* lib, fs, cgroup: WARNING in percpu_ref_kill_and_confirm
@ 2017-03-23 14:04 Dmitry Vyukov
2017-03-24 3:18 ` Zefan Li
0 siblings, 1 reply; 4+ messages in thread
From: Dmitry Vyukov @ 2017-03-23 14:04 UTC (permalink / raw)
To: Tejun Heo, roman.penyaev, LKML, Zefan Li, Eric W. Biederman,
jweiner, Andrew Morton
Cc: syzkaller
Hello,
The following program triggers WARNING in percpu_ref_kill_and_confirm:
https://gist.githubusercontent.com/dvyukov/bcfcef3d6b24b9fd841b88ee20c14d4b/raw/a54aeeb09ad1e0659b0ed87ef5efc4480ab2536f/gistfile1.txt
------------[ cut here ]------------
WARNING: CPU: 3 PID: 19987 at lib/percpu-refcount.c:317
percpu_ref_kill_and_confirm+0x303/0x3c0 lib/percpu-refcount.c:316
percpu_ref_kill_and_confirm called more than once on css_release!
CPU: 3 PID: 19987 Comm: a.out Not tainted 4.11.0-rc3+ #365
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x1b8/0x28d lib/dump_stack.c:52
panic+0x20c/0x423 kernel/panic.c:180
__warn+0x1c4/0x1e0 kernel/panic.c:541
warn_slowpath_fmt+0xc1/0x100 kernel/panic.c:564
percpu_ref_kill_and_confirm+0x303/0x3c0 lib/percpu-refcount.c:316
percpu_ref_kill include/linux/percpu-refcount.h:119 [inline]
cgroup_kill_sb+0x31d/0x480 kernel/cgroup/cgroup.c:1834
deactivate_locked_super+0x99/0xe0 fs/super.c:309
deactivate_super+0x151/0x160 fs/super.c:340
cleanup_mnt+0xb2/0x160 fs/namespace.c:1115
__cleanup_mnt+0x16/0x20 fs/namespace.c:1122
task_work_run+0x1a4/0x270 kernel/task_work.c:116
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x24d/0x2d0 arch/x86/entry/common.c:161
prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
syscall_return_slowpath+0x3bd/0x460 arch/x86/entry/common.c:260
entry_SYSCALL_64_fastpath+0xc0/0xc2
RIP: 0033:0x443129
RSP: 002b:00007ffe06080018 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffec RBX: 00000000004002b0 RCX: 0000000000443129
RDX: 000000002019cff9 RSI: 000000002000c000 RDI: 00000000204ff000
RBP: 00007ffe06080060 R08: 00000000201db000 R09: 0000000000000000
R10: 000000000000c084 R11: 0000000000000202 R12: 0000000000000000
R13: 00000000004025b0 R14: 0000000000402640 R15: 0000000000000000
On commit 093b995e3b55a0ae0670226ddfcb05bfbf0099ae
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: lib, fs, cgroup: WARNING in percpu_ref_kill_and_confirm
2017-03-23 14:04 lib, fs, cgroup: WARNING in percpu_ref_kill_and_confirm Dmitry Vyukov
@ 2017-03-24 3:18 ` Zefan Li
2017-05-31 14:08 ` Alexander Potapenko
0 siblings, 1 reply; 4+ messages in thread
From: Zefan Li @ 2017-03-24 3:18 UTC (permalink / raw)
To: Dmitry Vyukov, Tejun Heo, roman.penyaev, LKML, Eric W. Biederman,
jweiner, Andrew Morton
Cc: syzkaller
On 2017/3/23 22:04, Dmitry Vyukov wrote:
> Hello,
>
> The following program triggers WARNING in percpu_ref_kill_and_confirm:
> https://gist.githubusercontent.com/dvyukov/bcfcef3d6b24b9fd841b88ee20c14d4b/raw/a54aeeb09ad1e0659b0ed87ef5efc4480ab2536f/gistfile1.txt
>
The bug can be triggered immediately. I'll look into it. Thanks!
