syzbot


WARNING: bad unlock balance in __get_user_pages_remote

Status: fixed on 2020/05/10 10:42
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+a8c70b7f3579fc0587dc@syzkaller.appspotmail.com
Fix commit: c7b6a566b985 mm/gup: Mark lock taken only after a successful retake
First crash: 1476d, last: 1472d
Cause bisection: introduced by (bisect log) :
commit 71335f37c5e8ec9225285206f7f875057b9737ad
Author: Peter Xu <peterx@redhat.com>
Date: Thu Apr 2 04:08:53 2020 +0000

  mm/gup: allow to react to fatal signals

Crash: WARNING: bad unlock balance in __get_user_pages_remote (log)
Repro: syz .config
  
Discussions (2)
Title Replies (including bot) Last reply
[PATCH 0/2] mm: Two small fixes for recent syzbot reports 56 (56) 2020/05/11 15:29
WARNING: bad unlock balance in __get_user_pages_remote 1 (4) 2020/04/08 01:37
Last patch testing requests (1)
Created Duration User Patch Repo Result
2020/04/07 20:48 15m peterx@redhat.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master OK

Sample crash report:
=====================================
WARNING: bad unlock balance detected!
5.6.0-syzkaller #0 Not tainted
-------------------------------------
syz-executor151/7052 is trying to release lock (&mm->mmap_sem) at:
[<ffffffff819fbf60>] __get_user_pages_locked mm/gup.c:1366 [inline]
[<ffffffff819fbf60>] __get_user_pages_remote mm/gup.c:1831 [inline]
[<ffffffff819fbf60>] __get_user_pages_remote+0x540/0x740 mm/gup.c:1806
but there are no more locks to release!

other info that might help us debug this:
no locks held by syz-executor151/7052.

stack backtrace:
CPU: 0 PID: 7052 Comm: syz-executor151 Not tainted 5.6.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 __lock_release kernel/locking/lockdep.c:4633 [inline]
 lock_release+0x586/0x800 kernel/locking/lockdep.c:4941
 up_read+0x79/0x750 kernel/locking/rwsem.c:1573
 __get_user_pages_locked mm/gup.c:1366 [inline]
 __get_user_pages_remote mm/gup.c:1831 [inline]
 __get_user_pages_remote+0x540/0x740 mm/gup.c:1806
 pin_user_pages_remote+0x67/0xa0 mm/gup.c:2897
 process_vm_rw_single_vec mm/process_vm_access.c:108 [inline]
 process_vm_rw_core.isra.0+0x423/0x940 mm/process_vm_access.c:218
 compat_process_vm_rw+0x21f/0x240 mm/process_vm_access.c:343
 __do_compat_sys_process_vm_writev mm/process_vm_access.c:370 [inline]
 __se_compat_sys_process_vm_writev mm/process_vm_access.c:363 [inline]
 __ia32_compat_sys_process_vm_writev+0xdc/0x1b0 mm/process_vm_access.c:363
 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline]
 do_fast_syscall_32+0x270/0xe90 arch/x86/entry/common.c:396
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON(tmp < 0): count = 0xffffffffffffff00, magic = 0xffff88809e2392f8, owner = 0x3, curr 0xffff88809a6c6240, list empty
WARNING: CPU: 1 PID: 7052 at kernel/locking/rwsem.c:1435 __up_read kernel/locking/rwsem.c:1435 [inline]
WARNING: CPU: 1 PID: 7052 at kernel/locking/rwsem.c:1435 up_read+0x5f9/0x750 kernel/locking/rwsem.c:1574

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/04/08 01:37 upstream 763dede1b248 db9bcd4b .config console log report syz C ci-upstream-kasan-gce-386
2020/04/07 23:38 upstream 763dede1b248 db9bcd4b .config console log report syz ci-upstream-kasan-gce
2020/04/07 14:55 upstream 7e63420847ae 99a96044 .config console log report syz ci-upstream-kasan-gce-smack-root
2020/04/07 14:50 upstream 7e63420847ae 99a96044 .config console log report syz ci-upstream-kasan-gce
2020/04/07 16:04 upstream 7e63420847ae 99a96044 .config console log report syz ci-upstream-kasan-gce-386
2020/04/07 15:03 linux-next 5fab54423a0a 99a96044 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/04/07 21:58 upstream 763dede1b248 db9bcd4b .config console log report ci-upstream-kasan-gce
2020/04/07 14:37 upstream 7e63420847ae 99a96044 .config console log report ci-upstream-kasan-gce-smack-root
2020/04/07 14:29 upstream 7e63420847ae 99a96044 .config console log report ci-upstream-kasan-gce
2020/04/06 21:17 upstream 7e63420847ae 99a96044 .config console log report ci-upstream-kasan-gce-root
2020/04/03 22:42 upstream bef7b2a7be28 5ed396e6 .config console log report ci-upstream-kasan-gce
2020/04/07 22:31 upstream 763dede1b248 db9bcd4b .config console log report ci-upstream-kasan-gce-386
2020/04/07 21:44 upstream 763dede1b248 db9bcd4b .config console log report ci-upstream-kasan-gce-386
2020/04/07 14:41 upstream 7e63420847ae 99a96044 .config console log report ci-upstream-kasan-gce-386
2020/04/07 14:41 linux-next 5fab54423a0a 99a96044 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.