* [syzbot] [mm?] BUG: spinlock recursion in try_to_wake_up
@ 2023-11-13 21:09 syzbot
2026-10-06 9:30 ` Forwarded: " syzbot
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2023-11-13 21:09 UTC (permalink / raw)
To: akpm, linux-kernel, linux-mm, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 6bc986ab839c Merge tag 'nfs-for-6.7-1' of git://git.linux-..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=163b5f90e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=cd456c5e6582895e
dashboard link: https://syzkaller.appspot.com/bug?extid=6f49826383204e367d67
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b34e04e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1308dc0f680000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-6bc986ab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3ff7887a8f39/vmlinux-6bc986ab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/60418843207c/bzImage-6bc986ab.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6f49826383204e367d67@syzkaller.appspotmail.com
BUG: spinlock recursion on CPU#0, syz-executor110/7601
lock: 0xffff88806b63c740, .magic: dead4ead, .owner: syz-executor110/7601, .owner_cpu: 1
CPU: 0 PID: 7601 Comm: syz-executor110 Tainted: G D 6.6.0-syzkaller-15494-g6bc986ab839c #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
do_raw_spin_lock+0x237/0x2b0 kernel/locking/spinlock_debug.c:114
raw_spin_rq_lock_nested kernel/sched/core.c:566 [inline]
raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:551
raw_spin_rq_lock kernel/sched/sched.h:1349 [inline]
rq_lock kernel/sched/sched.h:1663 [inline]
ttwu_queue kernel/sched/core.c:4019 [inline]
try_to_wake_up+0x654/0x15d0 kernel/sched/core.c:4342
kick_pool+0x253/0x460 kernel/workqueue.c:1142
__queue_work+0x5d9/0x1050 kernel/workqueue.c:1800
call_timer_fn+0x193/0x580 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1746 [inline]
__run_timers+0x585/0xb10 kernel/time/timer.c:2022
run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035
__do_softirq+0x21a/0x968 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu kernel/softirq.c:632 [inline]
irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1076
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5721
Code: c1 05 8d 88 9a 7e 83 f8 01 0f 85 b0 02 00 00 9c 58 f6 c4 02 0f 85 9b 02 00 00 48 85 ed 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc9000b427420 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92001684e86 RCX: 0000000000000001
RDX: 1ffff1100526d3a7 RSI: ffffffff8accaca0 RDI: ffffffff8b2ec600
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff23e25d8
R10: ffffffff91f12ec7 R11: dffffc0000000000 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88806b636e80 R15: 0000000000000000
local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
folio_add_lru+0x2b2/0x7d0 mm/swap.c:515
folio_add_lru_vma+0xb0/0x100 mm/swap.c:537
wp_page_copy mm/memory.c:3189 [inline]
do_wp_page+0x19fa/0x3a70 mm/memory.c:3510
handle_pte_fault mm/memory.c:5054 [inline]
__handle_mm_fault+0x1d7c/0x3d60 mm/memory.c:5179
handle_mm_fault+0x478/0xa00 mm/memory.c:5344
do_user_addr_fault+0x3d1/0x1000 arch/x86/mm/fault.c:1413
handle_page_fault arch/x86/mm/fault.c:1505 [inline]
exc_page_fault+0x5c/0xd0 arch/x86/mm/fault.c:1561
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0010:copy_user_generic arch/x86/include/asm/uaccess_64.h:112 [inline]
