BUG: spinlock bad magic in lock_timer_base

BUG: spinlock bad magic in lock_timer_base

[白烁冉]

Dear Maintainers,

When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (110th)was triggered.


HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
git tree: upstream
Output:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/report110.txt 
Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/config.txt
C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.c Syzlang 
reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.txt Our reproducer uses mounts a constructed filesystem image.
 
 
The error occurs in the lock_timer_base (timer.c lines 1770-1790 or so). It happens cleanup_srcu_struct during the KVM VM shutdown process, and it is likely that the memory pointed to by the timer object has been freed. The timer_base pointer returned by the get_timer_base (tf) points to an invalid memory area (__init_begin+0x2a500)
We have reproduced this issue several times on 6.14 again.



If you fix this issue, please add the following tag to the commit:
Reported-by: Kun Hu <huk23@m.fudan.edu.cn>, Jiaji Qin <jjtan24@m.fudan.edu.cn>, Shuoran Bai <baishuoran@hrbeu.edu.cn>




BUG: spinlock bad magic on CPU#2, syz.6.399/18129
 lock: __init_begin+0x2a500/0x41000, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
CPU: 2 UID: 0 PID: 18129 Comm: syz.6.399 Not tainted 6.14.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x116/0x1b0
 do_raw_spin_lock+0x22c/0x2e0
 _raw_spin_lock_irqsave+0x45/0x60
 lock_timer_base+0x125/0x1c0
 __try_to_del_timer_sync+0x7f/0x160
 __timer_delete_sync+0x120/0x1c0
 cleanup_srcu_struct+0x122/0x5a0
 kvm_put_kvm+0x7c9/0xa10
 kvm_vcpu_release+0x4b/0x70
 __fput+0x417/0xb60
 __fput_sync+0xa6/0xc0
 __x64_sys_close+0x8b/0x120
 do_syscall_64+0xcf/0x250
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fafdad1ebdb
Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffde8c95b20 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fafdad1ebdb
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000005
RBP: 00007ffde8c95bf8 R08: 0000000000000000 R09: 00007fafda8015a6
R10: 0000000000000001 R11: 0000000000000293 R12: 00007fafdafa5fa0
R13: 000000000002f3ea R14: ffffffffffffffff R15: 00007fafdafa5fa0
 </TASK>






thanks,
Kun Hu

BUG: spinlock bad magic in lock_timer_base

[白烁冉]

Dear Maintainers,

When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (110th)was triggered.


HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
git tree: upstream
Output:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/report110.txt 
Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/config.txt
C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.c Syzlang 
reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.txt Our reproducer uses mounts a constructed filesystem image.
 
 
The error occurs in the lock_timer_base (timer.c lines 1770-1790 or so). It happens cleanup_srcu_struct during the KVM VM shutdown process, and it is likely that the memory pointed to by the timer object has been freed. The timer_base pointer returned by the get_timer_base (tf) points to an invalid memory area (__init_begin+0x2a500)
We have reproduced this issue several times on 6.14 again.



If you fix this issue, please add the following tag to the commit:
Reported-by: Kun Hu <huk23@m.fudan.edu.cn>, Jiaji Qin <jjtan24@m.fudan.edu.cn>, Shuoran Bai <baishuoran@hrbeu.edu.cn>




BUG: spinlock bad magic on CPU#2, syz.6.399/18129
 lock: __init_begin+0x2a500/0x41000, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
CPU: 2 UID: 0 PID: 18129 Comm: syz.6.399 Not tainted 6.14.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x116/0x1b0
 do_raw_spin_lock+0x22c/0x2e0
 _raw_spin_lock_irqsave+0x45/0x60
 lock_timer_base+0x125/0x1c0
 __try_to_del_timer_sync+0x7f/0x160
 __timer_delete_sync+0x120/0x1c0
 cleanup_srcu_struct+0x122/0x5a0
 kvm_put_kvm+0x7c9/0xa10
 kvm_vcpu_release+0x4b/0x70
 __fput+0x417/0xb60
 __fput_sync+0xa6/0xc0
 __x64_sys_close+0x8b/0x120
 do_syscall_64+0xcf/0x250
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fafdad1ebdb
Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffde8c95b20 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fafdad1ebdb
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000005
RBP: 00007ffde8c95bf8 R08: 0000000000000000 R09: 00007fafda8015a6
R10: 0000000000000001 R11: 0000000000000293 R12: 00007fafdafa5fa0
R13: 000000000002f3ea R14: ffffffffffffffff R15: 00007fafdafa5fa0
 </TASK>






thanks,
Kun Hu

Re: BUG: spinlock bad magic in lock_timer_base

[Thomas Gleixner]

