Re: WARNING in port_delete
On Mon, Apr 1, 2019 at 9:25 PM Paul E. McKenney wrote:
>
> On Mon, Apr 01, 2019 at 12:58:01AM -0700, syzbot wrote:
> > syzbot has bisected this bug to:
> >
> > commit 63d86a7e85f84b8ac3b2f394570965aedbb03787
> > Author: Paul E. McKenney
> > Date: Tue May 1 20:08:46 2018 +
> >
> > rcu: Convert rcu_grace_period_init tracepoint to gp_seq
> >
> > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17f86d2f20
> > start commit: 091a1eaa Merge branch 'akpm'
> > git tree: upstream
> > final crash:https://syzkaller.appspot.com/x/report.txt?x=14046d2f20
> > console output: https://syzkaller.appspot.com/x/log.txt?x=10046d2f20
> > kernel config: https://syzkaller.appspot.com/x/.config?x=c0af03fe452b65fb
> > dashboard link: https://syzkaller.appspot.com/bug?extid=e4c8abb920efa77bace9
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=102e2c9140
> >
> > Reported-by: syzbot+e4c8abb920efa77ba...@syzkaller.appspotmail.com
> > Fixes: 63d86a7e85f8 ("rcu: Convert rcu_grace_period_init tracepoint
> > to gp_seq")
>
> I could easily be suffering from a lack of imagination, but I am not
> seeing how this change to RCU's event tracing could cause this result.
> Especially given that CONFIG_RCU_TRACE=n in your .config.
>
> What am I missing here?
I don't think you are missing something here.
Re: WARNING in port_delete
On Mon, Apr 01, 2019 at 12:58:01AM -0700, syzbot wrote:
> syzbot has bisected this bug to:
>
> commit 63d86a7e85f84b8ac3b2f394570965aedbb03787
> Author: Paul E. McKenney
> Date: Tue May 1 20:08:46 2018 +
>
> rcu: Convert rcu_grace_period_init tracepoint to gp_seq
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17f86d2f20
> start commit: 091a1eaa Merge branch 'akpm'
> git tree: upstream
> final crash:https://syzkaller.appspot.com/x/report.txt?x=14046d2f20
> console output: https://syzkaller.appspot.com/x/log.txt?x=10046d2f20
> kernel config: https://syzkaller.appspot.com/x/.config?x=c0af03fe452b65fb
> dashboard link: https://syzkaller.appspot.com/bug?extid=e4c8abb920efa77bace9
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=102e2c9140
>
> Reported-by: syzbot+e4c8abb920efa77ba...@syzkaller.appspotmail.com
> Fixes: 63d86a7e85f8 ("rcu: Convert rcu_grace_period_init tracepoint
> to gp_seq")
I could easily be suffering from a lack of imagination, but I am not
seeing how this change to RCU's event tracing could cause this result.
Especially given that CONFIG_RCU_TRACE=n in your .config.
What am I missing here?
Thanx, Paul
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
Re: WARNING in port_delete
syzbot has bisected this bug to:
commit 63d86a7e85f84b8ac3b2f394570965aedbb03787
Author: Paul E. McKenney
Date: Tue May 1 20:08:46 2018 +
rcu: Convert rcu_grace_period_init tracepoint to gp_seq
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17f86d2f20
start commit: 091a1eaa Merge branch 'akpm'
git tree: upstream
final crash:https://syzkaller.appspot.com/x/report.txt?x=14046d2f20
console output: https://syzkaller.appspot.com/x/log.txt?x=10046d2f20
kernel config: https://syzkaller.appspot.com/x/.config?x=c0af03fe452b65fb
dashboard link: https://syzkaller.appspot.com/bug?extid=e4c8abb920efa77bace9
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=102e2c9140
Reported-by: syzbot+e4c8abb920efa77ba...@syzkaller.appspotmail.com
Fixes: 63d86a7e85f8 ("rcu: Convert rcu_grace_period_init tracepoint to
gp_seq")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Re: WARNING in port_delete
syzbot has found a reproducer for the following crash on: HEAD commit:091a1eaa0e30 Merge branch 'akpm' git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16623e5940 kernel config: https://syzkaller.appspot.com/x/.config?x=c0af03fe452b65fb dashboard link: https://syzkaller.appspot.com/bug?extid=e4c8abb920efa77bace9 compiler: gcc (GCC) 8.0.1 20180413 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=102e2c9140 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+e4c8abb920efa77ba...