RIP: 0010:raw_copy_to_user arch/x86/include/asm/uaccess_64.h:133 [inline]
RIP: 0010:copy_to_user_iter lib/iov_iter.c:25 [inline]
RIP: 0010:iterate_iovec include/linux/iov_iter.h:51 [inline]
RIP: 0010:iterate_and_advance2 include/linux/iov_iter.h:247 [inline]
RIP: 0010:iterate_and_advance include/linux/iov_iter.h:271 [inline]
RIP: 0010:_copy_to_iter+0x4c7/0x11d0 lib/iov_iter.c:186
Code: 45 e8 8d 37 27 fd 48 8b 4c 24 18 89 ee 48 8b 44 24 28 4c 8d 34 01 4c 89 f7 e8 e5 6e 7d fd 0f 01 cb 48 89 e9 4c 89 ff 4c 89 f6 <f3> a4 0f 1f 00 0f 01 ca 48 89 e8 48 29 eb 48 29 c8 48 01 cb 48 01
RSP: 0018:ffffc9000b427970 EFLAGS: 00050246
RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000e80
RDX: 0000000000000000 RSI: ffff888010b19180 RDI: 0000000020755000
RBP: 0000000000001000 R08: 0000000000000000 R09: ffffed10021633ff
R10: ffff888010b19fff R11: 0000000000000000 R12: 0000000000754b80
R13: ffffc9000b427d60 R14: ffff888010b19000 R15: 0000000020754e80
copy_page_to_iter lib/iov_iter.c:381 [inline]
copy_page_to_iter+0xf1/0x180 lib/iov_iter.c:368
process_vm_rw_pages mm/process_vm_access.c:45 [inline]
process_vm_rw_single_vec mm/process_vm_access.c:117 [inline]
process_vm_rw_core.constprop.0+0x5cd/0xa10 mm/process_vm_access.c:215
process_vm_rw+0x2ff/0x360 mm/process_vm_access.c:283
__do_sys_process_vm_readv mm/process_vm_access.c:295 [inline]
__se_sys_process_vm_readv mm/process_vm_access.c:291 [inline]
__x64_sys_process_vm_readv+0xe2/0x1b0 mm/process_vm_access.c:291
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7fd00a215259
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd00a1d3228 EFLAGS: 00000246 ORIG_RAX: 0000000000000136
RAX: ffffffffffffffda RBX: 00007fd00a29c308 RCX: 00007fd00a215259
RDX: 0000000000000002 RSI: 0000000020008400 RDI: 0000000000001db0
RBP: 00007fd00a29c300 R08: 0000000000000286 R09: 0000000000000000
R10: 0000000020008640 R11: 0000000000000246 R12: 00007fd00a269074
R13: 0000000000000000 R14: 00007ffec3c6eb10 R15: 00007ffec3c6ebf8
</TASK>
----------------
Code disassembly (best guess):
0: c1 05 8d 88 9a 7e 83 roll $0x83,0x7e9a888d(%rip) # 0x7e9a8894
7: f8 clc
8: 01 0f add %ecx,(%rdi)
a: 85 b0 02 00 00 9c test %esi,-0x63fffffe(%rax)
10: 58 pop %rax
11: f6 c4 02 test $0x2,%ah
14: 0f 85 9b 02 00 00 jne 0x2b5
1a: 48 85 ed test %rbp,%rbp
1d: 74 01 je 0x20
1f: fb sti
20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
27: fc ff df
* 2a: 48 01 c3 add %rax,%rbx <-- trapping instruction
2d: 48 c7 03 00 00 00 00 movq $0x0,(%rbx)
34: 48 c7 43 08 00 00 00 movq $0x0,0x8(%rbx)
3b: 00
3c: 48 rex.W
3d: 8b .byte 0x8b
3e: 84 .byte 0x84
3f: 24 .byte 0x24
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 2+ messages in thread
* Forwarded: Re: [syzbot] [mm?] BUG: spinlock recursion in try_to_wake_up
2023-11-13 21:09 [syzbot] [mm?] BUG: spinlock recursion in try_to_wake_up syzbot
@ 2026-10-06 9:30 ` syzbot
0 siblings, 0 replies; 2+ messages in thread
From: syzbot @ 2026-10-06 9:30 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [mm?] BUG: spinlock recursion in try_to_wake_up
Author: ebiggers@kernel.org
On Mon, Nov 13, 2023 at 01:09:20PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 6bc986ab839c Merge tag 'nfs-for-6.7-1' of git://git.linux-..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=163b5f90e80000
