linux-kernel - [mctp] 889b7da23a: net/mctp/route.c:#RCU-list_traversed_in_non-reader

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 8 Sep 2021 11:03:19 +0800
From:   kernel test robot <oliver.sang@...el.com>
To:     Jeremy Kerr <jk@...econstruct.com.au>
Cc:     "David S. Miller" <davem@...emloft.net>,
        LKML <linux-kernel@...r.kernel.org>, lkp@...ts.01.org,
        lkp@...el.com
Subject: [mctp]  889b7da23a:
 net/mctp/route.c:#RCU-list_traversed_in_non-reader_section



Greeting,

FYI, we noticed the following commit (built with gcc-9):

commit: 889b7da23abf92faf34491df95733bda63639e32 ("mctp: Add initial routing framework")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master


in testcase: trinity
version: trinity-x86_64-da65f0aa-1_20210719
with following parameters:

	number: 99999
	group: group-00

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):



If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>



[  843.495309][  T345]
[  843.509974][  T345] =============================
[  843.524220][  T345] WARNING: suspicious RCU usage
[  843.538791][  T345] 5.14.0-rc2-00606-g889b7da23abf #1 Not tainted
[  843.553617][  T345] -----------------------------
[  843.567412][  T345] net/mctp/route.c:310 RCU-list traversed in non-reader section!!
[  843.583699][  T345]
[  843.583699][  T345] other info that might help us debug this:
[  843.583699][  T345]
[  843.623303][  T345]
[  843.623303][  T345] rcu_scheduler_active = 2, debug_locks = 1
[  843.649555][  T345] 3 locks held by kworker/u4:1/345:
[  843.662935][  T345]  #0: ffff917f01b7e548 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x311/0x980
[  843.678204][  T345]  #1: ffffaaf904f77e48 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x311/0x980
[  843.693346][  T345]  #2: ffffffffa54be518 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x4c/0x540
[  843.708230][  T345]
[  843.708230][  T345] stack backtrace:
[  843.734903][  T345] CPU: 1 PID: 345 Comm: kworker/u4:1 Not tainted 5.14.0-rc2-00606-g889b7da23abf #1 8f09027720f43f2fcf70dac5ed9f779ab6f5e57b
[  843.764085][  T345] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  843.779545][  T345] Workqueue: netns cleanup_net
[  843.793968][  T345] Call Trace:
[  843.808340][  T345]  dump_stack_lvl+0xf9/0x169
[  843.823211][  T345]  mctp_routes_net_exit+0xb6/0xc0
[  843.837851][  T345]  ? mctp_route_release+0xc0/0xc0
[  843.852553][  T345]  ops_exit_list+0x51/0xc0
[  843.866911][  T345]  cleanup_net+0x317/0x540
[  843.880986][  T345]  process_one_work+0x3e7/0x980
[  843.895489][  T345]  worker_thread+0x5b/0x600
[  843.910180][  T345]  ? process_one_work+0x980/0x980
[  843.925065][  T345]  kthread+0x170/0x1c0
[  843.939268][  T345]  ? set_kthread_struct+0x80/0x80
[  843.953355][  T345]  ret_from_fork+0x22/0x30



To reproduce:

        # build kernel
	cd linux
	cp config-5.14.0-rc2-00606-g889b7da23abf .config
	make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



---
0DAY/LKP+ Test Infrastructure                   Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org       Intel Corporation

Thanks,
Oliver Sang


View attachment "config-5.14.0-rc2-00606-g889b7da23abf" of type "text/plain" (272580 bytes)

View attachment "job-script" of type "text/plain" (4406 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (58852 bytes)

View attachment "trinity" of type "text/plain" (7489 bytes)