syzbot


panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode

Status: fixed on 2022/12/01 12:27
Fix commit: 1823b16fccf7 Clean up DecRefs in mount methods.
First crash: 727d, last: 726d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode (3) C 16 377d 377d 26/26 fixed on 2023/11/17 08:30
gvisor panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode (2) C 47 566d 571d 26/26 fixed on 2023/05/17 09:52
gvisor panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode (4) C 22 311d 318d 26/26 fixed on 2024/01/22 18:53

Sample crash report:
panic: Decrementing non-positive ref count 0xc000215708, owned by tmpfs.inode

goroutine 273 [running]:
panic({0xe92cc0, 0xc000532dd0})
	GOROOT/src/runtime/panic.go:941 +0x397 fp=0xc000831a68 sp=0xc0008319a8 pc=0x435a77
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inodeRefs).DecRef(0xc000215708, 0x0?)
	bazel-out/k8-fastbuild-ST-246649c541f7/bin/pkg/sentry/fsimpl/tmpfs/inode_refs.go:125 +0x11f fp=0xc000831ad0 sp=0xc000831a68 pc=0x8133ff
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inode).decRef(0xc000215a48?, {0x1264dd0?, 0xc0007ad500?})
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:528 +0x55 fp=0xc000831b10 sp=0xc000831ad0 pc=0x81a275
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*dentry).DecRef(0x0?, {0x1264dd0?, 0xc0007ad500?})
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:387 +0x27 fp=0xc000831b38 sp=0xc000831b10 pc=0x819de7
gvisor.dev/gvisor/pkg/sentry/vfs.(*Dentry).DecRef(...)
	pkg/sentry/vfs/dentry.go:155
gvisor.dev/gvisor/pkg/sentry/vfs.VirtualDentry.DecRef({0xc0000e7980?, 0xc0000caaf0?}, {0x1264dd0, 0xc0007ad500})
	pkg/sentry/vfs/vfs.go:926 +0x45 fp=0xc000831b68 sp=0xc000831b38 pc=0x733545
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).DecRef.func1()
	pkg/sentry/vfs/file_description.go:196 +0x21e fp=0xc000831c38 sp=0xc000831b68 pc=0x71801e
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescriptionRefs).DecRef(0x71d29b?, 0xc000831cb0)
	bazel-out/k8-fastbuild-ST-246649c541f7/bin/pkg/sentry/vfs/file_description_refs.go:131 +0x4a fp=0xc000831ca0 sp=0xc000831c38 pc=0x71da4a
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).DecRef(0xc000831da0?, {0x1264dd0?, 0xc0007ad500?})
	pkg/sentry/vfs/file_description.go:161 +0x51 fp=0xc000831ce0 sp=0xc000831ca0 pc=0x717db1
gvisor.dev/gvisor/pkg/sentry/kernel.(*FDTable).drop(0xc000d0ce80?, {0x1264dd0, 0xc0007ad500}, 0xc0000e6c00)
	pkg/sentry/kernel/fd_table.go:137 +0xef fp=0xc000831d40 sp=0xc000831ce0 pc=0x8b276f
gvisor.dev/gvisor/pkg/sentry/kernel.(*FDTable).RemoveIf(0xc000d0ce80, {0x1264dd0, 0xc0007ad500}, 0x10beeb8)
	pkg/sentry/kernel/fd_table.go:501 +0x125 fp=0xc000831de0 sp=0xc000831d40 pc=0x8b4f05
gvisor.dev/gvisor/pkg/sentry/kernel.(*FDTable).DecRef.func1()
	pkg/sentry/kernel/fd_table.go:152 +0x2c fp=0xc000831e10 sp=0xc000831de0 pc=0x8b296c
gvisor.dev/gvisor/pkg/sentry/kernel.(*FDTableRefs).DecRef(0x8db0a0?, 0xc000831e88)
	bazel-out/k8-fastbuild-ST-246649c541f7/bin/pkg/sentry/kernel/fd_table_refs.go:131 +0x4a fp=0xc000831e78 sp=0xc000831e10 pc=0x8b5a2a
gvisor.dev/gvisor/pkg/sentry/kernel.(*FDTable).DecRef(0xc0007ad500?, {0x1264dd0?, 0xc0007ad500?})
	pkg/sentry/kernel/fd_table.go:151 +0x51 fp=0xc000831eb8 sp=0xc000831e78 pc=0x8b28f1
gvisor.dev/gvisor/pkg/sentry/kernel.(*runExitMain).execute(0xc0000e6a00, 0xc0007ad500)
	pkg/sentry/kernel/task_exit.go:281 +0x38c fp=0xc000831f60 sp=0xc000831eb8 pc=0x8dec6c
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc0007ad500, 0x1e)
	pkg/sentry/kernel/task_run.go:94 +0x1ac fp=0xc000831fc0 sp=0xc000831f60 pc=0x8e7a2c
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
	pkg/sentry/kernel/task_start.go:378 +0x2a fp=0xc000831fe0 sp=0xc000831fc0 pc=0x8f246a
runtime.goexit()
	src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000831fe8 sp=0xc000831fe0 pc=0x469781
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start
	pkg/sentry/kernel/task_start.go:378 +0xf9

Crashes (27):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/11/30 16:12 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-kvm panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 16:11 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-ptrace-1-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:49 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-ptrace-2-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:32 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-ptrace-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:28 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-ptrace-3-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:22 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-ptrace-2 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:22 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:22 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:22 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-ptrace-3 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:20 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-ptrace-2-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:05 gvisor 50f04e5aac0d 4c2a66e8 .config console log report syz C ci-gvisor-kvm-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/12/01 05:26 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-kvm-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/12/01 00:24 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/12/01 00:07 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/12/01 00:07 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-kvm-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 22:32 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 19:59 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 18:19 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 17:58 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 16:51 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-3-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:30 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 15:26 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 14:44 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-kvm-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 14:33 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 13:35 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 11:57 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2022/11/30 11:48 gvisor 50f04e5aac0d 4c2a66e8 .config console log report info ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
* Struck through repros no longer work on HEAD.