syzbot


panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode (4)

Status: fixed on 2024/01/22 18:53
Fix commit: 7b151e25d076 Don't drop the mountpoint reference in already umounted dead mountpoints.
First crash: 318d, last: 311d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode C 27 726d 727d 14/26 fixed on 2022/12/01 12:27
gvisor panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode (3) C 16 377d 377d 26/26 fixed on 2023/11/17 08:30
gvisor panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode (2) C 47 566d 571d 26/26 fixed on 2023/05/17 09:52

Sample crash report:
panic: Decrementing non-positive ref count 0xc0007f2058, owned by tmpfs.inode

goroutine 275 [running]:
panic({0x1015ce0?, 0xc0006c0650?})
	GOROOT/src/runtime/panic.go:1017 +0x3ac fp=0xc00081d368 sp=0xc00081d2b8 pc=0x43a74c
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inodeRefs).DecRef(0xc0007f2058, 0xc00081d3e0?)
	bazel-out/k8-fastbuild/bin/pkg/sentry/fsimpl/tmpfs/inode_refs.go:126 +0x10c fp=0xc00081d3d0 sp=0xc00081d368 pc=0x8b480c
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inode).decRef(...)
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:594
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*dentry).DecRef(0xc000814b00?, {0x1484d98?, 0xc00053ca80?})
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:452 +0x56 fp=0xc00081d410 sp=0xc00081d3d0 pc=0x8bb5d6
gvisor.dev/gvisor/pkg/sentry/vfs.(*Dentry).DecRef(...)
	pkg/sentry/vfs/dentry.go:156
gvisor.dev/gvisor/pkg/sentry/vfs.VirtualDentry.DecRef({0xc000814fd0?, 0xc0007f2000?}, {0x1484d98, 0xc00053ca80})
	pkg/sentry/vfs/vfs.go:1086 +0x3f fp=0xc00081d440 sp=0xc00081d410 pc=0x77d47f
gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualDentry).DecRef(0xc000814d10?, {0x1484d98?, 0xc00053ca80?})
	<autogenerated>:1 +0x3e fp=0xc00081d470 sp=0xc00081d440 pc=0x78bbfe
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*filesystem).RmdirAt.func1()
	pkg/sentry/fsimpl/tmpfs/filesystem.go:684 +0x4b fp=0xc00081d4c0 sp=0xc00081d470 pc=0x8b1a2b
runtime.deferreturn()
	GOROOT/src/runtime/panic.go:477 +0x31 fp=0xc00081d4f8 sp=0xc00081d4c0 pc=0x439891
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*filesystem).RmdirAt(0xc00059c460, {0x1484d98, 0xc00053ca80}, 0xc000694000)
	pkg/sentry/fsimpl/tmpfs/filesystem.go:735 +0x5d3 fp=0xc00081d720 sp=0xc00081d4f8 pc=0x8b1653
gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).RmdirAt(0xc0001bd4a0?, {0x1484d98, 0xc00053ca80}, 0xc0002edc00?, 0xc0006a6c00?)
	pkg/sentry/vfs/vfs.go:607 +0xf1 fp=0xc00081d780 sp=0xc00081d720 pc=0x77a4d1
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.rmdirat(0xc00053ca80, 0x53ca80?, 0xc0003918e0?)
	pkg/sentry/syscalls/linux/sys_file.go:971 +0x1a5 fp=0xc00081d8f0 sp=0xc00081d780 pc=0xae1c25
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Rmdir(0xc00053ca80?, 0x0?, {{0x7f5773b70a00}, {0x0}, {0x107d0}, {0x1000}, {0x560a08b6b85b}, {0x0}})
	pkg/sentry/syscalls/linux/sys_file.go:958 +0x1d fp=0xc00081d918 sp=0xc00081d8f0 pc=0xae1a3d
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc00053ca80, 0x54, {{0x7f5773b70a00}, {0x0}, {0x107d0}, {0x1000}, {0x560a08b6b85b}, {0x0}})
	pkg/sentry/kernel/task_syscall.go:142 +0x673 fp=0xc00081dc58 sp=0xc00081d918 pc=0x9ab0f3
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc00053ca80, 0xc000270848?, {{0x7f5773b70a00}, {0x0}, {0x107d0}, {0x1000}, {0x560a08b6b85b}, {0x0}})
	pkg/sentry/kernel/task_syscall.go:322 +0x45 fp=0xc00081dcb8 sp=0xc00081dc58 pc=0x9ac265
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc00053ca80?, 0x54?, {{0x7f5773b70a00}, {0x0}, {0x107d0}, {0x1000}, {0x560a08b6b85b}, {0x0}})
	pkg/sentry/kernel/task_syscall.go:282 +0x59 fp=0xc00081dd18 sp=0xc00081dcb8 pc=0x9abf79
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc00053ca80?)
	pkg/sentry/kernel/task_syscall.go:257 +0x2d5 fp=0xc00081de10 sp=0xc00081dd18 pc=0x9abd15
gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc0001ce380?, 0xc00053ca80)
	pkg/sentry/kernel/task_run.go:269 +0xfb7 fp=0xc00081df48 sp=0xc00081de10 pc=0x99ff97
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc00053ca80, 0x6)
	pkg/sentry/kernel/task_run.go:98 +0x1ef fp=0xc00081dfc0 sp=0xc00081df48 pc=0x99e92f
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
	pkg/sentry/kernel/task_start.go:392 +0x25 fp=0xc00081dfe0 sp=0xc00081dfc0 pc=0x9a9a05
runtime.goexit()
	src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00081dfe8 sp=0xc00081dfe0 pc=0x471261
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start in goroutine 229
	pkg/sentry/kernel/task_start.go:392 +0xe5

