syzbot


WARNING in print_tainted

Status: upstream: reported on 2022/12/19 10:37
Subsystems: can (incorrect?)
Reported-by: syzbot+5aed6c3aaba661f5b917@syzkaller.appspotmail.com
Fix commit: c6adf659a8ba can: isotp: check CAN address family in isotp_bind() 4f027cba8216 can: isotp: split tx timer into transmission and timeout
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 95d, last: 4d06h

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 13864 at net/sched/sch_generic.c:525 dev_watchdog+0x2a0/0x2d0 net/sched/sch_generic.c:525
NETDEV WATCHDOG: usb0 (cdc_ether): transmit queue 0 timed out
Modules linked in:
Kernel panic - not syncing: kernel: panic_on_warn set ...
CPU: 0 PID: 13864 Comm: kworker/0:1 Not tainted 6.3.0-rc2-syzkaller #0
Hardware name: ARM-Versatile Express
Workqueue: usb_hub_wq hub_event
Backtrace: frame pointer underflow
[<817b16fc>] (dump_backtrace) from [<817b17f0>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:256)
 r7:81d81a88 r6:82422c04 r5:60000193 r4:81d90198
[<817b17d8>] (show_stack) from [<817cde00>] (__dump_stack lib/dump_stack.c:88 [inline])
[<817b17d8>] (show_stack) from [<817cde00>] (dump_stack_lvl+0x48/0x54 lib/dump_stack.c:106)
[<817cddb8>] (dump_stack_lvl) from [<817cde24>] (dump_stack+0x18/0x1c lib/dump_stack.c:113)
 r5:00000000 r4:8264dd14
[<817cde0c>] (dump_stack) from [<817b22e4>] (panic+0x11c/0x36c kernel/panic.c:340)
[<817b21c8>] (panic) from [<802422c4>] (print_tainted+0x0/0xa0 kernel/panic.c:236)
 r3:8240c488 r2:00000001 r1:81d79f94 r0:81d81a88
 r7:8138de34
[<80242240>] (check_panic_on_warn) from [<802424b8>] (__warn+0x7c/0x180 kernel/panic.c:673)
[<8024243c>] (__warn) from [<80242700>] (warn_slowpath_fmt+0x144/0x1d8 kernel/panic.c:704)
 r8:00000009 r7:0000020d r6:81f27584 r5:8240c954 r4:822ab6bc
[<802425c0>] (warn_slowpath_fmt) from [<8138de34>] (dev_watchdog+0x2a0/0x2d0 net/sched/sch_generic.c:525)
 r10:dddcaa80 r9:825e052d r8:82404d40 r7:00000000 r6:85146800 r5:85146a94
 r4:85146ae8
[<8138db94>] (dev_watchdog) from [<802e6dbc>] (call_timer_fn+0x30/0x220 kernel/time/timer.c:1700)
 r10:dddcaa80 r9:00049780 r8:00000101 r7:8138db94 r6:840ed080 r5:df801efc
 r4:85146ae8
[<802e6d8c>] (call_timer_fn) from [<802e72f8>] (expire_timers kernel/time/timer.c:1751 [inline])
[<802e6d8c>] (call_timer_fn) from [<802e72f8>] (__run_timers kernel/time/timer.c:2022 [inline])
[<802e6d8c>] (call_timer_fn) from [<802e72f8>] (run_timer_softirq+0x34c/0x4bc kernel/time/timer.c:2035)
 r9:840ed080 r8:8240c498 r7:00000000 r6:825e1370 r5:df801efc r4:85146ae8
[<802e6fac>] (run_timer_softirq) from [<80201338>] (__do_softirq+0x16c/0x480 kernel/softirq.c:571)
 r10:840ed080 r9:00000101 r8:00000282 r7:dfb25bc8 r6:00000001 r5:00000002
 r4:82404084
[<802011cc>] (__do_softirq) from [<8024adb0>] (invoke_softirq kernel/softirq.c:445 [inline])
[<802011cc>] (__do_softirq) from [<8024adb0>] (__irq_exit_rcu kernel/softirq.c:650 [inline])
[<802011cc>] (__do_softirq) from [<8024adb0>] (__irq_exit_rcu kernel/softirq.c:640 [inline])
[<802011cc>] (__do_softirq) from [<8024adb0>] (irq_exit+0x9c/0xe8 kernel/softirq.c:674)
