syzbot


possible deadlock in userfaultfd_read

Status: fixed on 2019/03/28 12:00
Subsystems: fs
[Documentation on labels]
Fix commit: d3d6a18d7d35 aio: Fix locking in aio_poll()
First crash: 1970d, last: 1915d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in userfaultfd_read (2) fs 228 1815d 1914d 12/27 fixed on 2019/07/29 13:39
linux-4.19 possible deadlock in userfaultfd_read 19 1816d 1845d 0/1 auto-closed as invalid on 2019/11/02 18:47

Sample crash report:
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
5.1.0-rc2+ #40 Not tainted
-----------------------------------------------------
syz-executor.2/23677 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
00000000cba049aa (&ctx->fault_pending_wqh){+.+.}, at: spin_lock include/linux/spinlock.h:329 [inline]
00000000cba049aa (&ctx->fault_pending_wqh){+.+.}, at: userfaultfd_ctx_read fs/userfaultfd.c:1040 [inline]
00000000cba049aa (&ctx->fault_pending_wqh){+.+.}, at: userfaultfd_read+0x540/0x1940 fs/userfaultfd.c:1198

and this task is already holding:
00000000359d67f9 (&ctx->fd_wqh){....}, at: spin_lock_irq include/linux/spinlock.h:354 [inline]
00000000359d67f9 (&ctx->fd_wqh){....}, at: userfaultfd_ctx_read fs/userfaultfd.c:1036 [inline]
00000000359d67f9 (&ctx->fd_wqh){....}, at: userfaultfd_read+0x27a/0x1940 fs/userfaultfd.c:1198
which would create a new lock dependency:
 (&ctx->fd_wqh){....} -> (&ctx->fault_pending_wqh){+.+.}

but this new dependency connects a SOFTIRQ-irq-safe lock:
 (&(&ctx->ctx_lock)->rlock){..-.}

... which became SOFTIRQ-irq-safe at:
  lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
  __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
  _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:160
  spin_lock_irq include/linux/spinlock.h:354 [inline]
  free_ioctx_users+0x2d/0x4a0 fs/aio.c:621
  percpu_ref_put_many include/linux/percpu-refcount.h:285 [inline]
  percpu_ref_put include/linux/percpu-refcount.h:301 [inline]
  percpu_ref_call_confirm_rcu lib/percpu-refcount.c:123 [inline]
  percpu_ref_switch_to_atomic_rcu+0x3e7/0x520 lib/percpu-refcount.c:158
  __rcu_reclaim kernel/rcu/rcu.h:227 [inline]
  rcu_do_batch kernel/rcu/tree.c:2475 [inline]
  invoke_rcu_callbacks kernel/rcu/tree.c:2788 [inline]
  rcu_core+0x928/0x1390 kernel/rcu/tree.c:2769
  __do_softirq+0x266/0x95a kernel/softirq.c:293
  invoke_softirq kernel/softirq.c:374 [inline]
  irq_exit+0x180/0x1d0 kernel/softirq.c:414
  exiting_irq arch/x86/include/asm/apic.h:536 [inline]
  smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062
  apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
  __might_sleep+0x3a/0x190 kernel/sched/core.c:6136
  cache_alloc_debugcheck_before mm/slab.c:3066 [inline]
  cache_alloc_debugcheck_before mm/slab.c:3063 [inline]
  slab_alloc mm/slab.c:3382 [inline]
  kmem_cache_alloc+0x2e2/0x6f0 mm/slab.c:3554
  getname_flags fs/namei.c:138 [inline]
  getname_flags+0xd6/0x5b0 fs/namei.c:128
  getname fs/namei.c:209 [inline]
  do_renameat2+0x1f3/0xc40 fs/namei.c:4550
  __do_sys_rename fs/namei.c:4671 [inline]
  __se_sys_rename fs/namei.c:4669 [inline]
  __x64_sys_rename+0x61/0x80 fs/namei.c:4669
  do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

