Received: by 10.223.185.116 with SMTP id b49csp4884606wrg; Tue, 27 Feb 2018 04:24:54 -0800 (PST) X-Google-Smtp-Source: AH8x226nud2tBCMqYopr/BKb1Zr2IvBuCetO826NXXYPW4eA2A0mNQc6R4imnpa3AR3HsS6/ZbbX X-Received: by 10.99.180.3 with SMTP id s3mr11096215pgf.258.1519734294469; Tue, 27 Feb 2018 04:24:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519734294; cv=none; d=google.com; s=arc-20160816; b=u5Vtbi53CS/yL4AK7oKaJ3ux0T2PrHPjjqjoOISpxqgM3vpTSg5aBNjVYEATSUuAab fQI0JtMPbczHIImESeOc+oubsKVbE0iHi2q8GrFKjXJGVnGG2ixC7yg4QlulXwu3RVWX rRSY9M8xbVGov1zZMfzkbzWn5tR7XGHMzsS7Nr9p7MI3PrXkNyWiXuEqcesJxeBHO0ve jZYuKhedfAzSpRM42g6MOgurWbeJO0yxH/J8X702iLWRQZQpUrFBvIFnOBHY7+DMn5K5 f1v27bnLeVZUj1xfWJcM7EweU+HqSrNL9UXP+GriT/evGXxSN9tVukssr8Xjm9k1mTn0 nC7w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:date:organization:references :in-reply-to:to:from:subject:message-id:arc-authentication-results; bh=KOsN6jWZdh8GFlFaaLOHA1PKdSGo8OXV7g+teSzD+Tg=; b=aO9YY8TkO9y5BntVi7RCR54InfMhdVMqCBl5msTcHQzNE7Sq/Ph+RSBxSKR28Y5pmd kG6/E5MHtW4+0u6JX0Q80jlQdkJFe1/U44kIMpWF2H5wG3XXjTVD3e6eiJvs/IQpCaN8 IC6FCkaQK2UJamNjur60Ymk6F1xZY/hW40G4BmNQvh1TKubUo5Y3yJITrEXL8RBDjdBP H5CbvMXmV7Kt/ZCruWrTvOmBGxnvF1eD8oe574ZUr8EIQB01a1PjqB3kGsQ2lOrp/2UY OigrjRdELbebIj5wU6MdBm0EQvMe4Z0Ke8eRV2fXIPxoa/cTX9DShP1qx/imUjBWcsoA 7K3A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id q3-v6si8444087plb.824.2018.02.27.04.24.39; Tue, 27 Feb 2018 04:24:54 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753016AbeB0MXy (ORCPT + 99 others); Tue, 27 Feb 2018 07:23:54 -0500 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:43134 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752107AbeB0MXw (ORCPT ); Tue, 27 Feb 2018 07:23:52 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 8493F401DEC1; Tue, 27 Feb 2018 12:23:51 +0000 (UTC) Received: from ovpn-204-174.brq.redhat.com (ovpn-204-174.brq.redhat.com [10.40.204.174]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0E7F11C73E; Tue, 27 Feb 2018 12:23:49 +0000 (UTC) Message-ID: <1519734229.2699.6.camel@redhat.com> Subject: Re: WARNING in smc_unhash_sk From: Davide Caratti To: syzbot , davem@davemloft.net, linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com, ubraun@linux.vnet.ibm.com In-Reply-To: <001a114fa99028d2a10565e33df4@google.com> References: <001a114fa99028d2a10565e33df4@google.com> Organization: red hat Content-Type: multipart/mixed; boundary="=-UQZW0R4usRki+zH1OxSq" Date: Tue, 27 Feb 2018 13:23:49 +0100 Mime-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Tue, 27 Feb 2018 12:23:51 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Tue, 27 Feb 2018 12:23:51 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'dcaratti@redhat.com' RCPT:'' Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --=-UQZW0R4usRki+zH1OxSq Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit On Fri, 2018-02-23 at 07:59 -0800, syzbot wrote: > Hello, > > syzbot hit the following crash on upstream commit > af3e79d29555b97dd096e2f8e36a0f50213808a8 (Tue Feb 20 18:05:02 2018 +0000) > Merge tag 'leds_for-4.16-rc3' of > git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds > > So far this crash happened 27 