syzbot


WARNING: suspicious RCU usage in br_mst_set_state

Status: fixed on 2024/06/05 13:52
Subsystems: bridge
[Documentation on labels]
Reported-by: syzbot+fa04eb8a56fd923fc5d8@syzkaller.appspotmail.com
Fix commit: 3a7c1661ae13 net: bridge: mst: fix vlan use-after-free
First crash: 54d, last: 16d
Discussions (2)
Title Replies (including bot) Last reply
[PATCH net] net: bridge: mst: fix vlan use-after-free 3 (3) 2024/05/15 10:50
[syzbot] [netfilter?] WARNING: suspicious RCU usage in br_mst_set_state 0 (1) 2024/05/02 18:15
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 WARNING: suspicious RCU usage in br_mst_set_state 1 44d 44d 0/3 upstream: reported on 2024/05/09 03:44
upstream WARNING: suspicious RCU usage in br_mst_set_state (2) net 10 2d12h 13d 24/27 upstream: reported on 2024/06/08 17:29

Sample crash report:
=============================
WARNING: suspicious RCU usage
6.9.0-syzkaller-10323-g8f6a15f095a6 #0 Not tainted
-----------------------------
net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
5 locks held by kworker/u8:2/35:
 #0: ffff88802b2d0148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
 #0: ffff88802b2d0148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
 #1: ffffc90000ab7d00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #1: ffffc90000ab7d00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
 #2: ffffc90000007be0 ((&p->forward_delay_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1789
 #3: ffff888051e94cb8 (&br->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #3: ffff888051e94cb8 (&br->lock){+.-.}-{2:2}, at: br_forward_delay_timer_expired+0x50/0x440 net/bridge/br_stp_timer.c:86
 #4: ffffffff8e333d20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
 #4: ffffffff8e333d20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
 #4: ffffffff8e333d20 (rcu_read_lock){....}-{1:2}, at: br_mst_set_state+0x171/0x7a0 net/bridge/br_mst.c:105

stack backtrace:
CPU: 0 PID: 35 Comm: kworker/u8:2 Not tainted 6.9.0-syzkaller-10323-g8f6a15f095a6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712
 nbp_vlan_group net/bridge/br_private.h:1599 [inline]
 br_mst_set_state+0x29e/0x7a0 net/bridge/br_mst.c:106
 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47
 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88
 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1843 [inline]
 __run_timers kernel/time/timer.c:2417 [inline]
 __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2428
 run_timer_base kernel/time/timer.c:2437 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2447
 handle_softirqs+0x2d6/0x990 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_release+0x630/0x9f0 kernel/locking/lockdep.c:5778
Code: 3c 3b 00 74 08 4c 89 f7 e8 4d 1d 86 00 f6 84 24 91 00 00 00 02 75 77 41 f7 c5 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 27 00 00 00 00 4b c7 44 27 08 00 00 00 00 65 48 8b 04 25
RSP: 0018:ffffc90000ab7a20 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff92000156f56 RCX: ffffc90000ab7a03
RDX: 0000000000000002 RSI: ffffffff8bcaca00 RDI: ffffffff8c1f0da0
RBP: ffffc90000ab7b48 R08: ffffffff8fac0c6f R09: 1ffffffff1f5818d
R10: dffffc0000000000 R11: fffffbfff1f5818e R12: 1ffff92000156f50
R13: 0000000000000246 R14: ffffc90000ab7ab0 R15: dffffc0000000000
 rcu_lock_release include/linux/rcupdate.h:339 [inline]
 rcu_read_unlock include/linux/rcupdate.h:812 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline]
 batadv_nc_worker+0x28b/0x610 net/batman-adv/network-coding.c:719
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
bridge0: port 1(bridge_slave_0) entered learning state
bridge0: port 2(bridge_slave_1) entered learning state
----------------
Code disassembly (best guess):
   0:	3c 3b                	cmp    $0x3b,%al
   2:	00 74 08 4c          	add    %dh,0x4c(%rax,%rcx,1)
   6:	89 f7                	mov    %esi,%edi
   8:	e8 4d 1d 86 00       	call   0x861d5a
   d:	f6 84 24 91 00 00 00 	testb  $0x2,0x91(%rsp)
  14:	02
  15:	75 77                	jne    0x8e
  17:	41 f7 c5 00 02 00 00 	test   $0x200,%r13d
  1e:	74 01                	je     0x21
  20:	fb                   	sti
  21:	48 c7 44 24 60 0e 36 	movq   $0x45e0360e,0x60(%rsp)
  28:	e0 45
* 2a:	4b c7 04 27 00 00 00 	movq   $0x0,(%r15,%r12,1) <-- trapping instruction
  31:	00
  32:	4b c7 44 27 08 00 00 	movq   $0x0,0x8(%r15,%r12,1)
  39:	00 00
  3b:	65                   	gs
  3c:	48                   	rex.W
  3d:	8b                   	.byte 0x8b
  3e:	04 25                	add    $0x25,%al