On Thu, Jul 03 2025 at 16:54, 白烁冉 wrote:

> Dear Maintainers,

The timer maintainers are hardly the right group to ask. The timer code
is just the messenger :)

I've Cc'ed the KVM folks, as you correctly identified KVM already as the
probable source of the problem.

> When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (110th)was triggered.

6.14 is not really the latest kernel.

> HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
> git tree: upstream
> Output:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/report110.txt 
> Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/config.txt
> C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.c Syzlang 
> reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.txt Our reproducer uses mounts a constructed filesystem image.
>  
> The error occurs in the lock_timer_base (timer.c lines 1770-1790 or
> so). It happens cleanup_srcu_struct during the KVM VM shutdown
> process, and it is likely that the memory pointed to by the timer
> object has been freed. The timer_base pointer returned by the
> get_timer_base (tf) points to an invalid memory area
> (__init_begin+0x2a500)

If you enable DEBUG_OBJECTS_TIMERS and DEBUG_OBJECTS_FREE the kernel
should survive and provide some useful output.

> We have reproduced this issue several times on 6.14 again.

Does the probkem still exist on the latest upstream kernel release
candidate, i.e. v6.16-rc4?

Leaving the report context intact for kvm folks.

Thanks,

        tglx
    

> If you fix this issue, please add the following tag to the commit:
> Reported-by: Kun Hu <huk23@m.fudan.edu.cn>, Jiaji Qin <jjtan24@m.fudan.edu.cn>, Shuoran Bai <baishuoran@hrbeu.edu.cn>
>
>
>
>
> BUG: spinlock bad magic on CPU#2, syz.6.399/18129
>  lock: __init_begin+0x2a500/0x41000, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
> CPU: 2 UID: 0 PID: 18129 Comm: syz.6.399 Not tainted 6.14.0 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x116/0x1b0
>  do_raw_spin_lock+0x22c/0x2e0
>  _raw_spin_lock_irqsave+0x45/0x60
>  lock_timer_base+0x125/0x1c0
>  __try_to_del_timer_sync+0x7f/0x160
>  __timer_delete_sync+0x120/0x1c0
>  cleanup_srcu_struct+0x122/0x5a0
>  kvm_put_kvm+0x7c9/0xa10
>  kvm_vcpu_release+0x4b/0x70
>  __fput+0x417/0xb60
>  __fput_sync+0xa6/0xc0
>  __x64_sys_close+0x8b/0x120
>  do_syscall_64+0xcf/0x250
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fafdad1ebdb
> Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
> RSP: 002b:00007ffde8c95b20 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fafdad1ebdb
> RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000005
> RBP: 00007ffde8c95bf8 R08: 0000000000000000 R09: 00007fafda8015a6
> R10: 0000000000000001 R11: 0000000000000293 R12: 00007fafdafa5fa0
> R13: 000000000002f3ea R14: ffffffffffffffff R15: 00007fafdafa5fa0
>  </TASK>

Re: Re: Re: BUG: spinlock bad magic in lock_timer_base

[白烁冉]

I have just tried further with the provided C repro and it seems that this bug can be triggered with the C repro on kernel 6.16.I will reach out to the KVM folks to report the issue further.