times on > https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/master, > net-next, upstream. > C reproducer is attached. > syzkaller reproducer is attached. > Raw console output is attached. > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached. > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+3a0748c8f2f210c0ef9b@syzkaller.appspotmail.com > It will help syzbot understand when the bug is fixed. See footer for > details. > If you forward the report, please keep this part and the footer. > > WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638 sk_del_node_init > include/net/sock.h:638 [inline] > WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638 > smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90 > Kernel panic - not syncing: panic_on_warn set ... > > CPU: 1 PID: 9921 Comm: syzkaller089677 Not tainted 4.16.0-rc2+ #324 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:17 [inline] > dump_stack+0x194/0x24d lib/dump_stack.c:53 > panic+0x1e4/0x41c kernel/panic.c:183 > __warn+0x1dc/0x200 kernel/panic.c:547 > report_bug+0x211/0x2d0 lib/bug.c:184 > fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178 > fixup_bug arch/x86/kernel/traps.c:247 [inline] > do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296 > do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315 > invalid_op+0x58/0x80 arch/x86/entry/entry_64.S:957 > RIP: 0010:sk_del_node_init include/net/sock.h:638 [inline] > RIP: 0010:smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90 > RSP: 0018:ffff8801b639f198 EFLAGS: 00010293 > RAX: ffff8801b684a340 RBX: 1ffff10036c73e37 RCX: ffffffff85a3f1f5 > RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 1ffff10036c73e3b > RBP: ffff8801b639f280 R08: dffffc0000000000 R09: 0000000000000004 > R10: ffff8801b639f050 R11: 0000000000000004 R12: ffff8801b639f258 > R13: ffffffff87669b40 R14: ffff8801c08d57c0 R15: 1ffff10036c73e3b > smc_release+0x321/0x580 net/smc/af_smc.c:148 > sock_release+0x8d/0x1e0 net/socket.c:595 > sock_close+0x16/0x20 net/socket.c:1149 > __fput+0x327/0x7e0 fs/file_table.c:209 > ____fput+0x15/0x20 fs/file_table.c:243 > task_work_run+0x199/0x270 kernel/task_work.c:113 > exit_task_work include/linux/task_work.h:22 [inline] > do_exit+0x9bb/0x1ad0 kernel/exit.c:865 > do_group_exit+0x149/0x400 kernel/exit.c:968 > get_signal+0x73a/0x16d0 kernel/signal.c:2469 > do_signal+0x90/0x1e90 arch/x86/kernel/signal.c:809 > exit_to_usermode_loop+0x258/0x2f0 arch/x86/entry/common.c:162 > prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] > syscall_return_slowpath arch/x86/entry/common.c:265 [inline] > do_syscall_64+0x6e5/0x940 arch/x86/entry/common.c:292 > entry_SYSCALL_64_after_hwframe+0x42/0xb7 > RIP: 0033:0x44cad9 > RSP: 002b:00007fbf24687ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 > RAX: 0000000000000001 RBX: 0000000000700024 RCX: 000000000044cad9 > RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000020000080 > RBP: 0000000000700020 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > R13: 000000000080ef3f R14: 00007fbf246889c0 R15: 0000000000000005 > Dumping ftrace buffer: > (ftrace buffer empty) > Kernel Offset: disabled > Rebooting