syzbot


BUG: sleeping function called from invalid context in vm_map_ram

Status: closed as invalid on 2023/03/24 10:23
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+6d9043ea38ed2b9ef000@syzkaller.appspotmail.com
First crash: 400d, last: 396d
Cause bisection: introduced by (bisect log) :
commit 8f4977bdd77ee3dce8af81488231e7535695f889
Author: Lorenzo Stoakes <lstoakes@gmail.com>
Date: Sun Mar 19 07:09:31 2023 +0000

  mm: vmalloc: use rwsem, mutex for vmap_area_lock and vmap_block->lock

Crash: BUG: sleeping function called from invalid context in vm_map_ram (log)
Repro: C syz .config
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [xfs?] BUG: sleeping function called from invalid context in vm_map_ram 1 (2) 2023/03/22 05:41

Sample crash report:
loop0: detected capacity change from 0 to 65536
XFS (loop0): Mounting V4 Filesystem 5e6273b8-2167-42bb-911b-418aa14a1261
XFS (loop0): Starting recovery (logdev: internal)
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5092, name: syz-executor364
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
2 locks held by syz-executor364/5092:
 #0: ffff8880759980e0 (&type->s_umount_key#41/1){+.+.}-{3:3}, at: alloc_super+0x22e/0xb60 fs/super.c:228
 #1: ffffffff8c796440 (rcu_read_lock){....}-{1:2}, at: vb_alloc mm/vmalloc.c:2090 [inline]
 #1: ffffffff8c796440 (rcu_read_lock){....}-{1:2}, at: vm_map_ram+0x7a/0xcf0 mm/vmalloc.c:2290
CPU: 0 PID: 5092 Comm: syz-executor364 Not tainted 6.3.0-rc3-next-20230320-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106
 __might_resched+0x358/0x580 kernel/sched/core.c:10059
 __mutex_lock_common kernel/locking/mutex.c:580 [inline]
 __mutex_lock+0x9f/0x1350 kernel/locking/mutex.c:747
 vb_alloc mm/vmalloc.c:2105 [inline]
 vm_map_ram+0x13d/0xcf0 mm/vmalloc.c:2290
 _xfs_buf_map_pages+0x158/0x3a0 fs/xfs/xfs_buf.c:441
 xfs_buf_get_map+0x1cb8/0x2fd0 fs/xfs/xfs_buf.c:719
 xfs_buf_read_map+0xce/0xb10 fs/xfs/xfs_buf.c:811
 xfs_buf_readahead_map+0x8c/0xc0 fs/xfs/xfs_buf.c:889
 xfs_buf_readahead fs/xfs/xfs_buf.h:262 [inline]
 xlog_buf_readahead+0x121/0x140 fs/xfs/xfs_log_recover.c:1939
 xlog_recover_inode_ra_pass2+0x1cb/0x230 fs/xfs/xfs_inode_item_recover.c:34
 xlog_recover_commit_trans+0x266/0x960 fs/xfs/xfs_log_recover.c:2004
 xlog_recovery_process_trans+0x19d/0x1c0 fs/xfs/xfs_log_recover.c:2257
 xlog_recover_process_ophdr+0x1e5/0x3f0 fs/xfs/xfs_log_recover.c:2403
 xlog_recover_process_data+0x1f3/0x3d0 fs/xfs/xfs_log_recover.c:2445
 xlog_recover_process+0x257/0x2e0 fs/xfs/xfs_log_recover.c:2900
 xlog_do_recovery_pass+0x90c/0xd80 fs/xfs/xfs_log_recover.c:3186
 xlog_do_log_recovery+0x85/0xb0 fs/xfs/xfs_log_recover.c:3266
 xlog_do_recover+0xdf/0x580 fs/xfs/xfs_log_recover.c:3294
 xlog_recover+0x2a8/0x500 fs/xfs/xfs_log_recover.c:3427
 xfs_log_mount+0x36e/0x700 fs/xfs/xfs_log.c:741
 xfs_mountfs+0x11e1/0x1f60 fs/xfs/xfs_mount.c:819
 xfs_fs_fill_super+0x1412/0x1f30 fs/xfs/xfs_super.c:1677
 get_tree_bdev+0x444/0x760 fs/super.c:1303
 vfs_get_tree+0x8d/0x350 fs/super.c:1510
 do_new_mount fs/namespace.c:3039 [inline]
 path_mount+0x134b/0x1e40 fs/namespace.c:3369
 do_mount fs/namespace.c:3382 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __x64_sys_mount+0x283/0x300 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f3b2886ed8a
Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd50e43ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f3b2886ed8a
RDX: 000000002000bb00 RSI: 000000002000bb40 RDI: 00007ffd50e43f10
RBP: 00007ffd50e43f10 R08: 00007ffd50e43f50 R09: 000000000000bb6a
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 000055555638e2c0 R14: 0000000000000000 R15: 00007ffd50e43f50
 </TASK>

