| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <77c2ee24.b63e.19681e979ea.Coremail.luckd0g@163.com>
Date: Tue, 29 Apr 2025 22:18:04 +0800 (CST)
From: "Jianzhou Zhao" <luckd0g@....com>
To: stable@...r.kernel.org
Cc: alexander.shishkin@...ux.intel.com, peterz@...radead.org,
mingo@...hat.com, acme@...nel.org, namhyung@...nel.org,
mark.rutland@....com, jolsa@...nel.org, irogers@...gle.com,
adrian.hunter@...el.com, kan.liang@...ux.intel.com,
linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: possible deadlock in perf_ctx_lock in linux6.12.25(longterm
maintenance)
Hello, I found a potential bug titled " possible deadlock in perf_ctx_lock " with modified syzkaller in the Linux6.12.25(longterm maintenance, last updated on April 25, 2025)
If you fix this issue, please add the following tag to the commit: Reported-by: Jianzhou Zhao <luckd0g@....com>, xingwei lee <xrivendell7@...il.com>
The commit of the kernel is : ef4999852d307d38cfdecd91ed6892cc03beb9b8
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=55f8591b98dd132
compiler: gcc version 11.4.0
Unfortunately, I am unable to reproduce this bug.
------------[ cut here ]-----------------------------------------
TITLE: possible deadlock in perf_ctx_lock
------------[ cut here ]------------
------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
6.12.25 #3 Not tainted
------------------------------------------------------
syz.9.499/15835 is trying to acquire lock:
ffffffff8dec35a0 (console_owner){-.-.}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:2029 [inline]
ffffffff8dec35a0 (console_owner){-.-.}-{0:0}, at: vprintk_emit kernel/printk/printk.c:2406 [inline]
ffffffff8dec35a0 (console_owner){-.-.}-{0:0}, at: vprintk_emit+0x377/0x6d0 kernel/printk/printk.c:2353
but task is already holding lock:
ffff88804ed2b818 (&ctx->lock){-...}-{2:2}, at: __perf_ctx_lock kernel/events/core.c:174 [inline]
ffff88804ed2b818 (&ctx->lock){-...}-{2:2}, at: perf_ctx_lock+0x6a/0xe0 kernel/events/core.c:183
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #5 (&ctx->lock){-...}-{2:2}:
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
perf_event_context_sched_out kernel/events/core.c:3668 [inline]
__perf_event_task_sched_out+0x4b3/0x18a0 kernel/events/core.c:3772
perf_event_task_sched_out include/linux/perf_event.h:1547 [inline]
prepare_task_switch kernel/sched/core.c:5136 [inline]
context_switch kernel/sched/core.c:5279 [inline]
__schedule+0x2250/0x5b20 kernel/sched/core.c:6710
__schedule_loop kernel/sched/core.c:6787 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6802
futex_wait_queue+0x101/0x1f0 kernel/futex/waitwake.c:370
__futex_wait+0x23d/0x3c0 kernel/futex/waitwake.c:669
futex_wait+0xdc/0x370 kernel/futex/waitwake.c:697
do_futex+0x250/0x360 kernel/futex/syscalls.c:102
__do_sys_futex kernel/futex/syscalls.c:179 [inline]
__se_sys_futex kernel/futex/syscalls.c:160 [inline]
__x64_sys_futex+0x1c6/0x4c0 kernel/futex/syscalls.c:160
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #4 (&rq->__lock){-.-.}-{2:2}:
_raw_spin_lock_nested+0x34/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x2f/0x120 kernel/sched/core.c:598
raw_spin_rq_lock kernel/sched/sched.h:1515 [inline]
task_rq_lock+0xd3/0x390 kernel/sched/core.c:700
cgroup_move_task+0x70/0x220 kernel/sched/psi.c:1161
