syzbot


general protection fault in try_to_del_timer_sync

Status: closed as invalid on 2018/09/05 12:51
Subsystems: net nfs
[Documentation on labels]
First crash: 2395d, last: 2395d

Sample crash report:
general protection fault: 0000 [#1] SMP PTI
CPU: 0 PID: 11632 Comm: syz-executor3 Not tainted 4.19.0-rc1+ #36
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__hlist_del include/linux/list.h:681 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:817 [inline]
RIP: 0010:detach_if_pending kernel/time/timer.c:834 [inline]
RIP: 0010:try_to_del_timer_sync+0x725/0x880 kernel/time/timer.c:1228
Code: 80 00 00 00 e8 6c 36 1b 00 49 83 c7 08 4d 85 f6 0f 85 40 01 00 00 4c 89 ff e8 77 2d 76 00 4c 89 20 4d 85 e4 0f 85 39 01 00 00 <4d> 89 2f eb 5a 8b 7d d0 e8 5e 36 76 00 e9 63 ff ff ff 8b 7d d0 e8
RSP: 0018:ffff8801bfe8eed8 EFLAGS: 00010046
RAX: ffffffff8a11f000 RBX: ffff880131b44400 RCX: 0000000000040000
RDX: ffffffff8a120000 RSI: 0000000000000008 RDI: dead000000000208
RBP: ffff8801bfe8ef68 R08: 0000000000480000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000080080007 R12: 0000000000000000
R13: ffff88013fd55bc8 R14: 0000000000000000 R15: dead000000000208
FS:  00007fdcde49b700(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdcde416db8 CR3: 000000012797a000 CR4: 00000000001406f0
Call Trace:
 del_timer_sync+0xaa/0x180 kernel/time/timer.c:1293
 xprt_destroy net/sunrpc/xprt.c:1503 [inline]
 xprt_destroy_kref net/sunrpc/xprt.c:1515 [inline]
 kref_put include/linux/kref.h:70 [inline]
 xprt_put+0x228/0x3b0 net/sunrpc/xprt.c:1539
 xprt_switch_free_entries net/sunrpc/xprtmultipath.c:124 [inline]
 xprt_switch_free net/sunrpc/xprtmultipath.c:135 [inline]
 kref_put include/linux/kref.h:70 [inline]
 xprt_switch_put+0x35f/0x5d0 net/sunrpc/xprtmultipath.c:161
 xprt_iter_destroy+0x41/0x70 net/sunrpc/xprtmultipath.c:408
 rpc_free_client+0x4ca/0x630 net/sunrpc/clnt.c:885
 rpc_release_client+0x2b5/0x380 net/sunrpc/clnt.c:898
 rpc_shutdown_client+0x834/0x850 net/sunrpc/clnt.c:862
 rpc_create_xprt+0x745/0xcb0 net/sunrpc/clnt.c:481
 rpc_create+0xa48/0xaf0 net/sunrpc/clnt.c:587
 nfs_create_rpc_client+0x566/0x800 fs/nfs/client.c:523
 nfs_init_client+0xb8/0x1d0 fs/nfs/client.c:634
 nfs_get_client+0x153c/0x1750 fs/nfs/client.c:425
 nfs_init_server fs/nfs/client.c:670 [inline]
 nfs_create_server+0xb33/0x31c0 fs/nfs/client.c:954
 nfs_try_mount+0x10f3/0x14f0 fs/nfs/super.c:1829
 nfs_fs_mount+0x3765/0x3df0 fs/nfs/super.c:2695
 mount_fs+0x28f/0x760 fs/super.c:1261
 vfs_kern_mount+0x21b/0x8d0 fs/namespace.c:961
 do_new_mount fs/namespace.c:2457 [inline]
 do_mount+0xcee/0x56b0 fs/namespace.c:2787
 ksys_mount+0x32e/0x3d0 fs/namespace.c:3003
 __do_sys_mount fs/namespace.c:3017 [inline]
 __se_sys_mount fs/namespace.c:3014 [inline]
 __x64_sys_mount+0x157/0x1c0 fs/namespace.c:3014
 do_syscall_64+0x15b/0x220 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x457089
Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fdcde49ac78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fdcde49b6d4 RCX: 0000000000457089
RDX: 0000000020fb5ffc RSI: 0000000020343ff8 RDI: 0000000020000140
RBP: 00000000009300a0 R08: 000000002000a000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004d2820 R14: 00000000004c7c5a R15: 0000000000000000
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace 759db2efc8201eef ]---
RIP: 0010:__hlist_del include/linux/list.h:681 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:817 [inline]
RIP: 0010:detach_if_pending kernel/time/timer.c:834 [inline]
RIP: 0010:try_to_del_timer_sync+0x725/0x880 kernel/time/timer.c:1228
Code: 80 00 00 00 e8 6c 36 1b 00 49 83 c7 08 4d 85 f6 0f 85 40 01 00 00 4c 89 ff e8 77 2d 76 00 4c 89 20 4d 85 e4 0f 85 39 01 00 00 <4d> 89 2f eb 5a 8b 7d d0 e8 5e 36 76 00 e9 63 ff ff ff 8b 7d d0 e8
RSP: 0018:ffff8801bfe8eed8 EFLAGS: 00010046
RAX: ffffffff8a11f000 RBX: ffff880131b44400 RCX: 0000000000040000
RDX: ffffffff8a120000 RSI: 0000000000000008 RDI: dead000000000208
RBP: ffff8801bfe8ef68 R08: 0000000000480000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000080080007 R12: 0000000000000000
R13: ffff88013fd55bc8 R14: 0000000000000000 R15: dead000000000208
FS:  00007fdcde49b700(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdcde416db8 CR3: 000000012797a000 CR4: 00000000001406f0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/08/28 19:18 https://github.com/google/kmsan.git master 2dca2cbde67a b771b17e .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.