syzbot


panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode (2)

Status: fixed on 2023/05/17 09:52
Fix commit: 283b80a456aa Fix logic bug in attaching mounts.
First crash: 571d, last: 566d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode C 27 726d 727d 14/26 fixed on 2022/12/01 12:27
gvisor panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode (3) C 16 377d 377d 26/26 fixed on 2023/11/17 08:30
gvisor panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode (4) C 22 311d 318d 26/26 fixed on 2024/01/22 18:53

Sample crash report:
panic: Decrementing non-positive ref count 0xc0007a7858, owned by tmpfs.inode

goroutine 219 [running]:
panic({0x2b3500, 0xc000900d30})
	GOROOT/src/runtime/panic.go:987 +0x3bb fp=0xc0008bef88 sp=0xc0008beec8 pc=0x11f38fb
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inodeRefs).DecRef(0xc0007a7858, 0xc0008beff8)
	bazel-out/k8-fastbuild-ST-3dcbe13c9b87/bin/pkg/sentry/fsimpl/tmpfs/inode_refs.go:125 +0x148 fp=0xc0008befe8 sp=0xc0008bef88 pc=0x19512e8
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inode).decRef(0xc0007a7850, {0x75b278, 0xc0004b1500})
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:552 +0x8b fp=0xc0008bf028 sp=0xc0008befe8 pc=0x195cc6b
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*dentry).DecRef(0xc0007a7800, {0x75b278, 0xc0004b1500})
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:411 +0x69 fp=0xc0008bf050 sp=0xc0008bf028 pc=0x195c089
gvisor.dev/gvisor/pkg/sentry/vfs.(*Dentry).DecRef(0xc0007a7800, {0x75b278, 0xc0004b1500})
	pkg/sentry/vfs/dentry.go:155 +0x71 fp=0xc0008bf078 sp=0xc0008bf050 pc=0x175ad31
gvisor.dev/gvisor/pkg/sentry/vfs.(*Mount).destroy(0xc0006e7880, {0x75b278, 0xc0004b1500})
	pkg/sentry/vfs/mount.go:741 +0x17d fp=0xc0008bf0d0 sp=0xc0008bf078 pc=0x177d39d
gvisor.dev/gvisor/pkg/sentry/vfs.(*Mount).DecRef(0xc0006e7880, {0x75b278, 0xc0004b1500})
	pkg/sentry/vfs/mount.go:727 +0xcc fp=0xc0008bf100 sp=0xc0008bf0d0 pc=0x177d1cc
gvisor.dev/gvisor/pkg/sentry/vfs.VirtualDentry.DecRef({0xc0006e7880?, 0xc0007a7800?}, {0x75b278, 0xc0004b1500})
	pkg/sentry/vfs/vfs.go:1020 +0x7e fp=0xc0008bf138 sp=0xc0008bf100 pc=0x1797d5e
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.(*taskPathOperation).Release(0xc0008bf450, 0x0?)
	pkg/sentry/syscalls/linux/path.go:77 +0xd9 fp=0xc0008bf178 sp=0xc0008bf138 pc=0x1d11979
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Mount.func1()
	pkg/sentry/syscalls/linux/sys_mount.go:70 +0x48 fp=0xc0008bf1a8 sp=0xc0008bf178 pc=0x1d483a8
runtime.deferreturn()
	GOROOT/src/runtime/panic.go:476 +0x33 fp=0xc0008bf1e8 sp=0xc0008bf1a8 pc=0x11f2a13
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Mount(0xc0004b1500, 0xc0008bf5d0?, {{0x20000000}, {0x200000c0}, {0x0}, {0x1000}, {0x0}, {0x7febe1926e78}})
	pkg/sentry/syscalls/linux/sys_mount.go:85 +0x616 fp=0xc0008bf550 sp=0xc0008bf1e8 pc=0x1d47576
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc0004b1500, 0xa5, {{0x20000000}, {0x200000c0}, {0x0}, {0x1000}, {0x0}, {0x7febe1926e78}})
	pkg/sentry/kernel/task_syscall.go:142 +0xabf fp=0xc0008bf968 sp=0xc0008bf550 pc=0x1b19a5f
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc0004b1500, 0x1?, {{0x20000000}, {0x200000c0}, {0x0}, {0x1000}, {0x0}, {0x7febe1926e78}})
	pkg/sentry/kernel/task_syscall.go:322 +0x8e fp=0xc0008bfa08 sp=0xc0008bf968 pc=0x1b1bb6e
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc0007ca4b0?, 0xc0008bfb37?, {{0x20000000}, {0x200000c0}, {0x0}, {0x1000}, {0x0}, {0x7febe1926e78}})
	pkg/sentry/kernel/task_syscall.go:282 +0xc5 fp=0xc0008bfa80 sp=0xc0008bfa08 pc=0x1b1b465
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc0004b1500)
	pkg/sentry/kernel/task_syscall.go:257 +0x53b fp=0xc0008bfba8 sp=0xc0008bfa80 pc=0x1b1af7b
gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc0004b1500?, 0xc0004b1500)
	pkg/sentry/kernel/task_run.go:269 +0x22b4 fp=0xc0008bfe68 sp=0xc0008bfba8 pc=0x1b03b74
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc0004b1500, 0xa)
	pkg/sentry/kernel/task_run.go:98 +0x35b fp=0xc0008bffb0 sp=0xc0008bfe68 pc=0x1b00e5b
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
	pkg/sentry/kernel/task_start.go:377 +0x48 fp=0xc0008bffe0 sp=0xc0008bffb0 pc=0x1b17148
runtime.goexit()
	src/runtime/asm_amd64.s:1598 +0x1 fp=0xc0008bffe8 sp=0xc0008bffe0 pc=0x122c841
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start
	pkg/sentry/kernel/task_start.go:377 +0x1da