css_set_move_task+0x280/0x570 kernel/cgroup/cgroup.c:898
cgroup_post_fork+0x20c/0x9d0 kernel/cgroup/cgroup.c:6705
copy_process+0x4bf6/0x8960 kernel/fork.c:2623
kernel_clone+0xeb/0x8f0 kernel/fork.c:2809
user_mode_thread+0xc9/0x110 kernel/fork.c:2887
rest_init+0x23/0x2b0 init/main.c:712
start_kernel+0x3dd/0x4c0 init/main.c:1105
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb3/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #3 (&p->pi_lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0xb1/0x14b0 kernel/sched/core.c:4168
autoremove_wake_function+0x16/0x150 kernel/sched/wait.c:384
__wake_up_common+0x135/0x1f0 kernel/sched/wait.c:89
__wake_up_common_lock kernel/sched/wait.c:106 [inline]
__wake_up+0x31/0x60 kernel/sched/wait.c:127
tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
serial8250_tx_chars+0x6a8/0x8a0 drivers/tty/serial/8250/8250_port.c:1821
serial8250_handle_irq+0x6a2/0xbb0 drivers/tty/serial/8250/8250_port.c:1929
serial8250_default_handle_irq+0x9a/0x210 drivers/tty/serial/8250/8250_port.c:1949
serial8250_interrupt+0x103/0x210 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x22a/0x7b0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x265/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:249 [inline]
call_irq_handler arch/x86/kernel/irq.c:261 [inline]
__common_interrupt+0xe0/0x250 arch/x86/kernel/irq.c:287
common_interrupt+0xf2/0x110 arch/x86/kernel/irq.c:280
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
pv_native_safe_halt+0x1e/0x30 arch/x86/kernel/paravirt.c:105
arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
default_idle+0x1d/0x30 arch/x86/kernel/process.c:747
default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117
cpuidle_idle_call kernel/sched/idle.c:185 [inline]
do_idle+0x318/0x3c0 kernel/sched/idle.c:326
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424
rest_init+0x16b/0x2b0 init/main.c:747
start_kernel+0x3dd/0x4c0 init/main.c:1105
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb3/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #2 (&tty->write_wait){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
__wake_up_common_lock kernel/sched/wait.c:105 [inline]
__wake_up+0x1c/0x60 kernel/sched/wait.c:127
tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
serial8250_tx_chars+0x6a8/0x8a0 drivers/tty/serial/8250/8250_port.c:1821
serial8250_handle_irq+0x6a2/0xbb0 drivers/tty/serial/8250/8250_port.c:1929
serial8250_default_handle_irq+0x9a/0x210 drivers/tty/serial/8250/8250_port.c:1949
serial8250_interrupt+0x103/0x210 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x22a/0x7b0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x265/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:249 [inline]
call_irq_handler arch/x86/kernel/irq.c:261 [inline]
__common_interrupt+0xe0/0x250 arch/x86/kernel/irq.c:287
common_interrupt+0xf2/0x110 arch/x86/kernel/irq.c:280
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
pv_native_safe_halt+0x1e/0x30 arch/x86/kernel/paravirt.c:105
arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
default_idle+0x1d/0x30 arch/x86/kernel/process.c:747
default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117
cpuidle_idle_call kernel/sched/idle.c:185 [inline]
do_idle+0x318/0x3c0 kernel/sched/idle.c:326
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424
