Re: BUG: spinlock bad magic in lock_timer_base

Re: BUG: spinlock bad magic in lock_timer_base

[Thomas Gleixner]

On Thu, Jul 03 2025 at 16:54, 白烁冉 wrote:

> Dear Maintainers,

The timer maintainers are hardly the right group to ask. The timer code
is just the messenger :)

I've Cc'ed the KVM folks, as you correctly identified KVM already as the
probable source of the problem.

> When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (110th)was triggered.

6.14 is not really the latest kernel.

> HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
> git tree: upstream
> Output:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/report110.txt 
> Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/config.txt
> C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.c Syzlang 
> reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.txt Our reproducer uses mounts a constructed filesystem image.
>  
> The error occurs in the lock_timer_base (timer.c lines 1770-1790 or
> so). It happens cleanup_srcu_struct during the KVM VM shutdown
> process, and it is likely that the memory pointed to by the timer
> object has been freed. The timer_base pointer returned by the
> get_timer_base (tf) points to an invalid memory area
> (__init_begin+0x2a500)

If you enable DEBUG_OBJECTS_TIMERS and DEBUG_OBJECTS_FREE the kernel
should survive and provide some useful output.

> We have reproduced this issue several times on 6.14 again.

Does the probkem still exist on the latest upstream kernel release
candidate, i.e. v6.16-rc4?

Leaving the report context intact for kvm folks.

Thanks,

        tglx
    

> If you fix this issue, please add the following tag to the commit:
> Reported-by: Kun Hu <huk23@m.fudan.edu.cn>, Jiaji Qin <jjtan24@m.fudan.edu.cn>, Shuoran Bai <baishuoran@hrbeu.edu.cn>
>
>
>
>
> BUG: spinlock bad magic on CPU#2, syz.6.399/18129
>  lock: __init_begin+0x2a500/0x41000, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
> CPU: 2 UID: 0 PID: 18129 Comm: syz.6.399 Not tainted 6.14.0 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x116/0x1b0
>  do_raw_spin_lock+0x22c/0x2e0
>  _raw_spin_lock_irqsave+0x45/0x60
>  lock_timer_base+0x125/0x1c0
>  __try_to_del_timer_sync+0x7f/0x160
>  __timer_delete_sync+0x120/0x1c0
>  cleanup_srcu_struct+0x122/0x5a0
>  kvm_put_kvm+0x7c9/0xa10
>  kvm_vcpu_release+0x4b/0x70
>  __fput+0x417/0xb60
>  __fput_sync+0xa6/0xc0
>  __x64_sys_close+0x8b/0x120
>  do_syscall_64+0xcf/0x250
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fafdad1ebdb
> Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
> RSP: 002b:00007ffde8c95b20 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fafdad1ebdb
> RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000005
> RBP: 00007ffde8c95bf8 R08: 0000000000000000 R09: 00007fafda8015a6
> R10: 0000000000000001 R11: 0000000000000293 R12: 00007fafdafa5fa0
> R13: 000000000002f3ea R14: ffffffffffffffff R15: 00007fafdafa5fa0
>  </TASK>

Re: Re: Re: BUG: spinlock bad magic in lock_timer_base

[白烁冉]

I have just tried further with the provided C repro and it seems that this bug can be triggered with the C repro on kernel 6.16.I will reach out to the KVM folks to report the issue further.


