syzbot


WARNING: bad unlock balance in rcu_lock_release

Status: fixed on 2020/08/18 12:30
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+f9545ab3e9f85cd43a3a@syzkaller.appspotmail.com
Fix commit: 10476e630422 locking/lockdep: Fix bad recursion pattern
First crash: 1824d, last: 1538d
Cause bisection: the cause commit could be any of (bisect log):
  9211bfbff80a netfilter: add missing IS_ENABLED(CONFIG_BRIDGE_NETFILTER) checks to header-file.
  47e640af2e49 netfilter: add missing IS_ENABLED(CONFIG_NF_TABLES) check to header-file.
  a1b2f04ea527 netfilter: add missing includes to a number of header-files.
  0abc8bf4f284 netfilter: add missing IS_ENABLED(CONFIG_NF_CONNTRACK) checks to some header-files.
  bd96b4c75675 netfilter: inline four headers files into another one.
  43dd16efc7f2 netfilter: nf_tables: store data in offload context registers
  78458e3e08cd netfilter: add missing IS_ENABLED(CONFIG_NETFILTER) checks to some header-files.
  20a9379d9a03 netfilter: remove "#ifdef __KERNEL__" guards from some headers.
  bd8699e9e292 netfilter: nft_bitwise: add offload support
  2a475c409fe8 kbuild: remove all netfilter headers from header-test blacklist.
  7e59b3fea2a2 netfilter: remove unnecessary spaces
  1b90af292e71 ipvs: Improve robustness to the ipvs sysctl
  5785cf15fd74 netfilter: nf_tables: add missing prototypes.
  0a30ba509fde netfilter: nf_nat_proto: make tables static
  e84fb4b3666d netfilter: conntrack: use shared sysctl constants
  105333435b4f netfilter: connlabels: prefer static lock initialiser
  8c0bb7873815 netfilter: synproxy: rename mss synproxy_options field
  c162610c7db2 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
  
Fix bisection: fixed by (bisect log) :
commit 10476e6304222ced7df9b3d5fb0a043b3c2a1ad8
Author: Peter Zijlstra <peterz@infradead.org>
Date: Fri Mar 13 08:56:38 2020 +0000

  locking/lockdep: Fix bad recursion pattern

  
Discussions (3)
Title Replies (including bot) Last reply
WARNING: bad unlock balance in rcu_lock_release 2 (5) 2020/04/30 06:15
Reminder: 5 open syzbot bugs in "fs/ntfs" subsystem 1 (1) 2019/07/24 02:30
Reminder: 5 open syzbot bugs in "fs/ntfs" subsystem 1 (1) 2019/07/09 20:27

Sample crash report:
=====================================
WARNING: bad unlock balance detected!
5.4.0-rc4 #0 Not tainted
-------------------------------------
syz-executor230/7782 is trying to release lock (rcu_callback) at:
[<ffffffff81612c54>] rcu_lock_release+0x4/0x20 include/linux/rcupdate.h:212
but there are no more locks to release!

other info that might help us debug this:
1 lock held by syz-executor230/7782:
 #0: ffff888092e680d8 (&type->s_umount_key#40/1){+.+.}, at: alloc_super+0x15f/0x790 fs/super.c:229

stack backtrace:
CPU: 0 PID: 7782 Comm: syz-executor230 Not tainted 5.4.0-rc4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x2f8 lib/dump_stack.c:113
 print_unlock_imbalance_bug+0x20b/0x240 kernel/locking/lockdep.c:4008
 __lock_release kernel/locking/lockdep.c:4244 [inline]
 lock_release+0x473/0x780 kernel/locking/lockdep.c:4506
 rcu_lock_release+0x1c/0x20 include/linux/rcupdate.h:214
 __rcu_reclaim kernel/rcu/rcu.h:223 [inline]
 rcu_do_batch kernel/rcu/tree.c:2157 [inline]
 rcu_core+0x84f/0x1050 kernel/rcu/tree.c:2377
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2386
 __do_softirq+0x333/0x7c4 arch/x86/include/asm/paravirt.h:766
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x227/0x230 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x113/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:756 [inline]
RIP: 0010:console_unlock+0xa65/0xef0 kernel/printk/printk.c:2481
Code: 20 00 74 0c 48 c7 c7 f0 91 8a 88 e8 f5 e6 4f 00 48 83 3d fd 00 2e 07 00 0f 84 52 04 00 00 e8 92 a7 16 00 48 8b 7c 24 10 57 9d <0f> 1f 44 00 00 f6 44 24 07 01 75 52 e8 7a a7 16 00 eb 63 0f 1f 84
RSP: 0018:ffff8880a246f930 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: ffffffff815c90fe RBX: 0000000000000200 RCX: ffff888093f8e080
RDX: 0000000000000000 RSI: ffffffff815c81a9 RDI: 0000000000000282
RBP: ffff8880a246f9f0 R08: ffff888093f8e080 R09: fffffbfff111a4f1
R10: fffffbfff111a4f1 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff88a3e8b8
 vprintk_emit+0x239/0x3a0 kernel/printk/printk.c:1996
 vprintk_default+0x28/0x30 kernel/printk/printk.c:2023
 vprintk_func+0x158/0x170 kernel/printk/printk_safe.c:386
 printk+0x62/0x8d kernel/printk/printk.c:2056
 __ntfs_error+0x185/0x190 fs/ntfs/debug.c:89
 read_ntfs_boot_sector fs/ntfs/super.c:675 [inline]
 ntfs_fill_super+0x720/0x2a40 fs/ntfs/super.c:2784
 mount_bdev+0x27c/0x390 fs/super.c:1415
 ntfs_mount+0x34/0x40 fs/ntfs/super.c:3051
 legacy_get_tree+0xf9/0x1a0 fs/fs_context.c:647
 vfs_get_tree+0x8b/0x2a0 fs/super.c:1545
 do_new_mount fs/namespace.c:2823 [inline]
 do_mount+0x16c0/0x2510 fs/namespace.c:3143
 ksys_mount+0xcc/0x100 fs/namespace.c:3352
 __do_sys_mount fs/namespace.c:3366 [inline]
 __se_sys_mount fs/namespace.c:3363 [inline]
 __x64_sys_mount+0xbf/0xd0 fs/namespace.c:3363
 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4411a9
Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffd94d98178 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004411a9
RDX: 0000000020000140 RSI: 0000000020000280 RDI: 00000000200004c0
RBP: 000000000000cb68 R08: 0000000000000000 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401fd0
R13: 0000000000402060 R14: 0000000000000000 R15: 0000000000000000

