From: syzbot <syzbot+d17177af4afd8c6f804c@syzkaller.appspotmail.com>
To: davem@davemloft.net, edumazet@google.com, jhs@mojatatu.com,
jiri@resnulli.us, kuba@kernel.org, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, pabeni@redhat.com,
syzkaller-bugs@googlegroups.com, vinicius.gomes@intel.com,
xiyou.wangcong@gmail.com
Subject: Re: [syzbot] [net?] WARNING in call_rcu (3)
Date: Sun, 24 Mar 2024 16:14:22 -0700 [thread overview]
Message-ID: <000000000000a5d0a30614703740@google.com> (raw)
In-Reply-To: <000000000000ef958c060cc9cc3d@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 707081b61156 Merge branch 'for-next/core', remote-tracking..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=141d023a180000
kernel config: https://syzkaller.appspot.com/x/.config?x=caeac3f3565b057a
dashboard link: https://syzkaller.appspot.com/bug?extid=d17177af4afd8c6f804c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=107d3aa5180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10611291180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6cad68bf7532/disk-707081b6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1a27e5400778/vmlinux-707081b6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/67dfc53755d0/Image-707081b6.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d17177af4afd8c6f804c@syzkaller.appspotmail.com
------------[ cut here ]------------
ODEBUG: activate active (active state 1) object: 000000007c840c9e object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:517 debug_print_object lib/debugobjects.c:514 [inline]
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:517 debug_object_activate+0x360/0x4ac lib/debugobjects.c:732
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:514 [inline]
pc : debug_object_activate+0x360/0x4ac lib/debugobjects.c:732
lr : debug_print_object lib/debugobjects.c:514 [inline]
lr : debug_object_activate+0x360/0x4ac lib/debugobjects.c:732
sp : ffff800080007ad0
x29: ffff800080007ad0 x28: ffff800093738000 x27: dfff800000000000
x26: ffff80008aef0200 x25: 0000000000000001 x24: ffff0000d010cd00
x23: 0000000000000003 x22: ffff80008b41a2e0 x21: 0000000000000000
x20: ffff80008aef0200 x19: ffff0000d010cd00 x18: ffff800080006fa0
x17: 3963303438633730 x16: ffff80008ad6b09c x15: 0000000000000001
x14: 1fffe00036800002 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000010004 x10: 0000000000ff0100 x9 : 42aaeb85fb1b0600
x8 : 42aaeb85fb1b0600 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000800073b8 x4 : ffff80008ed822c0 x3 : ffff8000805ba130
x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000000
Call trace:
debug_print_object lib/debugobjects.c:514 [inline]
debug_object_activate+0x360/0x4ac lib/debugobjects.c:732
debug_rcu_head_queue kernel/rcu/rcu.h:227 [inline]
__call_rcu_common kernel/rcu/tree.c:2700 [inline]
call_rcu+0x48/0xaf4 kernel/rcu/tree.c:2829
switch_schedules net/sched/sch_taprio.c:210 [inline]
advance_sched+0x7e0/0xac0 net/sched/sch_taprio.c:984
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x484/0xca0 kernel/time/hrtimer.c:1753
hrtimer_interrupt+0x2c0/0xb64 kernel/time/hrtimer.c:1815
timer_handler drivers/clocksource/arm_arch_timer.c:674 [inline]
arch_timer_handler_virt+0x74/0x88 drivers/clocksource/arm_arch_timer.c:685
handle_percpu_devid_irq+0x2a4/0x804 kernel/irq/chip.c:942
generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
handle_irq_desc kernel/irq/irqdesc.c:672 [inline]
generic_handle_domain_irq+0x7c/0xc4 kernel/irq/irqdesc.c:728
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:782 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:833 [inline]
gic_handle_irq+0x6c/0x190 drivers/irqchip/irq-gic-v3.c:877
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:310
__el1_irq arch/arm64/kernel/entry-common.c:536 [inline]
el1_interrupt+0x34/0x68 arch/arm64/kernel/entry-common.c:551
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
__daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]
arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49
cpuidle_idle_call kernel/sched/idle.c:170 [inline]
do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312
cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410
rest_init+0x2dc/0x2f4 init/main.c:730
start_kernel+0x0/0x4ec init/main.c:827
start_kernel+0x3ec/0x4ec init/main.c:1072
__primary_switched+0x84/0x8c arch/arm64/kernel/head.S:243
irq event stamp: 700776
hardirqs last enabled at (700775): [<ffff80008ad6bc6c>] default_idle_call+0xf4/0x128 kernel/sched/idle.c:103
hardirqs last disabled at (700776): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
hardirqs last disabled at (700776): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
