syzbot


kernel BUG in put_ucounts

Status: fixed on 2021/11/10 00:50
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+6cd79f45bb8fa1c9eeae@syzkaller.appspotmail.com
Fix commit: 345daff2e994 ucounts: Fix race condition between alloc_ucounts and put_ucounts
First crash: 1004d, last: 917d
Discussions (5)
Title Replies (including bot) Last reply
Re: [GIT PULL] ucount fix for v5.14-rc 1 (1) 2021/08/06 03:38
[GIT PULL] ucount fix for v5.14-rc 2 (2) 2021/08/05 19:26
Re: [PATCH v1] ucounts: Fix race condition between alloc_ucounts and put_ucounts 2 (2) 2021/07/28 17:05
[PATCH v1] ucounts: Fix race condition between alloc_ucounts and put_ucounts 1 (1) 2021/07/27 15:24
[syzbot] kernel BUG in put_ucounts 0 (1) 2021/07/20 08:22
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in f2fs_init_xattr_caches f2fs C 24 575d 598d 22/26 fixed on 2023/02/24 13:50
upstream kernel BUG at mm/slub.c:LINE! fs 6 2061d 2109d 0/26 closed as invalid on 2018/09/05 12:51

Sample crash report:
raw: 00fff00000001000 ffffea00002e14c8 ffffea00002e14c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(!PageCompound(page))
page_owner info is not present (never set?)
------------[ cut here ]------------
kernel BUG at mm/slub.c:3516!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8865 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:free_nonslab_page mm/slub.c:3516 [inline]
RIP: 0010:free_nonslab_page+0xb0/0x130 mm/slub.c:3512
Code: 01 fb 5b 44 89 ee 48 89 ef 5d 41 5c 41 5d e9 27 e8 f6 ff 48 8b 45 08 a8 01 75 97 48 c7 c6 60 9b 16 8b 48 89 ef e8 c0 4f ed ff <0f> 0b 48 8b 45 00 a9 00 00 01 00 75 39 48 8b 45 08 a8 01 74 dc 48
RSP: 0000:ffffc9000483fbf8 EFLAGS: 00010046
RAX: 0000000000040000 RBX: 1ffff92000907f84 RCX: ffffc90010347000
RDX: 0000000000040000 RSI: ffffffff81bd5c70 RDI: fffff52000907f55
RBP: ffffea00002e14c0 R08: 000000000000002b R09: 0000000000000000
R10: ffffffff815e264e R11: 0000000000000000 R12: ffffffff8eeff7d0
R13: ffff888010dad300 R14: ffff88808621e328 R15: ffff88801e498878
FS:  00007f2f5a659700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2f5d0eda91 CR3: 0000000086344000 CR4: 0000000000350ef0
Call Trace:
 put_ucounts+0x153/0x1c0 kernel/ucount.c:207
 __sigqueue_free.part.0+0x9b/0xe0 kernel/signal.c:468
 __sigqueue_free kernel/signal.c:465 [inline]
 dequeue_synchronous_signal kernel/signal.c:758 [inline]
 get_signal+0xbd5/0x2160 kernel/signal.c:2748
 arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
 exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
 irqentry_exit_to_user_mode+0x5/0x40 kernel/entry/common.c:313
 exc_page_fault+0xc6/0x180 arch/x86/mm/fault.c:1544
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7f2f5d0ed3d2
Code: ff e8 32 33 01 00 85 c0 0f 84 ba 01 00 00 64 f0 83 2c 25 b8 ff ff ff 01 e8 3b d1 00 00 48 8b 0c 24 8b 00 48 8b 99 80 00 00 00 <89> 81 88 00 00 00 85 c0 75 06 48 83 fb ff 74 18 48 63 44 24 14 48
RSP: 002b:00007f2f5a6591a0 EFLAGS: 00010203
RAX: 0000000000000013 RBX: 00000002be5741c3 RCX: 00007f2f5d0eda09
RDX: 00007f2f5d0ed3ae RSI: 0000000000000001 RDI: 00007f2f5a6595f0
RBP: 00007f2f5d1a0c5f R08: 00007f2f5a6591a0 R09: 00007f2f5d1a0c5f
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 00007fffec8448ef R14: 00007f2f5a659300 R15: 0000000000022000
Modules linked in:
---[ end trace 96916f6872121865 ]---
RIP: 0010:free_nonslab_page mm/slub.c:3516 [inline]
RIP: 0010:free_nonslab_page+0xb0/0x130 mm/slub.c:3512
Code: 01 fb 5b 44 89 ee 48 89 ef 5d 41 5c 41 5d e9 27 e8 f6 ff 48 8b 45 08 a8 01 75 97 48 c7 c6 60 9b 16 8b 48 89 ef e8 c0 4f ed ff <0f> 0b 48 8b 45 00 a9 00 00 01 00 75 39 48 8b 45 08 a8 01 74 dc 48
RSP: 0000:ffffc9000483fbf8 EFLAGS: 00010046
RAX: 0000000000040000 RBX: 1ffff92000907f84 RCX: ffffc90010347000
RDX: 0000000000040000 RSI: ffffffff81bd5c70 RDI: fffff52000907f55
RBP: ffffea00002e14c0 R08: 000000000000002b R09: 0000000000000000
R10: ffffffff815e264e R11: 0000000000000000 R12: ffffffff8eeff7d0
R13: ffff888010dad300 R14: ffff88808621e328 R15: ffff88801e498878
FS:  00007f2f5a659700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2f5d0eda91 CR3: 0000000086344000 CR4: 0000000000350ef0

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/10/14 13:47 upstream 348949d9a444 5462d470 .config console log report info ci-upstream-kasan-gce-root kernel BUG in put_ucounts
2021/09/27 19:26 upstream 5816b3e6577e 78494d16 .config console log report info ci-upstream-kasan-gce kernel BUG in put_ucounts
2021/07/20 07:11 upstream 2734d6c1b1a0 bc48c9ab .config console log report info ci-upstream-kasan-gce-386 kernel BUG in put_ucounts
* Struck through repros no longer work on HEAD.