syzbot


panic: Decrementing non-positive ref count ADDR, owned by kernel.ProcessGroup (2)

Status: fixed on 2022/10/07 23:11
Fix commit: 36ddd3050cc2 Check if ThreadGroup exists before executing JoinProcessGroup.
First crash: 815d, last: 780d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: Decrementing non-positive ref count ADDR, owned by kernel.ProcessGroup 1 995d 988d 0/26 auto-closed as invalid on 2022/06/05 05:48

Sample crash report:
panic: Decrementing non-positive ref count 0xc000527140, owned by kernel.ProcessGroup

goroutine 322 [running]:
panic({0xfe33a0, 0xc000b1b7d0})
	GOROOT/src/runtime/panic.go:941 +0x397 fp=0xc000997408 sp=0xc000997348 pc=0x435837
gvisor.dev/gvisor/pkg/sentry/kernel.(*ProcessGroupRefs).DecRef(0xc000527140, 0x2?)
	bazel-out/k8-fastbuild-ST-246649c541f7/bin/pkg/sentry/kernel/process_group_refs.go:125 +0x16a fp=0xc000997470 sp=0xc000997408 pc=0x9f15aa
gvisor.dev/gvisor/pkg/sentry/kernel.(*ProcessGroup).decRefWithParent(0xc000527140, 0xc0005189c0?)
	pkg/sentry/kernel/sessions.go:159 +0x8d fp=0xc0009974b0 sp=0xc000997470 pc=0x9fdf2d
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).exitNotifyLocked(0xc000cd2000, 0x0)
	pkg/sentry/kernel/task_exit.go:714 +0x97b fp=0xc000997560 sp=0xc0009974b0 pc=0xa1309b
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).waitCollectZombieLocked(0xc000926a80, 0xc000cd2000, 0xc0009978e0, 0x0?)
	pkg/sentry/kernel/task_exit.go:1109 +0x435 fp=0xc0009975a8 sp=0xc000997560 pc=0xa14dd5
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).waitParentLocked(0x203000?, 0xc0009978e0, 0xc000926a80)
	pkg/sentry/kernel/task_exit.go:977 +0x131 fp=0xc000997668 sp=0xc0009975a8 pc=0xa144b1
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).waitOnce(0xc000926a80, 0xc0009978e0)
	pkg/sentry/kernel/task_exit.go:944 +0x225 fp=0xc0009976d0 sp=0xc000997668 pc=0xa14285
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Wait(0xa07630?, 0xc000997800?)
	pkg/sentry/kernel/task_exit.go:917 +0x1ca fp=0xc000997790 sp=0xc0009976d0 pc=0xa13dea
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.wait4(0xc000926a80, 0x0?, 0x7ff93d68dc04, 0x40000001, 0x0)
	pkg/sentry/syscalls/linux/sys_thread.go:288 +0x1b4 fp=0xc000997920 sp=0xc000997790 pc=0xad4294
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Wait4(0x0?, {{0xffffffff}, {0x7ff93d68dc04}, {0x40000001}, {0x0}, {0x2fdca105}, {0x46}})
	pkg/sentry/syscalls/linux/sys_thread.go:316 +0x5e fp=0xc000997958 sp=0xc000997920 pc=0xad455e
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc000926a80, 0x3d, {{0xffffffff}, {0x7ff93d68dc04}, {0x40000001}, {0x0}, {0x2fdca105}, {0x46}})
	pkg/sentry/kernel/task_syscall.go:142 +0x80b fp=0xc000997c98 sp=0xc000997958 pc=0xa2b4eb
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc000926a80, 0x85?, {{0xffffffff}, {0x7ff93d68dc04}, {0x40000001}, {0x0}, {0x2fdca105}, {0x46}})
	pkg/sentry/kernel/task_syscall.go:322 +0x54 fp=0xc000997cf8 sp=0xc000997c98 pc=0xa2cad4
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0x8bf92f?, 0x0?, {{0xffffffff}, {0x7ff93d68dc04}, {0x40000001}, {0x0}, {0x2fdca105}, {0x46}})
	pkg/sentry/kernel/task_syscall.go:282 +0x85 fp=0xc000997d58 sp=0xc000997cf8 pc=0xa2c6c5
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc00034c5b0?)
	pkg/sentry/kernel/task_syscall.go:257 +0x3ac fp=0xc000997e50 sp=0xc000997d58 pc=0xa2c38c
gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc0001de400?, 0xc000926a80)
	pkg/sentry/kernel/task_run.go:253 +0x1125 fp=0xc000997f60 sp=0xc000997e50 pc=0xa1e105
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc000926a80, 0xd)
	pkg/sentry/kernel/task_run.go:94 +0x1ec fp=0xc000997fc0 sp=0xc000997f60 pc=0xa1c94c
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
	pkg/sentry/kernel/task_start.go:380 +0x2a fp=0xc000997fe0 sp=0xc000997fc0 pc=0xa2998a
runtime.goexit()
	src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000997fe8 sp=0xc000997fe0 pc=0x4693c1
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start
	pkg/sentry/kernel/task_start.go:380 +0x105

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/09/03 12:53 gvisor dade50095a41 49e94a20 .config console log report syz C ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by kernel.ProcessGroup
2022/10/07 18:39 gvisor 1f101ba738bf 79a59635 .config console log report info ci-gvisor-ptrace-2-cover panic: Decrementing non-positive ref count ADDR, owned by kernel.ProcessGroup
2022/09/03 12:46 gvisor dade50095a41 49e94a20 .config console log report info ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by kernel.ProcessGroup
* Struck through repros no longer work on HEAD.