From: syzbot <syzbot+956ef5eac18eadd0fb7f@syzkaller.appspotmail.com>
To: anant.thazhemadam@gmail.com, asml.silence@gmail.com,
axboe@kernel.dk, hdanton@sina.com, io-uring@vger.kernel.org,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk
Subject: Re: WARNING: refcount bug in io_wqe_worker
Date: Sat, 12 Sep 2020 11:49:26 -0700 [thread overview]
Message-ID: <000000000000b1a2f805af224224@google.com> (raw)
In-Reply-To: <0000000000004ba2fe05aebfc526@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 729e3d09 Merge tag 'ceph-for-5.9-rc5' of git://github.com/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12f2ce0d900000
kernel config: https://syzkaller.appspot.com/x/.config?x=c61610091f4ca8c4
dashboard link: https://syzkaller.appspot.com/bug?extid=956ef5eac18eadd0fb7f
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10f3a853900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=157f7263900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+956ef5eac18eadd0fb7f@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 7382 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 7382 Comm: io_wqe_worker-1 Not tainted 5.9.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x198/0x1fd lib/dump_stack.c:118
panic+0x347/0x7c0 kernel/panic.c:231
__warn.cold+0x20/0x46 kernel/panic.c:600
report_bug+0x1bd/0x210 lib/bug.c:198
handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 2c dd 18 fe e9 8a fe ff ff e8 c2 d6 d8 fd 48 c7 c7 60 dc 93 88 c6 05 0d 0d 12 07 01 e8 b1 d7 a9 fd <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55
RSP: 0018:ffffc9000810fe08 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88809592a200 RSI: ffffffff815db9a7 RDI: fffff52001021fb3
RBP: 0000000000000003 R08: 0000000000000001 R09: ffff8880ae6318e7
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809a6080b8
R13: ffff8880a7896e30 R14: ffff8880a7896e00 R15: ffff8880a6727f00
refcount_sub_and_test include/linux/refcount.h:274 [inline]
refcount_dec_and_test include/linux/refcount.h:294 [inline]
io_worker_exit fs/io-wq.c:236 [inline]
io_wqe_worker+0xcdb/0x10e0 fs/io-wq.c:596
kthread+0x3b5/0x4a0 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Kernel Offset: disabled
Rebooting in 86400 seconds..
prev parent reply other threads:[~2020-09-12 18:49 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-07 21:19 WARNING: refcount bug in io_wqe_worker syzbot
2020-09-12 18:49 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000b1a2f805af224224@google.com \
--to=syzbot+956ef5eac18eadd0fb7f@syzkaller.appspotmail.com \
--cc=anant.thazhemadam@gmail.com \
--cc=asml.silence@gmail.com \
--cc=axboe@kernel.dk \
--cc=hdanton@sina.com \
--cc=io-uring@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.