@syzkaller.appspotmail.com WARNING: CPU: 1 PID: 23693 at sound/core/seq/seq_ports.c:275 port_delete+0x177/0x1b0 sound/core/seq/seq_ports.c:275 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 23693 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #47 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113 panic+0x238/0x4e7 kernel/panic.c:184 __warn.cold.8+0x163/0x1ba kernel/panic.c:536 report_bug+0x254/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296 kobject: 'loop1' (baf940ef): kobject_uevent_env kobject: 'loop1' (baf940ef): fill_kobj_path: path = '/devices/virtual/block/loop1' do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:993 RIP: 0010:port_delete+0x177/0x1b0 sound/core/seq/seq_ports.c:275 Code: e7 99 fb 45 85 e4 75 14 e8 66 e6 99 fb 48 89 df e8 ee 29 dd fb 31 c0 5b 41 5c 5d c3 e8 52 e6 99 fb 0f 0b eb e3 e8 49 e6 99 fb <0f> 0b eb 9b e8 a0 55 dd fb eb bd e8 99 55 dd fb e9 77 ff ff ff e8 RSP: 0018:8801a7477890 EFLAGS: 00010293 RAX: 8801a84e05c0 RBX: 8801cf0be4c0 RCX: 85e4eee1 RDX: RSI: 85e4ef47 RDI: 0005 RBP: 8801a74778a0 R08: 8801a84e05c0 R09: deede79a R10: da8ba726 R11: R12: 0001 R13: 8801cf0be510 R14: 110034e8ef20 R15: 8801cb447b00 snd_seq_delete_port+0x3cb/0x4a0 sound/core/seq/seq_ports.c:303 snd_seq_ioctl_delete_port+0xba/0x190 sound/core/seq/seq_clientmgr.c:1324 snd_seq_kernel_client_ctl+0x15a/0x190 sound/core/seq/seq_clientmgr.c:2353 snd_seq_event_port_detach+0xfc/0x170 sound/core/seq/seq_ports.c:705 delete_port+0x7d/0xc0 sound/core/seq/oss/seq_oss_init.c:354 snd_seq_oss_release+0xf2/0x130 sound/core/seq/oss/seq_oss_init.c:433 odev_release+0x52/0x70 sound/core/seq/oss/seq_oss.c:153 __fput+0x385/0xa30 fs/file_table.c:278 fput+0x15/0x20 fs/file_table.c:309 task_work_run+0x1e8/0x2a0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457579 Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:7f85fa204c78 EFLAGS: 0246 ORIG_RAX: 0003 RAX: RBX: 0001 RCX: 00457579 RDX: RSI: RDI: 0006 RBP: 0072bfa0 R08: R09: R10: R11: 0246 R12: 7f85fa2056d4 R13: 004ef912 R14: 004cc460 R15: Kernel Offset: disabled Rebooting in 86400 seconds..
Re: WARNING in port_delete
syzbot has found a reproducer for the following crash on: HEAD commit:091a1eaa0e30 Merge branch 'akpm' git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16623e5940 kernel config: https://syzkaller.appspot.com/x/.config?x=c0af03fe452b65fb dashboard link: https://syzkaller.appspot.com/bug?extid=e4c8abb920efa77bace9 compiler: gcc (GCC) 8.0.1 20180413 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=102e2c9140 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+e4c8abb920efa77ba...@syzkaller.appspotmail.com WARNING: CPU: 1 PID: 23693 at sound/core/seq/seq_ports.c:275 port_delete+0x177/0x1b0 sound/core/seq/seq_ports.c:275 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 23693 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #47 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113 panic+0x238/0x4e7 kernel/panic.c:184 __warn.cold.8+0x163/0x1ba kernel/panic.c:536 report_bug+0x254/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296 kobject: 'loop1' (baf940ef): kobject_uevent_env kobject: 'loop1' (baf940ef): fill_kobj_path: path = '/devices/virtual/block/loop1' do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:993 RIP: 0010:port_delete+0x177/0x1b0 sound/core/seq/seq_ports.c:275 Code: e7 99 fb 45 85 e4 75 14 e8 66 e6 99 fb 48 89 df e8 ee 29 dd fb 31 c0 5b 41 5c 5d c3 e8 52 e6 99 fb 0f 0b eb e3 e8 49 e6 99 fb <0f> 0b eb 9b e8 a0 55 dd fb eb bd e8 99 55 dd fb e9 77 ff ff ff e8 RSP: 0018:8801a7477890 EFLAGS: 00010293 RAX: 8801a84e05c0 RBX: 8801cf0be4c0 RCX: 85e4eee1 RDX: RSI: 85e4ef47 RDI: 0005 RBP: 8801a74778a0 R08: 8801a84e05c0 R09: deede79a R10: da8ba726 R11: R12: 0001 R13: 8801cf0be510 R14: 110034e8ef20 R15: 8801cb447b00 snd_seq_delete_port+0x3cb/0x4a0 sound/core/seq/seq_ports.c:303 snd_seq_ioctl_delete_port+0xba/0x190 sound/core/seq/seq_clientmgr.c:1324 snd_seq_kernel_client_ctl+0x15a/0x190 sound/core/seq/seq_clientmgr.c:2353 snd_seq_event_port_detach+0xfc/0x170 sound/core/seq/seq_ports.c:705 delete_port+0x7d/0xc0 sound/core/seq/oss/seq_oss_init.c:354 snd_seq_oss_release+0xf2/0x130 sound/core/seq/oss/seq_oss_init.c:433 odev_release+0x52/0x70 sound/core/seq/oss/seq_oss.c:153 __fput+0x385/0xa30 fs/file_table.c:278 fput+0x15/0x20 fs/file_table.c:309 task_work_run+0x1e8/0x2a0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457579 Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:7f85fa204c78 EFLAGS: 0246 ORIG_RAX: 0003 RAX: RBX: 0001 RCX: 00457579 RDX: RSI: RDI: 0006 RBP: 0072bfa0 R08: R09: R10: R11: 0246 R12: 7f85fa2056d4 R13: 004ef912 R14: 004cc460 R15: Kernel Offset: disabled Rebooting in 86400 seconds..