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 19987 at lib/percpu-refcount.c:317
> percpu_ref_kill_and_confirm+0x303/0x3c0 lib/percpu-refcount.c:316
> percpu_ref_kill_and_confirm called more than once on css_release!
> CPU: 3 PID: 19987 Comm: a.out Not tainted 4.11.0-rc3+ #365
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:16 [inline]
> dump_stack+0x1b8/0x28d lib/dump_stack.c:52
> panic+0x20c/0x423 kernel/panic.c:180
> __warn+0x1c4/0x1e0 kernel/panic.c:541
> warn_slowpath_fmt+0xc1/0x100 kernel/panic.c:564
> percpu_ref_kill_and_confirm+0x303/0x3c0 lib/percpu-refcount.c:316
> percpu_ref_kill include/linux/percpu-refcount.h:119 [inline]
> cgroup_kill_sb+0x31d/0x480 kernel/cgroup/cgroup.c:1834
> deactivate_locked_super+0x99/0xe0 fs/super.c:309
> deactivate_super+0x151/0x160 fs/super.c:340
> cleanup_mnt+0xb2/0x160 fs/namespace.c:1115
> __cleanup_mnt+0x16/0x20 fs/namespace.c:1122
> task_work_run+0x1a4/0x270 kernel/task_work.c:116
> tracehook_notify_resume include/linux/tracehook.h:191 [inline]
> exit_to_usermode_loop+0x24d/0x2d0 arch/x86/entry/common.c:161
> prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
> syscall_return_slowpath+0x3bd/0x460 arch/x86/entry/common.c:260
> entry_SYSCALL_64_fastpath+0xc0/0xc2
> RIP: 0033:0x443129
> RSP: 002b:00007ffe06080018 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffec RBX: 00000000004002b0 RCX: 0000000000443129
> RDX: 000000002019cff9 RSI: 000000002000c000 RDI: 00000000204ff000
> RBP: 00007ffe06080060 R08: 00000000201db000 R09: 0000000000000000
> R10: 000000000000c084 R11: 0000000000000202 R12: 0000000000000000
> R13: 00000000004025b0 R14: 0000000000402640 R15: 0000000000000000
>
> On commit 093b995e3b55a0ae0670226ddfcb05bfbf0099ae
> .
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: lib, fs, cgroup: WARNING in percpu_ref_kill_and_confirm
2017-03-24 3:18 ` Zefan Li
@ 2017-05-31 14:08 ` Alexander Potapenko
2017-06-01 1:07 ` Zefan Li
0 siblings, 1 reply; 4+ messages in thread
From: Alexander Potapenko @ 2017-05-31 14:08 UTC (permalink / raw)
To: Zefan Li
Cc: Dmitry Vyukov, Tejun Heo, roman.penyaev, LKML, Eric W. Biederman,
jweiner, Andrew Morton, syzkaller
On Fri, Mar 24, 2017 at 4:18 AM, Zefan Li <lizefan@huawei.com> wrote:
> On 2017/3/23 22:04, Dmitry Vyukov wrote:
>> Hello,
>>
>> The following program triggers WARNING in percpu_ref_kill_and_confirm:
>> https://gist.githubusercontent.com/dvyukov/bcfcef3d6b24b9fd841b88ee20c14d4b/raw/a54aeeb09ad1e0659b0ed87ef5efc4480ab2536f/gistfile1.txt
>>
>
> The bug can be triggered immediately. I'll look into it. Thanks!
Hi Zefan,
Have you had a chance to look into this bug?
It's still reproducible for me with KMSAN.
>> ------------[ cut here ]------------
>> WARNING: CPU: 3 PID: 19987 at lib/percpu-refcount.c:317
>> percpu_ref_kill_and_confirm+0x303/0x3c0 lib/percpu-refcount.c:316
>> percpu_ref_kill_and_confirm called more than once on css_release!