to a SOFTIRQ-irq-unsafe lock:
 (&ctx->fault_pending_wqh){+.+.}

... which became SOFTIRQ-irq-unsafe at:
...
  lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
  spin_lock include/linux/spinlock.h:329 [inline]
  handle_userfault+0x58e/0x18c0 fs/userfaultfd.c:461
  do_anonymous_page mm/memory.c:2941 [inline]
  handle_pte_fault mm/memory.c:3807 [inline]
  __handle_mm_fault+0x361d/0x3ec0 mm/memory.c:3933
  handle_mm_fault+0x43f/0xb30 mm/memory.c:3970
  do_user_addr_fault arch/x86/mm/fault.c:1475 [inline]
  __do_page_fault+0x5ef/0xda0 arch/x86/mm/fault.c:1541
  do_page_fault+0x71/0x581 arch/x86/mm/fault.c:1572
  page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143
  __get_user_4+0x21/0x30 arch/x86/lib/getuser.S:76
  sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3120
  __sys_setsockopt+0x180/0x280 net/socket.c:2046
  __do_sys_setsockopt net/socket.c:2057 [inline]
  __se_sys_setsockopt net/socket.c:2054 [inline]
  __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2054
  do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:
  &(&ctx->ctx_lock)->rlock --> &ctx->fd_wqh --> &ctx->fault_pending_wqh

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&ctx->fault_pending_wqh);
                               local_irq_disable();
                               lock(&(&ctx->ctx_lock)->rlock);
                               lock(&ctx->fd_wqh);
  <Interrupt>
    lock(&(&ctx->ctx_lock)->rlock);

 *** DEADLOCK ***

1 lock held by syz-executor.2/23677:
 #0: 00000000359d67f9 (&ctx->fd_wqh){....}, at: spin_lock_irq include/linux/spinlock.h:354 [inline]
 #0: 00000000359d67f9 (&ctx->fd_wqh){....}, at: userfaultfd_ctx_read fs/userfaultfd.c:1036 [inline]
 #0: 00000000359d67f9 (&ctx->fd_wqh){....}, at: userfaultfd_read+0x27a/0x1940 fs/userfaultfd.c:1198

