syzbot


WARNING: suspicious RCU usage in 4 (3)

Status: auto-closed as invalid on 2021/05/21 06:13
Reported-by: syzbot+65127a13f7bf887e23a2@syzkaller.appspotmail.com
First crash: 519d, last: 519d
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 WARNING: suspicious RCU usage in 4 3 1052d 1092d 0/1 auto-closed as invalid on 2019/12/05 20:57
linux-4.14 WARNING: suspicious RCU usage in 4 (2) 3 721d 853d 0/1 auto-closed as invalid on 2020/10/31 00:33
android-414 WARNING: suspicious RCU usage in 4 1 956d 956d 0/1 auto-closed as invalid on 2020/03/10 17:38

Sample crash report:
=============================
WARNING: suspicious RCU usage
CPU: 0 PID: 19226 Comm: syz-executor.5 Not tainted 4.14.216-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
4.14.216-syzkaller #0 Not tainted
-----------------------------
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc mm/slab.c:3376 [inline]
 kmem_cache_alloc+0x28e/0x3c0 mm/slab.c:3550
 kmem_cache_zalloc include/linux/slab.h:651 [inline]
 __kernfs_new_node+0x6f/0x470 fs/kernfs/dir.c:632
 kernfs_new_node+0x7b/0xe0 fs/kernfs/dir.c:677
 __kernfs_create_file+0x3d/0x320 fs/kernfs/file.c:989
 sysfs_add_file_mode_ns+0x1e1/0x450 fs/sysfs/file.c:307
 create_files fs/sysfs/group.c:64 [inline]
 internal_create_group+0x22b/0x710 fs/sysfs/group.c:134
 loop_sysfs_init drivers/block/loop.c:821 [inline]
 loop_set_fd drivers/block/loop.c:946 [inline]
 lo_ioctl+0x1137/0x1cd0 drivers/block/loop.c:1417
 __blkdev_driver_ioctl block/ioctl.c:297 [inline]
 blkdev_ioctl+0x540/0x1830 block/ioctl.c:594
net/tipc/bearer.c:177 suspicious rcu_dereference_protected() usage!
 block_ioctl+0xd9/0x120 fs/block_dev.c:1893
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292

other info that might help us debug this:

 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e087
RSP: 002b:00007f2b80084a18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045e087
RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005
RBP: 0000000000000000 R08: 00007f2b80084ac8 R09: 0000000000000000
R10: 00007f2b80084acc R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000004 R14: 0000000000000004 R15: 00000000200002d0
ntfs: (device loop5): parse_options(): The errors option requires an argument.

rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syz-executor.4/19232:
 #0:  (cb_lock){++++}, at: [<ffffffff85e0f845>] genl_rcv+0x15/0x40 net/netlink/genetlink.c:635
 #1:  (genl_mutex){+.+.}, at: [<ffffffff85e104a2>] genl_lock net/netlink/genetlink.c:33 [inline]
 #1:  (genl_mutex){+.+.}, at: [<ffffffff85e104a2>] genl_rcv_msg+0x112/0x140 net/netlink/genetlink.c:623

stack backtrace:
CPU: 1 PID: 19232 Comm: syz-executor.4 Not tainted 4.14.216-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 tipc_bearer_find+0x1ff/0x2f0 net/tipc/bearer.c:177
 tipc_nl_compat_link_set+0x40b/0xb90 net/tipc/netlink_compat.c:807
 __tipc_nl_compat_doit net/tipc/netlink_compat.c:316 [inline]
 tipc_nl_compat_doit+0x192/0x5d0 net/tipc/netlink_compat.c:364
 tipc_nl_compat_handle net/tipc/netlink_compat.c:1215 [inline]
 tipc_nl_compat_recv+0xa0b/0xae0 net/tipc/netlink_compat.c:1297
 genl_family_rcv_msg+0x572/0xb20 net/netlink/genetlink.c:600
 genl_rcv_msg+0xaf/0x140 net/netlink/genetlink.c:625
 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2433
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:636
 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
 netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e219
RSP: 002b:00007f338a114c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219
RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000007
RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c
R13: 00007ffeb04a856f R14: 00007f338a1159c0 R15: 000000000119bf8c
ntfs: (device loop5): parse_options(): Unrecognized mount option errors/{ZWj>w\3r}
PA)V1.
ntfs: (device loop5): parse_options(): Unrecognized mount option errors/{ZWj>w\3r}
PA)V1.
ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size.
ntfs: (device loop5): parse_options(): Unrecognized mount option ./file0.
squashfs: SQUASHFS error: Can't find a SQUASHFS superblock on loop3
ntfs: (device loop5): parse_options(): The errors option requires an argument.
ntfs: (device loop5): parse_options(): The errors option requires an argument.
squashfs: SQUASHFS error: Can't find a SQUASHFS superblock on loop3
ntfs: (device loop5): parse_options(): The errors option requires an argument.
ntfs: (device loop5): parse_options(): Unrecognized mount option disable_eparse.
SQUASHFS error: squashfs_read_data failed to read block 0x0
squashfs: SQUASHFS error: unable to read squashfs_super_block
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
MTD: Attempt to mount non-MTD device "/dev/loop5"
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
romfs: VFS: Can't find a romfs filesystem on dev loop5.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
NILFS (loop1): couldn't find nilfs on the device
kauditd_printk_skb: 18 callbacks suppressed
audit: type=1804 audit(1611209558.642:20): pid=19766 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir815431819/syzkaller.bGUFSk/343/bus" dev="sda1" ino=15954 res=1
audit: type=1804 audit(1611209558.722:21): pid=19832 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir815431819/syzkaller.bGUFSk/343/bus" dev="sda1" ino=15954 res=1
audit: type=1804 audit(1611209558.732:22): pid=19832 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir815431819/syzkaller.bGUFSk/343/bus" dev="sda1" ino=15954 res=1
ntfs: (device loop5): parse_options(): Unrecognized mount option umaskYa.
ntfs: (device loop5): parse_options(): Unrecognized mount option disable_sZ p?x?dnHars.
ntfs: (device loop5): parse_options(): Unrecognized mount option umaskYa.
ntfs: (device loop5): parse_options(): Unrecognized mount option disable_sZ p?x?dnHars.
ntfs: (device loop5): parse_options(): Unrecognized mount option disabla_sparsy8|"q.
syz-executor.2 uses obsolete (PF_INET,SOCK_PACKET)
ntfs: (device loop5): parse_options(): Unrecognized mount option disabla_sparsy8|"q.
ntfs: (device loop5): parse_options(): Unrecognized mount option .
vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4)
vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(7)
vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
vhci_hcd: connection closed
vhci_hcd: stop threads
vhci_hcd: connection closed
vhci_hcd: release socket
vhci_hcd: disconnect device
vhci_hcd: stop threads
vhci_hcd: release socket
vhci_hcd: disconnect device
vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(3)
vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(5)
vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
vhci_hcd: connection closed
vhci_hcd: connection closed
vhci_hcd: stop threads
vhci_hcd: release socket
vhci_hcd: disconnect device
vhci_hcd: stop threads
vhci_hcd: release socket
vhci_hcd: disconnect device
nla_parse: 2 callbacks suppressed
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'.

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-14 2021/01/21 06:12 linux-4.14.y 2762b48e9611 d4f4eca5 .config log report info WARNING: suspicious RCU usage in 4