WARNING in call_rcu (2)

Status: auto-obsoleted due to no activity on 2023/04/15 15:13
Subsystems: xfs
[Documentation on labels]
Reported-by: syzbot+49cacf14fd027a089740@syzkaller.appspotmail.com
First crash: 1310d, last: 1299d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [xfs?] WARNING in call_rcu (2) 0 (1) 2022/12/29 20:26
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 WARNING in call_rcu -1 3 1084d 1114d 0/3 auto-obsoleted due to no activity on 2023/11/16 11:10
linux-5.15 WARNING in call_rcu (2) -1 1 931d 930d 0/3 auto-obsoleted due to no activity on 2024/04/17 03:03
upstream WARNING in call_rcu net -1 C done 8 2323d 2330d 15/29 fixed on 2020/05/10 10:41
upstream WARNING in call_rcu (3) net -1 C 3 850d 952d 0/29 closed as invalid on 2026/06/11 10:27
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2023/04/15 14:40 32m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci OK log
2023/04/15 13:40 23m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci OK log

Sample crash report:
XFS (loop0): Please unmount the filesystem and rectify the problem(s).
------------[ cut here ]------------
ODEBUG: activate active (active state 1) object type: rcu_head hint: 0x0
WARNING: CPU: 1 PID: 77 at lib/debugobjects.c:505 debug_print_object lib/debugobjects.c:502 [inline]
WARNING: CPU: 1 PID: 77 at lib/debugobjects.c:505 debug_object_activate+0x2c0/0x300 lib/debugobjects.c:674
Modules linked in:
CPU: 1 PID: 77 Comm: kworker/1:1H Not tainted 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: xfs-log/loop0 xlog_ioend_work
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:502 [inline]
pc : debug_object_activate+0x2c0/0x300 lib/debugobjects.c:674
lr : debug_print_object lib/debugobjects.c:502 [inline]
lr : debug_object_activate+0x2c0/0x300 lib/debugobjects.c:674
sp : ffff80000fbe3880
x29: ffff80000fbe3880 x28: 0000000000000001 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000000 x24: ffff0000cb55f250
x23: ffff80000c0cec40 x22: ffff0000c9922af0 x21: ffff80000f143000
x20: ffff80000c0cec40 x19: ffff0000c716d878 x18: 00000000000000c0
x17: 6820646165685f75 x16: ffff80000dbe6158 x15: ffff0000c21e9a40
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c21e9a40
x11: ff808000081c4d64 x10: 0000000000000000 x9 : d8d748a84881af00
x8 : d8d748a84881af00 x7 : ffff80000c091ebc x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000048
Call trace:
 debug_print_object lib/debugobjects.c:502 [inline]
 debug_object_activate+0x2c0/0x300 lib/debugobjects.c:674
 debug_rcu_head_queue kernel/rcu/rcu.h:189 [inline]
 call_rcu+0x40/0x494 kernel/rcu/tree.c:2783
 xfs_buf_rele+0x654/0x780
 xfs_buf_relse fs/xfs/xfs_buf.h:286 [inline]
 xfs_buf_ioend+0x214/0x228 fs/xfs/xfs_buf.c:1339
 xfs_buf_ioend_fail+0x58/0x68 fs/xfs/xfs_buf.c:1397
 xfs_buf_item_unpin+0x18c/0x280 fs/xfs/xfs_buf_item.c:549
 xfs_trans_committed_bulk+0x190/0x460 fs/xfs/xfs_trans.c:806
 xlog_cil_committed+0xcc/0x340 fs/xfs/xfs_log_cil.c:795
 xlog_cil_process_committed+0x6c/0xa8 fs/xfs/xfs_log_cil.c:823
 xlog_state_shutdown_callbacks+0xac/0x140 fs/xfs/xfs_log.c:538
 xlog_force_shutdown+0x1ac/0x230 fs/xfs/xfs_log.c:3821
 xlog_ioend_work+0x68/0xa0 fs/xfs/xfs_log.c:1402
 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
 worker_thread+0x340/0x610 kernel/workqueue.c:2436
 kthread+0x12c/0x158 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
irq event stamp: 1642
hardirqs last  enabled at (1641): [<ffff8000081c3048>] __up_console_sem+0xb0/0xfc kernel/printk/printk.c:261