Re: WARNING in port_delete
On Tue, 24 Jul 2018 09:14:14 +0200, DaeRyong Jeong wrote: > > I agree with that having a C reproducer would be much better. > Now I'm working on it. > I will immediately let you know once I get the C reproducer. That's great, thanks! Takashi > > > Thank you. > > Best regards, > DaeRyong Jeong > On 24 Jul 2018, 4:00 PM +0900, Takashi Iwai , wrote: > > On Tue, 24 Jul 2018 05:59:56 +0200, > > DaeRyong Jeong wrote: > > > > > > I just realized that the crash has been spotted by Syzkaller a few days > > > before. > > > (https://syzkaller.appspot.com/bug?id=3490860a465e6b39227c6906f0ef2d40ad4d5bb1) > > > > > > I'm CC'ing Syzkaller's mailing list. > > > > It's very likely a false-positive sanity check, and if so, nothing > > serious at all. We may simply remove two snd_BUG_ON() lines. > > > > But I'd love to have a C reproducer to confirm my understanding is > > correct... > > > > > > thanks, > > > > Takashi > > > > --- > > --- a/sound/core/seq/seq_ports.c > > +++ b/sound/core/seq/seq_ports.c > > @@ -272,9 +272,6 @@ static int port_delete(struct snd_seq_client *client, > > if (port->private_free) > > port->private_free(port->private_data); > > > > - snd_BUG_ON(port->c_src.count != 0); > > - snd_BUG_ON(port->c_dest.count != 0); > > - > > kfree(port); > > return 0; > > } > [2 ] >
Re: WARNING in port_delete
On Tue, 24 Jul 2018 09:14:14 +0200, DaeRyong Jeong wrote: > > I agree with that having a C reproducer would be much better. > Now I'm working on it. > I will immediately let you know once I get the C reproducer. That's great, thanks! Takashi > > > Thank you. > > Best regards, > DaeRyong Jeong > On 24 Jul 2018, 4:00 PM +0900, Takashi Iwai , wrote: > > On Tue, 24 Jul 2018 05:59:56 +0200, > > DaeRyong Jeong wrote: > > > > > > I just realized that the crash has been spotted by Syzkaller a few days > > > before. > > > (https://syzkaller.appspot.com/bug?id=3490860a465e6b39227c6906f0ef2d40ad4d5bb1) > > > > > > I'm CC'ing Syzkaller's mailing list. > > > > It's very likely a false-positive sanity check, and if so, nothing > > serious at all. We may simply remove two snd_BUG_ON() lines. > > > > But I'd love to have a C reproducer to confirm my understanding is > > correct... > > > > > > thanks, > > > > Takashi > > > > --- > > --- a/sound/core/seq/seq_ports.c > > +++ b/sound/core/seq/seq_ports.c > > @@ -272,9 +272,6 @@ static int port_delete(struct snd_seq_client *client, > > if (port->private_free) > > port->private_free(port->private_data); > > > > - snd_BUG_ON(port->c_src.count != 0); > > - snd_BUG_ON(port->c_dest.count != 0); > > - > > kfree(port); > > return 0; > > } > [2 ] >
Re: WARNING in port_delete
I agree with that having a C reproducer would be much better. Now I'm working on it. I will immediately let you know once I get the C reproducer. Thank you. Best regards, DaeRyong Jeong On 24 Jul 2018, 4:00 PM +0900, Takashi Iwai , wrote: > On Tue, 24 Jul 2018 05:59:56 +0200, > DaeRyong Jeong wrote: > > > > I just realized that the crash has been spotted by Syzkaller a few days > > before. > > (https://syzkaller.appspot.com/bug?id=3490860a465e6b39227c6906f0ef2d40ad4d5bb1) > > > > I'm CC'ing Syzkaller's mailing list. > > It's very likely a false-positive sanity check, and if so, nothing > serious at all. We may simply remove two snd_BUG_ON() lines. > > But I'd love to have a C reproducer to confirm my understanding is > correct... > > > thanks, > > Takashi > > --- > --- a/sound/core/seq/seq_ports.c > +++ b/sound/core/seq/seq_ports.c > @@ -272,9 +272,6 @@ static int port_delete(struct snd_seq_client *client, > if (port->private_free) > port->private_free(port->private_data); > > - snd_BUG_ON(port->c_src.count != 0); > - snd_BUG_ON(port->c_dest.count != 0); > - > kfree(port); > return 0; > }
Re: WARNING in port_delete
