| TITLE: BUG: corrupted list in tipc_nametbl_unsubscribe |
| |
| [ 440.811510] list_del corruption. prev->next should be 00000000bc6553ca, but was 0000000038fa8131 |
| [ 440.811620] ------------[ cut here ]------------ |
| [ 440.811625] kernel BUG at lib/list_debug.c:53! |
| [ 440.811637] invalid opcode: 0000 [#1] SMP KASAN |
| [ 440.811642] Dumping ftrace buffer: |
| [ 440.811646] (ftrace buffer empty) |
| [ 440.811649] Modules linked in: |
| [ 440.811658] CPU: 1 PID: 3200 Comm: syz-executor4 Not tainted 4.15.0-rc8+ #264 |
| [ 440.811662] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 440.811673] RIP: 0010:__list_del_entry_valid+0xef/0x150 |
| [ 440.811677] RSP: 0018:ffff8801be95eb20 EFLAGS: 00010286 |
| [ 440.811683] RAX: 0000000000000054 RBX: ffff8801d359f240 RCX: 0000000000000000 |
| [ 440.811686] RDX: 0000000000000054 RSI: 1ffff10039af2dca RDI: ffffed0037d2bd58 |
| [ 440.811690] RBP: ffff8801be95eb38 R08: 1ffff10037d2bcfc R09: 0000000000000000 |
| [ 440.811694] R10: ffff8801be95ea00 R11: 0000000000000000 R12: ffff8801d50e4900 |
| [ 440.811698] R13: ffff8801be95ecd8 R14: ffff8801c29ac860 R15: ffff8801bd76aa80 |
| [ 440.811704] FS: 00007f70eee26700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 |
| [ 440.811708] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| [ 440.811712] CR2: 00000000010bad18 CR3: 0000000006822006 CR4: 00000000001606e0 |
| [ 440.811718] Call Trace: |
| [ 440.811727] ? _raw_spin_lock_bh+0x39/0x40 |
| [ 440.811737] tipc_nametbl_unsubscribe+0x318/0x990 |
| [ 440.811751] ? tipc_nametbl_subscribe+0xc10/0xc10 |
| [ 440.811764] ? lock_acquire+0x1d5/0x580 |
| [ 440.811770] ? lock_acquire+0x1d5/0x580 |
| [ 440.811777] ? tipc_subscrb_subscrp_delete+0x8f/0x460 |
| [ 440.811785] ? __radix_tree_lookup+0x435/0x5e0 |
| [ 440.811797] ? lock_release+0xa40/0xa40 |
| [ 440.811806] ? print_irqtrace_events+0x270/0x270 |
| [ 440.811815] ? find_held_lock+0x35/0x1d0 |
| [ 440.811828] ? tipc_subscrb_subscrp_delete+0x8f/0x460 |
| [ 440.811843] tipc_subscrb_subscrp_delete+0x1e9/0x460 |
| [ 440.811857] ? tipc_subscrp_put+0x360/0x360 |
| [ 440.811866] ? __local_bh_enable_ip+0x121/0x230 |
| [ 440.811876] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 440.811884] ? tipc_conn_lookup+0x74/0x90 |
| [ 440.811891] ? tipc_subscrb_subscrp_delete+0x460/0x460 |
| [ 440.811901] tipc_subscrb_release_cb+0x17/0x30 |
| [ 440.811910] tipc_close_conn+0x171/0x270 |
| [ 440.811922] tipc_topsrv_kern_unsubscr+0x213/0x340 |
| [ 440.811928] ? tipc_dest_del+0x350/0x350 |
| [ 440.811937] ? tipc_topsrv_kern_subscr+0x850/0x850 |
| [ 440.811947] ? tipc_node_distr_xmit+0x212/0x2b0 |
| [ 440.811964] tipc_group_delete+0x2c0/0x3d0 |
| [ 440.811975] ? print_irqtrace_events+0x270/0x270 |
| [ 440.811984] ? tipc_group_create+0x9c0/0x9c0 |
| [ 440.811993] ? __tipc_shutdown+0x916/0xc80 |
| [ 440.811999] ? find_held_lock+0x35/0x1d0 |
| [ 440.812020] ? tipc_sk_respond+0x550/0x550 |
| [ 440.812038] tipc_sk_leave+0x10b/0x200 |
| [ 440.812049] ? tipc_sk_withdraw+0x6b0/0x6b0 |
| [ 440.812062] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 440.812071] ? lock_sock_nested+0x91/0x110 |
| [ 440.812080] ? __local_bh_enable_ip+0x121/0x230 |
| [ 440.812096] tipc_release+0x154/0xfe0 |
| [ 440.812114] ? kernel_text_address+0x102/0x140 |
| [ 440.812124] ? tipc_sk_backlog_rcv+0x390/0x390 |
| [ 440.812132] ? trace_event_raw_event_lock+0x340/0x340 |
| [ 440.812140] ? perf_trace_lock+0xd6/0x900 |
| [ 440.812147] ? __save_stack_trace+0x7e/0xd0 |
| [ 440.812156] ? check_noncircular+0x20/0x20 |
| [ 440.812167] ? trace_event_raw_event_lock+0x340/0x340 |
| [ 440.812183] ? locks_remove_file+0x3fa/0x5a0 |
| [ 440.812194] ? fcntl_setlk+0x10c0/0x10c0 |
| [ 440.812200] ? fsnotify+0x7b3/0x1140 |
| [ 440.812219] ? fsnotify_first_mark+0x2b0/0x2b0 |
| [ 440.812240] sock_release+0x8d/0x1e0 |