 r10:85856404 r9:840ed080 r8:00000000 r7:dfb25bc8 r6:81f47c6c r5:81f47c84
 r4:822ad840
[<8024ad14>] (irq_exit) from [<817ce4f8>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:240)
 r5:81f47c84 r4:822ad81c
[<817ce47c>] (generic_handle_arch_irq) from [<817837e4>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40)
 r9:840ed080 r8:00000200 r7:dfb25bfc r6:ffffffff r5:60000113 r4:817d9f40
[<817837c8>] (call_with_stack) from [<80200b44>] (__irq_svc+0x84/0xac arch/arm/kernel/entry-armv.S:221)
Exception stack(0xdfb25bc8 to 0xdfb25c10)
5bc0:                   82707810 00000000 89995a94 0000b449 85856400 85856418
5be0: 82707810 82707810 00000200 81e67c6c 85856404 dfb25c24 dfb25c28 dfb25c18
5c00: 80cff45c 817d9f40 60000113 ffffffff
[<817d9f18>] (_raw_spin_unlock_irq) from [<80cff45c>] (spin_unlock_irq include/linux/spinlock.h:400 [inline])
[<817d9f18>] (_raw_spin_unlock_irq) from [<80cff45c>] (usb_hcd_flush_endpoint+0x90/0x194 drivers/usb/core/hcd.c:1819)
[<80cff3cc>] (usb_hcd_flush_endpoint) from [<80d02ef8>] (usb_disable_endpoint drivers/usb/core/message.c:1304 [inline])
[<80cff3cc>] (usb_hcd_flush_endpoint) from [<80d02ef8>] (usb_disable_interface+0x5c/0xdc drivers/usb/core/message.c:1350)
 r10:85856400 r9:85856800 r8:00000000 r7:85384508 r6:00000000 r5:00000038
 r4:00000000
[<80d02e9c>] (usb_disable_interface) from [<80d05654>] (usb_unbind_interface+0x124/0x288 drivers/usb/core/driver.c:456)
 r10:00000002 r9:85856880 r8:00000044 r7:85855020 r6:82571a9c r5:00000000
 r4:85855020 r3:00000006
[<80d05530>] (usb_unbind_interface) from [<809f56f4>] (device_remove drivers/base/dd.c:542 [inline])
[<80d05530>] (usb_unbind_interface) from [<809f56f4>] (device_remove+0x64/0x6c drivers/base/dd.c:534)
 r10:00000002 r9:85384508 r8:00000044 r7:85855064 r6:82571a9c r5:00000000
 r4:85855020
[<809f5690>] (device_remove) from [<809f6cb0>] (__device_release_driver drivers/base/dd.c:1240 [inline])
[<809f5690>] (device_remove) from [<809f6cb0>] (device_release_driver_internal+0x188/0x1fc drivers/base/dd.c:1263)
 r5:00000000 r4:85855020
[<809f6b28>] (device_release_driver_internal) from [<809f6d3c>] (device_release_driver+0x18/0x1c drivers/base/dd.c:1286)
 r9:85384508 r8:82a51d40 r7:82a51d38 r6:82a51d0c r5:85855020 r4:82a51d30
[<809f6d24>] (device_release_driver) from [<809f4e4c>] (bus_remove_device+0xcc/0x120 drivers/base/bus.c:574)
[<809f4d80>] (bus_remove_device) from [<809ef614>] (device_del+0x16c/0x3c8 drivers/base/core.c:3775)
 r9:85384508 r8:85856880 r7:840ed080 r6:827001ec r5:85855064 r4:85855020
[<809ef4a8>] (device_del) from [<80d03060>] (usb_disable_device+0xe8/0x1f4 drivers/usb/core/message.c:1420)
 r10:00000002 r9:85384508 r8:00000000 r7:00000000 r6:85855000 r5:85856800
 r4:00000070
[<80d02f78>] (usb_disable_device) from [<80cf7ebc>] (usb_disconnect+0xe4/0x26c drivers/usb/core/hub.c:2238)
 r10:00000001 r9:858568c4 r8:85856880 r7:00000100 r6:84e35c00 r5:85856800
 r4:83aba800
[<80cf7dd8>] (usb_disconnect) from [<80cfaee4>] (hub_port_connect drivers/usb/core/hub.c:5246 [inline])
