lkml.org 
[lkml]   [2018]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    Subjectsyzbot rcu/debugobjects warning
    Hi Paul, Thomas,

    I received a crash report from syzbot on the android 4.9 kernel and I
    am looking into it, it seems the debugobjects subsystem is warning
    that a certain RCU structure is not allocated on the stack, but is
    annotated to be.

    ------------[ cut here ]------------
    WARNING: CPU: 1 PID: 0 at lib/debugobjects.c:300
    debug_object_is_on_stack lib/debugobjects.c:300 [inline]
    WARNING: CPU: 1 PID: 0 at lib/debugobjects.c:300
    __debug_object_init+0x526/0xc40 lib/debugobjects.c:326
    [...]
    <IRQ> [ 150.631700] [<ffffffff81d96069>] dump_stack+0xc1/0x128
    lib/dump_stack.c:51
    [<ffffffff8142fbd1>] panic+0x1bc/0x3a8 kernel/panic.c:179
    [<ffffffff81131894>] __warn+0x1c4/0x1e0 kernel/panic.c:542
    [<ffffffff81131afc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
    [<ffffffff81dfefb6>] debug_object_is_on_stack lib/debugobjects.c:300 [inline]
    [<ffffffff81dfefb6>] __debug_object_init+0x526/0xc40 lib/debugobjects.c:326
    [<ffffffff81dff709>] debug_object_init_on_stack+0x19/0x20
    lib/debugobjects.c:378
    [<ffffffff81287a93>] init_rcu_head_on_stack kernel/rcu/update.c:403 [inline]
    [<ffffffff81287a93>] __wait_rcu_gp+0x93/0x1b0 kernel/rcu/update.c:358
    [<ffffffff81290251>] synchronize_rcu.part.65+0x101/0x110
    kernel/rcu/tree_plugin.h:678
    [<ffffffff81290287>] synchronize_rcu+0x27/0x90 kernel/rcu/tree_plugin.h:679
    [<ffffffff83588b35>] __l2tp_session_unhash+0x3d5/0x550
    net/l2tp/l2tp_core.c:1792

    The full report is here:
    https://syzkaller.appspot.com/bug?extid=e6a19b585ab2dba3eee8

    It seems as per the code that the structure is on the stack so its
    weird why debugobjects thinks its not.
    The object in question is allocated on the stack by the __wait_rcu_gp
    macro when its called from synchronize_rcu:

    #define _wait_rcu_gp(checktiny, ...) \
    do { \
    call_rcu_func_t __crcu_array[] = { __VA_ARGS__ }; \
    struct rcu_synchronize __rs_array[ARRAY_SIZE(__crcu_array)]; \
    __wait_rcu_gp(checktiny, ARRAY_SIZE(__crcu_array), \
    __crcu_array, __rs_array); \
    } while (0)


    Any debug ideas or thoughts about it?

    thanks for any help,

    - Joel

    \
     
     \ /
      Last update: 2018-03-23 03:52    [W:2.945 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site