| [ 440.812249] ? sock_alloc_file+0x560/0x560 |
| [ 440.812257] sock_close+0x16/0x20 |
| [ 440.812268] __fput+0x327/0x7e0 |
| [ 440.812284] ? fput+0x140/0x140 |
| [ 440.812295] ? _raw_spin_unlock_irq+0x27/0x70 |
| [ 440.812311] ____fput+0x15/0x20 |
| [ 440.812320] task_work_run+0x199/0x270 |
| [ 440.812333] ? task_work_cancel+0x210/0x210 |
| [ 440.812342] ? _raw_spin_unlock+0x22/0x30 |
| [ 440.812351] ? switch_task_namespaces+0x87/0xc0 |
| [ 440.812365] do_exit+0x9bb/0x1ad0 |
| [ 440.812374] ? try_to_wake_up+0xf9/0x1600 |
| [ 440.812389] ? mm_update_next_owner+0x930/0x930 |
| [ 440.812400] ? debug_check_no_locks_freed+0x3c0/0x3c0 |
| [ 440.812408] ? debug_check_no_locks_freed+0x3c0/0x3c0 |
| [ 440.812418] ? do_raw_spin_trylock+0x190/0x190 |
| [ 440.812425] ? do_raw_spin_trylock+0x190/0x190 |
| [ 440.812438] ? __lock_is_held+0xb6/0x140 |
| [ 440.812463] ? perf_trace_lock+0xd6/0x900 |
| [ 440.812479] ? trace_event_raw_event_lock+0x340/0x340 |
| [ 440.812488] ? __perf_event_task_sched_out+0x266/0x1490 |
| [ 440.812500] ? check_noncircular+0x20/0x20 |
| [ 440.812516] ? perf_event_sync_stat+0x5b0/0x5b0 |
| [ 440.812525] ? __perf_event_task_sched_in+0x200/0xc20 |
| [ 440.812549] ? find_held_lock+0x35/0x1d0 |
| [ 440.812567] ? get_signal+0x7ae/0x16c0 |
| [ 440.812577] ? lock_downgrade+0x980/0x980 |
| [ 440.812595] do_group_exit+0x149/0x400 |
| [ 440.812604] ? do_raw_spin_trylock+0x190/0x190 |
| [ 440.812612] ? SyS_exit+0x30/0x30 |
| [ 440.812620] ? _raw_spin_unlock_irq+0x27/0x70 |
| [ 440.812631] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 440.812645] get_signal+0x73f/0x16c0 |
| [ 440.812664] ? ptrace_notify+0x130/0x130 |
| [ 440.812678] ? __schedule+0x8f3/0x2060 |
| [ 440.812685] ? exit_robust_list+0x240/0x240 |
| [ 440.812701] ? __sched_text_start+0x8/0x8 |
| [ 440.812719] ? find_held_lock+0x35/0x1d0 |
| [ 440.812731] do_signal+0x90/0x1eb0 |
| [ 440.812742] ? task_work_run+0x16c/0x270 |
| [ 440.812751] ? lock_downgrade+0x980/0x980 |
| [ 440.812758] ? mntput+0x66/0x90 |
| [ 440.812769] ? setup_sigcontext+0x7d0/0x7d0 |
| [ 440.812787] ? schedule+0xf5/0x430 |
| [ 440.812794] ? _raw_spin_unlock_irq+0x27/0x70 |
| [ 440.812804] ? __schedule+0x2060/0x2060 |
| [ 440.812816] ? _raw_spin_unlock_irq+0x27/0x70 |
| [ 440.812824] ? task_work_run+0x1f4/0x270 |
| [ 440.812837] ? task_work_cancel+0x210/0x210 |
| [ 440.812849] ? exit_to_usermode_loop+0x8c/0x310 |
| [ 440.812865] exit_to_usermode_loop+0x214/0x310 |
| [ 440.812878] ? trace_event_raw_event_sys_exit+0x260/0x260 |
| [ 440.812899] syscall_return_slowpath+0x490/0x550 |
| [ 440.812908] ? prepare_exit_to_usermode+0x340/0x340 |
| [ 440.812914] ? SyS_write+0x184/0x220 |
| [ 440.812924] ? entry_SYSCALL_64_fastpath+0x73/0xa0 |
| [ 440.812935] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 440.812944] ? trace_hardirqs_on_thunk+0x1a/0x1c |
| [ 440.812961] entry_SYSCALL_64_fastpath+0x9e/0xa0 |
| [ 440.812967] RIP: 0033:0x452df9 |
| [ 440.812971] RSP: 002b:00007f70eee25c88 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca |
| [ 440.812978] RAX: 0000000000000001 RBX: 000000000071bea0 RCX: 0000000000452df9 |
| [ 440.812983] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000071becc |
| [ 440.812987] RBP: 0000000000000573 R08: 0000000000000000 R09: 0000000000000000 |
| [ 440.812991] R10: 0000000000000010 R11: 0000000000000246 R12: 0000000000000001 |
| [ 440.812995] R13: 0000000000000014 R14: 00007f70eee266d4 R15: ffffffffffffffff |
| [ 440.813016] Code: 4c 89 e2 48 c7 c7 c0 fb e0 85 e8 95 26 fe fe 0f 0b 48 c7 c7 20 fc e0 85 e8 87 26 fe fe 0f 0b 48 c7 c7 80 fc e0 85 e8 79 26 fe fe <0f> 0b 48 c7 c7 e0 fc e0 85 e8 6b 26 fe fe 0f 0b 48 89 df 48 89 |
| [ 440.813159] RIP: __list_del_entry_valid+0xef/0x150 RSP: ffff8801be95eb20 |
| [ 440.813194] ---[ end trace 0c495e0cee371de9 ]--- |
