syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20 stub_timer() is installed as timer callback function in hrtimer_fixup_assert_init(), which is invoked when debug_object_assert_init() can't find a shadow object. In that case debug objects emits a warning about it before invoking the fixup. Though the provided console log lacks this warning and instead has the following a few seconds before the splat: ODEBUG: Out of memory. ODEBUG disabled So the object was looked up in debug_object_assert_init() and the lookup failed due a concurrent out of memory situation which disabled debug objects and freed the shadow objects: debug_object_assert_init() if (!debug_objects_enabled) return; obj = alloc(); if (!obj) { // Out of memory debug_objects_enabled = false; free_objects(); obj = lookup_or_alloc(); // The lookup failed because the other side // removed the objects, so this returns // an error code as the object in question // is not statically initialized if (!IS_ERR_OR_NULL(obj)) return; if (!obj) { debug_oom(); return; } print(...) if (!debug_objects_enabled) return; fixup(...) The debug object splat is skipped because debug_objects_enabled is false, but the fixup callback is invoked unconditionally, which makes the timer disfunctional. This is only a problem in debug_object_assert_init() and debug_object_activate() as both have to handle statically initialized objects and therefore must handle the error pointer return case gracefully. All other places only handle the found/not found case and the NULL pointer return is a signal for OOM. Otherwise they get a valid shadow object. Plug the hole by checking whether debug objects are still enabled before invoking the print and fixup function in those two places.
Showing the changes to lib/debugobjects.c (1 of 1 file). Show all
Unified · Split
| @@ -894,6 +894,14 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr) · 893 unmodified lines | ||
| 894 | 894 | } |
| 895 | 895 | |
| 896 | 896 | raw_spin_unlock_irqrestore(&db->lock, flags); |
| 897 | + | |
| 898 | + /* | |
| 899 | + * lookup_object_or_alloc() might have raced with a concurrent | |
| 900 | + * allocation failure which disabled debug objects. | |
| 901 | + */ | |
| 902 | + if (!debug_objects_enabled) | |
| 903 | + return 0; | |
| 904 | + | |
| 897 | 905 | debug_print_object(&o, "activate"); |
| 898 | 906 | |
| 899 | 907 | switch (o.state) { |
| @@ -1071,6 +1079,15 @@ void debug_object_assert_init(void *addr, const struct debug_obj_descr *descr) · 171 unmodified lines | ||
| 1071 | 1079 | return; |
| 1072 | 1080 | } |
| 1073 | 1081 | |
| 1082 | + /* | |
| 1083 | + * lookup_object_or_alloc() might have raced with a concurrent | |
| 1084 | + * allocation failure which disabled debug objects. Don't run the fixup | |
| 1085 | + * as it might turn a valid object useless. See for example | |
| 1086 | + * hrtimer_fixup_assert_init(). | |
| 1087 | + */ | |
| 1088 | + if (!debug_objects_enabled) | |
| 1089 | + return; | |
| 1090 | + | |
| 1074 | 1091 | /* Object is neither tracked nor static. It's not initialized. */ |
| 1075 | 1092 | debug_print_object(&o, "assert_init"); |
| 1076 | 1093 | debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE); |