:2958 [inline]
 [<ffffffff814d06dd>] kfree+0x18d/0x310 mm/slub.c:3878
 [<ffffffff81246e05>] __rcu_reclaim kernel/rcu/rcu.h:113 [inline]
 [<ffffffff81246e05>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 [<ffffffff81246e05>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 [<ffffffff81246e05>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 [<ffffffff81246e05>] rcu_process_callbacks+0x9d5/0x12b0 kernel/rcu/tree.c:3037
 [<ffffffff82793200>] __do_softirq+0x210/0x940 kernel/softirq.c:288
 [<ffffffff810ece84>] invoke_softirq kernel/softirq.c:368 [inline]
 [<ffffffff810ece84>] irq_exit+0x114/0x150 kernel/softirq.c:409
 [<ffffffff82791de1>] exiting_irq arch/x86/include/asm/apic.h:669 [inline]
 [<ffffffff82791de1>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:962
 [<ffffffff8278f6ad>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:648
 <EOI> [  791.606241]  [<ffffffff819b0c03>] ? current_sid security/selinux/hooks.c:219 [inline]
 <EOI> [  791.606241]  [<ffffffff819b0c03>] ? inode_alloc_security security/selinux/hooks.c:229 [inline]
 <EOI> [  791.606241]  [<ffffffff819b0c03>] ? selinux_inode_alloc_security+0x13/0x270 security/selinux/hooks.c:2825
 [<ffffffff81998f0a>] security_inode_alloc+0x9a/0xe0 security/security.c:350
 [<ffffffff8153f62a>] inode_init_always+0x47a/0x9b0 fs/inode.c:166
 [<ffffffff81540870>] alloc_inode+0x80/0x180 fs/inode.c:214
 [<ffffffff81545fd7>] new_inode_pseudo+0x17/0xe0 fs/inode.c:890
 [<ffffffff82223021>] sock_alloc+0x41/0x280 net/socket.c:571
 [<ffffffff82223d9d>] __sock_create+0x8d/0x5f0 net/socket.c:1159
 [<ffffffff8222775e>] sock_create net/socket.c:1235 [inline]
 [<ffffffff8222775e>] SYSC_socket net/socket.c:1265 [inline]
 [<ffffffff8222775e>] SyS_socket+0xee/0x1f0 net/socket.c:1245
 [<ffffffff8100554f>] do_syscall_64+0x19f/0x480 arch/x86/entry/common.c:282
 [<ffffffff8278df13>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/09/20 23:49 https://android.googlesource.com/kernel/common android-4.9 1c57ba4f543b 6cee973c .config console log report syz ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.