syzbot


BUG: soft lockup in do_raw_spin_unlock

Status: closed as invalid on 2018/05/19 09:33
Subsystems: fs
[Documentation on labels]
First crash: 2177d, last: 2177d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: soft lockup in do_raw_spin_unlock (2) fs 1 2153d 2153d 8/26 fixed on 2018/07/09 18:05

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor5:4459]
Modules linked in:
irq event stamp: 12497856
hardirqs last  enabled at (12497855): [<ffffffff81c6992f>] seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline]
hardirqs last  enabled at (12497855): [<ffffffff81c6992f>] read_seqcount_begin include/linux/seqlock.h:164 [inline]
hardirqs last  enabled at (12497855): [<ffffffff81c6992f>] read_seqbegin include/linux/seqlock.h:433 [inline]
hardirqs last  enabled at (12497855): [<ffffffff81c6992f>] read_seqbegin_or_lock include/linux/seqlock.h:529 [inline]
hardirqs last  enabled at (12497855): [<ffffffff81c6992f>] d_walk+0x80f/0xc80 fs/dcache.c:1248
hardirqs last disabled at (12497856): [<ffffffff87800905>] interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625
softirqs last  enabled at (609566): [<ffffffff87a00778>] __do_softirq+0x778/0xaf5 kernel/softirq.c:311
softirqs last disabled at (609511): [<ffffffff81475241>] invoke_softirq kernel/softirq.c:365 [inline]
softirqs last disabled at (609511): [<ffffffff81475241>] irq_exit+0x1d1/0x200 kernel/softirq.c:405
CPU: 0 PID: 4459 Comm: syz-executor5 Not tainted 4.17.0-rc4+ #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bytes_is_nonzero mm/kasan/kasan.c:167 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/kasan.c:184 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/kasan.c:210 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/kasan.c:241 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/kasan.c:257 [inline]
RIP: 0010:check_memory_region+0x121/0x1b0 mm/kasan/kasan.c:267
RSP: 0018:ffff8801a4217910 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffffed00376a2c69 RBX: 1ffff100376a2c68 RCX: ffffffff815e08fe
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8801bb516340
RBP: ffff8801a4217928 R08: ffffed00376a2c69 R09: ffffed00376a2c68
R10: ffffed00376a2c68 R11: ffff8801bb516343 R12: ffffed00376a2c69
R13: dffffc0000000000 R14: ffff8801a42179a8 R15: ffff8801a4217b50
FS:  000000000203b940(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000002044978 CR3: 00000001a4087000 CR4: 00000000001406f0
DR0: 00000000200001c0 DR1: 00000000200001c0 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
 queued_spin_is_locked include/asm-generic/qspinlock.h:36 [inline]
 debug_spin_unlock kernel/locking/spinlock_debug.c:98 [inline]
 do_raw_spin_unlock+0x9e/0x2e0 kernel/locking/spinlock_debug.c:134
 __raw_spin_unlock include/linux/spinlock_api_smp.h:151 [inline]
 _raw_spin_unlock+0x22/0x30 kernel/locking/spinlock.c:176
 spin_unlock include/linux/spinlock.h:350 [inline]
 d_walk+0x451/0xc80 fs/dcache.c:1298
 shrink_dcache_parent+0x179/0x230 fs/dcache.c:1486
 vfs_rmdir+0x202/0x470 fs/namei.c:3850
 do_rmdir+0x523/0x610 fs/namei.c:3911
 __do_sys_rmdir fs/namei.c:3929 [inline]
 __se_sys_rmdir fs/namei.c:3927 [inline]
 __x64_sys_rmdir+0x36/0x40 fs/namei.c:3927
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455777
RSP: 002b:00007ffe8bc48db8 EFLAGS: 00000206 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000455777
RDX: 0000000000000000 RSI: 00007ffe8bc4ab60 RDI: 00007ffe8bc4ab60
RBP: 00007ffe8bc4ab60 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000206 R12: 000000000203c940
R13: 0000000000000000 R14: 00000000000001da R15: 000000000001b450
Code: 49 29 c0 e9 6c ff ff ff 4d 85 c0 74 ba 48 b8 01 00 00 00 00 fc ff df 4d 01 c8 48 01 d8 41 80 39 00 74 08 e9 8c 00 00 00 48 89 d8 <4c> 39 c0 74 97 80 38 00 48 8d 58 01 74 ef eb 87 4c 89 c0 49 39 
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4461 Comm: syz-executor4 Not tainted 4.17.0-rc4+ #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:mark_lock+0x14/0x19e0 kernel/locking/lockdep.c:3115
RSP: 0018:ffff8801a35f7510 EFLAGS: 00000002
RAX: 0000000000000001 RBX: 000000000000010e RCX: 0000000000000006
RDX: dffffc0000000000 RSI: ffff8801a35ec9d8 RDI: ffff8801a35ec100
RBP: ffff8801a35f78a8 R08: 0000000000000006 R09: 0000000000000004
R10: ffff8801a35ec100 R11: ffff8801a35ec100 R12: ffff8801a35ec9fa
R13: 0000000000000001 R14: 0000000000000004 R15: ffff8801a35ec924
FS:  0000000002218940(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31a22000 CR3: 00000001a34de000 CR4: 00000000001406e0
DR0: 00000000200001c0 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 lock_acquire+0x1dc/0x520 kernel/locking/lockdep.c:3920
 _raw_spin_lock_nested+0x28/0x40 kernel/locking/spinlock.c:354
 d_walk+0x3ad/0xc80 fs/dcache.c:1274
 shrink_dcache_parent+0x179/0x230 fs/dcache.c:1486
 vfs_rmdir+0x202/0x470 fs/namei.c:3850
 do_rmdir+0x523/0x610 fs/namei.c:3911
 __do_sys_rmdir fs/namei.c:3929 [inline]
 __se_sys_rmdir fs/namei.c:3927 [inline]
 __x64_sys_rmdir+0x36/0x40 fs/namei.c:3927
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455777
RSP: 002b:00007ffc55a90be8 EFLAGS: 00000206 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000455777
RDX: 0000000000000000 RSI: 00007ffc55a92990 RDI: 00007ffc55a92990
RBP: 00007ffc55a92990 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000206 R12: 0000000002219940
R13: 0000000000000000 R14: 00000000000001f2 R15: 000000000001b4b8
Code: 5f 5d c3 0f 0b e8 7d 73 59 00 eb d8 e8 96 73 59 00 eb 87 0f 1f 40 00 55 41 89 d0 49 89 fa 48 ba 00 00 00 00 00 fc ff df 44 89 c1 <48> 89 e5 41 57 41 bf 01 00 00 00 41 56 41 d3 e7 41 55 4c 8d 6e 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/05/19 02:26 bpf-next 82f9e2d5dba6 849705db .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.