Crashes (1433):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/21 17:07 upstream 7d194c2100ad b24d2b8a .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/10/13 21:27 upstream da94001239cc 2f661ec4 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/03/31 01:43 upstream 7111951b8d49 c8d1cc20 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/30 20:42 upstream 7111951b8d49 c8d1cc20 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/30 19:06 upstream 7111951b8d49 c8d1cc20 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/30 17:34 upstream 7111951b8d49 c8d1cc20 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/30 13:14 upstream 7111951b8d49 c8d1cc20 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/30 09:25 upstream 7111951b8d49 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/30 08:02 upstream 7111951b8d49 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/30 06:10 upstream e595dd94515e 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/30 04:48 upstream e595dd94515e 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/30 01:30 upstream e595dd94515e 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/29 23:19 upstream e595dd94515e 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/29 21:05 upstream e595dd94515e 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/29 19:23 upstream e595dd94515e 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/29 10:41 upstream 906c40438bb6 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/29 09:10 upstream 906c40438bb6 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/29 07:19 upstream 906c40438bb6 05736b29 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/28 21:16 upstream 69c5eea3128e f1ebdfba .config console log report ci-upstream-kasan-gce-smack-root
2020/03/28 16:54 upstream 69c5eea3128e f1ebdfba .config console log report ci-upstream-kasan-gce-smack-root
2020/03/28 12:04 upstream 69c5eea3128e f1ebdfba .config console log report ci-upstream-kasan-gce-smack-root
2020/03/28 10:54 upstream 69c5eea3128e 831e9a81 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/27 19:52 upstream 527630fbf4f1 831e9a81 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/27 18:18 upstream 527630fbf4f1 831e9a81 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/27 13:24 upstream f3e69428b5e2 7d95711b .config console log report ci-upstream-kasan-gce-smack-root
2020/03/27 09:44 upstream f3e69428b5e2 7d95711b .config console log report ci-upstream-kasan-gce-smack-root
2020/03/27 06:28 upstream f3e69428b5e2 7d95711b .config console log report ci-upstream-kasan-gce-smack-root
2020/03/26 16:08 upstream 1b649e0bcae7 6d25c5a0 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/26 09:06 upstream 1b649e0bcae7 e8e6c7d2 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/26 03:13 upstream 1b649e0bcae7 e8e6c7d2 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/25 12:23 upstream 76ccd234269b 41f049cc .config console log report ci-upstream-kasan-gce-smack-root
2020/03/25 05:22 upstream 76ccd234269b 41f049cc .config console log report ci-upstream-kasan-gce-smack-root
2020/03/24 14:51 upstream 979e52ca0469 33e14df3 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/23 16:51 upstream 16fbf79b0f83 84f999d6 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/23 14:28 upstream 67d584e33e54 78267cec .config console log report ci-upstream-kasan-gce-smack-root
2020/03/23 10:37 upstream 67d584e33e54 78267cec .config console log report ci-upstream-kasan-gce-smack-root
2020/03/23 00:58 upstream 67d584e33e54 78267cec .config console log report ci-upstream-kasan-gce-smack-root
2020/03/22 01:24 upstream b74b991fb8b9 78267cec .config console log report ci-upstream-kasan-gce-smack-root
2020/03/22 00:20 upstream b74b991fb8b9 78267cec .config console log report ci-upstream-kasan-gce-smack-root
2020/03/21 14:20 upstream 5ad0ec0b8652 4288d95e .config console log report ci-upstream-kasan-gce-smack-root
2020/03/21 11:54 upstream 5ad0ec0b8652 4288d95e .config console log report ci-upstream-kasan-gce-smack-root
2020/03/21 06:47 upstream 5ad0ec0b8652 2c31c529 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/20 23:34 upstream 6c90b86a745a 2c31c529 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/20 22:09 upstream 6c90b86a745a 2c31c529 .config console log report ci-upstream-kasan-gce-smack-root
2020/03/20 14:04 upstream 6c90b86a745a 2c31c529 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/19 09:03 upstream bed3c0d84e7e 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.