>> CPU: 3 PID: 19987 Comm: a.out Not tainted 4.11.0-rc3+ #365
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> Call Trace:
>> __dump_stack lib/dump_stack.c:16 [inline]
>> dump_stack+0x1b8/0x28d lib/dump_stack.c:52
>> panic+0x20c/0x423 kernel/panic.c:180
>> __warn+0x1c4/0x1e0 kernel/panic.c:541
>> warn_slowpath_fmt+0xc1/0x100 kernel/panic.c:564
>> percpu_ref_kill_and_confirm+0x303/0x3c0 lib/percpu-refcount.c:316
>> percpu_ref_kill include/linux/percpu-refcount.h:119 [inline]
>> cgroup_kill_sb+0x31d/0x480 kernel/cgroup/cgroup.c:1834
>> deactivate_locked_super+0x99/0xe0 fs/super.c:309
>> deactivate_super+0x151/0x160 fs/super.c:340
>> cleanup_mnt+0xb2/0x160 fs/namespace.c:1115
>> __cleanup_mnt+0x16/0x20 fs/namespace.c:1122
>> task_work_run+0x1a4/0x270 kernel/task_work.c:116
>> tracehook_notify_resume include/linux/tracehook.h:191 [inline]
>> exit_to_usermode_loop+0x24d/0x2d0 arch/x86/entry/common.c:161
>> prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
>> syscall_return_slowpath+0x3bd/0x460 arch/x86/entry/common.c:260
>> entry_SYSCALL_64_fastpath+0xc0/0xc2
>> RIP: 0033:0x443129
>> RSP: 002b:00007ffe06080018 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
>> RAX: ffffffffffffffec RBX: 00000000004002b0 RCX: 0000000000443129
>> RDX: 000000002019cff9 RSI: 000000002000c000 RDI: 00000000204ff000
>> RBP: 00007ffe06080060 R08: 00000000201db000 R09: 0000000000000000
>> R10: 000000000000c084 R11: 0000000000000202 R12: 0000000000000000
>> R13: 00000000004025b0 R14: 0000000000402640 R15: 0000000000000000
>>
>> On commit 093b995e3b55a0ae0670226ddfcb05bfbf0099ae
>> .
>>
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
--
Alexander Potapenko
Software Engineer
Google Germany GmbH
Erika-Mann-Straße, 33
80636 München
Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: lib, fs, cgroup: WARNING in percpu_ref_kill_and_confirm
2017-05-31 14:08 ` Alexander Potapenko
@ 2017-06-01 1:07 ` Zefan Li
0 siblings, 0 replies; 4+ messages in thread
From: Zefan Li @ 2017-06-01 1:07 UTC (permalink / raw)
To: Alexander Potapenko
Cc: Dmitry Vyukov, Tejun Heo, roman.penyaev, LKML, Eric W. Biederman,
jweiner, Andrew Morton, syzkaller
On 2017/5/31 22:08, Alexander Potapenko wrote:
> On Fri, Mar 24, 2017 at 4:18 AM, Zefan Li <lizefan@huawei.com> wrote:
>> On 2017/3/23 22:04, Dmitry Vyukov wrote:
>>> Hello,
>>>
>>> The following program triggers WARNING in percpu_ref_kill_and_confirm:
>>> https://gist.githubusercontent.com/dvyukov/bcfcef3d6b24b9fd841b88ee20c14d4b/raw/a54aeeb09ad1e0659b0ed87ef5efc4480ab2536f/gistfile1.txt
>>>
>>
>> The bug can be triggered immediately. I'll look into it. Thanks!
> Hi Zefan,
>
> Have you had a chance to look into this bug?
> It's still reproducible for me with KMSAN.
But I already fixed it..
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9732adc5d6520238223df16630f1f8cad2269317
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-06-01 1:11 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-23 14:04 lib, fs, cgroup: WARNING in percpu_ref_kill_and_confirm Dmitry Vyukov
2017-03-24 3:18 ` Zefan Li
2017-05-31 14:08 ` Alexander Potapenko
2017-06-01 1:07 ` Zefan Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).