hardirqs last disabled at (1642): [<ffff80000c084084>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (1616): [<ffff800008e528b8>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (1614): [<ffff800008e52884>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ODEBUG: active_state active (active state 1) object type: rcu_head hint: 0x0
WARNING: CPU: 1 PID: 77 at lib/debugobjects.c:505 debug_print_object lib/debugobjects.c:502 [inline]
WARNING: CPU: 1 PID: 77 at lib/debugobjects.c:505 debug_object_active_state+0x1b0/0x1dc lib/debugobjects.c:950
Modules linked in:
CPU: 1 PID: 77 Comm: kworker/1:1H Tainted: G        W          6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: xfs-log/loop0 xlog_ioend_work
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:502 [inline]
pc : debug_object_active_state+0x1b0/0x1dc lib/debugobjects.c:950
lr : debug_print_object lib/debugobjects.c:502 [inline]
lr : debug_object_active_state+0x1b0/0x1dc lib/debugobjects.c:950
sp : ffff80000fbe3880
x29: ffff80000fbe3880 x28: 0000000000000001 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000000 x24: ffff0000c9922af0
x23: 0000000000000000 x22: 0000000000000001 x21: ffff80000f0dbe88
x20: ffff80000c0cec40 x19: ffff80000f143000 x18: 00000000000000c0
x17: 65685f756372203a x16: ffff80000dbe6158 x15: ffff0000c21e9a40
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c21e9a40
x11: ff808000081c4d64 x10: 0000000000000000 x9 : d8d748a84881af00
x8 : d8d748a84881af00 x7 : ffff80000c091ebc x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefddcd0 x1 : 0000000100000000 x0 : 000000000000004c
Call trace:
 debug_print_object lib/debugobjects.c:502 [inline]
 debug_object_active_state+0x1b0/0x1dc lib/debugobjects.c:950
 debug_rcu_head_queue kernel/rcu/rcu.h:190 [inline]
 call_rcu+0x58/0x494 kernel/rcu/tree.c:2783
 xfs_buf_rele+0x654/0x780
 xfs_buf_relse fs/xfs/xfs_buf.h:286 [inline]
 xfs_buf_ioend+0x214/0x228 fs/xfs/xfs_buf.c:1339
 xfs_buf_ioend_fail+0x58/0x68 fs/xfs/xfs_buf.c:1397
 xfs_buf_item_unpin+0x18c/0x280 fs/xfs/xfs_buf_item.c:549
 xfs_trans_committed_bulk+0x190/0x460 fs/xfs/xfs_trans.c:806
 xlog_cil_committed+0xcc/0x340 fs/xfs/xfs_log_cil.c:795
 xlog_cil_process_committed+0x6c/0xa8 fs/xfs/xfs_log_cil.c:823
 xlog_state_shutdown_callbacks+0xac/0x140 fs/xfs/xfs_log.c:538
 xlog_force_shutdown+0x1ac/0x230 fs/xfs/xfs_log.c:3821
 xlog_ioend_work+0x68/0xa0 fs/xfs/xfs_log.c:1402
 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
 worker_thread+0x340/0x610 kernel/workqueue.c:2436
 kthread+0x12c/0x158 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
irq event stamp: 1698
hardirqs last  enabled at (1697): [<ffff8000081c3048>] __up_console_sem+0xb0/0xfc kernel/printk/printk.c:261
hardirqs last disabled at (1698): [<ffff80000c084084>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (1680): [<ffff8000080102e4>] _stext+0x2e4/0x37c
softirqs last disabled at (1671): [<ffff800008017c88>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
rcu: call_rcu(): Double-freed CB 000000002d0203c1->xfs_buf_free_callback+0x0/0x64()!!!   slab xfs_buf start ffff0000c716d600 pointer offset 632
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 PID: 77 Comm: kworker/1:1H Tainted: G        W          6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: xfs-log/loop0 xlog_ioend_work
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:163
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 assign_lock_key+0x134/0x140 kernel/locking/lockdep.c:981
 register_lock_class+0xc4/0x2f8 kernel/locking/lockdep.c:1294
 __lock_acquire+0xa8/0x3084 kernel/locking/lockdep.c:4934
 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:350 [inline]
 xfs_trans_committed_bulk+0x414/0x460 fs/xfs/xfs_trans.c:842
 xlog_cil_committed+0xcc/0x340 fs/xfs/xfs_log_cil.c:795