rest_init+0x16b/0x2b0 init/main.c:747
start_kernel+0x3dd/0x4c0 init/main.c:1105
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb3/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #1 (&port_lock_key){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
uart_port_lock_irqsave include/linux/serial_core.h:711 [inline]
serial8250_console_write+0xb3e/0x19b0 drivers/tty/serial/8250/8250_port.c:3381
console_emit_next_record kernel/printk/printk.c:3090 [inline]
console_flush_all+0x767/0xc30 kernel/printk/printk.c:3178
__console_flush_and_unlock kernel/printk/printk.c:3237 [inline]
console_unlock+0xc3/0x1f0 kernel/printk/printk.c:3277
vprintk_emit kernel/printk/printk.c:2407 [inline]
vprintk_emit+0x4fb/0x6d0 kernel/printk/printk.c:2353
vprintk+0x93/0xb0 kernel/printk/printk_safe.c:73
_printk+0xbf/0x100 kernel/printk/printk.c:2432
register_console+0xc11/0x11b0 kernel/printk/printk.c:4067
univ8250_console_init+0x62/0x90 drivers/tty/serial/8250/8250_core.c:513
console_init+0xcc/0x680 kernel/printk/printk.c:4260
start_kernel+0x293/0x4c0 init/main.c:1040
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb3/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #0 (console_owner){-.-.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x2425/0x3b90 kernel/locking/lockdep.c:5202
lock_acquire.part.0+0x11b/0x370 kernel/locking/lockdep.c:5825
console_trylock_spinning kernel/printk/printk.c:2029 [inline]
vprintk_emit kernel/printk/printk.c:2406 [inline]
vprintk_emit+0x38c/0x6d0 kernel/printk/printk.c:2353
vprintk+0x93/0xb0 kernel/printk/printk_safe.c:73
_printk+0xbf/0x100 kernel/printk/printk.c:2432
__report_bug lib/bug.c:195 [inline]
report_bug+0x27c/0x500 lib/bug.c:219
handle_bug+0xe5/0x180 arch/x86/kernel/traps.c:285
exc_invalid_op+0x35/0x80 arch/x86/kernel/traps.c:309
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
perf_trace_add+0x2da/0x390 kernel/trace/trace_event_perf.c:375
event_sched_in+0x434/0xac0 kernel/events/core.c:2629
group_sched_in kernel/events/core.c:2662 [inline]
merge_sched_in+0x895/0x1570 kernel/events/core.c:3940
visit_groups_merge.constprop.0.isra.0+0x6d2/0x1250 kernel/events/core.c:3885
pmu_groups_sched_in kernel/events/core.c:3967 [inline]
__pmu_ctx_sched_in kernel/events/core.c:3979 [inline]
ctx_sched_in+0x5c1/0xa30 kernel/events/core.c:4030
perf_event_sched_in+0x5d/0x90 kernel/events/core.c:2760
perf_event_context_sched_in kernel/events/core.c:4077 [inline]
__perf_event_task_sched_in+0x33a/0x6f0 kernel/events/core.c:4106
perf_event_task_sched_in include/linux/perf_event.h:1524 [inline]
finish_task_switch.isra.0+0x5f9/0xcb0 kernel/sched/core.c:5201
context_switch kernel/sched/core.c:5335 [inline]
__schedule+0x1156/0x5b20 kernel/sched/core.c:6710
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7032
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
__sanitizer_cov_trace_pc+0x0/0x80 kernel/kcov.c:127
rcu_read_unlock include/linux/rcupdate.h:878 [inline]
count_memcg_events_mm.constprop.0+0x12a/0x330 include/linux/memcontrol.h:1046
count_memcg_event_mm include/linux/memcontrol.h:1052 [inline]
mm_account_fault mm/memory.c:5947 [inline]
handle_mm_fault+0x5af/0xab0 mm/memory.c:6107
do_user_addr_fault+0x61b/0x13a0 arch/x86/mm/fault.c:1338
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x98/0x180 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