> -----原始邮件-----
> 发件人: 白烁冉 <baishuoran@hrbeu.edu.cn>
> 发送时间:2025-07-06 14:32:29 (星期日)
> 收件人: "Thomas Gleixner" <tglx@linutronix.de>
> 主题: Re: Re: BUG: spinlock bad magic in lock_timer_base
> 
> 
> Sorry, we triggered this bug when we were doing experiments with the 6.14 kernel, so we reported it. Now we tried to trigger this bug in 6.16 kernel version and it didn't trigger successfully. Sorry for the trouble.
> 
> > -----原始邮件-----
> > 发件人: "Thomas Gleixner" <tglx@linutronix.de>
> > 发送时间:2025-07-03 17:56:21 (星期四)
> > 收件人: 白烁冉 <baishuoran@hrbeu.edu.cn>, "Anna-Maria Behnsen" <anna-maria@linutronix.de>, "Frederic Weisbecker" <frederic@kernel.org>
> > 抄送: "Kun Hu" <huk23@m.fudan.edu.cn>, "Jiaji Qin" <jjtan24@m.fudan.edu.cn>, linux-kernel@vger.kernel.org, syzkaller@googlegroups.com, kvm@vger.kernel.org, "Paolo Bonzini" <bonzini@redhat.com>
> > 主题: Re: BUG: spinlock bad magic in lock_timer_base
> > 
> > On Thu, Jul 03 2025 at 16:54, 白烁冉 wrote:
> > 
> > > Dear Maintainers,
> > 
> > The timer maintainers are hardly the right group to ask. The timer code
> > is just the messenger :)
> > 
> > I've Cc'ed the KVM folks, as you correctly identified KVM already as the
> > probable source of the problem.
> > 
> > > When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (110th)was triggered.
> > 
> > 6.14 is not really the latest kernel.
> > 
> > > HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
> > > git tree: upstream
> > > Output:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/report110.txt 
> > > Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/config.txt
> > > C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.c Syzlang 
> > > reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/BUG%3A%20spinlock%20bad%20magic%20in%20lock_timer_base/110repro.txt Our reproducer uses mounts a constructed filesystem image.
> > >  
> > > The error occurs in the lock_timer_base (timer.c lines 1770-1790 or
> > > so). It happens cleanup_srcu_struct during the KVM VM shutdown
> > > process, and it is likely that the memory pointed to by the timer
> > > object has been freed. The timer_base pointer returned by the
> > > get_timer_base (tf) points to an invalid memory area
> > > (__init_begin+0x2a500)
> > 
> > If you enable DEBUG_OBJECTS_TIMERS and DEBUG_OBJECTS_FREE the kernel
> > should survive and provide some useful output.
> > 
> > > We have reproduced this issue several times on 6.14 again.
> > 
> > Does the probkem still exist on the latest upstream kernel release
> > candidate, i.e. v6.16-rc4?
> > 
> > Leaving the report context intact for kvm folks.
> > 
> > Thanks,
> > 
> >         tglx
> >     
> > 
> > > If you fix this issue, please add the following tag to the commit:
> > > Reported-by: Kun Hu <huk23@m.fudan.edu.cn>, Jiaji Qin <jjtan24@m.fudan.edu.cn>, Shuoran Bai <baishuoran@hrbeu.edu.cn>
> > >
> > >
> > >
> > >
> > > BUG: spinlock bad magic on CPU#2, syz.6.399/18129
> > >  lock: __init_begin+0x2a500/0x41000, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
> > > CPU: 2 UID: 0 PID: 18129 Comm: syz.6.399 Not tainted 6.14.0 #1
> > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> > > Call Trace:
> > >  <TASK>
> > >  dump_stack_lvl+0x116/0x1b0
> > >  do_raw_spin_lock+0x22c/0x2e0
> > >  _raw_spin_lock_irqsave+0x45/0x60
> > >  lock_timer_base+0x125/0x1c0
> > >  __try_to_del_timer_sync+0x7f/0x160
> > >  __timer_delete_sync+0x120/0x1c0
> > >  cleanup_srcu_struct+0x122/0x5a0
> > >  kvm_put_kvm+0x7c9/0xa10
> > >  kvm_vcpu_release+0x4b/0x70
> > >  __fput+0x417/0xb60
> > >  __fput_sync+0xa6/0xc0
> > >  __x64_sys_close+0x8b/0x120
> > >  do_syscall_64+0xcf/0x250
> > >  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > RIP: 0033:0x7fafdad1ebdb
> > > Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
> > > RSP: 002b:00007ffde8c95b20 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> > > RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fafdad1ebdb
> > > RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000005
> > > RBP: 00007ffde8c95bf8 R08: 0000000000000000 R09: 00007fafda8015a6
> > > R10: 0000000000000001 R11: 0000000000000293 R12: 00007fafdafa5fa0
> > > R13: 000000000002f3ea R14: ffffffffffffffff R15: 00007fafdafa5fa0
> > >  </TASK>