I agree with that having a C reproducer would be much better. Now I'm working on it. I will immediately let you know once I get the C reproducer. Thank you. Best regards, DaeRyong Jeong On 24 Jul 2018, 4:00 PM +0900, Takashi Iwai , wrote: > On Tue, 24 Jul 2018 05:59:56 +0200, > DaeRyong Jeong wrote: > > > > I just realized that the crash has been spotted by Syzkaller a few days > > before. > > (https://syzkaller.appspot.com/bug?id=3490860a465e6b39227c6906f0ef2d40ad4d5bb1) > > > > I'm CC'ing Syzkaller's mailing list. > > It's very likely a false-positive sanity check, and if so, nothing > serious at all. We may simply remove two snd_BUG_ON() lines. > > But I'd love to have a C reproducer to confirm my understanding is > correct... > > > thanks, > > Takashi > > --- > --- a/sound/core/seq/seq_ports.c > +++ b/sound/core/seq/seq_ports.c > @@ -272,9 +272,6 @@ static int port_delete(struct snd_seq_client *client, > if (port->private_free) > port->private_free(port->private_data); > > - snd_BUG_ON(port->c_src.count != 0); > - snd_BUG_ON(port->c_dest.count != 0); > - > kfree(port); > return 0; > }
Re: WARNING in port_delete
On Tue, 24 Jul 2018 05:59:56 +0200, DaeRyong Jeong wrote: > > I just realized that the crash has been spotted by Syzkaller a few days > before. > (https://syzkaller.appspot.com/bug?id=3490860a465e6b39227c6906f0ef2d40ad4d5bb1) > > I'm CC'ing Syzkaller's mailing list. It's very likely a false-positive sanity check, and if so, nothing serious at all. We may simply remove two snd_BUG_ON() lines. But I'd love to have a C reproducer to confirm my understanding is correct... thanks, Takashi --- --- a/sound/core/seq/seq_ports.c +++ b/sound/core/seq/seq_ports.c @@ -272,9 +272,6 @@ static int port_delete(struct snd_seq_client *client, if (port->private_free) port->private_free(port->private_data); - snd_BUG_ON(port->c_src.count != 0); - snd_BUG_ON(port->c_dest.count != 0); - kfree(port); return 0; }
Re: WARNING in port_delete
On Tue, 24 Jul 2018 05:59:56 +0200, DaeRyong Jeong wrote: > > I just realized that the crash has been spotted by Syzkaller a few days > before. > (https://syzkaller.appspot.com/bug?id=3490860a465e6b39227c6906f0ef2d40ad4d5bb1) > > I'm CC'ing Syzkaller's mailing list. It's very likely a false-positive sanity check, and if so, nothing serious at all. We may simply remove two snd_BUG_ON() lines. But I'd love to have a C reproducer to confirm my understanding is correct... thanks, Takashi --- --- a/sound/core/seq/seq_ports.c +++ b/sound/core/seq/seq_ports.c @@ -272,9 +272,6 @@ static int port_delete(struct snd_seq_client *client, if (port->private_free) port->private_free(port->private_data); - snd_BUG_ON(port->c_src.count != 0); - snd_BUG_ON(port->c_dest.count != 0); - kfree(port); return 0; }
Re: WARNING in port_delete
I just realized that the crash has been spotted by Syzkaller a few days before.
(https://syzkaller.appspot.com/bug?id=3490860a465e6b39227c6906f0ef2d40ad4d5bb1)
I'm CC'ing Syzkaller's mailing list.
Best regards,
DaeRyong Jeong
On Tue, Jul 24, 2018 at 12:36 PM, Dae R. Jeong wrote:
> Reporting the crash: WARNING in port_delete
>
> This crash has been found in v4.18-rc3 using RaceFuzzer (a modified
> version of Syzkaller), which we descrbie more at the end of this
> report. Our analysis shows that the race occurs when invoking two close
> syscalls concurrently.
>
>
> The executed program is as follows:
> r0 = open("/dev/snd/seq", 0x0, 0x0)
> ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT, {{0x80},
> "706f729430233f77081000",
> 0x, 0xfbff})
> r1 = openat(AT_FDCWD, "/dev/sequencer2", 0x8402, 0x0)
> close(r0)
> close(r1)
>
> and two threads executed the program as follows:
> Thread0 Thread1
> open("/dev/snd/seq")
> ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT)
> openat("/dev/sequencer2")
> close(r0) close(r1)
>
> (Note that two close() syscalls were exeuted after openat() syscall, and
> two close() syscalls were executed concurrently.)
>
>
> Crash log:
> ==
> WARNING: CPU: 1 PID: 32519 at
> /home/daeryong/workspace/race-fuzzer/kernels_repo/kernel_v4.18-rc3/sound/core/seq/seq_ports.c:275
> port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
> Kernel panic - not syncing: panic_on_warn set ...
