Re: suspicious RCU usage at drivers/staging/android/ion/ion-ioctl.c:LINE

[Laura Abbott]

On 01/10/2018 03:18 AM, syzbot wrote:
> Hello,
>
> syzkaller hit the following crash on 69eed2290e1d81b7a33774a24bbcb79f51958e57
> git://git.cmpxchg.org/linux-mmots.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
> Unfortunately, I don't have any reproducer for this bug yet.
>
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+1df9728298a8617bd419@xxxxxxxxxxxxxxxxxxxxxxxxx
> It will help syzbot understand when the bug is fixed. See footer for details.
> If you forward the report, please keep this part and the footer.
>
>
> =============================
> WARNING: suspicious RCU usage
> 4.15.0-rc6-mm1+ #52 Not tainted
> WARNING: CPU: 1 PID: 4388 at drivers/staging/android/ion/ion-ioctl.c:63 ion_ioctl+0x2db/0x380 drivers/staging/android/ion/ion-ioctl.c:63
> Kernel panic - not syncing: panic_on_warn set ...
>
> CPU: 1 PID: 4388 Comm: syz-executor1 Not tainted 4.15.0-rc6-mm1+ #52
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
>  Â__dump_stack lib/dump_stack.c:17 [inline]
>  Âdump_stack+0x194/0x257 lib/dump_stack.c:53
>  Âpanic+0x1e4/0x41c kernel/panic.c:183
>  Â__warn+0x1dc/0x200 kernel/panic.c:547
>  Âreport_bug+0x211/0x2d0 lib/bug.c:184
>  Âfixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
>  Âfixup_bug arch/x86/kernel/traps.c:247 [inline]
>  Âdo_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
>  Âdo_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
>  Âinvalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1079
> RIP: 0010:ion_ioctl+0x2db/0x380 drivers/staging/android/ion/ion-ioctl.c:63
> RSP: 0018:ffff8801cf60fce0 EFLAGS: 00010212
> RAX: 0000000000010000 RBX: 0000000000000018 RCX: ffffffff841563eb
> RDX: 000000000000006f RSI: ffffc90002d23000 RDI: ffff8801cf60fd14
> RBP: ffff8801cf60fd78 R08: d7987b3bb57b3c72 R09: ffffed0039ec1fa5
> R10: 0000000000000003 R11: ffffed0039ec1fa4 R12: 1ffff10039ec1f9e
> R13: 00000000c0184908 R14: ffff8801cf60fd50 R15: dffffc0000000000
>  Âvfs_ioctl fs/ioctl.c:46 [inline]
>  Âdo_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
>  ÂSYSC_ioctl fs/ioctl.c:701 [inline]
>  ÂSyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
>  Âentry_SYSCALL_64_fastpath+0x23/0x9a
> RIP: 0033:0x452ac9
> RSP: 002b:00007fd877792c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000452ac9
> RDX: 0000000020003000 RSI: 00000000c0184908 RDI: 0000000000000013
> RBP: 00000000000003aa R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f3890
> R13: 00000000ffffffff R14: 00007fd8777936d4 R15: 0000000000000000
> Dumping ftrace buffer:
>  ÂÂ (ftrace buffer empty)
> Kernel Offset: disabled
> Rebooting in 86400 seconds..

#syz dup: WARNING in ion_ioctl