=============================
[ BUG: Invalid wait context ]
6.3.0-rc3-next-20230320-syzkaller #0 Tainted: G        W         
-----------------------------
syz-executor364/5092 is trying to lock:
ffff88802181f868 (&vb->lock){+.+.}-{3:3}, at: vb_alloc mm/vmalloc.c:2105 [inline]
ffff88802181f868 (&vb->lock){+.+.}-{3:3}, at: vm_map_ram+0x13d/0xcf0 mm/vmalloc.c:2290
other info that might help us debug this:
context-{4:4}
2 locks held by syz-executor364/5092:
 #0: ffff8880759980e0 (&type->s_umount_key#41/1){+.+.}-{3:3}, at: alloc_super+0x22e/0xb60 fs/super.c:228
 #1: ffffffff8c796440 (rcu_read_lock){....}-{1:2}, at: vb_alloc mm/vmalloc.c:2090 [inline]
 #1: ffffffff8c796440 (rcu_read_lock){....}-{1:2}, at: vm_map_ram+0x7a/0xcf0 mm/vmalloc.c:2290
stack backtrace:
CPU: 0 PID: 5092 Comm: syz-executor364 Tainted: G        W          6.3.0-rc3-next-20230320-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4724 [inline]
 check_wait_context kernel/locking/lockdep.c:4785 [inline]
 __lock_acquire+0x159e/0x5df0 kernel/locking/lockdep.c:5024
 lock_acquire.part.0+0x11c/0x370 kernel/locking/lockdep.c:5691
 __mutex_lock_common kernel/locking/mutex.c:603 [inline]
 __mutex_lock+0x12f/0x1350 kernel/locking/mutex.c:747
 vb_alloc mm/vmalloc.c:2105 [inline]
 vm_map_ram+0x13d/0xcf0 mm/vmalloc.c:2290
 _xfs_buf_map_pages+0x158/0x3a0 fs/xfs/xfs_buf.c:441
 xfs_buf_get_map+0x1cb8/0x2fd0 fs/xfs/xfs_buf.c:719
 xfs_buf_read_map+0xce/0xb10 fs/xfs/xfs_buf.c:811
 xfs_buf_readahead_map+0x8c/0xc0 fs/xfs/xfs_buf.c:889
 xfs_buf_readahead fs/xfs/xfs_buf.h:262 [inline]
 xlog_buf_readahead+0x121/0x140 fs/xfs/xfs_log_recover.c:1939
 xlog_recover_inode_ra_pass2+0x1cb/0x230 fs/xfs/xfs_inode_item_recover.c:34
 xlog_recover_commit_trans+0x266/0x960 fs/xfs/xfs_log_recover.c:2004
 xlog_recovery_process_trans+0x19d/0x1c0 fs/xfs/xfs_log_recover.c:2257
 xlog_recover_process_ophdr+0x1e5/0x3f0 fs/xfs/xfs_log_recover.c:2403
 xlog_recover_process_data+0x1f3/0x3d0 fs/xfs/xfs_log_recover.c:2445
 xlog_recover_process+0x257/0x2e0 fs/xfs/xfs_log_recover.c:2900
 xlog_do_recovery_pass+0x90c/0xd80 fs/xfs/xfs_log_recover.c:3186
 xlog_do_log_recovery+0x85/0xb0 fs/xfs/xfs_log_recover.c:3266
 xlog_do_recover+0xdf/0x580 fs/xfs/xfs_log_recover.c:3294
 xlog_recover+0x2a8/0x500 fs/xfs/xfs_log_recover.c:3427
 xfs_log_mount+0x36e/0x700 fs/xfs/xfs_log.c:741
 xfs_mountfs+0x11e1/0x1f60 fs/xfs/xfs_mount.c:819
 xfs_fs_fill_super+0x1412/0x1f30 fs/xfs/xfs_super.c:1677
 get_tree_bdev+0x444/0x760 fs/super.c:1303
 vfs_get_tree+0x8d/0x350 fs/super.c:1510
 do_new_mount fs/namespace.c:3039 [inline]
 path_mount+0x134b/0x1e40 fs/namespace.c:3369
 do_mount fs/namespace.c:3382 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __x64_sys_mount+0x283/0x300 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f3b2886ed8a
Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd50e43ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f3b2886ed8a
RDX: 000000002000bb00 RSI: 000000002000bb40 RDI: 00007ffd50e43f10
RBP: 00007ffd50e43f10 R08: 00007ffd50e43f50 R09: 000000000000bb6a
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 000055555638e2c0 R14: 0000000000000000 R15: 00007ffd50e43f50
 </TASK>
XFS (loop0): Ending recovery (logdev: internal)
xfs filesystem being mounted at /root/syzkaller.5R8rAp/1/file0 supports timestamps until 2038-01-19 (0x7fffffff)

Crashes (1222):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/03/21 00:27 linux-next 73f2c2a7e1d2 7939252e .config strace log report syz C [mounted in repro] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/20 23:22 linux-next 73f2c2a7e1d2 7939252e .config strace log report syz C [mounted in repro] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 17:15 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 17:15 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 16:13 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 15:54 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 14:51 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 14:37 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 13:28 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 12:18 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 11:15 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 10:31 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 09:25 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 08:16 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 06:43 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 06:11 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 05:42 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 05:12 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 04:20 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 03:19 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 02:18 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 01:13 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/23 00:06 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 23:44 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 22:34 linux-next 0aa250ce67a2 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 21:15 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 20:34 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 20:07 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 19:45 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 19:15 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 18:50 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 18:08 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 17:53 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 16:53 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 15:35 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 14:27 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 14:15 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 13:04 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 11:54 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 10:44 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 10:15 linux-next 0aa250ce67a2 d846e076 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 09:10 linux-next 0aa250ce67a2 8b4eb097 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 08:07 linux-next 0aa250ce67a2 8b4eb097 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
2023/03/22 07:37 linux-next 0aa250ce67a2 8b4eb097 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: sleeping function called from invalid context in vm_map_ram
* Struck through repros no longer work on HEAD.