>
> CPU: 1 PID: 32519 Comm: syz-executor0 Not tainted 4.18.0-rc3 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x16e/0x22c lib/dump_stack.c:113
> panic+0x1a8/0x3a7 kernel/panic.c:184
> __warn+0x191/0x1a0 kernel/panic.c:536
> report_bug+0x132/0x1b0 lib/bug.c:186
> fixup_bug.part.10+0x28/0x50 arch/x86/kernel/traps.c:178
> fixup_bug arch/x86/kernel/traps.c:247 [inline]
> do_error_trap+0x284/0x2c0 arch/x86/kernel/traps.c:296
> do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
> invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
> RIP: 0010:port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
> Code: 00 00 e8 b5 68 d2 fd 8b 83 58 01 00 00 85 c0 75 1d e8 86 5c ae fd 48 89
> df e8 3e 52 d2 fd 31 c0 5b 41 5c 5d c3 e8 72 5c ae fd <0f> 0b eb c8 e8 69 5c
> ae fd 0f 0b eb da 0f 1f 44 00 00 55 48 89 e5
> RSP: 0018:8801d635f900 EFLAGS: 00010216
> RAX: 0004 RBX: 8801da196900 RCX: 839b86ee
> RDX: 5e94 RSI: c9000264 RDI: 8801da196978
> RBP: 8801d635f910 R08: 0098 R09:
> R10: R11: R12: 839ba820
> R13: 8801da196950 R14: 8801ed5bc080 R15: 8801da196958
> snd_seq_delete_port+0x2b0/0x2d0 sound/core/seq/seq_ports.c:303
> snd_seq_ioctl_delete_port+0x5b/0xa0 sound/core/seq/seq_clientmgr.c:1325
> snd_seq_kernel_client_ctl+0xd4/0xf0 sound/core/seq/seq_clientmgr.c:2361
> snd_seq_event_port_detach+0xcb/0x120 sound/core/seq/seq_ports.c:705
> delete_port+0x3a/0x70 sound/core/seq/oss/seq_oss_init.c:354
> snd_seq_oss_release+0x7c/0x90 sound/core/seq/oss/seq_oss_init.c:433
> odev_release+0x40/0x60 sound/core/seq/oss/seq_oss.c:153
> __fput+0x234/0x470 fs/file_table.c:209
> fput+0x15/0x20 fs/file_table.c:243
> task_work_run+0x15a/0x1c0 kernel/task_work.c:113
> tracehook_notify_resume include/linux/tracehook.h:192 [inline]
> exit_to_usermode_loop+0x2a3/0x2b0 arch/x86/entry/common.c:166
> prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
> syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
> do_syscall_64+0x485/0x4b0 arch/x86/entry/common.c:293
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x456469
> Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48
> 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f
> 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:7fe9a8936b28 EFLAGS: 0246 ORIG_RAX: 0003
> RAX: RBX: 0072bfa0 RCX: 00456469
> RDX: RSI: RDI: 0014
> RBP: 0054 R08: R09:
> R10: R11: 0246 R12: 7fe9a89376d4
> R13: R14: 006f5880 R15:
> Dumping ftrace buffer:
>(ftrace buffer
Re: WARNING in port_delete
I just realized that the crash has been spotted by Syzkaller a few days before.
(https://syzkaller.appspot.com/bug?id=3490860a465e6b39227c6906f0ef2d40ad4d5bb1)
I'm CC'ing Syzkaller's mailing list.
Best regards,
DaeRyong Jeong
On Tue, Jul 24, 2018 at 12:36 PM, Dae R. Jeong wrote:
> Reporting the crash: WARNING in port_delete
>
> This crash has been found in v4.18-rc3 using RaceFuzzer (a modified
> version of Syzkaller), which we descrbie more at the end of this
> report. Our analysis shows that the race occurs when invoking two close
> syscalls concurrently.
>
>
> The executed program is as follows:
> r0 = open("/dev/snd/seq", 0x0, 0x0)
> ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT, {{0x80},
> "706f729430233f77081000",
> 0x, 0xfbff})
> r1 = openat(AT_FDCWD, "/dev/sequencer2", 0x8402, 0x0)
> close(r0)
> close(r1)
>
> and two threads executed the program as follows:
> Thread0 Thread1
> open("/dev/snd/seq")
> ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT)
> openat("/dev/sequencer2")
> close(r0) close(r1)
>
> (Note that two close() syscalls were exeuted after openat() syscall, and
> two close() syscalls were executed concurrently.)
>
>
> Crash log:
> ==
> WARNING: CPU: 1 PID: 32519 at
> /home/daeryong/workspace/race-fuzzer/kernels_repo/kernel_v4.18-rc3/sound/core/seq/seq_ports.c:275
> port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
> Kernel panic - not syncing: panic_on_warn set ...
>
> CPU: 1 PID: 32519 Comm: syz-executor0 Not tainted 4.18.0-rc3 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x16e/0x22c lib/dump_stack.c:113
> panic+0x1a8/0x3a7 kernel/panic.c:184
> __warn+0x191/0x1a0 kernel/panic.c:536
> report_bug+0x132/0x1b0 lib/bug.c:186
> fixup_bug.part.10+0x28/0x50 arch/x86/kernel/traps.c:178
> fixup_bug arch/x86/kernel/traps.c:247 [inline]
> do_error_trap+0x284/0x2c0 arch/x86/kernel/traps.c:296
> do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
> invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
> RIP: 0010:port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
> Code: 00 00 e8 b5 68 d2 fd 8b 83 58 01 00 00 85 c0 75 1d e8 86 5c ae fd 48 89
> df e8 3e 52 d2 fd 31 c0 5b 41 5c 5d c3 e8 72 5c ae fd <0f> 0b eb c8 e8 69 5c
> ae fd 0f 0b eb da 0f 1f 44 00 00 55 48 89 e5
> RSP: 0018:8801d635f900 EFLAGS: 00010216
> RAX: 0004 RBX: 8801da196900 RCX: 839b86ee
> RDX: 5e94 RSI: c9000264 RDI: 8801da196978
> RBP: 8801d635f910 R08: 0098 R09:
> R10: R11: R12: 839ba820
> R13: 8801da196950 R14: 8801ed5bc080 R15: 8801da196958
> snd_seq_delete_port+0x2b0/0x2d0 sound/core/seq/seq_ports.c:303
> snd_seq_ioctl_delete_port+0x5b/0xa0 sound/core/seq/seq_clientmgr.c:1325
> snd_seq_kernel_client_ctl+0xd4/0xf0 sound/core/seq/seq_clientmgr.c:2361
> snd_seq_event_port_detach+0xcb/0x120 sound/core/seq/seq_ports.c:705
> delete_port+0x3a/0x70 sound/core/seq/oss/seq_oss_init.c:354
> snd_seq_oss_release+0x7c/0x90 sound/core/seq/oss/seq_oss_init.c:433
> odev_release+0x40/0x60 sound/core/seq/oss/seq_oss.c:153
> __fput+0x234/0x470 fs/file_table.c:209
> fput+0x15/0x20 fs/file_table.c:243
> task_work_run+0x15a/0x1c0 kernel/task_work.c:113
> tracehook_notify_resume include/linux/tracehook.h:192 [inline]
> exit_to_usermode_loop+0x2a3/0x2b0 arch/x86/entry/common.c:166
> prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
> syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
> do_syscall_64+0x485/0x4b0 arch/x86/entry/common.c:293
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x456469
> Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48
> 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f
> 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:7fe9a8936b28 EFLAGS: 0246 ORIG_RAX: 0003
> RAX: RBX: 0072bfa0 RCX: 00456469
> RDX: RSI: RDI: 0014
> RBP: 0054 R08: R09:
> R10: R11: 0246 R12: 7fe9a89376d4
> R13: R14: 006f5880 R15:
> Dumping ftrace buffer:
>(ftrace buffer
WARNING in port_delete
Reporting the crash: WARNING in port_delete
This crash has been found in v4.18-rc3 using RaceFuzzer (a modified
version of Syzkaller), which we descrbie more at the end of this
report. Our analysis shows that the race occurs when invoking two close
syscalls concurrently.