the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
 -> (&(&ctx->ctx_lock)->rlock){..-.} {
    IN-SOFTIRQ-W at:
                      lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
                      __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                      _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:160
                      spin_lock_irq include/linux/spinlock.h:354 [inline]
                      free_ioctx_users+0x2d/0x4a0 fs/aio.c:621
                      percpu_ref_put_many include/linux/percpu-refcount.h:285 [inline]
                      percpu_ref_put include/linux/percpu-refcount.h:301 [inline]
                      percpu_ref_call_confirm_rcu lib/percpu-refcount.c:123 [inline]
                      percpu_ref_switch_to_atomic_rcu+0x3e7/0x520 lib/percpu-refcount.c:158
                      __rcu_reclaim kernel/rcu/rcu.h:227 [inline]
                      rcu_do_batch kernel/rcu/tree.c:2475 [inline]
                      invoke_rcu_callbacks kernel/rcu/tree.c:2788 [inline]
                      rcu_core+0x928/0x1390 kernel/rcu/tree.c:2769
                      __do_softirq+0x266/0x95a kernel/softirq.c:293
                      invoke_softirq kernel/softirq.c:374 [inline]
                      irq_exit+0x180/0x1d0 kernel/softirq.c:414
                      exiting_irq arch/x86/include/asm/apic.h:536 [inline]
                      smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062
                      apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
                      __might_sleep+0x3a/0x190 kernel/sched/core.c:6136
                      cache_alloc_debugcheck_before mm/slab.c:3066 [inline]
                      cache_alloc_debugcheck_before mm/slab.c:3063 [inline]
                      slab_alloc mm/slab.c:3382 [inline]
                      kmem_cache_alloc+0x2e2/0x6f0 mm/slab.c:3554
                      getname_flags fs/namei.c:138 [inline]
                      getname_flags+0xd6/0x5b0 fs/namei.c:128
                      getname fs/namei.c:209 [inline]
                      do_renameat2+0x1f3/0xc40 fs/namei.c:4550
                      __do_sys_rename fs/namei.c:4671 [inline]
                      __se_sys_rename fs/namei.c:4669 [inline]
                      __x64_sys_rename+0x61/0x80 fs/namei.c:4669
                      do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
                      entry_SYSCALL_64_after_hwframe+0x49/0xbe
    INITIAL USE at:
                     lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
                     __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                     _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:160
                     spin_lock_irq include/linux/spinlock.h:354 [inline]
                     free_ioctx_users+0x2d/0x4a0 fs/aio.c:621
                     percpu_ref_put_many include/linux/percpu-refcount.h:285 [inline]
                     percpu_ref_put include/linux/percpu-refcount.h:301 [inline]
                     percpu_ref_call_confirm_rcu lib/percpu-refcount.c:123 [inline]
                     percpu_ref_switch_to_atomic_rcu+0x3e7/0x520 lib/percpu-refcount.c:158
                     __rcu_reclaim kernel/rcu/rcu.h:227 [inline]
                     rcu_do_batch kernel/rcu/tree.c:2475 [inline]
                     invoke_rcu_callbacks kernel/rcu/tree.c:2788 [inline]
                     rcu_core+0x928/0x1390 kernel/rcu/tree.c:2769
                     __do_softirq+0x266/0x95a kernel/softirq.c:293
                     invoke_softirq kernel/softirq.c:374 [inline]
                     irq_exit+0x180/0x1d0 kernel/softirq.c:414
                     exiting_irq arch/x86/include/asm/apic.h:536 [inline]
                     smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062
                     apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
                     __might_sleep+0x3a/0x190 kernel/sched/core.c:6136
                     cache_alloc_debugcheck_before mm/slab.c:3066 [inline]
                     cache_alloc_debugcheck_before mm/slab.c:3063 [inline]
                     slab_alloc mm/slab.c:3382 [inline]
                     kmem_cache_alloc+0x2e2/0x6f0 mm/slab.c:3554
                     getname_flags fs/namei.c:138 [inline]
                     getname_flags+0xd6/0x5b0 fs/namei.c:128
                     getname fs/namei.c:209 [inline]
                     do_renameat2+0x1f3/0xc40 fs/namei.c:4550
                     __do_sys_rename fs/namei.c:4671 [inline]
                     __se_sys_rename fs/namei.c:4669 [inline]
                     __x64_sys_rename+0x61/0x80 fs/namei.c:4669
                     do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
  }
  ... key      at: [<ffffffff8a5e8ea0>] __key.52644+0x0/0x40
  ... acquired at:
   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
   spin_lock include/linux/spinlock.h:329 [inline]
   aio_poll fs/aio.c:1762 [inline]
   __io_submit_one fs/aio.c:1868 [inline]
   io_submit_one+0xe35/0x1cf0 fs/aio.c:1901
   __do_sys_io_submit fs/aio.c:1946 [inline]
   __se_sys_io_submit fs/aio.c:1916 [inline]
   __x64_sys_io_submit+0x1bd/0x580 fs/aio.c:1916
   do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
   entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> (&ctx->fd_wqh){....} {
   INITIAL USE at:
                   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
                   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                   _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152
                   __wake_up_common_lock+0xc7/0x190 kernel/sched/wait.c:120
                   __wake_up+0xe/0x10 kernel/sched/wait.c:145
                   handle_userfault+0x925/0x18c0 fs/userfaultfd.c:487
                   do_anonymous_page mm/memory.c:2941 [inline]
                   handle_pte_fault mm/memory.c:3807 [inline]
                   __handle_mm_fault+0x361d/0x3ec0 mm/memory.c:3933
                   handle_mm_fault+0x43f/0xb30 mm/memory.c:3970
                   do_user_addr_fault arch/x86/mm/fault.c:1475 [inline]
                   __do_page_fault+0x5ef/0xda0 arch/x86/mm/fault.c:1541
                   do_page_fault+0x71/0x581 arch/x86/mm/fault.c:1572
                   page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143
                   __get_user_4+0x21/0x30 arch/x86/lib/getuser.S:76
                   sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3120
                   __sys_setsockopt+0x180/0x280 net/socket.c:2046
                   __do_sys_setsockopt net/socket.c:2057 [inline]
                   __se_sys_setsockopt net/socket.c:2054 [inline]
                   __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2054
                   do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
                   entry_SYSCALL_64_after_hwframe+0x49/0xbe
 }
 ... key      at: [<ffffffff8a5e8c20>] __key.45453+0x0/0x40
 ... acquired at:
   check_prevs_add kernel/locking/lockdep.c:2333 [inline]
   validate_chain kernel/locking/lockdep.c:2714 [inline]
   __lock_acquire+0x239c/0x3fb0 kernel/locking/lockdep.c:3701
   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
   spin_lock include/linux/spinlock.h:329 [inline]
   userfaultfd_ctx_read fs/userfaultfd.c:1040 [inline]
   userfaultfd_read+0x540/0x1940 fs/userfaultfd.c:1198
   __vfs_read+0x8d/0x110 fs/read_write.c:416
   vfs_read+0x194/0x3e0 fs/read_write.c:452
   ksys_read+0xea/0x1f0 fs/read_write.c:578
   __do_sys_read fs/read_write.c:588 [inline]
   __se_sys_read fs/read_write.c:586 [inline]
   __x64_sys_read+0x73/0xb0 fs/read_write.c:586
   do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
   entry_SYSCALL_64_after_hwframe+0x49/0xbe