Crashes (22):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/01/19 04:05 gvisor e9bdc76c02bd 21772ce4 console log report syz C ci-gvisor-ptrace-2 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/19 04:05 gvisor e9bdc76c02bd 21772ce4 .config console log report syz C ci-gvisor-systrap-1-race-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/19 04:04 gvisor e9bdc76c02bd 21772ce4 console log report syz C ci-gvisor-ptrace-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/19 01:40 gvisor e9bdc76c02bd 21772ce4 .config console log report syz C ci-gvisor-ptrace-2-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/19 01:39 gvisor e9bdc76c02bd 21772ce4 .config console log report syz C ci-gvisor-ptrace-1-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/19 01:16 gvisor e9bdc76c02bd 21772ce4 .config console log report syz C ci-gvisor-ptrace-2-race-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/19 01:05 gvisor e9bdc76c02bd 21772ce4 .config console log report syz C ci-gvisor-ptrace-1-race-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/19 00:56 gvisor e9bdc76c02bd 21772ce4 console log report syz C ci-gvisor-systrap-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/19 00:45 gvisor e9bdc76c02bd 21772ce4 .config console log report syz C ci-gvisor-systrap-1-race panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 22:37 gvisor 588d87b40a36 21772ce4 .config console log report syz C ci-gvisor-ptrace-3-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 19:36 gvisor e9bdc76c02bd 21772ce4 .config console log report syz C ci-gvisor-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 19:31 gvisor e9bdc76c02bd 21772ce4 .config console log report syz C ci-gvisor-systrap-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 19:27 gvisor e9bdc76c02bd 21772ce4 .config console log report syz C ci-gvisor-ptrace-2-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 04:05 gvisor e89d94be4836 915053c7 console log report syz C ci-gvisor-kvm panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 04:05 gvisor e89d94be4836 915053c7 .config console log report syz C ci-gvisor-kvm-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 07:45 gvisor e89d94be4836 915053c7 .config console log report syz C ci-gvisor-arm64-systrap-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 05:04 gvisor e89d94be4836 915053c7 .config console log report syz C ci-gvisor-arm64-ptrace-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 03:59 gvisor e89d94be4836 915053c7 console log report syz C ci-gvisor-arm64-ptrace-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 03:38 gvisor e89d94be4836 915053c7 console log report syz C ci-gvisor-arm64-systrap-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/20 02:10 gvisor bb840068163c 9bd8dcda .config console log report info ci-gvisor-kvm-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/18 03:08 gvisor e89d94be4836 915053c7 console log report info ci-gvisor-arm64-systrap-1 panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
2024/01/13 09:21 gvisor 49f7ee9e926a 551587c1 .config console log report info ci-gvisor-arm64-systrap-1-cover panic: Decrementing non-positive ref count ADDR, owned by tmpfs.inode
* Struck through repros no longer work on HEAD.