The executed program is as follows:
r0 = open("/dev/snd/seq", 0x0, 0x0)
ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT, {{0x80},
"706f729430233f77081000",
0x, 0xfbff})
r1 = openat(AT_FDCWD, "/dev/sequencer2", 0x8402, 0x0)
close(r0)
close(r1)
and two threads executed the program as follows:
Thread0 Thread1
open("/dev/snd/seq")
ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT)
openat("/dev/sequencer2")
close(r0) close(r1)
(Note that two close() syscalls were exeuted after openat() syscall, and
two close() syscalls were executed concurrently.)
Crash log:
==
WARNING: CPU: 1 PID: 32519 at
/home/daeryong/workspace/race-fuzzer/kernels_repo/kernel_v4.18-rc3/sound/core/seq/seq_ports.c:275
port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 32519 Comm: syz-executor0 Not tainted 4.18.0-rc3 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x16e/0x22c lib/dump_stack.c:113
panic+0x1a8/0x3a7 kernel/panic.c:184
__warn+0x191/0x1a0 kernel/panic.c:536
report_bug+0x132/0x1b0 lib/bug.c:186
fixup_bug.part.10+0x28/0x50 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x284/0x2c0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
Code: 00 00 e8 b5 68 d2 fd 8b 83 58 01 00 00 85 c0 75 1d e8 86 5c ae fd 48 89
df e8 3e 52 d2 fd 31 c0 5b 41 5c 5d c3 e8 72 5c ae fd <0f> 0b eb c8 e8 69 5c ae
fd 0f 0b eb da 0f 1f 44 00 00 55 48 89 e5
RSP: 0018:8801d635f900 EFLAGS: 00010216
RAX: 0004 RBX: 8801da196900 RCX: 839b86ee
RDX: 5e94 RSI: c9000264 RDI: 8801da196978
RBP: 8801d635f910 R08: 0098 R09:
R10: R11: R12: 839ba820
R13: 8801da196950 R14: 8801ed5bc080 R15: 8801da196958
snd_seq_delete_port+0x2b0/0x2d0 sound/core/seq/seq_ports.c:303
snd_seq_ioctl_delete_port+0x5b/0xa0 sound/core/seq/seq_clientmgr.c:1325
snd_seq_kernel_client_ctl+0xd4/0xf0 sound/core/seq/seq_clientmgr.c:2361
snd_seq_event_port_detach+0xcb/0x120 sound/core/seq/seq_ports.c:705
delete_port+0x3a/0x70 sound/core/seq/oss/seq_oss_init.c:354
snd_seq_oss_release+0x7c/0x90 sound/core/seq/oss/seq_oss_init.c:433
odev_release+0x40/0x60 sound/core/seq/oss/seq_oss.c:153
__fput+0x234/0x470 fs/file_table.c:209
fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x15a/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:192 [inline]
exit_to_usermode_loop+0x2a3/0x2b0 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x485/0x4b0 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x456469
Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48
89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83
eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:7fe9a8936b28 EFLAGS: 0246 ORIG_RAX: 0003
RAX: RBX: 0072bfa0 RCX: 00456469
RDX: RSI: RDI: 0014
RBP: 0054 R08: R09:
R10: R11: 0246 R12: 7fe9a89376d4
R13: R14: 006f5880 R15:
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
= About RaceFuzzer
RaceFuzzer is a customized version of Syzkaller, specifically tailored
to find race condition bugs in the Linux kernel. While we leverage
many different technique, the notable feature of RaceFuzzer is in
leveraging a custom hypervisor (QEMU/KVM) to interleave the
scheduling. In particular, we modified the hypervisor to intentionally
stall a per-core execution, which is similar to supporting per-core
breakpoint functionality. This allows RaceFuzzer to force the kernel
to deterministically trigger racy condition (which may rarely happen
in practice due to randomness in scheduling).
RaceFuzzer's C repro always pinpoints two ra
WARNING in port_delete
Reporting the crash: WARNING in port_delete
This crash has been found in v4.18-rc3 using RaceFuzzer (a modified
version of Syzkaller), which we descrbie more at the end of this
report. Our analysis shows that the race occurs when invoking two close
syscalls concurrently.
