syzbot


WARNING: locking bug in __vmalloc_node_range

Status: closed as dup on 2018/11/16 07:28
Subsystems: bridge netfilter
[Documentation on labels]
Reported-by: syzbot+5adafc38d1009d56bed3@syzkaller.appspotmail.com
First crash: 1991d, last: 1991d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
WARNING: locking bug in loop_control_ioctl block C 4018 1968d 1995d

Sample crash report:
syz-executor0: vmalloc: allocation failure: 256 bytes, mode:0x6000c0(GFP_KERNEL), nodemask=(null)
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(depth <= 0)
WARNING: CPU: 0 PID: 24211 at kernel/locking/lockdep.c:3595 __lock_release kernel/locking/lockdep.c:3595 [inline]
WARNING: CPU: 0 PID: 24211 at kernel/locking/lockdep.c:3595 lock_release+0x740/0xa10 kernel/locking/lockdep.c:3863
syz-executor0 cpuset=syz0 mems_allowed=0
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 24208 Comm: syz-executor0 Not tainted 4.20.0-rc1-next-20181109+ #110
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
 warn_alloc.cold.116+0xb7/0x1bd mm/page_alloc.c:3419
 __vmalloc_node_range+0x472/0x750 mm/vmalloc.c:1766
 __vmalloc_node mm/vmalloc.c:1795 [inline]
 __vmalloc_node_flags mm/vmalloc.c:1809 [inline]
 vmalloc+0x6f/0x80 mm/vmalloc.c:1831
 do_replace+0x23b/0x4c0 net/bridge/netfilter/ebtables.c:1140
 do_ebt_set_ctl+0xe7/0x110 net/bridge/netfilter/ebtables.c:1528
 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
 nf_setsockopt+0x7d/0xd0 net/netfilter/nf_sockopt.c:115
 ip_setsockopt+0xd8/0xf0 net/ipv4/ip_sockglue.c:1260
 tcp_setsockopt+0x93/0xe0 net/ipv4/tcp.c:3072
 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2980
 __sys_setsockopt+0x1ba/0x3c0 net/socket.c:1903
 __do_sys_setsockopt net/socket.c:1914 [inline]
 __se_sys_setsockopt net/socket.c:1911 [inline]
 __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fe16d2c4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007fe16d2c4c90 RCX: 0000000000457569
RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 000000000072bf00 R08: 0000000000000240 R09: 0000000000000000
R10: 0000000020000100 R11: 0000000000000246 R12: 00007fe16d2c56d4
R13: 00000000004c3d13 R14: 00000000004d6138 R15: 0000000000000004
CPU: 0 PID: 24211 Comm: syz-executor3 Not tainted 4.20.0-rc1-next-20181109+ #110
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Mem-Info:
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
 panic+0x2ad/0x55c kernel/panic.c:188
active_anon:170564 inactive_anon:354 isolated_anon:0
 active_file:8068 inactive_file:28304 isolated_file:0
 unevictable:9379 dirty:116 writeback:0 unstable:0
 slab_reclaimable:14501 slab_unreclaimable:107427
 mapped:59814 shmem:419 pagetables:2067 bounce:0
 free:1188623 free_pcp:806 free_cma:0
Node 0 active_anon:682256kB inactive_anon:1416kB active_file:32272kB inactive_file:113216kB unevictable:37516kB isolated(anon):0kB isolated(file):0kB mapped:239256kB dirty:464kB writeback:0kB shmem:1676kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 653312kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
 __warn.cold.8+0x20/0x45 kernel/panic.c:540
Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
 report_bug+0x254/0x2d0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271
 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290
lowmem_reserve[]: 0 2818 6321 6321
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:969
RIP: 0010:__lock_release kernel/locking/lockdep.c:3595 [inline]
RIP: 0010:lock_release+0x740/0xa10 kernel/locking/lockdep.c:3863
Code: 03 38 d0 7c 08 84 d2 0f 85 da 02 00 00 8b 35 a7 95 b3 08 85 f6 75 15 48 c7 c6 20 66 2b 88 48 c7 c7 c0 33 2b 88 e8 10 36 e7 ff <0f> 0b 48 8b 95 e8 fe ff ff 4c 89 f7 48 8b b5 f0 fe ff ff e8 e8 58
RSP: 0018:ffff8801839ef868 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 1ffff1003073df12 RCX: ffffc9000be41000
RDX: 00000000000087b4 RSI: ffffffff8165ba15 RDI: 0000000000000006
RBP: ffff8801839ef998 R08: ffff88017c010600 R09: fffffbfff12b2254
R10: fffffbfff12b2254 R11: ffffffff895912a3 R12: ffffffff8b0e27a0
R13: ffff8801839ef970 R14: ffff88017c010600 R15: ffff8801839ef8b0
Node 0 DMA32 free:2887356kB min:30052kB low:37564kB high:45076kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888772kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:1416kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 0 3503 3503
Node 0 Normal free:1851116kB min:37364kB low:46704kB high:56044kB active_anon:682256kB inactive_anon:19220kB active_file:32272kB inactive_file:128516kB unevictable:4476kB writepending:464kB present:4718592kB managed:3587820kB mlocked:4496kB kernel_stack:9216kB pagetables:8268kB bounce:0kB free_pcp:1868kB local_pcp:1272kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0
 __mutex_unlock_slowpath+0x102/0x8c0 kernel/locking/mutex.c:1197
kobject: 'loop4' (00000000ca93cfbb): kobject_uevent_env
kobject: 'loop4' (00000000ca93cfbb): fill_kobj_path: path = '/devices/virtual/block/loop4'
Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB
Node 0 DMA32: 5*4kB (M) 3*8kB (M) 3*16kB (M) 3*32kB (M) 2*64kB (M) 3*128kB (M) 2*256kB (M) 3*512kB (M) 3*1024kB (M) 1*2048kB (M) 703*4096kB (M) = 2887356kB
 mutex_unlock+0xd/0x10 kernel/locking/mutex.c:713
 loop_control_ioctl+0xf5/0x4e0 drivers/block/loop.c:2095
Node 0 Normal: 3861*4kB (UM) 3426*8kB (UME) 2279*16kB (UM) 1122*32kB (UME) 509*64kB (UM) 140*128kB (UM) 27*256kB (UM) 20*512kB (UM) 9*1024kB (UME) 1*2048kB (E) 405*4096kB (M) = 1853012kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x1de/0x1790 fs/ioctl.c:696
41659 total pagecache pages
0 pages in swap cache
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:713
Swap cache stats: add 0, delete 0, find 0/0
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
Free swap  = 0kB
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
Total swap = 0kB
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
1965979 pages RAM
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
0 pages HighMem/MovableOnly
RSP: 002b:00007fc5266f3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569
RDX: 0000000000000000 RSI: 0000000000004c81 RDI: 000000000000000a
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc5266f46d4
R13: 00000000004c0631 R14: 00000000004d0b40 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/13 19:25 linux-next 442b8cea2477 5f5f6d14 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.