other info that might help us debug this:
Chain exists of:
console_owner --> &rq->__lock --> &ctx->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ctx->lock);
lock(&rq->__lock);
lock(&ctx->lock);
lock(console_owner);
*** DEADLOCK ***
5 locks held by syz.9.499/15835:
#0: ffff88804a983b68 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:704 [inline]
#0: ffff88804a983b68 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x141/0x9a0 mm/memory.c:6247
#1: ffffffff8dfb62a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#1: ffffffff8dfb62a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffffff8dfb62a0 (rcu_read_lock){....}-{1:2}, at: count_memcg_events_mm.constprop.0+0x3a/0x330 include/linux/memcontrol.h:1042
#2: ffffffff8dfb62a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#2: ffffffff8dfb62a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8dfb62a0 (rcu_read_lock){....}-{1:2}, at: perf_event_context_sched_in kernel/events/core.c:4039 [inline]
#2: ffffffff8dfb62a0 (rcu_read_lock){....}-{1:2}, at: __perf_event_task_sched_in+0xd3/0x6f0 kernel/events/core.c:4106
#3: ffff88802b837af8 (&cpuctx_lock){-.-.}-{2:2}, at: __perf_ctx_lock kernel/events/core.c:174 [inline]
#3: ffff88802b837af8 (&cpuctx_lock){-.-.}-{2:2}, at: perf_ctx_lock+0x15/0xe0 kernel/events/core.c:181
#4: ffff88804ed2b818 (&ctx->lock){-...}-{2:2}, at: __perf_ctx_lock kernel/events/core.c:174 [inline]
#4: ffff88804ed2b818 (&ctx->lock){-...}-{2:2}, at: perf_ctx_lock+0x6a/0xe0 kernel/events/core.c:183
stack backtrace:
CPU: 0 UID: 0 PID: 15835 Comm: syz.9.499 Not tainted 6.12.25 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
print_circular_bug+0x406/0x5c0 kernel/locking/lockdep.c:2074
check_noncircular+0x2f7/0x3e0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x2425/0x3b90 kernel/locking/lockdep.c:5202
lock_acquire.part.0+0x11b/0x370 kernel/locking/lockdep.c:5825
console_trylock_spinning kernel/printk/printk.c:2029 [inline]
vprintk_emit kernel/printk/printk.c:2406 [inline]
vprintk_emit+0x38c/0x6d0 kernel/printk/printk.c:2353
vprintk+0x93/0xb0 kernel/printk/printk_safe.c:73
_printk+0xbf/0x100 kernel/printk/printk.c:2432
__report_bug lib/bug.c:195 [inline]
report_bug+0x27c/0x500 lib/bug.c:219
handle_bug+0xe5/0x180 arch/x86/kernel/traps.c:285
exc_invalid_op+0x35/0x80 arch/x86/kernel/traps.c:309
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
RIP: 0010:perf_trace_add+0x2da/0x390 kernel/trace/trace_event_perf.c:375
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 64 48 89 ab f8 01 00 00 48 89 df e8 b1 ab 26 00 e9 f3 fd ff ff e8 37 87 f6 ff 90 <0f> 0b 90 41 bc ea ff ff ff e9 77 ff ff ff e8 23 c5 56 00 e9 8a fd
RSP: 0018:ffffc9000713f7f0 EFLAGS: 00010006
RAX: 0000000040000002 RBX: ffff88802a069880 RCX: ffffffff8195a68e
RDX: ffff888045ec2500 RSI: ffffffff8195a839 RDI: ffffffff8deabf48
RBP: 0000000000000000 R08: 0000000000000001 R09: fffff52000e27eef
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8deabee0 R14: ffff88802a069928 R15: ffff888051237200
event_sched_in+0x434/0xac0 kernel/events/core.c:2629
group_sched_in kernel/events/core.c:2662 [inline]
merge_sched_in+0x895/0x1570 kernel/events/core.c:3940
visit_groups_merge.constprop.0.isra.0+0x6d2/0x1250 kernel/events/core.c:3885
pmu_groups_sched_in kernel/events/core.c:3967 [inline]