The executed program is as follows:
r0 = open("/dev/snd/seq", 0x0, 0x0)
ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT, {{0x80},
"706f729430233f77081000",
0x, 0xfbff})
r1 = openat(AT_FDCWD, "/dev/sequencer2", 0x8402, 0x0)
close(r0)
close(r1)
and two threads executed the program as follows:
Thread0 Thread1
open("/dev/snd/seq")
ioctl(r0, SNDRV_SEQ_IOCTL_CREATE_PORT)
openat("/dev/sequencer2")
close(r0) close(r1)
(Note that two close() syscalls were exeuted after openat() syscall, and
two close() syscalls were executed concurrently.)
Crash log:
==
WARNING: CPU: 1 PID: 32519 at
/home/daeryong/workspace/race-fuzzer/kernels_repo/kernel_v4.18-rc3/sound/core/seq/seq_ports.c:275
port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 32519 Comm: syz-executor0 Not tainted 4.18.0-rc3 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x16e/0x22c lib/dump_stack.c:113
panic+0x1a8/0x3a7 kernel/panic.c:184
__warn+0x191/0x1a0 kernel/panic.c:536
report_bug+0x132/0x1b0 lib/bug.c:186
fixup_bug.part.10+0x28/0x50 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x284/0x2c0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:port_delete+0xde/0xf0 sound/core/seq/seq_ports.c:275
Code: 00 00 e8 b5 68 d2 fd 8b 83 58 01 00 00 85 c0 75 1d e8 86 5c ae fd 48 89
df e8 3e 52 d2 fd 31 c0 5b 41 5c 5d c3 e8 72 5c ae fd <0f> 0b eb c8 e8 69 5c ae
fd 0f 0b eb da 0f 1f 44 00 00 55 48 89 e5
RSP: 0018:8801d635f900 EFLAGS: 00010216
RAX: 0004 RBX: 8801da196900 RCX: 839b86ee
RDX: 5e94 RSI: c9000264 RDI: 8801da196978
RBP: 8801d635f910 R08: 0098 R09:
R10: R11: R12: 839ba820
R13: 8801da196950 R14: 8801ed5bc080 R15: 8801da196958
snd_seq_delete_port+0x2b0/0x2d0 sound/core/seq/seq_ports.c:303
snd_seq_ioctl_delete_port+0x5b/0xa0 sound/core/seq/seq_clientmgr.c:1325
snd_seq_kernel_client_ctl+0xd4/0xf0 sound/core/seq/seq_clientmgr.c:2361
snd_seq_event_port_detach+0xcb/0x120 sound/core/seq/seq_ports.c:705
delete_port+0x3a/0x70 sound/core/seq/oss/seq_oss_init.c:354
snd_seq_oss_release+0x7c/0x90 sound/core/seq/oss/seq_oss_init.c:433
odev_release+0x40/0x60 sound/core/seq/oss/seq_oss.c:153
__fput+0x234/0x470 fs/file_table.c:209
fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x15a/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:192 [inline]
exit_to_usermode_loop+0x2a3/0x2b0 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x485/0x4b0 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x456469
Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48
89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83
eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:7fe9a8936b28 EFLAGS: 0246 ORIG_RAX: 0003
RAX: RBX: 0072bfa0 RCX: 00456469
RDX: RSI: RDI: 0014
RBP: 0054 R08: R09:
R10: R11: 0246 R12: 7fe9a89376d4
R13: R14: 006f5880 R15:
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
= About RaceFuzzer
RaceFuzzer is a customized version of Syzkaller, specifically tailored
to find race condition bugs in the Linux kernel. While we leverage
many different technique, the notable feature of RaceFuzzer is in
leveraging a custom hypervisor (QEMU/KVM) to interleave the
scheduling. In particular, we modified the hypervisor to intentionally
stall a per-core execution, which is similar to supporting per-core
breakpoint functionality. This allows RaceFuzzer to force the kernel
to deterministically trigger racy condition (which may rarely happen
in practice due to randomness in scheduling).
