linux-kernel - Re: [syzbot] WARNING in insert

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 19 Sep 2021 14:55:22 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     syzbot <syzbot+4546a69bfcab9a42f280@...kaller.appspotmail.com>,
        bp@...en8.de, dwmw@...zon.co.uk, hpa@...or.com,
        linux-kernel@...r.kernel.org, mingo@...hat.com,
        syzkaller-bugs@...glegroups.com, x86@...nel.org,
        Tejun Heo <tj@...nel.org>
Subject: Re: [syzbot] WARNING in insert_work

On Tue, Sep 14 2021 at 23:06, syzbot wrote:
>
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 0 at kernel/workqueue.c:633 set_work_data kernel/workqueue.c:633 [inline]

That is this warning in set_work_data():

     WARN_ON_ONCE(!work_pending(work));

> WARNING: CPU: 0 PID: 0 at kernel/workqueue.c:633 set_work_pwq kernel/workqueue.c:640 [inline]
> WARNING: CPU: 0 PID: 0 at kernel/workqueue.c:633 insert_work+0x2a7/0x370 kernel/workqueue.c:1356
> Modules linked in:
> CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.14.0-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:set_work_data kernel/workqueue.c:633 [inline]
> RIP: 0010:set_work_pwq kernel/workqueue.c:640 [inline]
> RIP: 0010:insert_work+0x2a7/0x370 kernel/workqueue.c:1356
> Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 cc 00 00 00 48 8b 7b 40 e8 30 93 05 00 eb 83 e8 09 86 2a 00 <0f> 0b e9 dc fd ff ff 48 89 ef e8 ca d0 71 00 e9 56 ff ff ff 4c 89
> RSP: 0018:ffffc90000007c70 EFLAGS: 00010046
> RAX: 0000000000000000 RBX: ffff888088ac54b0 RCX: 0000000000000100
> RDX: ffffffff8b6bc680 RSI: ffffffff814b8737 RDI: 0000000000000003
> RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000
> R10: ffffffff814b8511 R11: 0000000000000000 R12: ffff888010c69858
> R13: ffff888147c49800 R14: ffff888010c69800 R15: 0000000000000000
> FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f4db76b6ab4 CR3: 000000000b68e000 CR4: 0000000000350ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
> Call Trace:
>  <IRQ>
>  __queue_work+0x5ca/0xee0 kernel/workqueue.c:1519
>  call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421

So this is a delayed work. The timer fires and wants to queue the work,
but the work is not pending. No idea how that can happen.

Unfortunately there is no hint which work item this could be. The
warning does not tell which work function is associated to that
work. That might be a useful hint (or not if it's some generic and
widely used work function).

Thanks,

        tglx