__pmu_ctx_sched_in kernel/events/core.c:3979 [inline]
ctx_sched_in+0x5c1/0xa30 kernel/events/core.c:4030
perf_event_sched_in+0x5d/0x90 kernel/events/core.c:2760
perf_event_context_sched_in kernel/events/core.c:4077 [inline]
__perf_event_task_sched_in+0x33a/0x6f0 kernel/events/core.c:4106
perf_event_task_sched_in include/linux/perf_event.h:1524 [inline]
finish_task_switch.isra.0+0x5f9/0xcb0 kernel/sched/core.c:5201
context_switch kernel/sched/core.c:5335 [inline]
__schedule+0x1156/0x5b20 kernel/sched/core.c:6710
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7032
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x80 kernel/kcov.c:210
Code: 5d 41 5c 41 5d c3 cc cc cc cc 48 c7 c0 f4 ff ff ff eb 92 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 65 48 8b 15 04 ae 77 7e 65 8b 05 05 ae 77 7e a9 00 01
RSP: 0000:ffffc9000713fe20 EFLAGS: 00000212
RAX: 000000000000fe4d RBX: 0000000000000200 RCX: ffffc9002f801000
RDX: 0000000000080000 RSI: ffffffff81d2e884 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000001 R09: fffffbfff2d84fa6
R10: 0000000000000200 R11: 0000000000000000 R12: ffff888020dea000
R13: ffff88804a8558c8 R14: 0000000000000040 R15: ffff88804f13f200
rcu_read_unlock include/linux/rcupdate.h:878 [inline]
count_memcg_events_mm.constprop.0+0x12a/0x330 include/linux/memcontrol.h:1046
count_memcg_event_mm include/linux/memcontrol.h:1052 [inline]
mm_account_fault mm/memory.c:5947 [inline]
handle_mm_fault+0x5af/0xab0 mm/memory.c:6107
do_user_addr_fault+0x61b/0x13a0 arch/x86/mm/fault.c:1338
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x98/0x180 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fe4fdc4f757
Code: 70 48 63 d5 48 01 c2 49 3b 55 08 77 4e 8d 55 ff 85 ed 74 35 0f 1f 80 00 00 00 00 48 39 c6 77 1c 49 8b 7d 00 49 89 c1 49 29 f1 <46> 0f b6 0c 0f 45 84 c9 74 08 44 88 0c 07 49 8b 45 10 48 83 c0 01
RSP: 002b:00007fe4fec1b420 EFLAGS: 00010206
RAX: 0000000000067001 RBX: 00007fe4fec1b480 RCX: 0000000000000000
RDX: 000000000000004c RSI: 0000000000000001 RDI: 00007fe4f3600000
RBP: 0000000000000102 R08: 0000000000000001 R09: 0000000000067000
R10: 0000000000000000 R11: 00007fe4fec1b490 R12: 00007fe4fec1b490
R13: 00007fe4fec1b520 R14: 0000000000000001 R15: 0000000000000000
</TASK>
WARNING: CPU: 0 PID: 15835 at kernel/trace/trace_event_perf.c:375 perf_trace_add+0x2da/0x390 kernel/trace/trace_event_perf.c:375
Modules linked in:
CPU: 0 UID: 0 PID: 15835 Comm: syz.9.499 Not tainted 6.12.25 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:perf_trace_add+0x2da/0x390 kernel/trace/trace_event_perf.c:375
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 64 48 89 ab f8 01 00 00 48 89 df e8 b1 ab 26 00 e9 f3 fd ff ff e8 37 87 f6 ff 90 <0f> 0b 90 41 bc ea ff ff ff e9 77 ff ff ff e8 23 c5 56 00 e9 8a fd
RSP: 0018:ffffc9000713f7f0 EFLAGS: 00010006
RAX: 0000000040000002 RBX: ffff88802a069880 RCX: ffffffff8195a68e
RDX: ffff888045ec2500 RSI: ffffffff8195a839 RDI: ffffffff8deabf48
RBP: 0000000000000000 R08: 0000000000000001 R09: fffff52000e27eef
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8deabee0 R14: ffff88802a069928 R15: ffff888051237200
FS: 00007fe4fec1c640(0000) GS:ffff88802b800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f50219e7bac CR3: 00000000743bc000 CR4: 0000000000752ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 80000000
