syzbot


WARNING: suspicious RCU usage in shmem_add_seals

Status: fixed on 2019/12/21 01:54
Reported-by: syzbot+a10503c42dbeaa14c641@syzkaller.appspotmail.com
Fix commit: 988f701a805b memfd: Use radix_tree_deref_slot_protected to avoid the warning.
First crash: 1612d, last: 1590d
Cause bisection: introduced by (bisect log) :
commit 391d4ee568b546c9900cc058b82d290e2f71a99c
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date: Fri Oct 25 16:58:35 2019 +0000

  memfd: Fix locking when tagging pins

Crash: WARNING: suspicious RCU usage in shmem_add_seals (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit 988f701a805bf980e70a557894d26564e10fc1a6
Author: zhong jiang <zhongjiang@huawei.com>
Date: Mon Nov 18 03:26:07 2019 +0000

  memfd: Use radix_tree_deref_slot_protected to avoid the warning.

  
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 WARNING: suspicious RCU usage in shmem_add_seals C 7728 1590d 1611d 0/1 public: reported C repro on 2019/10/30 10:43

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
audit: type=1400 audit(1572790266.538:36): avc:  denied  { map } for  pid=6845 comm="syz-executor220" path="/root/syz-executor220679597" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
=============================
WARNING: suspicious RCU usage
4.14.151 #0 Not tainted
-----------------------------
./include/linux/radix-tree.h:238 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syz-executor220/6845:
 #0:  (&sb->s_type->i_mutex_key#12){+.+.}, at: [<ffffffff81770c7e>] inode_lock include/linux/fs.h:718 [inline]
 #0:  (&sb->s_type->i_mutex_key#12){+.+.}, at: [<ffffffff81770c7e>] shmem_add_seals+0x15e/0x1060 mm/shmem.c:2810
 #1:  (&(&mapping->tree_lock)->rlock){-...}, at: [<ffffffff81770e54>] spin_lock_irq include/linux/spinlock.h:342 [inline]
 #1:  (&(&mapping->tree_lock)->rlock){-...}, at: [<ffffffff81770e54>] shmem_tag_pins mm/shmem.c:2665 [inline]
 #1:  (&(&mapping->tree_lock)->rlock){-...}, at: [<ffffffff81770e54>] shmem_wait_for_pins mm/shmem.c:2706 [inline]
 #1:  (&(&mapping->tree_lock)->rlock){-...}, at: [<ffffffff81770e54>] shmem_add_seals+0x334/0x1060 mm/shmem.c:2822

stack backtrace:
CPU: 0 PID: 6845 Comm: syz-executor220 Not tainted 4.14.151 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x138/0x197 lib/dump_stack.c:53
 lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:4665
 radix_tree_deref_slot include/linux/radix-tree.h:238 [inline]
 radix_tree_deref_slot include/linux/radix-tree.h:236 [inline]
 shmem_tag_pins mm/shmem.c:2667 [inline]
 shmem_wait_for_pins mm/shmem.c:2706 [inline]
 shmem_add_seals+0x9e0/0x1060 mm/shmem.c:2822
 shmem_fcntl+0xf7/0x130 mm/shmem.c:2857
 do_fcntl+0x190/0xe10 fs/fcntl.c:421
 SYSC_fcntl fs/fcntl.c:463 [inline]
 SyS_fcntl+0xd5/0x110 fs/fcntl.c:448
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4401b9
RSP: 002b:00007ffeb3400b68 EFLAGS: 00000246 ORIG_RAX: 000

Crashes (1435):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/03 14:14 linux-4.14.y ddef1e8e3f6e c9610487 .config console log report syz C ci2-linux-4-14
2019/11/03 12:32 linux-4.14.y ddef1e8e3f6e c9610487 .config console log report syz C ci2-linux-4-14
2019/10/29 09:46 linux-4.14.y ddef1e8e3f6e 5ea87a66 .config console log report syz C ci2-linux-4-14
2019/11/20 19:28 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 16:30 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 15:29 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 12:12 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 10:50 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 10:19 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 07:14 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 05:41 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 04:33 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 02:30 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/20 01:18 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 23:28 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 22:23 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 18:38 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 15:51 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 14:28 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 13:17 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 12:26 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 11:01 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 09:35 linux-4.14.y 775d01b65b5d 432c7650 .config console log report ci2-linux-4-14
2019/11/19 06:56 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/19 05:39 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/19 03:22 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/19 03:03 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/19 01:52 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 23:37 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 22:14 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 19:24 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 18:17 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 18:08 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 16:03 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 14:32 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 13:21 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 10:32 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 08:21 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 04:55 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/18 02:52 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/17 23:43 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/17 23:28 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/17 22:14 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/17 19:38 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/17 16:46 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
2019/11/17 15:34 linux-4.14.y 775d01b65b5d d5696d51 .config console log report ci2-linux-4-14
* Struck through repros no longer work on HEAD.