Crashes (47):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/05/10 13:49 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-ptrace-3-race-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:41 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-systrap-1-race-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:35 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-ptrace-1-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:35 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-ptrace-3-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:34 gvisor a1006d486d30 dfd5a9ac console log report syz C ci-gvisor-ptrace-2 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:34 gvisor a1006d486d30 14b12a99 console log report syz C ci-gvisor-kvm panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:32 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:30 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:30 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-systrap-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:30 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-ptrace-2-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:30 gvisor a1006d486d30 dfd5a9ac console log report syz C ci-gvisor-ptrace-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:29 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-systrap-1-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:29 gvisor a1006d486d30 dfd5a9ac console log report syz C ci-gvisor-systrap-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:29 gvisor a1006d486d30 dfd5a9ac .config console log report syz C ci-gvisor-ptrace-2-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:28 gvisor a1006d486d30 dfd5a9ac console log report syz C ci-gvisor-ptrace-3 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/10 13:13 gvisor a1006d486d30 14b12a99 .config console log report syz C ci-gvisor-kvm-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 15:36 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-systrap-1-race-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 15:08 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-systrap-1-race-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:32 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-3-race-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:15 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-2-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:15 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-1-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:13 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-kvm-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:09 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-systrap-1-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:09 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-3-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:09 gvisor ff424dce7f0f abac29b5 console log report syz C ci-gvisor-ptrace-3 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:09 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-2-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:07 gvisor ff424dce7f0f abac29b5 console log report syz C ci-gvisor-kvm panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:06 gvisor ff424dce7f0f abac29b5 console log report syz C ci-gvisor-ptrace-2 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:05 gvisor ff424dce7f0f abac29b5 console log report syz C ci-gvisor-ptrace-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:04 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-3-race-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:04 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:01 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 14:00 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-systrap-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:57 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-1-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:56 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-2-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:55 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:53 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-kvm-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:52 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:50 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-systrap-1-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:50 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-3-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:50 gvisor ff424dce7f0f abac29b5 console log report syz C ci-gvisor-ptrace-3 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:50 gvisor ff424dce7f0f abac29b5 console log report syz C ci-gvisor-systrap-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:49 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-ptrace-2-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:48 gvisor ff424dce7f0f abac29b5 console log report syz C ci-gvisor-kvm panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:47 gvisor ff424dce7f0f abac29b5 console log report syz C ci-gvisor-ptrace-2 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:45 gvisor ff424dce7f0f abac29b5 .config console log report syz C ci-gvisor-systrap-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2023/05/05 13:34 gvisor ff424dce7f0f abac29b5 console log report syz C ci-gvisor-ptrace-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
* Struck through repros no longer work on HEAD.