Messages in this thread | | | From | Dmitry Vyukov <> | Date | Tue, 24 Nov 2015 11:35:50 +0100 | Subject | WARNING in gsm_cleanup_mux |
| |
Hello,
The following program trigger WARNING in gsm_cleanup_mux (run in a loop, there seems to be a race):
// autogenerated by syzkaller (http://github.com/google/syzkaller) #include <syscall.h> #include <string.h> #include <stdint.h> #include <pthread.h> #include <unistd.h>
long r2 = -1;
void *thr1(void *a) { r2 = syscall(SYS_open, 0x200004b1ul, 0x100ul, 0x0ul, 0, 0, 0); return 0; }
void *thr2(void *a) { *(uint32_t*)0x200055a1 = 0x15; syscall(SYS_ioctl, r2, 0x5423ul, 0x200055a1ul, 0, 0, 0); return 0; }
int main() { syscall(SYS_mmap, 0x20000000ul, 0x100000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x200004b1, "\x2f\x64\x65\x76\x2f\x70\x74\x6d\x78", 9); r2 = syscall(SYS_open, 0x200004b1ul, 0x100ul, 0x0ul, 0, 0, 0); *(uint32_t*)0x200055a1 = 0x15; syscall(SYS_ioctl, r2, 0x5423ul, 0x200055a1ul, 0, 0, 0); pthread_t th1; pthread_create(&th1, 0, thr1, 0); pthread_t th2; pthread_create(&th2, 0, thr2, 0); usleep(10000); return 0; }
------------[ cut here ]------------ WARNING: CPU: 2 PID: 24238 at drivers/tty/n_gsm.c:2048 gsm_cleanup_mux+0x166/0x6b0() Modules linked in: CPU: 2 PID: 24238 Comm: a.out Tainted: G B W 4.4.0-rc1+ #81 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 00000000ffffffff ffff8800621279d0 ffffffff825d3336 0000000000000000 ffff880061e50000 ffffffff84f12ce0 ffff880062127a10 ffffffff81247889 ffffffff828d0456 ffffffff84f12ce0 0000000000000800 0000000000000004 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff825d3336>] dump_stack+0x68/0x92 lib/dump_stack.c:50 [<ffffffff81247889>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:457 [<ffffffff81247ab9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:490 [<ffffffff828d0456>] gsm_cleanup_mux+0x166/0x6b0 drivers/tty/n_gsm.c:2048 [<ffffffff828d4d87>] gsmld_open+0x5b7/0x7a0 drivers/tty/n_gsm.c:2386 [<ffffffff828b9078>] tty_ldisc_open.isra.2+0x78/0xd0 drivers/tty/tty_ldisc.c:447 [<ffffffff828b973a>] tty_set_ldisc+0x1ca/0xa70 drivers/tty/tty_ldisc.c:567 [< inline >] tiocsetd drivers/tty/tty_io.c:2650 [<ffffffff828a14ea>] tty_ioctl+0xb2a/0x2140 drivers/tty/tty_io.c:2883 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff8169bcc1>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607 [< inline >] SYSC_ioctl fs/ioctl.c:622 [<ffffffff8169c50f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613 [<ffffffff84bf0c36>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 ---[ end trace 179dec89fcb66e7c ]---
Here is strace output of the program:
execve("./a.out", ["./a.out"], [/* 14 vars */]) = 0 uname({sys="Linux", node="dvyukov-z840.muc.corp.google.com", ...}) = 0 brk(0) = 0xef6000 brk(0xef71c0) = 0xef71c0 arch_prctl(ARCH_SET_FS, 0xef6880) = 0 set_tid_address(0xef6b50) = 24314 set_robust_list(0xef6b60, 0x18) = 0 futex(0x7ffe5155b000, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, ef6880) = -1 EAGAIN (Resource temporarily unavailable) rt_sigaction(SIGRTMIN, {0x405a10, [], SA_RESTORER|SA_SIGINFO, 0x4060d0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0x405aa0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x4060d0}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 readlink("/proc/self/exe", "/root/a.out", 4096) = 11 brk(0xf181c0) = 0xf181c0 brk(0xf19000) = 0xf19000 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) mmap(0x20000000, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 open("/dev/ptmx", O_RDONLY|O_NOCTTY) = 3 ioctl(3, TIOCSETD, [21]) = 0 mmap(NULL, 8392704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd129b91000 mprotect(0x7fd129b91000, 4096, PROT_NONE) = 0 clone(Process 24315 attached child_stack=0x7fd12a390e70, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tidptr=0x7fd12a3919d0, tls=0x7fd12a391700, child_tidptr=0x7fd12a3919d0) = 24315 [pid 24314] mmap(NULL, 8392704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd129390000 [pid 24315] set_robust_list(0x7fd12a3919e0, 0x18 <unfinished ...> [pid 24314] mprotect(0x7fd129390000, 4096, PROT_NONE <unfinished ...> [pid 24315] <... set_robust_list resumed> ) = 0 [pid 24314] <... mprotect resumed> ) = 0 [pid 24315] open("/dev/ptmx", O_RDONLY|O_NOCTTY <unfinished ...> [pid 24314] clone(Process 24316 attached child_stack=0x7fd129b8fe70, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tidptr=0x7fd129b909d0, tls=0x7fd129b90700, child_tidptr=0x7fd129b909d0) = 24316 [pid 24314] nanosleep({0, 10000000}, <unfinished ...> [pid 24315] <... open resumed> ) = 4 [pid 24315] madvise(0x7fd129b91000, 8368128, MADV_DONTNEED) = 0 [pid 24315] _exit(0) = ? Process 24315 detached [pid 24316] set_robust_list(0x7fd129b909e0, 0x18) = 0 [pid 24316] ioctl(4, TIOCSETD <unfinished ...> [pid 24314] <... nanosleep resumed> NULL) = 0 [pid 24314] exit_group(0) = ?
On commit 8005c49d9aea74d382f474ce11afbbc7d7130bec.
Thanks
| |