> -----原始邮件-----
> 发件人: 白烁冉 <baishuoran@hrbeu.edu.cn>
> 发送时间:2025-07-06 14:32:29 (星期日)
> 收件人: "Thomas Gleixner" <tglx@linutronix.de>
> 主题: Re: Re: BUG: spinlock bad magic in lock_timer_base
> 
> 
> Sorry, we triggered this bug when we were doing experiments with the 6.14 kernel, so we reported it. Now we tried to trigger this bug in 6.16 kernel version and it didn't trigger successfully. Sorry for the trouble.
> 
> > -----原始邮件-----
> > 发件人: "Thomas Gleixner" <tglx@linutronix.de>
> > 发送时间:2025-07-03 17:56:21 (星期四)
> > 收件人: 白烁冉 <baishuoran@hrbeu.edu.cn>, "Anna-Maria Behnsen" <anna-maria@linutronix.de>, "Frederic Weisbecker" <frederic@kernel.org>
> > 抄送: "Kun Hu" <huk23@m.fudan.edu.cn>, "Jiaji Qin" <jjtan24@m.fudan.edu.cn>, linux-kernel@vger.kernel.org, syzkaller@googlegroups.com, kvm@vger.kernel.org, "Paolo Bonzini" <bonzini@redhat.com>
> > 主题: Re: BUG: spinlock bad magic in lock_timer_base
> > 
> > On Thu, Jul 03 2025 at 16:54, 白烁冉 wrote:
> > 
> > > Dear Maintainers,
> > 
> > The timer maintainers are hardly the right group to ask. The timer code
> > is just the messenger :)
> > 
> > I've Cc'ed the KVM folks, as you correctly identified KVM already as the
> > probable source of the problem.
> > 
> > > When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (110th)was triggered.
> > 
> > 6.14 is not really the latest kernel.
> > 
> > > HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
> > > git tree: upstream
> > > Output:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/report110.txt 
> > > Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/config.txt
> > > C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.c Syzlang 
> > > reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.txt Our reproducer uses mounts a constructed filesystem image.
> > >  
> > > The error occurs in the lock_timer_base (timer.c lines 1770-1790 or
> > > so). It happens cleanup_srcu_struct during the KVM VM shutdown
> > > process, and it is likely that the memory pointed to by the timer
> > > object has been freed. The timer_base pointer returned by the
> > > get_timer_base (tf) points to an invalid memory area
> > > (__init_begin+0x2a500)
> > 
> > If you enable DEBUG_OBJECTS_TIMERS and DEBUG_OBJECTS_FREE the kernel
> > should survive and provide some useful output.
> > 
> > > We have reproduced this issue several times on 6.14 again.
> > 
> > Does the probkem still exist on the latest upstream kernel release
> > candidate, i.e. v6.16-rc4?
> > 
> > Leaving the report context intact for kvm folks.
> > 
> > Thanks,
> > 
> >         tglx
> >     
> > 
> > > If you fix this issue, please add the following tag to the commit:
> > > Reported-by: Kun Hu <huk23@m.fudan.edu.cn>, Jiaji Qin <jjtan24@m.fudan.edu.cn>, Shuoran Bai <baishuoran@hrbeu.edu.cn>
> > >
> > >
> > >
> > >
> > > BUG: spinlock bad magic on CPU#2, syz.6.399/18129
> > >  lock: __init_begin+0x2a500/0x41000, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
> > > CPU: 2 UID: 0 PID: 18129 Comm: syz.6.399 Not tainted 6.14.0 #1
> > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> > > Call Trace:
> > >  <TASK>
> > >  dump_stack_lvl+0x116/0x1b0
> > >  do_raw_spin_lock+0x22c/0x2e0
> > >  _raw_spin_lock_irqsave+0x45/0x60
> > >  lock_timer_base+0x125/0x1c0
> > >  __try_to_del_timer_sync+0x7f/0x160
> > >  __timer_delete_sync+0x120/0x1c0
> > >  cleanup_srcu_struct+0x122/0x5a0
> > >  kvm_put_kvm+0x7c9/0xa10
> > >  kvm_vcpu_release+0x4b/0x70
> > >  __fput+0x417/0xb60
> > >  __fput_sync+0xa6/0xc0
> > >  __x64_sys_close+0x8b/0x120
> > >  do_syscall_64+0xcf/0x250
> > >  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > RIP: 0033:0x7fafdad1ebdb
> > > Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
> > > RSP: 002b:00007ffde8c95b20 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> > > RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fafdad1ebdb
> > > RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000005
> > > RBP: 00007ffde8c95bf8 R08: 0000000000000000 R09: 00007fafda8015a6
> > > R10: 0000000000000001 R11: 0000000000000293 R12: 00007fafdafa5fa0
> > > R13: 000000000002f3ea R14: ffffffffffffffff R15: 00007fafdafa5fa0
> > >  </TASK>