RaceFuzzer's C repro always pinpoints two ra
WARNING in port_delete
Hello, syzbot found the following crash on: HEAD commit:30c2c32d7f70 Merge tag 'drm-fixes-2018-07-10' of git://ano.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=139408c840 kernel config: https://syzkaller.appspot.com/x/.config?x=25856fac4e580aa7 dashboard link: https://syzkaller.appspot.com/bug?extid=e4c8abb920efa77bace9 compiler: gcc (GCC) 8.0.1 20180413 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+e4c8abb920efa77ba...@syzkaller.appspotmail.com netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'. WARNING: CPU: 0 PID: 20823 at sound/core/seq/seq_ports.c:276 port_delete+0x16e/0x1b0 sound/core/seq/seq_ports.c:276 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 20823 Comm: syz-executor4 Not tainted 4.18.0-rc4+ #140 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 panic+0x238/0x4e7 kernel/panic.c:184 __warn.cold.8+0x163/0x1ba kernel/panic.c:536 report_bug+0x252/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992 RIP: 0010:port_delete+0x16e/0x1b0 sound/core/seq/seq_ports.c:276 Code: 00 00 31 ff 44 89 e6 e8 e0 f8 9d fb 45 85 e4 75 14 e8 c6 f7 9d fb 48 89 df e8 4e a6 db fb 31 c0 5b 41 5c 5d c3 e8 b2 f7 9d fb <0f> 0b eb e3 e8 a9 f7 9d fb 0f 0b eb 9b e8 d0 d1 db fb eb bd e8 c9 RSP: 0018:88019b9f78d0 EFLAGS: 00010293 RAX: 8801c5f74100 RBX: 8801b053adc0 RCX: 85de13d0 RDX: RSI: 85de13ee RDI: 0005 RBP: 88019b9f78e0 R08: 8801c5f74100 R09: 0006 R10: 8801c5f74100 R11: R12: 0001 R13: 8801b053ae10 R14: 11003373ef28 R15: 88019b95d6d0 snd_seq_delete_port+0x3cb/0x4a0 sound/core/seq/seq_ports.c:303 snd_seq_ioctl_delete_port+0xba/0x190 sound/core/seq/seq_clientmgr.c:1325 snd_seq_kernel_client_ctl+0x15a/0x190 sound/core/seq/seq_clientmgr.c:2361 snd_seq_event_port_detach+0xfb/0x160 sound/core/seq/seq_ports.c:705 delete_port+0x7d/0xc0 sound/core/seq/oss/seq_oss_init.c:354 snd_seq_oss_release+0xf2/0x130 sound/core/seq/oss/seq_oss_init.c:433 odev_release+0x52/0x70 sound/core/seq/oss/seq_oss.c:153 __fput+0x355/0x8b0 fs/file_table.c:209 fput+0x15/0x20 fs/file_table.c:243 task_work_run+0x1ec/0x2a0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:192 [inline] exit_to_usermode_loop+0x313/0x370 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x40ff01 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00a3eab0 EFLAGS: 0293 ORIG_RAX: 0003 RAX: RBX: 0015 RCX: 0040ff01 RDX: RSI: 007328a0 RDI: 0014 RBP: 0013 R08: R09: R10: 00a3e930 R11: 0293 R12: R13: R14: 00a3f160 R15: 007034c0 Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Rebooting in 86400 seconds.. --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkal...@googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot.
WARNING in port_delete
Hello, syzbot found the following crash on: HEAD commit:30c2c32d7f70 Merge tag 'drm-fixes-2018-07-10' of git://ano.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=139408c840 kernel config: https://syzkaller.appspot.com/x/.config?x=25856fac4e580aa7 dashboard link: https://syzkaller.appspot.com/bug?extid=e4c8abb920efa77bace9 compiler: gcc (GCC) 8.0.1 20180413 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+e4c8abb920efa77ba...@syzkaller.appspotmail.com netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'. WARNING: CPU: 0 PID: 20823 at sound/core/seq/seq_ports.c:276 port_delete+0x16e/0x1b0 sound/core/seq/seq_ports.c:276 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 20823 Comm: syz-executor4 Not tainted 4.18.0-rc4+ #140 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 panic+0x238/0x4e7 kernel/panic.c:184 __warn.cold.8+0x163/0x1ba kernel/panic.c:536 report_bug+0x252/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992 RIP: 0010:port_delete+0x16e/0x1b0 sound/core/seq/seq_ports.c:276 Code: 00 00 31 ff 44 89 e6 e8 e0 f8 9d fb 45 85 e4 75 14 e8 c6 f7 9d fb 48 89 df e8 4e a6 db fb 31 c0 5b 41 5c 5d c3 e8 b2 f7 9d fb <0f> 0b eb e3 e8 a9 f7 9d fb 0f 0b eb 9b e8 d0 d1 db fb eb bd e8 c9 RSP: 0018:88019b9f78d0 EFLAGS: 00010293 RAX: 8801c5f74100 RBX: 8801b053adc0 RCX: 85de13d0 RDX: RSI: 85de13ee RDI: 0005 RBP: 88019b9f78e0 R08: 8801c5f74100 R09: 0006 R10: 8801c5f74100 R11: R12: 0001 R13: 8801b053ae10 R14: 11003373ef28 R15: 88019b95d6d0 snd_seq_delete_port+0x3cb/0x4a0 sound/core/seq/seq_ports.c:303 snd_seq_ioctl_delete_port+0xba/0x190 sound/core/seq/seq_clientmgr.c:1325 snd_seq_kernel_client_ctl+0x15a/0x190 sound/core/seq/seq_clientmgr.c:2361 snd_seq_event_port_detach+0xfb/0x160 sound/core/seq/seq_ports.c:705 delete_port+0x7d/0xc0 sound/core/seq/oss/seq_oss_init.c:354 snd_seq_oss_release+0xf2/0x130 sound/core/seq/oss/seq_oss_init.c:433 odev_release+0x52/0x70 sound/core/seq/oss/seq_oss.c:153 __fput+0x355/0x8b0 fs/file_table.c:209 fput+0x15/0x20 fs/file_table.c:243 task_work_run+0x1ec/0x2a0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:192 [inline] exit_to_usermode_loop+0x313/0x370 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x40ff01 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00a3eab0 EFLAGS: 0293 ORIG_RAX: 0003 RAX: RBX: 0015 RCX: 0040ff01 RDX: RSI: 007328a0 RDI: 0014 RBP: 0013 R08: R09: R10: 00a3e930 R11: 0293 R12: R13: R14: 00a3f160 R15: 007034c0 Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Rebooting in 86400 seconds.. --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkal...@googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot.