Call Trace:
<TASK>
event_sched_in+0x434/0xac0 kernel/events/core.c:2629
group_sched_in kernel/events/core.c:2662 [inline]
merge_sched_in+0x895/0x1570 kernel/events/core.c:3940
visit_groups_merge.constprop.0.isra.0+0x6d2/0x1250 kernel/events/core.c:3885
pmu_groups_sched_in kernel/events/core.c:3967 [inline]
__pmu_ctx_sched_in kernel/events/core.c:3979 [inline]
ctx_sched_in+0x5c1/0xa30 kernel/events/core.c:4030
perf_event_sched_in+0x5d/0x90 kernel/events/core.c:2760
perf_event_context_sched_in kernel/events/core.c:4077 [inline]
__perf_event_task_sched_in+0x33a/0x6f0 kernel/events/core.c:4106
perf_event_task_sched_in include/linux/perf_event.h:1524 [inline]
finish_task_switch.isra.0+0x5f9/0xcb0 kernel/sched/core.c:5201
context_switch kernel/sched/core.c:5335 [inline]
__schedule+0x1156/0x5b20 kernel/sched/core.c:6710
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7032
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x80 kernel/kcov.c:210
Code: 5d 41 5c 41 5d c3 cc cc cc cc 48 c7 c0 f4 ff ff ff eb 92 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 65 48 8b 15 04 ae 77 7e 65 8b 05 05 ae 77 7e a9 00 01
RSP: 0000:ffffc9000713fe20 EFLAGS: 00000212
RAX: 000000000000fe4d RBX: 0000000000000200 RCX: ffffc9002f801000
RDX: 0000000000080000 RSI: ffffffff81d2e884 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000001 R09: fffffbfff2d84fa6
R10: 0000000000000200 R11: 0000000000000000 R12: ffff888020dea000
R13: ffff88804a8558c8 R14: 0000000000000040 R15: ffff88804f13f200
rcu_read_unlock include/linux/rcupdate.h:878 [inline]
count_memcg_events_mm.constprop.0+0x12a/0x330 include/linux/memcontrol.h:1046
count_memcg_event_mm include/linux/memcontrol.h:1052 [inline]
mm_account_fault mm/memory.c:5947 [inline]
handle_mm_fault+0x5af/0xab0 mm/memory.c:6107
do_user_addr_fault+0x61b/0x13a0 arch/x86/mm/fault.c:1338
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x98/0x180 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fe4fdc4f757
Code: 70 48 63 d5 48 01 c2 49 3b 55 08 77 4e 8d 55 ff 85 ed 74 35 0f 1f 80 00 00 00 00 48 39 c6 77 1c 49 8b 7d 00 49 89 c1 49 29 f1 <46> 0f b6 0c 0f 45 84 c9 74 08 44 88 0c 07 49 8b 45 10 48 83 c0 01
RSP: 002b:00007fe4fec1b420 EFLAGS: 00010206
RAX: 0000000000067001 RBX: 00007fe4fec1b480 RCX: 0000000000000000
RDX: 000000000000004c RSI: 0000000000000001 RDI: 00007fe4f3600000
RBP: 0000000000000102 R08: 0000000000000001 R09: 0000000000067000
R10: 0000000000000000 R11: 00007fe4fec1b490 R12: 00007fe4fec1b490
R13: 00007fe4fec1b520 R14: 0000000000000001 R15: 0000000000000000
</TASK>
----------------
Code disassembly (best guess):
0: 5d pop %rbp
1: 41 5c pop %r12
3: 41 5d pop %r13
5: c3 ret
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: 48 c7 c0 f4 ff ff ff mov $0xfffffffffffffff4,%rax
11: eb 92 jmp 0xffffffa5
13: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 90 nop
28: 90 nop
29: 90 nop
* 2a: f3 0f 1e fa endbr64 <-- trapping instruction
2e: 65 48 8b 15 04 ae 77 mov %gs:0x7e77ae04(%rip),%rdx # 0x7e77ae3a
35: 7e
36: 65 8b 05 05 ae 77 7e mov %gs:0x7e77ae05(%rip),%eax # 0x7e77ae42
3d: a9 .byte 0xa9
3e: 00 01 add %al,(%rcx)
===================================================================
I hope it helps.
Best regards
Jianzhou Zhao
Powered by blists - more mailing lists