Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp498885img; Thu, 21 Mar 2019 02:48:48 -0700 (PDT) X-Google-Smtp-Source: APXvYqz1k5afEsgp9LsoVTw6UfLwKFIP0W17D5z7LFLWkTudz4ARrW9fsxqCG4+oI9j+13oMfI63 X-Received: by 2002:a63:1d20:: with SMTP id d32mr2486157pgd.49.1553161728301; Thu, 21 Mar 2019 02:48:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553161728; cv=none; d=google.com; s=arc-20160816; b=yDLX5KjXts2nEcVVvrTAvRvpCQ55LcMxvU8hky99QLpr3Wc/y9fox1lr58A50KV5LN EX1p1shx4aJIFEwN5xmTopKYepxmRzIKIOuOzVp0uJ4KYALqkxSanoKOUhr7A4GZaG2/ +JJaJbbFOoNlVf+Y5R/FYNGbMcRQnEmob4fOXHRLctrAx1cbVhNxQPfTd6ozjZInIKIx nT5EgcZUk7AU1uYcxhzUl4TfAIMp7KtqEE0fwIcgQe27x3erg16qWAUc1/pltMjNLpcu z1f3TRfmQZc8ZjlMrv1ocvbEcsHZAt/YLspZQVC8rPNfv2mEMkimyOrxZLg4SvizRZek 2Rgw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=NE9gEP8H9Kxuof1sLyo7NCmaVwDyqvvJ4c7J4qYBo1M=; b=hyA0g5WOzU81xEzFK38PSdDnmxdaOQksRlle/Zp8m2Tcgi+NBVljcvoUOfv2rcbNLv rjJD59xz3d0+RQt8qhZWlpkpkE2X0jxM8NnpFAZhTkVAbB8wj3c26Gtf1vHBfIbfkBwa 26OHle2V/su0pvraDIx+6FLSsyL267FSfw8G/6b7A1XljCC3LFxOEcNe99ZtPJD2gty2 QRnW366bDE+YisDNsXkTw/ap0VMVlhl1FngAplvF6aePNczdKxLAbdrCAfuH9/2SoyYn /cP8RXgV65R52wY0renX2ezIveDR77RNFBF9ilhzv1zRPlCmzo5wf1aNnVlVWPI8WUM9 AYOg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=tqDdFbdu; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id co9si4231672plb.324.2019.03.21.02.48.33; Thu, 21 Mar 2019 02:48:48 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=tqDdFbdu; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728228AbfCUJp7 (ORCPT + 99 others); Thu, 21 Mar 2019 05:45:59 -0400 Received: from mail-it1-f195.google.com ([209.85.166.195]:36594 "EHLO mail-it1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728218AbfCUJp7 (ORCPT ); Thu, 21 Mar 2019 05:45:59 -0400 Received: by mail-it1-f195.google.com with SMTP id h9so3218197itl.1 for ; Thu, 21 Mar 2019 02:45:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NE9gEP8H9Kxuof1sLyo7NCmaVwDyqvvJ4c7J4qYBo1M=; b=tqDdFbduPVxACV7klGwElCXLOFKv6aVeY/E+AkUrZwa6gxyE2cW0PFQZpGA7fUnC1P I7QnWNkyfYRKEXgWJ2OegfTeT35Naaa8atOUjKs2+Fq6Y1+IKI+pZsp6Jq2Gp2usgmc+ ImHMOhqLZiY9NmL+q0pfbzO2v9jRYSeYb3vmiFVqgkSRKCwgM1Wb1ROUc/BhlduwI8jj y7vyyI7ZScIz2efASuLfo9GYZGZGwy1dvFSsEsXXh6+OfUxK++QZO1ttU60icDMZW07X PPzbWqLzYn56eU34fsn29Aj9sPZGEKjiRVUqoEbl28EuoPr3jNImveoLaaO2Qg1lWRRf DlEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NE9gEP8H9Kxuof1sLyo7NCmaVwDyqvvJ4c7J4qYBo1M=; b=SIfQLS+jTtaM5X/cuQBrr1/QEpYaTkGbJiFhJICgBUuqr59oiUfBJhZ5J5Lv4AQeVV dTe/XkVqbowYx57iQQai12Ve5A91stExQTWPFkwXSNL4PI41zZKN3hGidhR9JV8Kbgdk MPiMwjwG7it2XPF0a80l77282bc2uQPoTTWkfjY2WrQ/jKjARkBY5k7ej7EQhnBNV5IK Wg7nBUyX8kJPHoTgNao9nwHD8h952OwGVspiAGqZtCCtS5Gj4EpddunxzVaPC15qg0be 4T0TxjnOG7C38O9mtNYFcKvykrQ6v5m+i/Ez1IfyttzDubD2e6fLIG0/odWmgHmmdwHB bKpw== X-Gm-Message-State: APjAAAVPZa5ZzAauUacvc3p0uAieH8Z72PPWmiCcXHDbqDG1p1Mv+1ew c0kC4HSN7X1cDGQyj8dyG6V+i/epxqGGs9Lm02+iIw== X-Received: by 2002:a24:3b01:: with SMTP id c1mr1750423ita.144.1553161556990; Thu, 21 Mar 2019 02:45:56 -0700 (PDT) MIME-Version: 1.0 References: <000000000000db3d130584506672@google.com> <426293c3-bf63-88ad-06fb-83927ab0d7c0@I-love.SAKURA.ne.jp> <315c8ff3-fd03-f2ca-c546-ca7dc5c14669@virtuozzo.com> In-Reply-To: From: Dmitry Vyukov Date: Thu, 21 Mar 2019 10:45:45 +0100 Message-ID: Subject: Re: kernel panic: corrupted stack end in wb_workfn To: Andrey Ryabinin Cc: Tetsuo Handa , syzbot , Andrew Morton , Qian Cai , David Miller , guro@fb.com, Johannes Weiner , Josef Bacik , Kirill Tkhai , LKML , Linux-MM , linux-sctp@vger.kernel.org, Mel