Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1760190AbcLPJet (ORCPT <rfc822;w@1wt.eu>);
        Fri, 16 Dec 2016 04:34:49 -0500
Received: from mail-wm0-f50.google.com ([74.125.82.50]:36888 "EHLO
        mail-wm0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1757111AbcLPJe3 (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 16 Dec 2016 04:34:29 -0500
MIME-Version: 1.0
From: Dmitry Vyukov <dvyukov@google.com>
Date: Fri, 16 Dec 2016 10:33:19 +0100
Message-ID: <CACT4Y+a-MavOOisxqLpQqoje5YthZLtKeg0yqe7UnhVPuO4Pag@mail.gmail.com>
Subject: ipc: BUG: sem_unlock unlocks non-locked lock
To: Andrew Morton <akpm@linux-foundation.org>,
        Davidlohr Bueso <dave@stgolabs.net>, Ingo Molnar <mingo@kernel.org>,
        manfred <manfred@colorfullife.com>,
        Peter Zijlstra <peterz@infradead.org>, fabf@skynet.be, kernel@kyup.com,
        LKML <linux-kernel@vger.kernel.org>
Cc: syzkaller <syzkaller@googlegroups.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 2544
Lines: 55

Hello,

The following program causes BUG: bad unlock balance detected!

https://gist.githubusercontent.com/dvyukov/d0e5efefe4d7d6daed829f5c3ca26a40/raw/08d0a261fe3c987bed04fbf267e08ba04bd533ea/gistfile1.txt

On commit 5cc60aeedf315a7513f92e98314e86d515b986d1 (Dec 14).

[ BUG: bad unlock balance detected! ]
4.9.0+ #89 Not tainted
-------------------------------------
a.out/6330 is trying to release lock (&(&new->lock)->rlock) at:
[<ffffffff8316d150>] spin_unlock include/linux/spinlock.h:347 [inline]
[<ffffffff8316d150>] ipc_unlock_object ipc/util.h:175 [inline]
[<ffffffff8316d150>] sem_unlock ipc/sem.c:404 [inline]
[<ffffffff8316d150>] SYSC_semtimedop+0x22f0/0x4410 ipc/sem.c:2004
but there are no more locks to release!

other info that might help us debug this:
2 locks held by a.out/6330:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8316c9c2>]
SYSC_semtimedop+0x1b62/0x4410 ipc/sem.c:1968
 #1:  (&(&sma->sem_base[i].lock)->rlock){+.+...}, at:
[<ffffffff8316d1e4>] spin_lock include/linux/spinlock.h:302 [inline]
 #1:  (&(&sma->sem_base[i].lock)->rlock){+.+...}, at:
[<ffffffff8316d1e4>] sem_lock ipc/sem.c:362 [inline]
 #1:  (&(&sma->sem_base[i].lock)->rlock){+.+...}, at:
[<ffffffff8316d1e4>] SYSC_semtimedop+0x2384/0x4410 ipc/sem.c:1980

stack backtrace:
CPU: 1 PID: 6330 Comm: a.out Not tainted 4.9.0+ #89
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:15 [inline]
 dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
 print_unlock_imbalance_bug+0x12f/0x140 kernel/locking/lockdep.c:3391
 __lock_release kernel/locking/lockdep.c:3533 [inline]
 lock_release+0xa21/0xf00 kernel/locking/lockdep.c:3772
 __raw_spin_unlock include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock+0x1f/0x40 kernel/locking/spinlock.c:183
 spin_unlock include/linux/spinlock.h:347 [inline]
 ipc_unlock_object ipc/util.h:175 [inline]
 sem_unlock ipc/sem.c:404 [inline]
 SYSC_semtimedop+0x22f0/0x4410 ipc/sem.c:2004
 SyS_semtimedop ipc/sem.c:1755 [inline]
 SYSC_semop ipc/sem.c:2015 [inline]
 SyS_semop+0x2b/0x40 ipc/sem.c:2012
 entry_SYSCALL_64_fastpath+0x23/0xc6
RIP: 0033:0x44dc19
RSP: 002b:00007fa18086ec88 EFLAGS: 00000206 ORIG_RAX: 0000000000000041
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044dc19
RDX: 0000000000000001 RSI: 0000000020002ff0 RDI: 0000000000008001
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fa18086f9c0 R15: 00007fa18086f700