syzbot


WARNING: refcount bug in p9_req_put (2)

Status: upstream: reported on 2022/09/19 04:54
Reported-by: syzbot+3ba8f2097df93bc26d2f@syzkaller.appspotmail.com
First crash: 77d, last: 10d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 WARNING: refcount bug in p9_req_put 2 1124d 1165d 0/1 auto-closed as invalid on 2020/02/28 21:29
upstream WARNING: refcount bug in p9_req_put syz inconclusive done 6 922d 1474d 17/24 fixed on 2020/11/16 12:12

Sample crash report:
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 0 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rc2-syzkaller-00107-g200204f56f3b #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 7c 5d c3 fd e9 8a fe ff ff e8 72 ca 77 fd 48 c7 c7 40 47 49 8a c6 05 04 c5 c7 09 01 e8 2b 6e 45 05 <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55
RSP: 0018:ffffc90000007d88 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffffffff8bcbc9c0 RSI: ffffffff816142b8 RDI: fffff52000000fa3
RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000010002 R11: 0000000063666572 R12: 0000000000000000
R13: ffff888074dd9c08 R14: ffff888022cc8400 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9b583a8000 CR3: 000000005d02f000 CR4: 0000000000150ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:283 [inline]
 __refcount_dec_and_test include/linux/refcount.h:315 [inline]
 refcount_dec_and_test include/linux/refcount.h:333 [inline]
 p9_req_put+0x1f2/0x250 net/9p/client.c:392
 req_done+0x1de/0x2e0 net/9p/trans_virtio.c:148
 vring_interrupt drivers/virtio/virtio_ring.c:2470 [inline]
 vring_interrupt+0x29d/0x3d0 drivers/virtio/virtio_ring.c:2445
 __handle_irq_event_percpu+0x260/0x970 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xa7/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x25f/0xd00 kernel/irq/chip.c:819
 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
 handle_irq arch/x86/kernel/irq.c:231 [inline]
 __common_interrupt+0x9d/0x210 arch/x86/kernel/irq.c:250
 common_interrupt+0xa4/0xc0 arch/x86/kernel/irq.c:240
 </IRQ>
 <TASK>
 asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:640
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:731
Code: f8 e9 8c fd ff ff 4c 89 f7 e8 b1 03 36 f8 e9 3a fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc 66 90 0f 00 2d 67 85 55 00 fb f4 <c3> 0f 1f 40 00 41 54 be 08 00 00 00 53 65 48 8b 1c 25 80 6f 02 00
RSP: 0018:ffffffff8bc07e10 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffff8bcbc9c0 RCX: ffffffff898e3d75
RDX: ffffed100590698a RSI: 0000000000000000 RDI: ffffffff89915c8f
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff88802c834c4b
R10: ffffed1005906989 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff8de16c50 R15: 0000000000000000
 default_idle_call+0x80/0xc0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:191 [inline]
 do_idle+0x410/0x590 kernel/sched/idle.c:303
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
 rest_init+0x169/0x270 init/main.c:729
 arch_call_rest_init+0xf/0x14 init/main.c:890
 start_kernel+0x478/0x499 init/main.c:1145
 secondary_startup_64_no_verify+0xce/0xdb
 </TASK>
----------------
Code disassembly (best guess):
   0:	f8                   	clc
   1:	e9 8c fd ff ff       	jmpq   0xfffffd92
   6:	4c 89 f7             	mov    %r14,%rdi
   9:	e8 b1 03 36 f8       	callq  0xf83603bf
   e:	e9 3a fd ff ff       	jmpq   0xfffffd4d
  13:	cc                   	int3
  14:	cc                   	int3
  15:	cc                   	int3
  16:	cc                   	int3
  17:	cc                   	int3
  18:	cc                   	int3
  19:	cc                   	int3
  1a:	cc                   	int3
  1b:	cc                   	int3
  1c:	cc                   	int3
  1d:	cc                   	int3
  1e:	cc                   	int3
  1f:	66 90                	xchg   %ax,%ax
  21:	0f 00 2d 67 85 55 00 	verw   0x558567(%rip)        # 0x55858f
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	c3                   	retq <-- trapping instruction
  2b:	0f 1f 40 00          	nopl   0x0(%rax)
  2f:	41 54                	push   %r12
  31:	be 08 00 00 00       	mov    $0x8,%esi
  36:	53                   	push   %rbx
  37:	65 48 8b 1c 25 80 6f 	mov    %gs:0x26f80,%rbx
  3e:	02 00

Crashes (4):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-qemu-upstream 2022/11/03 11:02 upstream 200204f56f3b 7a2ebf95 .config log report info WARNING: refcount bug in p9_req_put
ci-qemu-upstream 2022/09/12 11:57 upstream 80e78fcce86d 356d8217 .config log report info WARNING: refcount bug in p9_req_put
ci-qemu-upstream-386 2022/11/19 10:48 upstream fe24a97cf254 5bb70014 .config log report info WARNING: refcount bug in p9_req_put
ci-qemu-upstream-386 2022/10/26 20:03 upstream 98555239e4c3 86777b7f .config log report info WARNING: refcount bug in p9_req_put
* Struck through repros no longer work on HEAD.