the dependencies between the lock to be acquired
 and SOFTIRQ-irq-unsafe lock:
-> (&ctx->fault_pending_wqh){+.+.} {
   HARDIRQ-ON-W at:
                    lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
                    spin_lock include/linux/spinlock.h:329 [inline]
                    handle_userfault+0x58e/0x18c0 fs/userfaultfd.c:461
                    do_anonymous_page mm/memory.c:2941 [inline]
                    handle_pte_fault mm/memory.c:3807 [inline]
                    __handle_mm_fault+0x361d/0x3ec0 mm/memory.c:3933
                    handle_mm_fault+0x43f/0xb30 mm/memory.c:3970
                    do_user_addr_fault arch/x86/mm/fault.c:1475 [inline]
                    __do_page_fault+0x5ef/0xda0 arch/x86/mm/fault.c:1541
                    do_page_fault+0x71/0x581 arch/x86/mm/fault.c:1572
                    page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143
                    __get_user_4+0x21/0x30 arch/x86/lib/getuser.S:76
                    sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3120
                    __sys_setsockopt+0x180/0x280 net/socket.c:2046
                    __do_sys_setsockopt net/socket.c:2057 [inline]
                    __se_sys_setsockopt net/socket.c:2054 [inline]
                    __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2054
                    do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
   SOFTIRQ-ON-W at:
                    lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
                    spin_lock include/linux/spinlock.h:329 [inline]
                    handle_userfault+0x58e/0x18c0 fs/userfaultfd.c:461
                    do_anonymous_page mm/memory.c:2941 [inline]
                    handle_pte_fault mm/memory.c:3807 [inline]
                    __handle_mm_fault+0x361d/0x3ec0 mm/memory.c:3933
                    handle_mm_fault+0x43f/0xb30 mm/memory.c:3970
                    do_user_addr_fault arch/x86/mm/fault.c:1475 [inline]
                    __do_page_fault+0x5ef/0xda0 arch/x86/mm/fault.c:1541
                    do_page_fault+0x71/0x581 arch/x86/mm/fault.c:1572
                    page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143
                    __get_user_4+0x21/0x30 arch/x86/lib/getuser.S:76
                    sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3120
                    __sys_setsockopt+0x180/0x280 net/socket.c:2046
                    __do_sys_setsockopt net/socket.c:2057 [inline]
                    __se_sys_setsockopt net/socket.c:2054 [inline]
                    __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2054
                    do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
   INITIAL USE at:
                   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
                   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
                   spin_lock include/linux/spinlock.h:329 [inline]
                   handle_userfault+0x58e/0x18c0 fs/userfaultfd.c:461
                   do_anonymous_page mm/memory.c:2941 [inline]
                   handle_pte_fault mm/memory.c:3807 [inline]
                   __handle_mm_fault+0x361d/0x3ec0 mm/memory.c:3933
                   handle_mm_fault+0x43f/0xb30 mm/memory.c:3970
                   do_user_addr_fault arch/x86/mm/fault.c:1475 [inline]
                   __do_page_fault+0x5ef/0xda0 arch/x86/mm/fault.c:1541
                   do_page_fault+0x71/0x581 arch/x86/mm/fault.c:1572
                   page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143
                   __get_user_4+0x21/0x30 arch/x86/lib/getuser.S:76
                   sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3120
                   __sys_setsockopt+0x180/0x280 net/socket.c:2046
                   __do_sys_setsockopt net/socket.c:2057 [inline]
                   __se_sys_setsockopt net/socket.c:2054 [inline]
                   __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2054
                   do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
                   entry_SYSCALL_64_after_hwframe+0x49/0xbe
 }
 ... key      at: [<ffffffff8a5e8ce0>] __key.45450+0x0/0x40
 ... acquired at:
   check_prevs_add kernel/locking/lockdep.c:2333 [inline]
   validate_chain kernel/locking/lockdep.c:2714 [inline]
   __lock_acquire+0x239c/0x3fb0 kernel/locking/lockdep.c:3701
   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
   spin_lock include/linux/spinlock.h:329 [inline]
   userfaultfd_ctx_read fs/userfaultfd.c:1040 [inline]
   userfaultfd_read+0x540/0x1940 fs/userfaultfd.c:1198
   __vfs_read+0x8d/0x110 fs/read_write.c:416
   vfs_read+0x194/0x3e0 fs/read_write.c:452
   ksys_read+0xea/0x1f0 fs/read_write.c:578
   __do_sys_read fs/read_write.c:588 [inline]
   __se_sys_read fs/read_write.c:586 [inline]
   __x64_sys_read+0x73/0xb0 fs/read_write.c:586
   do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
   entry_SYSCALL_64_after_hwframe+0x49/0xbe


