From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756913AbdLWTh0 (ORCPT ); Sat, 23 Dec 2017 14:37:26 -0500 Received: from Galois.linutronix.de ([146.0.238.70]:58834 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750852AbdLWThX (ORCPT ); Sat, 23 Dec 2017 14:37:23 -0500 Date: Sat, 23 Dec 2017 20:36:35 +0100 (CET) From: Thomas Gleixner To: syzbot cc: douly.fnst@cn.fujitsu.com, hpa@zytor.com, jgross@suse.com, linux-kernel@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, rostedt@goodmis.org, syzkaller-bugs@googlegroups.com, x86@kernel.org Subject: Re: WARNING in rcu_process_callbacks In-Reply-To: <94eb2c03c9bc3e1f310560ffd911@google.com> Message-ID: References: <94eb2c03c9bc3e1f310560ffd911@google.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 23 Dec 2017, syzbot wrote: > Hello, > > syzkaller hit the following crash on 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > > Unfortunately, I don't have any reproducer for this bug yet. > > > RBP: 00007f50826f4a90 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b75bb > R13: 00007f50826f4bc8 R14: 00000000004b75bb R15: 0000000000000000 > WARNING: CPU: 0 PID: 7719 at kernel/rcu/tree.c:2714 arch_local_irq_disable > arch/x86/include/asm/paravirt.h:772 [inline] So the only thing which triggers a BUG in that code is the paravirt stuff #define PVOP_TEST_NULL(op) BUG_ON(op == NULL) Your config has PARAVIRT_DEBUG=y So this is again something which got executed before a gazillion of times and then something becomes NULL. In this case it's pv_irq_ops.irq_disable I've seen such unexplainable NULL pointers in quite some sysbot bug reports lately. The irq_desc->irq_data.common issue is more or less the same problem. This really stinks like a stray pointer. Thanks, tglx