list_add corruption. next->prev should be prev (ffff8880ae62d8d8), but was 00000000000000e3. (next=ffff8880a947a2f0). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:23! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 12515 Comm: syz-executor0 Not tainted 4.20.0+ #13 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_add_valid.cold+0xf/0x3c lib/list_debug.c:23 Code: 34 fe eb d5 4c 89 e7 e8 da fe 34 fe eb a3 4c 89 f7 e8 d0 fe 34 fe e9 56 ff ff ff 4c 89 e1 48 c7 c7 20 b0 81 88 e8 c0 54 d7 fd <0f> 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 60 b1 81 88 e8 a9 54 d7 RSP: 0018:ffff88804fe272b8 EFLAGS: 00010082 RAX: 0000000000000075 RBX: ffff8880a8d17cc0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81684ce6 RDI: ffffed1009fc4e49 RBP: ffff88804fe272d0 R08: 0000000000000075 R09: ffffed1015ce5021 R10: ffffed1015ce5020 R11: ffff8880ae728107 R12: ffff8880a947a2f0 R13: ffff888051416530 R14: ffff88804fe27358 R15: ffff888051416530 FS: 0000000000b26940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200003c0 CR3: 0000000084f77000 CR4: 00000000001426e0 Call Trace: __list_add include/linux/list.h:60 [inline] list_add include/linux/list.h:79 [inline] account_entity_enqueue+0x3a0/0x660 kernel/sched/fair.c:2678 enqueue_entity+0x276/0x20b0 kernel/sched/fair.c:3902 enqueue_task_fair+0x237/0x10c0 kernel/sched/fair.c:5133 enqueue_task kernel/sched/core.c:730 [inline] activate_task+0x11d/0x470 kernel/sched/core.c:751 ttwu_activate kernel/sched/core.c:1643 [inline] ttwu_do_activate+0xd4/0x1f0 kernel/sched/core.c:1702 ttwu_queue kernel/sched/core.c:1847 [inline] try_to_wake_up+0x997/0x1480 kernel/sched/core.c:2057 wake_up_process kernel/sched/core.c:2129 [inline] wake_up_q+0x99/0x100 kernel/sched/core.c:440 futex_wake+0x638/0x7b0 kernel/futex.c:1621 do_futex+0x371/0x2910 kernel/futex.c:3598 __do_sys_futex kernel/futex.c:3654 [inline] __se_sys_futex kernel/futex.c:3622 [inline] __x64_sys_futex+0x459/0x670 kernel/futex.c:3622 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457ec9 Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc4e312de8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000457ec9 RDX: 0000000000000000 RSI: 0000000000000081 RDI: 000000000073bfa8 RBP: 000000000073bfa0 R08: 00000000007411e0 R09: 0000000000000000 R10: 00007ffc4e312ea0 R11: 0000000000000246 R12: 0000000000000004 R13: 000000000000062f R14: 000000000073bfac R15: 000000000073bfac Modules linked in: ====================================================== WARNING: possible circular locking dependency detected 4.20.0+ #13 Not tainted ------------------------------------------------------ syz-executor0/12515 is trying to acquire lock: 00000000a1e8ab44 ((console_sem).lock){-.-.}, at: down_trylock+0x13/0x70 kernel/locking/semaphore.c:136 but task is already holding lock: 00000000ee8f1277 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1149 [inline] 00000000ee8f1277 (&rq->lock){-.-.}, at: ttwu_queue kernel/sched/core.c:1845 [inline] 00000000ee8f1277 (&rq->lock){-.-.}, at: try_to_wake_up+0x933/0x1480 kernel/sched/core.c:2057 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&rq->lock){-.-.