stack backtrace:
CPU: 0 PID: 23677 Comm: syz-executor.2 Not tainted 5.1.0-rc2+ #40
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_bad_irq_dependency kernel/locking/lockdep.c:1920 [inline]
 check_usage.cold+0x60f/0x940 kernel/locking/lockdep.c:1952
 check_irq_usage kernel/locking/lockdep.c:1997 [inline]
 check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline]
 check_prev_add.constprop.0+0x2e3/0x23c0 kernel/locking/lockdep.c:2225
 check_prevs_add kernel/locking/lockdep.c:2333 [inline]
 validate_chain kernel/locking/lockdep.c:2714 [inline]
 __lock_acquire+0x239c/0x3fb0 kernel/locking/lockdep.c:3701
 lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
 spin_lock include/linux/spinlock.h:329 [inline]
 userfaultfd_ctx_read fs/userfaultfd.c:1040 [inline]
 userfaultfd_read+0x540/0x1940 fs/userfaultfd.c:1198
 __vfs_read+0x8d/0x110 fs/read_write.c:416
 vfs_read+0x194/0x3e0 fs/read_write.c:452
 ksys_read+0xea/0x1f0 fs/read_write.c:578
 __do_sys_read fs/read_write.c:588 [inline]
 __se_sys_read fs/read_write.c:586 [inline]
 __x64_sys_read+0x73/0xb0 fs/read_write.c:586
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458209
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd08e24dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458209
RDX: 0000000000000064 RSI: 0000000020009f9c RDI: 0000000000000008
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd08e24e6d4
R13: 00000000004c3d10 R14: 00000000004d8c08 R15: 00000000ffffffff