Gorman , Michal Hocko , netdev , Neil Horman , Shakeel Butt , syzkaller-bugs , Al Viro , Vladislav Yasevich , Matthew Wilcox , Xin Long Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Mar 20, 2019 at 2:57 PM Dmitry Vyukov wrote: > > On Wed, Mar 20, 2019 at 2:33 PM Andrey Ryabinin wrote: > > > > > > > > On 3/20/19 1:38 PM, Dmitry Vyukov wrote: > > > On Wed, Mar 20, 2019 at 11:24 AM Tetsuo Handa > > > wrote: > > >> > > >> On 2019/03/20 18:59, Dmitry Vyukov wrote: > > >>>> From bisection log: > > >>>> > > >>>> testing release v4.17 > > >>>> testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 > > >>>> run #0: crashed: kernel panic: corrupted stack end in wb_workfn > > >>>> run #1: crashed: kernel panic: corrupted stack end in worker_thread > > >>>> run #2: crashed: kernel panic: Out of memory and no killable processes... > > >>>> run #3: crashed: kernel panic: corrupted stack end in wb_workfn > > >>>> run #4: crashed: kernel panic: corrupted stack end in wb_workfn > > >>>> run #5: crashed: kernel panic: corrupted stack end in wb_workfn > > >>>> run #6: crashed: kernel panic: corrupted stack end in wb_workfn > > >>>> run #7: crashed: kernel panic: corrupted stack end in wb_workfn > > >>>> run #8: crashed: kernel panic: Out of memory and no killable processes... > > >>>> run #9: crashed: kernel panic: corrupted stack end in wb_workfn > > >>>> testing release v4.16 > > >>>> testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 > > >>>> run #0: OK > > >>>> run #1: OK > > >>>> run #2: OK > > >>>> run #3: OK > > >>>> run #4: OK > > >>>> run #5: crashed: kernel panic: Out of memory and no killable processes... > > >>>> run #6: OK > > >>>> run #7: crashed: kernel panic: Out of memory and no killable processes... > > >>>> run #8: OK > > >>>> run #9: OK > > >>>> testing release v4.15 > > >>>> testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 > > >>>> all runs: OK > > >>>> # git bisect start v4.16 v4.15 > > >>>> > > >>>> Why bisect started between 4.16 4.15 instead of 4.17 4.16? > > >>> > > >>> Because 4.16 was still crashing and 4.15 was not crashing. 4.15..4.16 > > >>> looks like the right range, no? > > >> > > >> No, syzbot should bisect between 4.16 and 4.17 regarding this bug, for > > >> "Stack corruption" can't manifest as "Out of memory and no killable processes". > > >> > > >> "kernel panic: Out of memory and no killable processes..." is completely > > >> unrelated to "kernel panic: corrupted stack end in wb_workfn". > > > > > > > > > Do you think this predicate is possible to code? > > > > Something like bellow probably would work better than current behavior. > > > > For starters, is_duplicates() might just compare 'crash' title with 'target_crash' title and its duplicates titles. > > Lots of bugs (half?) manifest differently. On top of this, titles > change as we go back in history. On top of this, if we see a different > bug, it does not mean that the original bug is also not there. > This will sure solve some subset of cases better then the current > logic. But I feel that that subset is smaller then what the current > logic solves. Counter-examples come up in basically every other bisection. For example: bisecting cause commit starting from ccda4af0f4b92f7b4c308d3acc262f4a7e3affad building syzkaller on 5f5f6d14e80b8bd6b42db961118e902387716bcb testing commit ccda4af0f4b92f7b4c308d3acc262f4a7e3affad with gcc (GCC) 8.1.0 all runs: crashed: KASAN: null-ptr-deref Read in refcount_sub_and_test_checked testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 all runs: crashed: KASAN: null-ptr-deref Read in refcount_sub_and_test_checked testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 all runs: crashed: KASAN: null-ptr-deref Read in refcount_sub_and_test testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 all runs: crashed: KASAN: null-ptr-deref Read in refcount_sub_and_test That's a different crash title, unless somebody explicitly code this case. Or, what crash is this? testing commit 52358cb5a310990ea5069f986bdab3620e01181f with gcc (GCC) 8.1.0 run #1: crashed: general protection fault in cpuacct_charge run #2: crashed: WARNING: suspicious RCU usage in corrupted run #3: crashed: general protection fault in cpuacct_charge run #4: crashed: BUG: unable to handle kernel paging request in ipt_do_table run #5: crashed: KASAN: stack-out-of-bounds Read in cpuacct_charge run #6: crashed: WARNING: suspicious RCU usage run #7: crashed: no output from test machine run #8: crashed: no output from test machine Or, that "INFO: trying to register non-static key in can_notifier" does not do any testing, but is "WARNING in dma_buf_vunmap" still there or not? testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 all runs: crashed: WARNING in dma_buf_vunmap testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 all runs: OK # git bisect start v4.12 v4.11 Bisecting: 7831 revisions left to test after this (roughly 13 steps) [2bd80401743568ced7d303b008ae5298ce77e695] Merge tag 'gpio-v4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio testing commit 2bd80401743568ced7d303b008ae5298ce77e695 with gcc (GCC) 7.3.0 all runs: crashed: INFO: trying to register non-static key in can_notifier # git bisect bad 2bd80401743568ced7d303b008ae5298ce77e695 Bisecting: 3853 revisions left to test after this (roughly 12 steps) [8d65b08debc7e62b2c6032d7fe7389d895b92cbc] Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next testing commit 8d65b08debc7e62b2c6032d7fe7389d895b92cbc with gcc (GCC) 7.3.0 all runs: crashed: INFO: trying to register non-static key in can_notifier # git bisect bad 8d65b08debc7e62b2c6032d7fe7389d895b92cbc Bisecting: 2022 revisions left to test after this (roughly 11 steps) [cec381919818a9a0cb85600b3c82404bdd38cf36] Merge tag 'mac80211-next-for-davem-2017-04-28' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next testing commit cec381919818a9a0cb85600b3c82404bdd38cf36 with gcc (GCC) 5.5.0 all runs: crashed: INFO: trying to register non-static key in can_notifier > > syzbot has some knowledge about duplicates with different crash titles when people use "syz dup" command. > > This is very limited set of info. And in the end I think we've seen > all bug types being duped on all other bugs types pair-wise, and at > the same time we've seen all bug types being not dups to all other bug > types. So I don't see where this gets us. > And again as we go back in history all these titles change. > > > Also it might be worth to experiment with using neural networks to identify duplicates. > > > > > > target_crash = 'kernel panic: corrupted stack end in wb_workfn' > > test commit: > > bad = false; > > skip = true; > > foreach run: > > run_started, crashed, crash := run_repro(); > > > > //kernel built, booted, reproducer launched successfully > > if (run_started) > > skip = false; > > if (crashed && is_duplicates(crash, target_crash)) > > bad = true; > > > > if (skip) > > git bisect skip; > > else if (bad) > > git bisect bad; > > else > > git bisect good;