softirqs last enabled at (700464): [<ffff80008002189c>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (700464): [<ffff80008002189c>] __do_softirq+0xac8/0xce4 kernel/softirq.c:582
softirqs last disabled at (700459): [<ffff80008002ab48>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ODEBUG: active_state active (active state 1) object: 000000007c840c9e object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:517 debug_print_object lib/debugobjects.c:514 [inline]
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:517 debug_object_active_state+0x2a8/0x37c lib/debugobjects.c:954
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 6.8.0-rc7-syzkaller-g707081b61156 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:514 [inline]
pc : debug_object_active_state+0x2a8/0x37c lib/debugobjects.c:954
lr : debug_print_object lib/debugobjects.c:514 [inline]
lr : debug_object_active_state+0x2a8/0x37c lib/debugobjects.c:954
sp : ffff800080007ad0
x29: ffff800080007ad0 x28: 00000000000000c0 x27: dfff800000000000
x26: 1fffe0001a95d34b x25: 0000000000000003 x24: ffff800093738000
x23: 0000000000000001 x22: ffff80008aef0200 x21: ffff0000d010cd00
x20: ffff80008b41a2e0 x19: 0000000000000000 x18: ffff800080006fa0
x17: 3863373030303030 x16: ffff80008ad6b09c x15: 0000000000000001
x14: 1fffe00036800002 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000010004 x10: 0000000000ff0100 x9 : 42aaeb85fb1b0600
x8 : 42aaeb85fb1b0600 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000800073b8 x4 : ffff80008ed822c0 x3 : ffff8000805ba130
x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000000
Call trace:
debug_print_object lib/debugobjects.c:514 [inline]
debug_object_active_state+0x2a8/0x37c lib/debugobjects.c:954
debug_rcu_head_queue kernel/rcu/rcu.h:228 [inline]
__call_rcu_common kernel/rcu/tree.c:2700 [inline]
call_rcu+0x60/0xaf4 kernel/rcu/tree.c:2829
switch_schedules net/sched/sch_taprio.c:210 [inline]
advance_sched+0x7e0/0xac0 net/sched/sch_taprio.c:984
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x484/0xca0 kernel/time/hrtimer.c:1753
hrtimer_interrupt+0x2c0/0xb64 kernel/time/hrtimer.c:1815
timer_handler drivers/clocksource/arm_arch_timer.c:674 [inline]
arch_timer_handler_virt+0x74/0x88 drivers/clocksource/arm_arch_timer.c:685
handle_percpu_devid_irq+0x2a4/0x804 kernel/irq/chip.c:942
generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
handle_irq_desc kernel/irq/irqdesc.c:672 [inline]
generic_handle_domain_irq+0x7c/0xc4 kernel/irq/irqdesc.c:728
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:782 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:833 [inline]
gic_handle_irq+0x6c/0x190 drivers/irqchip/irq-gic-v3.c:877
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:310
__el1_irq arch/arm64/kernel/entry-common.c:536 [inline]
el1_interrupt+0x34/0x68 arch/arm64/kernel/entry-common.c:551
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
__daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]
arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49
cpuidle_idle_call kernel/sched/idle.c:170 [inline]
do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312
cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410
rest_init+0x2dc/0x2f4 init/main.c:730
start_kernel+0x0/0x4ec init/main.c:827
start_kernel+0x3ec/0x4ec init/main.c:1072
__primary_switched+0x84/0x8c arch/arm64/kernel/head.S:243
irq event stamp: 700776
hardirqs last enabled at (700775): [<ffff80008ad6bc6c>] default_idle_call+0xf4/0x128 kernel/sched/idle.c:103
hardirqs last disabled at (700776): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
hardirqs last disabled at (700776): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
softirqs last enabled at (700464): [<ffff80008002189c>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (700464): [<ffff80008002189c>] __do_softirq+0xac8/0xce4 kernel/softirq.c:582
softirqs last disabled at (700459): [<ffff80008002ab48>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81
---[ end trace 0000000000000000 ]---
rcu: __call_rcu_common(): Double-freed CB 000000007c840c9e->taprio_free_sched_cb+0x0/0x178()!!! slab kmalloc-512 start ffff0000d010cc00 pointer offset 256 size 512
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2024-03-24 23:14 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-18 14:45 [syzbot] [net?] WARNING in call_rcu (3) syzbot
2024-03-24 23:14 ` syzbot [this message]
2026-06-11 10:27 ` Forwarded: syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000a5d0a30614703740@google.com \
--to=syzbot+d17177af4afd8c6f804c@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=vinicius.gomes@intel.com \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.