[<80cf7dd8>] (usb_disconnect) from [<80cfaee4>] (hub_port_connect_change drivers/usb/core/hub.c:5551 [inline])
[<80cf7dd8>] (usb_disconnect) from [<80cfaee4>] (port_event drivers/usb/core/hub.c:5711 [inline])
[<80cf7dd8>] (usb_disconnect) from [<80cfaee4>] (hub_event+0x1290/0x19a0 drivers/usb/core/hub.c:5793)
 r10:00000001 r9:83a4fa00 r8:83a4fb00 r7:00000100 r6:00000001 r5:83aba000
 r4:83abaa04
[<80cf9c54>] (hub_event) from [<80263344>] (process_one_work+0x20c/0x594 kernel/workqueue.c:2390)
 r10:ddddaa05 r9:840ed080 r8:00000000 r7:ddddaa00 r6:dddd3880 r5:8527ef00
 r4:83a4fb00
[<80263138>] (process_one_work) from [<80263b34>] (worker_thread+0x6c/0x4e0 kernel/workqueue.c:2537)
 r10:dddd3880 r9:00000008 r8:82404d40 r7:dddd389c r6:8527ef18 r5:dddd3880
 r4:8527ef00
[<80263ac8>] (worker_thread) from [<8026aa5c>] (kthread+0xec/0x11c kernel/kthread.c:376)
 r10:00000000 r9:dfa1de8c r8:85265300 r7:8527ef00 r6:80263ac8 r5:840ed080
 r4:85265700
[<8026a970>] (kthread) from [<80200100>] (ret_from_fork+0x14/0x34 arch/arm/kernel/entry-common.S:133)
Exception stack(0xdfb25fb0 to 0xdfb25ff8)
5fa0:                                     00000000 00000000 00000000 00000000
5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8026a970 r4:85265700
Rebooting in 86400 seconds..

Crashes (17):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-qemu2-arm32 2023/03/18 14:18 upstream 478a351ce0d6 7939252e .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/03/10 05:59 upstream 44889ba56cbb f08b59ac .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/01/25 14:27 upstream 948ef7bb70c4 7374c4e5 .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/01/25 02:24 upstream fb6e71db53f3 7374c4e5 .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/01/22 12:43 upstream f67144022885 7374c4e5 .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/01/21 03:28 upstream edc00350d205 7374c4e5 .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/01/13 21:45 upstream d863f0539b52 529798b0 .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/01/09 23:35 upstream 1fe4fd6f5cad 48bc529a .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/01/09 11:50 upstream 1fe4fd6f5cad 1dac8c7a .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/01/08 14:52 upstream e9ffbf16caa6 1dac8c7a .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2023/01/04 17:57 upstream 69b41ac87e4a 1dac8c7a .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2022/12/26 17:18 upstream 1b929c02afd3 9da18ae8 .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2022/12/24 07:47 upstream a27405b2ed9c 9da18ae8 .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2022/12/23 20:12 upstream a27405b2ed9c 9da18ae8 .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2022/12/20 17:38 upstream 6feb57c2fd7c 4791c8e9 .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2022/12/19 21:39 upstream 2f26e424552e c52b2efb .config console log report info WARNING in print_tainted
ci-qemu2-arm32 2022/12/17 01:30 upstream 77856d911a8c 05494336 .config console log report info WARNING in print_tainted
* Struck through repros no longer work on HEAD.