On Sun, Apr 01, 2018 at 09:05:31PM +0100, Al Viro wrote: > On Sun, Apr 01, 2018 at 04:35:19AM +0100, Al Viro wrote: > > On Sat, Mar 31, 2018 at 04:01:02PM -0700, syzbot wrote: > > > Hello, > > > > > > syzbot hit the following crash on bpf-next commit > > > 7828f20e3779e4e85e55371e0e43f5006a15fb41 (Sat Mar 31 00:17:57 2018 +0000) > > > Merge branch 'bpf-cgroup-bind-connect' > > > syzbot dashboard link: > > > https://syzkaller.appspot.com/bug?extid=f3bd89a5ab3266b10540 > > > > > > So far this crash happened 22 times on bpf-next, upstream. > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?id=6290970458980352 > > > syzkaller reproducer: > > > https://syzkaller.appspot.com/x/repro.syz?id=6577156880596992 > > > Raw console output: > > > https://syzkaller.appspot.com/x/log.txt?id=5107570603720704 > > > Kernel config: > > > https://syzkaller.appspot.com/x/.config?id=5909223872832634926 > > > compiler: gcc (GCC) 7.1.1 20170620 > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > Reported-by: syzbot+f3bd89a5ab3266b10540@xxxxxxxxxxxxxxxxxxxxxxxxx > > > It will help syzbot understand when the bug is fixed. See footer for > > > details. > > > If you forward the report, please keep this part and the footer. > > > > > > RBP: 00007ffd1bbb3ae0 R08: 0000000020000200 R09: 0000000300000000 > > > R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff > > > R13: 0000000000000003 R14: 0000000000001380 R15: 00007ffd1bbb3378 > > > list_del corruption. prev->next should be 00000000a8104008, but was > > > 00000000081c6144 > > > > Lovely... I'll look into that tomorrow morning. > > Can't reproduce - it reproducer had been running for several hours, with > that kernel and that config (gcc 6.3, not 7.1, though), no oopsen... > > If somebody can reproduce that thing, I'd appreciate having it bisected > a bit... > Apparently the reproducer wants to inject a fault into a specific memory allocation, and something is causing the memory allocations to be different. It works for me in ~10 seconds after applying the below patch to the C reproducer. (I also did 'echo 0 | tee /sys/kernel/debug/fail*/verbose' beforehand to quiet all the fault injection messages.) I'm guessing the bug is in the error handling in "rpc_pipefs", but not sure exactly what yet. The last messages in the kernel log before the BUG() were: [ 42.965515] net/sunrpc/rpc_pipe.c: __rpc_create_common failed to allocate inode for dentry blocklayout [ 42.967234] net/sunrpc/rpc_pipe.c: rpc_mkpipe_dentry() failed to create pipe nfs/blocklayout (errno = -12) diff --git a/syz_dentry_kill.c b/syz_dentry_kill.c index e38ee57..8c6a76e 100644 --- a/syz_dentry_kill.c +++ b/syz_dentry_kill.c @@ -723,6 +723,7 @@ static void loop() } if (symlink(cgroupdir_net, "./cgroup.net")) { } + srand(getpid()); execute_one(); doexit(0); } @@ -786,7 +787,7 @@ void execute_one() 48); write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N"); write_file("/sys/kernel/debug/fail_futex/ignore-private", "N"); - inject_fault(60); + inject_fault(rand() % 500); syscall(__NR_mount, 0x20000300, 0x20000140, 0x200002c0, 0, 0x20000200); }
