syzbot


WARNING: lock held when returning to user space in tun_get_user

Status: fixed on 2019/04/10 16:37
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 9180bb4f0460 tun: add a missing rcu_read_unlock() in error path
First crash: 1290d, last: 1289d

Cause bisection: introduced by (bisect log) :
commit 4477138fa0ae4e1b699786ef0600863ea6e6c61c
Author: Eric Dumazet <edumazet@google.com>
Date: Fri Mar 15 03:19:47 2019 +0000

  tun: properly test for IFF_UP

Crash: WARNING: lock held when returning to user space in tun_get_user (log)
Repro: C syz .config
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: lock held when returning to user space in tun_get_user (2) 7 967d 978d 16/24 fixed on 2020/02/18 14:31

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
================================================
WARNING: lock held when returning to user space!
5.0.0+ #124 Not tainted
------------------------------------------------
syz-executor528/7804 is leaving the kernel with locks still held!
1 lock held by syz-executor528/7804:
 #0: 0000000080d6340f (rcu_read_lock){....}, at: tun_get_user+0x12d1/0x3f10 drivers/net/tun.c:1956
WARNING: CPU: 1 PID: 7804 at kernel/rcu/tree_plugin.h:314 rcu_note_context_switch+0x32c/0x1750 kernel/rcu/tree_plugin.h:314
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 7804 Comm: syz-executor528 Not tainted 5.0.0+ #124
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 panic+0x2cb/0x65c kernel/panic.c:214
 __warn.cold+0x20/0x45 kernel/panic.c:571
 report_bug+0x263/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:179 [inline]
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973
RIP: 0010:rcu_note_context_switch+0x32c/0x1750 kernel/rcu/tree_plugin.h:314
Code: 8b 13 48 85 d2 75 c0 48 8b 5d c8 65 ff 0d fc 58 a3 7e 0f 85 41 fd ff ff e8 22 d2 a1 ff e9 37 fd ff ff 85 d2 0f 8e e3 00 00 00 <0f> 0b e9 50 fe ff ff 65 8b 05 76 ec a2 7e 83 f8 3f 0f 87 41 0a 00
RSP: 0000:ffff8880a5a47d60 EFLAGS: 00010002
RAX: ffffffff895e3e18 RBX: ffff8880ae92dd80 RCX: 1ffff11014989946
RDX: 0000000000000001 RSI: ffffffff8330d1fc RDI: ffff8880a4c4ca30
RBP: ffff8880a5a47dd8 R08: 0000000000000000 R09: ffffed1015d25bc8
R10: ffffed1015d25bc7 R11: ffff8880ae92de3b R12: 0000000000000000
R13: 000000000002cf80 R14: ffff8880a4c4c6c0 R15: ffff8880a4c4c6c0
 __schedule+0x1f4/0x1cc0 kernel/sched/core.c:3446
 schedule+0x92/0x180 kernel/sched/core.c:3562
 exit_to_usermode_loop+0x195/0x2c0 arch/x86/entry/common.c:152
 prepare_exit_to_usermode+0x279/0x2e0 arch/x86/entry/common.c:197
 retint_user+0x8/0x18
RIP: 0033:0x4413a0
Code: 05 48 3d 01 f0 ff ff 0f 83 3d 0f fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 71 8c 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 14 0f fc ff c3 48 83 ec 08 e8 7a 2b 00 00
RSP: 002b:00007ffff9f61888 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: fffffffffffffffb RBX: 00007ffff9f618a0 RCX: 00000000004413a0
RDX: 0000000000000001 RSI: 00007ffff9f618c0 RDI: 00000000000000f0
RBP: 0000000000000003 R08: 00000000bb1414ac R09: 00000000bb1414ac
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004a89d0
R13: 00000000004027d0 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (55):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-net-this-kasan-gce 2019/03/16 09:44 net 4477138fa0ae bab43553 .config log report syz C
ci-upstream-net-this-kasan-gce 2019/03/16 20:45 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 19:41 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 19:36 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 19:33 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 19:18 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 19:17 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 19:11 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 19:04 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 18:58 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 18:28 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 18:07 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 18:00 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 17:57 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 17:40 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 17:14 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 17:12 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 16:48 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 16:45 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 16:10 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 15:39 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 15:37 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 15:34 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 15:24 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 15:22 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 14:49 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 14:45 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 14:21 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 14:11 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 14:06 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 14:03 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 14:03 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 13:54 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 13:36 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 13:11 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 13:01 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 12:10 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 11:23 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 11:22 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 11:11 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 08:47 net 4477138fa0ae bab43553 .config log report
ci-upstream-net-this-kasan-gce 2019/03/16 08:23 net 4477138fa0ae bab43553 .config log report
* Struck through repros no longer work on HEAD.