 xlog_cil_process_committed+0x6c/0xa8 fs/xfs/xfs_log_cil.c:823
 xlog_state_shutdown_callbacks+0xac/0x140 fs/xfs/xfs_log.c:538
 xlog_force_shutdown+0x1ac/0x230 fs/xfs/xfs_log.c:3821
 xlog_ioend_work+0x68/0xa0 fs/xfs/xfs_log.c:1402
 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
 worker_thread+0x340/0x610 kernel/workqueue.c:2436
 kthread+0x12c/0x158 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
list_del corruption. prev->next should be ffff80000fbe3a70, but was 0000000000000000. (prev=ffff0000ca866c30)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 77 Comm: kworker/1:1H Tainted: G        W          6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: xfs-log/loop0 xlog_ioend_work
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0xbc/0xd0 lib/list_debug.c:59
lr : __list_del_entry_valid+0xbc/0xd0 lib/list_debug.c:59
sp : ffff80000fbe3a30
x29: ffff80000fbe3a30 x28: ffff0000ca866c40 x27: 0000000000000001
x26: 0000000100000000 x25: ffff0000c98b1880 x24: ffff0000ca866c00
x23: ffff0000c0c3ca58 x22: 0000000000000001 x21: ffff800008eb51e4
x20: 0000000100000000 x19: ffff80000fbe3a70 x18: 00000000000000c0
x17: 20747562202c3037 x16: 6133656266303030 x15: 3038666666662065
x14: 6220646c756f6873 x13: 205d373754202020 x12: 5b5d363437333439
x11: ff808000081c4d64 x10: 0000000000000000 x9 : d8d748a84881af00
x8 : d8d748a84881af00 x7 : 205b5d3634373334 x6 : ffff80000c091ebc
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefddcd0 x1 : 0000000000000001 x0 : 000000000000006d
Call trace:
 __list_del_entry_valid+0xbc/0xd0 lib/list_debug.c:59
 __list_del_entry include/linux/list.h:134 [inline]
 list_del_init include/linux/list.h:206 [inline]
 xfs_trans_ail_cursor_done+0x24/0x58 fs/xfs/xfs_trans_ail.c:199
 xfs_trans_committed_bulk+0x41c/0x460 fs/xfs/xfs_trans.c:843
 xlog_cil_committed+0xcc/0x340 fs/xfs/xfs_log_cil.c:795
 xlog_cil_process_committed+0x6c/0xa8 fs/xfs/xfs_log_cil.c:823
 xlog_state_shutdown_callbacks+0xac/0x140 fs/xfs/xfs_log.c:538
 xlog_force_shutdown+0x1ac/0x230 fs/xfs/xfs_log.c:3821
 xlog_ioend_work+0x68/0xa0 fs/xfs/xfs_log.c:1402
 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
 worker_thread+0x340/0x610 kernel/workqueue.c:2436
 kthread+0x12c/0x158 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
Code: b001b740 91044000 aa0803e3 94aa89e7 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/01/04 21:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 1dac8c7a .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-gce-arm64 WARNING in call_rcu
2022/12/25 20:31 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 9da18ae8 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/05 13:01 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/05 05:19 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/05 00:25 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/04 05:00 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/03 19:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/03 17:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/03 15:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/03 15:26 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/03 12:10 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/03 11:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2023/01/02 23:54 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2022/12/29 11:56 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 44712fbc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
2022/12/25 20:22 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 9da18ae8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in call_rcu
* Struck through repros no longer work on HEAD.