Re: BUG: unable to handle kernel paging request in delayed_put_task_struct

[Dmitry Vyukov]

On Tue, Dec 19, 2017 at 7:04 PM, Paul E. McKenney
<paulmck@xxxxxxxxxxxxxxxxxx> wrote:
> On Tue, Dec 19, 2017 at 01:15:26PM +0100, Dmitry Vyukov wrote:
>> On Sun, Dec 3, 2017 at 3:24 PM, syzbot
>> <bot+50679d35ad280ab66b83cc309568910ba99dc9f6@xxxxxxxxxxxxxxxxxxxxxxxxx>
>> wrote:
>> > Hello,
>> >
>> > syzkaller hit the following crash on
>> > 5bef2980adef8a6032d4f4709aebe9486181052f
>> > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
>> > compiler: gcc (GCC) 7.1.1 20170620
>> > .config is attached
>> > Raw console output is attached.
>> >
>> > Unfortunately, I don't have any reproducer for this bug yet.
>
> That does make things more difficult.  Nevertheless...
>
>> > BUG: unable to handle kernel paging request at fffffffffffffff8
>> > IP: delayed_put_task_struct+0x87/0x3d0 kernel/exit.c:178
>> > netlink: 6 bytes leftover after parsing attributes in process
>> > `syz-executor0'.
>> > PGD 5e28067 P4D 5e28067 PUD 5e2a067 PMD 0
>> > Oops: 0002 [#1] SMP KASAN
>> > Dumping ftrace buffer:
>> >    (ftrace buffer empty)
>> > Modules linked in:
>> > CPU: 1 PID: 5363 Comm: syz-executor4 Not tainted 4.15.0-rc1-next-20171128+
>> > #54
>> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
>> > Google 01/01/2011
>> > task: ffff8801d8d244c0 task.stack: ffff8801c15d8000
>> > RIP: 0010:delayed_put_task_struct+0x87/0x3d0 kernel/exit.c:178
>> > RSP: 0018:ffff8801db5078b0 EFLAGS: 00010206
>> > RAX: ffff8801d8d244c0 RBX: 1ffff1003b6a0f17 RCX: ffffffff81872631
>> > RDX: 0000000000000100 RSI: 000000003189bbb1 RDI: ffff8801d8bbb480
>> > RBP: ffff8801db507980 R08: 0000000000000005 R09: 0000000000000002
>> > R10: 0000000000000000 R11: ffffffff8748cd60 R12: ffff8801d8bbb5d0
>> > R13: ffff8801d8bbb5d8 R14: ffff8801d8bba1c0 R15: ffff8801db507c58
>> > FS:  00007f251e195700(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
>> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> > CR2: fffffffffffffff8 CR3: 00000001980c2000 CR4: 00000000001426e0
>> > Call Trace:
>> >  <IRQ>
>> >  __rcu_reclaim kernel/rcu/rcu.h:172 [inline]
>
> If you do find a reproducer, please try reproducing with
> CONFIG_DEBUG_OBJECTS_RCU_HEAD=y, which checks for the call_rcu()
> equivalent to double frees.


This looks like a generally useful config for debugging, so I just
enabled CONFIG_DEBUG_OBJECTS* in all runs.

But this particular bug was already root caused. You can see that it's
marked as a duplicate of "BUG: unable to handle kernel paging request
in __switch_to" in the previous email.
All syzbot reported bugs are here:
https://groups.google.com/forum/#!forum/syzkaller-bugs
You can find "BUG: unable to handle kernel paging request in
__switch_to" there and see what was the resolution.