Crashes (45):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/21 17:45 upstream 8f6a15f095a6 1014eca7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: suspicious RCU usage in br_mst_set_state
2024/05/13 09:03 upstream a38297e3fb01 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING: suspicious RCU usage in br_mst_set_state
2024/05/09 14:18 upstream 45db3ab70092 20bf80e1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 14:53 upstream dccb07f2914c 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 14:42 upstream dccb07f2914c 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: suspicious RCU usage in br_mst_set_state
2024/05/05 18:20 upstream 3d25a941ea50 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/02 21:07 upstream 49a73b1652c5 ddfc15a1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: suspicious RCU usage in br_mst_set_state
2024/04/29 02:02 upstream e67572cd2204 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: suspicious RCU usage in br_mst_set_state
2024/06/03 02:29 upstream c3f38fa61af7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: suspicious RCU usage in br_mst_set_state
2024/05/02 02:10 upstream 0106679839f7 3ba885bc .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: suspicious RCU usage in br_mst_set_state
2024/05/02 02:09 upstream 0106679839f7 3ba885bc .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: suspicious RCU usage in br_mst_set_state
2024/06/05 13:26 upstream 32f88d65f01b c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: suspicious RCU usage in br_mst_set_state
2024/06/05 11:10 upstream 32f88d65f01b c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 14:48 upstream dccb07f2914c 9473be88 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: suspicious RCU usage in br_mst_set_state
2024/06/04 19:12 net d6301802607b a1feae05 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/06/04 03:37 net d6301802607b 0aba2352 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/06/03 09:32 net 33700a0c9b56 0aba2352 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/31 19:41 net 13c7c941e729 3113787f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/14 12:17 net c2e0c58b25a0 fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/14 08:33 net c9f9df3f6347 fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/11 15:37 net 4c639b6a7b9d 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/11 10:24 net 4c639b6a7b9d 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/11 02:29 net a2c78977950d 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/10 14:22 net a2c78977950d f7c35481 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 17:38 net 9a169c267e94 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 17:37 net 9a169c267e94 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 14:37 net 19e35f24750d 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 14:31 net 19e35f24750d 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 14:22 net 19e35f24750d 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 14:21 net 19e35f24750d 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/04 08:45 net e0863634bf9f 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/04/28 19:08 net b2ff42c6d3ab 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/31 00:15 net-next 782471db6c72 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/26 15:15 net-next 66ad4829ddd0 a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/12 08:12 net-next cddd2dc6390b 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 19:27 net-next 252aa6d53931 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 17:52 net-next 252aa6d53931 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/08 16:21 net-next 252aa6d53931 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/07 19:21 net-next 7824463aaea9 cb2dcc0e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/06 23:50 net-next 8c4e4798123f c035c6de .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/06 08:20 net-next cdc74c9d06e7 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/05 19:52 net-next cdc74c9d06e7 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/03 07:48 net-next dcc61472534e ddfc15a1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/03 03:06 net-next dcc61472534e ddfc15a1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: suspicious RCU usage in br_mst_set_state
2024/05/09 09:46 linux-next 704ba27ac555 20bf80e1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING: suspicious RCU usage in br_mst_set_state
* Struck through repros no longer work on HEAD.