in 86400 seconds.. > > > --- > This bug is generated by a dumb bot. It may contain errors. > See https://goo.gl/tpsmEJ for details. > Direct all questions to syzkaller@googlegroups.com. > > syzbot will keep track of this bug report. > If you forgot to add the Reported-by tag, once the fix for this bug is > merged > into any tree, please reply to this email with: > #syz fix: exact-commit-title > If you want to test a patch for this bug, please reply with: > #syz test: git://repo/address.git branch > and provide the patch inline or as an attachment. > To mark this as a duplicate of another syzbot report, please reply with: > #syz dup: exact-subject-of-another-report > If it's a one-off invalid bug report, please reply with: > #syz invalid > Note: if the crash happens again, it will cause creation of a new bug > report. > Note: all commands must start from beginning of the line in the email body. #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master --=-UQZW0R4usRki+zH1OxSq Content-Disposition: attachment; filename*0=0001-af_smc-fix-NULL-pointer-dereference-on-sock_create_k.pat; filename*1=ch Content-Type: text/x-patch; name="0001-af_smc-fix-NULL-pointer-dereference-on-sock_create_k.patch"; charset="UTF-8" Content-Transfer-Encoding: base64 RnJvbSBjMjU4YmYzYWQwNzk4NWVhZjRlMDdkNzY2N2I3ODgyY2I5YTI2NjFiIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpNZXNzYWdlLUlkOiA8YzI1OGJmM2FkMDc5ODVlYWY0ZTA3ZDc2NjdiNzg4 MmNiOWEyNjYxYi4xNTE5NzMyNTQ1LmdpdC5kY2FyYXR0aUByZWRoYXQuY29tPgpGcm9tOiBEYXZp ZGUgQ2FyYXR0aSA8ZGNhcmF0dGlAcmVkaGF0LmNvbT4KRGF0ZTogVHVlLCAyNyBGZWIgMjAxOCAx Mjo0NToxMSArMDEwMApTdWJqZWN0OiBbUEFUQ0ggbmV0XSBhZl9zbWM6IGZpeCBOVUxMIHBvaW50 ZXIgZGVyZWZlcmVuY2Ugb24KIHNvY2tfY3JlYXRlX2tlcm4oKSBlcnJvciBwYXRoCgp3aGVuIHNv Y2tfY3JlYXRlX2tlcm4oLi4uLCBhKSByZXR1cm5zIGFuIGVycm9yLCAnYScgbWlnaHQgbm90IGJl IGEgdmFsaWQKcG9pbnRlciwgc28gaXQgc2hvdWxkbid0IGJlIGRlcmVmZXJlbmNlZCB0byByZWFk IGEtPnNrLT5za19zbmRidWYgYW5kCmFuZCBhLT5zay0+c2tfcmN2YnVmLgoKRml4ZXM6IGNkNjg1 MWYzMDM4NiBzbWM6IHJlbW90ZSBtZW1vcnkgYnVmZmVycyAoUk1CcykKUmVwb3J0ZWQtYnk6IHN5 emJvdCszYTA3NDhjOGYyZjIxMGMwZWY5YkBzeXprYWxsZXIuYXBwc3BvdG1haWwuY29tClNpZ25l ZC1vZmYtYnk6IERhdmlkZSBDYXJhdHRpIDxkY2FyYXR0aUByZWRoYXQuY29tPgotLS0KIG5ldC9z bWMvYWZfc21jLmMgfCA0ICsrKy0KIDEgZmlsZSBjaGFuZ2VkLCAzIGluc2VydGlvbnMoKyksIDEg ZGVsZXRpb24oLSkKCmRpZmYgLS1naXQgYS9uZXQvc21jL2FmX3NtYy5jIGIvbmV0L3NtYy9hZl9z bWMuYwppbmRleCAzOGFlMjJiNjVlNzcuLjI3ZTdkMGI1OWRhOSAxMDA2NDQKLS0tIGEvbmV0L3Nt Yy9hZl9zbWMuYworKysgYi9uZXQvc21jL2FmX3NtYy5jCkBAIC0xNDA1LDggKzE0MDUsMTAgQEAg c3RhdGljIGludCBzbWNfY3JlYXRlKHN0cnVjdCBuZXQgKm5ldCwgc3RydWN0IHNvY2tldCAqc29j aywgaW50IHByb3RvY29sLAogCXNtYy0+dXNlX2ZhbGxiYWNrID0gZmFsc2U7IC8qIGFzc3VtZSBy ZG1hIGNhcGFiaWxpdHkgZmlyc3QgKi8KIAlyYyA9IHNvY2tfY3JlYXRlX2tlcm4obmV0LCBQRl9J TkVULCBTT0NLX1NUUkVBTSwKIAkJCSAgICAgIElQUFJPVE9fVENQLCAmc21jLT5jbGNzb2NrKTsK LQlpZiAocmMpCisJaWYgKHJjKSB7CiAJCXNrX2NvbW1vbl9yZWxlYXNlKHNrKTsKKwkJZ290byBv dXQ7CisJfQogCXNtYy0+c2suc2tfc25kYnVmID0gbWF4KHNtYy0+Y2xjc29jay0+c2stPnNrX3Nu ZGJ1ZiwgU01DX0JVRl9NSU5fU0laRSk7CiAJc21jLT5zay5za19yY3ZidWYgPSBtYXgoc21jLT5j bGNzb2NrLT5zay0+c2tfcmN2YnVmLCBTTUNfQlVGX01JTl9TSVpFKTsKIAotLSAKMi4xNC4zCgo= --=-UQZW0R4usRki+zH1OxSq--