> kernel config: https://syzkaller.appspot.com/x/.config?x=cd456c5e6582895e
> dashboard link: https://syzkaller.appspot.com/bug?extid=6f49826383204e367d67
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b34e04e80000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1308dc0f680000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-6bc986ab.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/3ff7887a8f39/vmlinux-6bc986ab.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/60418843207c/bzImage-6bc986ab.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+6f49826383204e367d67@syzkaller.appspotmail.com
>
> BUG: spinlock recursion on CPU#0, syz-executor110/7601
> lock: 0xffff88806b63c740, .magic: dead4ead, .owner: syz-executor110/7601, .owner_cpu: 1
> CPU: 0 PID: 7601 Comm: syz-executor110 Tainted: G D 6.6.0-syzkaller-15494-g6bc986ab839c #0
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> Call Trace:
> <IRQ>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
> debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
> do_raw_spin_lock+0x237/0x2b0 kernel/locking/spinlock_debug.c:114
> raw_spin_rq_lock_nested kernel/sched/core.c:566 [inline]
> raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:551
> raw_spin_rq_lock kernel/sched/sched.h:1349 [inline]
> rq_lock kernel/sched/sched.h:1663 [inline]
> ttwu_queue kernel/sched/core.c:4019 [inline]
> try_to_wake_up+0x654/0x15d0 kernel/sched/core.c:4342
> kick_pool+0x253/0x460 kernel/workqueue.c:1142
> __queue_work+0x5d9/0x1050 kernel/workqueue.c:1800
> call_timer_fn+0x193/0x580 kernel/time/timer.c:1700
> expire_timers kernel/time/timer.c:1746 [inline]
> __run_timers+0x585/0xb10 kernel/time/timer.c:2022
> run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035
> __do_softirq+0x21a/0x968 kernel/softirq.c:553
> invoke_softirq kernel/softirq.c:427 [inline]
> __irq_exit_rcu kernel/softirq.c:632 [inline]
> irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
> sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1076
> </IRQ>
> <TASK>
> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
> RIP: 0010:lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5721
> Code: c1 05 8d 88 9a 7e 83 f8 01 0f 85 b0 02 00 00 9c 58 f6 c4 02 0f 85 9b 02 00 00 48 85 ed 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
> RSP: 0018:ffffc9000b427420 EFLAGS: 00000206
> RAX: dffffc0000000000 RBX: 1ffff92001684e86 RCX: 0000000000000001
> RDX: 1ffff1100526d3a7 RSI: ffffffff8accaca0 RDI: ffffffff8b2ec600
> RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff23e25d8
> R10: ffffffff91f12ec7 R11: dffffc0000000000 R12: 0000000000000001
> R13: 0000000000000000 R14: ffff88806b636e80 R15: 0000000000000000
> local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
> folio_add_lru+0x2b2/0x7d0 mm/swap.c:515
> folio_add_lru_vma+0xb0/0x100 mm/swap.c:537
> wp_page_copy mm/memory.c:3189 [inline]
> do_wp_page+0x19fa/0x3a70 mm/memory.c:3510
> handle_pte_fault mm/memory.c:5054 [inline]
> __handle_mm_fault+0x1d7c/0x3d60 mm/memory.c:5179
> handle_mm_fault+0x478/0xa00 mm/memory.c:5344
> do_user_addr_fault+0x3d1/0x1000 arch/x86/mm/fault.c:1413
> handle_page_fault arch/x86/mm/fault.c:1505 [inline]
> exc_page_fault+0x5c/0xd0 arch/x86/mm/fault.c:1561
> asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
> RIP: 0010:copy_user_generic arch/x86/include/asm/uaccess_64.h:112 [inline]