}: __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144 rq_lock kernel/sched/sched.h:1149 [inline] task_fork_fair+0xb5/0x7a0 kernel/sched/fair.c:10058 sched_fork+0x437/0xb90 kernel/sched/core.c:2359 copy_process+0x1ff6/0x8730 kernel/fork.c:1888 _do_fork+0x1a9/0x1170 kernel/fork.c:2217 kernel_thread+0x34/0x40 kernel/fork.c:2276 rest_init+0x28/0x37b init/main.c:408 arch_call_rest_init+0xe/0x1b start_kernel+0x882/0x8bd init/main.c:740 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:470 x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:451 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 -> #1 (&p->pi_lock){-.-.}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152 try_to_wake_up+0xb9/0x1480 kernel/sched/core.c:1965 wake_up_process+0x10/0x20 kernel/sched/core.c:2129 __up.isra.0+0x1c0/0x2a0 kernel/locking/semaphore.c:262 up+0x13e/0x1c0 kernel/locking/semaphore.c:187 __up_console_sem+0xb7/0x1c0 kernel/printk/printk.c:236 console_unlock+0x778/0x11e0 kernel/printk/printk.c:2426 do_con_write+0x1021/0x2420 drivers/tty/vt/vt.c:2767 con_write+0x27/0xb0 drivers/tty/vt/vt.c:3116 process_output_block drivers/tty/n_tty.c:593 [inline] n_tty_write+0x497/0x1220 drivers/tty/n_tty.c:2331 do_tty_write drivers/tty/tty_io.c:959 [inline] tty_write+0x45b/0x7a0 drivers/tty/tty_io.c:1043 __vfs_write+0x116/0xb40 fs/read_write.c:485 vfs_write+0x20c/0x580 fs/read_write.c:549 ksys_write+0x105/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 ((console_sem).lock){-.-.}: lock_acquire+0x1db/0x570 kernel/locking/lockdep.c:3841 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152 down_trylock+0x13/0x70 kernel/locking/semaphore.c:136 __down_trylock_console_sem+0xa8/0x210 kernel/printk/printk.c:219 console_trylock+0x15/0xa0 kernel/printk/printk.c:2242 console_trylock_spinning kernel/printk/printk.c:1662 [inline] vprintk_emit+0x351/0x960 kernel/printk/printk.c:1930 vprintk_default+0x28/0x30 kernel/printk/printk.c:1958 vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398 printk+0xba/0xed kernel/printk/printk.c:1991 __list_add_valid.cold+0xf/0x3c lib/list_debug.c:23 __list_add include/linux/list.h:60 [inline] list_add include/linux/list.h:79 [inline] account_entity_enqueue+0x3a0/0x660 kernel/sched/fair.c:2678 enqueue_entity+0x276/0x20b0 kernel/sched/fair.c:3902 enqueue_task_fair+0x237/0x10c0 kernel/sched/fair.c:5133 enqueue_task kernel/sched/core.c:730 [inline] activate_task+0x11d/0x470 kernel/sched/core.c:751 ttwu_activate kernel/sched/core.c:1643 [inline] ttwu_do_activate+0xd4/0x1f0 kernel/sched/core.c:1702 ttwu_queue kernel/sched/core.c:1847 [inline] try_to_wake_up+0x997/0x1480 kernel/sched/core.c:2057 wake_up_process kernel/sched/core.c:2129 [inline] wake_up_q+0x99/0x100 kernel/sched/core.c:440 futex_wake+0x638/0x7b0 kernel/futex.c:1621 do_futex+0x371/0x2910 kernel/futex.c:3598 __do_sys_futex kernel/futex.c:3654 [inline] __se_sys_futex kernel/futex.c:3622 [inline] __x64_sys_futex+0x459/0x670 kernel/futex.c:3622 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Chain exists of: (console_sem).lock --> &p->pi_lock --> &rq->lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rq->lock); lock(&p->pi_lock); lock(&rq->lock); lock((console_sem).lock); *** DEADLOCK *** 2 locks held by syz-executor0/12515: #0: 000000005779c28c (&p->pi_lock){-.-.}, at: try_to_wake_up+0xb9/0x1480 kernel/sched/core.c:1965 #1: 00000000ee8f1277 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1149 [inline] #1: 00000000ee8f1277 (&rq->lock){-.-.