Crashes (239):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/28 06:20 upstream 1a9df9e29c2a f94f56fe .config console log report ci-upstream-kasan-gce-root
2019/03/28 04:51 upstream 1a9df9e29c2a f94f56fe .config console log report ci-upstream-kasan-gce
2019/03/28 03:36 upstream 1a9df9e29c2a f94f56fe .config console log report ci-upstream-kasan-gce-smack-root
2019/03/27 21:51 upstream 14c741de9386 4e668495 .config console log report ci-upstream-kasan-gce
2019/03/27 12:27 upstream 65ae689329c5 55684ce1 .config console log report ci-upstream-kasan-gce-root
2019/03/27 10:12 upstream 65ae689329c5 55684ce1 .config console log report ci-upstream-kasan-gce
2019/03/27 01:11 upstream 14c741de9386 55684ce1 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/27 00:00 upstream a3ac7917b730 55684ce1 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/26 23:27 upstream a3ac7917b730 55684ce1 .config console log report ci-upstream-kasan-gce-root
2019/03/26 22:08 upstream a3ac7917b730 55684ce1 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/26 17:41 upstream a3ac7917b730 55684ce1 .config console log report ci-upstream-kasan-gce
2019/03/26 06:42 upstream a3ac7917b730 55684ce1 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/26 04:43 upstream 8c2ffd917477 55684ce1 .config console log report ci-upstream-kasan-gce
2019/03/25 21:56 upstream 8c2ffd917477 55684ce1 .config console log report ci-upstream-kasan-gce-root
2019/03/25 16:54 upstream 8c2ffd917477 2c86e0a5 .config console log report ci-upstream-kasan-gce
2019/03/25 15:28 upstream 8c2ffd917477 2c86e0a5 .config console log report ci-upstream-kasan-gce
2019/03/25 12:29 upstream 8c2ffd917477 2c86e0a5 .config console log report ci-upstream-kasan-gce
2019/03/25 03:02 upstream 8c2ffd917477 2c86e0a5 .config console log report ci-upstream-kasan-gce
2019/03/24 23:48 upstream 1bdd3dbfff7a acbc5b7d .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/24 18:24 upstream 1bdd3dbfff7a acbc5b7d .config console log report ci-upstream-kasan-gce
2019/03/24 09:07 upstream 1bdd3dbfff7a acbc5b7d .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/24 07:57 upstream 1bdd3dbfff7a a2cef203 .config console log report ci-upstream-kasan-gce-root
2019/03/24 00:04 upstream a5ed1e96cafd a2cef203 .config console log report ci-upstream-kasan-gce
2019/03/23 22:19 upstream a5ed1e96cafd a2cef203 .config console log report ci-upstream-kasan-gce
2019/03/23 15:03 upstream a5ed1e96cafd a2cef203 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/23 13:47 upstream a5ed1e96cafd 3361bde5 .config console log report ci-upstream-kasan-gce-root
2019/03/23 09:15 upstream fd1f297b794c 3361bde5 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 19:55 upstream fd1f297b794c 3361bde5 .config console log report ci-upstream-kasan-gce-root
2019/03/21 23:44 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/21 18:44 upstream 54c490164523 dce6e62f .config console log report ci-upstream-kasan-gce-smack-root
2019/03/21 16:42 upstream 54c490164523 dce6e62f .config console log report ci-upstream-kasan-gce-smack-root
2019/03/21 15:35 upstream 54c490164523 427ea487 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/20 15:00 upstream babf09c3837f a664c187 .config console log report ci-upstream-kasan-gce-root
2019/03/20 13:34 upstream babf09c3837f a664c187 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/20 09:01 upstream b7a42146dca3 2458c1c6 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/19 19:48 upstream b7a42146dca3 e4549234 .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/01 22:13 upstream 5eeb63359b1e 564f9a4f .config console log report ci-upstream-kasan-gce-smack-root
2019/03/27 14:57 upstream 65ae689329c5 4e668495 .config console log report ci-upstream-kasan-gce-386
2019/03/24 03:19 upstream a5ed1e96cafd a2cef203 .config console log report ci-upstream-kasan-gce-386
2019/03/27 13:39 linux-next a392ee45bae7 4e668495 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/27 04:43 linux-next ab8bba4ec4b9 55684ce1 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/26 13:03 linux-next ab8bba4ec4b9 55684ce1 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/25 20:08 linux-next e382d91f5f80 2c86e0a5 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/25 01:47 linux-next e382d91f5f80 2c86e0a5 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/24 06:54 linux-next e382d91f5f80 a2cef203 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/22 18:31 linux-next e382d91f5f80 dce6e62f .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/22 11:55 linux-next 32a217bae32c dce6e62f .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/22 06:38 linux-next 32a217bae32c dce6e62f .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/21 04:30 linux-next 32a217bae32c 427ea487 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/20 12:24 linux-next 835727301ed3 142c38ee .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/20 00:12 linux-next 75e6a83b189c 2458c1c6 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/19 21:39 linux-next 75e6a83b189c e4549234 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.