> RIP: 0010:raw_copy_to_user arch/x86/include/asm/uaccess_64.h:133 [inline]
> RIP: 0010:copy_to_user_iter lib/iov_iter.c:25 [inline]
> RIP: 0010:iterate_iovec include/linux/iov_iter.h:51 [inline]
> RIP: 0010:iterate_and_advance2 include/linux/iov_iter.h:247 [inline]
> RIP: 0010:iterate_and_advance include/linux/iov_iter.h:271 [inline]
> RIP: 0010:_copy_to_iter+0x4c7/0x11d0 lib/iov_iter.c:186
> Code: 45 e8 8d 37 27 fd 48 8b 4c 24 18 89 ee 48 8b 44 24 28 4c 8d 34 01 4c 89 f7 e8 e5 6e 7d fd 0f 01 cb 48 89 e9 4c 89 ff 4c 89 f6 <f3> a4 0f 1f 00 0f 01 ca 48 89 e8 48 29 eb 48 29 c8 48 01 cb 48 01
> RSP: 0018:ffffc9000b427970 EFLAGS: 00050246
> RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000e80
> RDX: 0000000000000000 RSI: ffff888010b19180 RDI: 0000000020755000
> RBP: 0000000000001000 R08: 0000000000000000 R09: ffffed10021633ff
> R10: ffff888010b19fff R11: 0000000000000000 R12: 0000000000754b80
> R13: ffffc9000b427d60 R14: ffff888010b19000 R15: 0000000020754e80
> copy_page_to_iter lib/iov_iter.c:381 [inline]
> copy_page_to_iter+0xf1/0x180 lib/iov_iter.c:368
> process_vm_rw_pages mm/process_vm_access.c:45 [inline]
> process_vm_rw_single_vec mm/process_vm_access.c:117 [inline]
> process_vm_rw_core.constprop.0+0x5cd/0xa10 mm/process_vm_access.c:215
> process_vm_rw+0x2ff/0x360 mm/process_vm_access.c:283
> __do_sys_process_vm_readv mm/process_vm_access.c:295 [inline]
> __se_sys_process_vm_readv mm/process_vm_access.c:291 [inline]
> __x64_sys_process_vm_readv+0xe2/0x1b0 mm/process_vm_access.c:291
> do_syscall_x64 arch/x86/entry/common.c:51 [inline]
> do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
> entry_SYSCALL_64_after_hwframe+0x63/0x6b
> RIP: 0033:0x7fd00a215259
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fd00a1d3228 EFLAGS: 00000246 ORIG_RAX: 0000000000000136
> RAX: ffffffffffffffda RBX: 00007fd00a29c308 RCX: 00007fd00a215259
> RDX: 0000000000000002 RSI: 0000000020008400 RDI: 0000000000001db0
> RBP: 00007fd00a29c300 R08: 0000000000000286 R09: 0000000000000000
> R10: 0000000020008640 R11: 0000000000000246 R12: 00007fd00a269074
> R13: 0000000000000000 R14: 00007ffec3c6eb10 R15: 00007ffec3c6ebf8
> </TASK>
> ----------------
> Code disassembly (best guess):
> 0: c1 05 8d 88 9a 7e 83 roll $0x83,0x7e9a888d(%rip) # 0x7e9a8894
> 7: f8 clc
> 8: 01 0f add %ecx,(%rdi)
> a: 85 b0 02 00 00 9c test %esi,-0x63fffffe(%rax)
> 10: 58 pop %rax
> 11: f6 c4 02 test $0x2,%ah
> 14: 0f 85 9b 02 00 00 jne 0x2b5
> 1a: 48 85 ed test %rbp,%rbp
> 1d: 74 01 je 0x20
> 1f: fb sti
> 20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
> 27: fc ff df
> * 2a: 48 01 c3 add %rax,%rbx <-- trapping instruction
> 2d: 48 c7 03 00 00 00 00 movq $0x0,(%rbx)
> 34: 48 c7 43 08 00 00 00 movq $0x0,0x8(%rbx)
> 3b: 00
> 3c: 48 rex.W
> 3d: 8b .byte 0x8b
> 3e: 84 .byte 0x84
> 3f: 24 .byte 0x24
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
This bug is assigned to the crypto and mm subsystems, but it doesn't
seem to have anything to do with crypto. It also seems to be obsolete,
as it was last seen 775 days ago.
#syz invalid
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-06 9:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-11-13 21:09 [syzbot] [mm?] BUG: spinlock recursion in try_to_wake_up syzbot
2026-10-06 9:30 ` Forwarded: " syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®