}, at: ttwu_queue kernel/sched/core.c:1845 [inline] #1: 00000000ee8f1277 (&rq->lock){-.-.}, at: try_to_wake_up+0x933/0x1480 kernel/sched/core.c:2057 stack backtrace: CPU: 1 PID: 12515 Comm: syz-executor0 Not tainted 4.20.0+ #13 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1db/0x2d0 lib/dump_stack.c:113 print_circular_bug.isra.0.cold+0x1cc/0x28f kernel/locking/lockdep.c:1224 check_prev_add kernel/locking/lockdep.c:1866 [inline] check_prevs_add kernel/locking/lockdep.c:1979 [inline] validate_chain kernel/locking/lockdep.c:2350 [inline] __lock_acquire+0x3014/0x4a30 kernel/locking/lockdep.c:3338 lock_acquire+0x1db/0x570 kernel/locking/lockdep.c:3841 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152 down_trylock+0x13/0x70 kernel/locking/semaphore.c:136 __down_trylock_console_sem+0xa8/0x210 kernel/printk/printk.c:219 console_trylock+0x15/0xa0 kernel/printk/printk.c:2242 console_trylock_spinning kernel/printk/printk.c:1662 [inline] vprintk_emit+0x351/0x960 kernel/printk/printk.c:1930 vprintk_default+0x28/0x30 kernel/printk/printk.c:1958 vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398 printk+0xba/0xed kernel/printk/printk.c:1991 __list_add_valid.cold+0xf/0x3c lib/list_debug.c:23 __list_add include/linux/list.h:60 [inline] list_add include/linux/list.h:79 [inline] account_entity_enqueue+0x3a0/0x660 kernel/sched/fair.c:2678 enqueue_entity+0x276/0x20b0 kernel/sched/fair.c:3902 enqueue_task_fair+0x237/0x10c0 kernel/sched/fair.c:5133 enqueue_task kernel/sched/core.c:730 [inline] activate_task+0x11d/0x470 kernel/sched/core.c:751 ttwu_activate kernel/sched/core.c:1643 [inline] ttwu_do_activate+0xd4/0x1f0 kernel/sched/core.c:1702 ttwu_queue kernel/sched/core.c:1847 [inline] try_to_wake_up+0x997/0x1480 kernel/sched/core.c:2057 wake_up_process kernel/sched/core.c:2129 [inline] wake_up_q+0x99/0x100 kernel/sched/core.c:440 futex_wake+0x638/0x7b0 kernel/futex.c:1621 do_futex+0x371/0x2910 kernel/futex.c:3598 __do_sys_futex kernel/futex.c:3654 [inline] __se_sys_futex kernel/futex.c:3622 [inline] __x64_sys_futex+0x459/0x670 kernel/futex.c:3622 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457ec9 Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc4e312de8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000457ec9 RDX: 0000000000000000 RSI: 0000000000000081 RDI: 000000000073bfa8 RBP: 000000000073bfa0 R08: 00000000007411e0 R09: 0000000000000000 R10: 00007ffc4e312ea0 R11: 0000000000000246 R12: 0000000000000004 R13: 000000000000062f R14: 000000000073bfac R15: 000000000073bfac ---[ end trace 3641d890b6affecd ]--- RIP: 0010:__list_add_valid.cold+0xf/0x3c lib/list_debug.c:23 Code: 34 fe eb d5 4c 89 e7 e8 da fe 34 fe eb a3 4c 89 f7 e8 d0 fe 34 fe e9 56 ff ff ff 4c 89 e1 48 c7 c7 20 b0 81 88 e8 c0 54 d7 fd <0f> 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 60 b1 81 88 e8 a9 54 d7 RSP: 0018:ffff88804fe272b8 EFLAGS: 00010082 RAX: 0000000000000075 RBX: ffff8880a8d17cc0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81684ce6 RDI: ffffed1009fc4e49 RBP: ffff88804fe272d0 R08: 0000000000000075 R09: ffffed1015ce5021 R10: ffffed1015ce5020 R11: ffff8880ae728107 R12: ffff8880a947a2f0 R13: ffff888051416530 R14: ffff88804fe27358 R15: ffff888051416530 FS: 0000000000b26940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200003c0 CR3: 0000000084f77000 CR4: 00000000001426e0