BUG: spinlock bad magic in try_to_wake_up (2)

Status: moderation: reported on 2026/11/01 20:04
Subsystems: kernel
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+20a44f5c8dccaee411db@syzkaller.appspotmail.com
First crash: 4d02h, last: 4d02h
✨ AI-generated root cause summary:

A privileged process wrote user data into PCI configuration space via proc_bus_pci_write() and pci_user_write_config_dword(). Writing unconstrained values to PCI configuration registers (such as host bridge memory routing or BAR registers) corrupted memory routing, causing physical RAM at 0x60008000 to read as unmapped/open-bus all-ones (0xffffffff). When a timer interrupt fired and executed try_to_wake_up(), inspecting the corrupted task_struct pi_lock returned 0xffffffff, triggering 'spinlock bad magic' and an out-of-bounds per-CPU array access in qspinlock decode_tail(), resulting in system crash and memory corruption.

▶ ▼ ✨ Full AI root cause analysis
Based on kernel commit 65ba8f34ec88:

Root Cause Analysis

1. Functions, Structs, Fields, and Files Involved

2. Trigger Mechanism and Lifecycle Invariant Violation

  1. A privileged user (UID: 0) opens a PCI configuration space device file under /proc/bus/pci/BB/DD.F (e.g., fd 3) and issues a 142-byte write (RDX: 0x8e) via vfs_write() -> proc_reg_write() -> pde_write() -> proc_bus_pci_write().
  2. When kernel lockdown (LOCKDOWN_PCI_ACCESS) is inactive, proc_bus_pci_write() iterates over the user buffer and writes words/dwords into the device's PCI configuration space using pci_user_write_config_dword().
  3. In pci_user_write_config_dword(), raw_spin_lock_irq(&pci_lock) is acquired, and the user-supplied 32-bit values are written to device configuration registers (e.g., offset 0x60, corresponding to memory routing/BAR registers such as PCIEXBAR or bridge configuration).
  4. Writing arbitrary configuration values to a PCI host bridge or device reconfigures physical memory routing, mapping a PCI window or unmapped address space over physical DRAM at address 0x60008000 (direct map 0xffff888060008000).
  5. As a result, subsequent memory accesses to this range of DRAM do not reach RAM; instead, the PCI bus cycles terminate with master abort / unmapped response, returning open-bus all-ones (0xffffffff).

3. Runtime Consequences in a Production Kernel

  1. At the completion of pci_user_write_config_dword(), raw_spin_unlock_irq(&pci_lock) executes sti to re-enable local interrupts.
  2. The APIC timer interrupt (sysvec_apic_timer_interrupt) triggers immediately on CPU 0 and calls hrtimer_interrupt() -> hrtimer_wakeup() -> wake_up_process() -> try_to_wake_up().
  3. try_to_wake_up() attempts to acquire &p->pi_lock (located at 0xffff888060008a80, inside the task at 0xffff888060008000).
  4. Because the physical memory now returns all ones (0xffffffff):
    • In debug builds, debug_spin_lock_before() checks lock->magic (SPINLOCK_MAGIC 0xdead4ead) and discovers 0xffffffff, emitting BUG: spinlock bad magic.
    • In the queued spinlock path, qspinlock interprets 0xffffffff as a locked word with a tail. decode_tail(tail) computes the CPU index as cpu = (tail >> _Q_TAIL_CPU_OFFSET) - 1 = 16382.
    • decode_tail() indexes out-of-bounds of __per_cpu_offset, returning an out-of-bounds pointer into memory.
  5. In a production kernel (without lock debugging or UBSAN):
    • __pv_queued_spin_lock_slowpath() proceeds to access and write to the out-of-bounds MCS node pointer (node->locked, node->count, linked list pointers), causing out-of-bounds memory writes and corruption.
    • Any further dereference of corrupted memory in task_struct (such as p->state, pointers, stacks) induces general protection faults, kernel panics, or hangs.

4. Classification

  • MemoryCorruption: true — The out-of-bounds CPU index (cpu = 16382) computed from the corrupted lock word in decode_tail() results in an out-of-bounds pointer dereference and memory corruption in __pv_queued_spin_lock_slowpath(), in addition to physical memory corruption caused by remapping PCI configuration over RAM.
  • InfoLeak: "none" — No kernel memory contents are exposed or returned to userspace.
  • RawDenialOfService: true — Execution of timer interrupts against corrupted memory immediately crashes or panics the kernel.
  • IsNetCandidate: false — No networking stack or subsystem is involved.
  • IsKVMCandidate: false — The issue is in PCI procfs/access core routines; neither KVM nor virtualization interfaces are involved.
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
ef95c736 repro-c Reproduced: ✅ ❓ BUG: spinlock bad magic in try_to_wake_up (2) 2026/10/31 13:14 2026/10/31 13:14 2026/10/31 17:29 2041d3f8
876bc3ff assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ✅ MemoryCorruption: ✅ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: spinlock bad magic in try_to_wake_up (2) 2026/10/28 19:58 2026/10/28 19:58 2026/10/28 20:59 b1d00f76
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: spinlock bad magic in try_to_wake_up fs 4 1 2251d 2245d 0/29 auto-closed as invalid on 2020/12/30 23:34
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/31 17:30 15m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 36aad21d50d1af3f6954bb0c988257a908202477 no crash job log log

Sample crash report:
BUG: spinlock bad magic on CPU#0, syz.5.1087/9534
 lock: 0xffff888060008a80, .magic: ffffffff, .owner: <none>/-1, .owner_cpu: -1
CPU: 0 UID: 0 PID: 9534 Comm: syz.5.1087 Tainted: G             L       syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 spin_bug kernel/locking/spinlock_debug.c:78 [inline]
 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
 do_raw_spin_lock.cold+0x37/0x3c kernel/locking/spinlock_debug.c:115
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:156 [inline]
 _raw_spin_lock_irqsave+0x42/0x60 kernel/locking/spinlock.c:181
 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:594 [inline]
 try_to_wake_up+0xbd/0x1ca0 kernel/sched/core.c:4365
 hrtimer_wakeup+0x47/0x60 kernel/time/hrtimer.c:2331
 __run_hrtimer kernel/time/hrtimer.c:2075 [inline]
 __hrtimer_run_queues+0x448/0x9a0 kernel/time/hrtimer.c:2132
 hrtimer_interrupt+0x441/0xaa0 kernel/time/hrtimer.c:2251
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x109/0x470 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:220 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:229
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 0a a0 fa f5 48 89 df e8 92 f6 fa f5 e8 2d ed 27 f6 fb bf 01 00 00 00 <e8> f2 b9 e9 f5 65 48 83 3d 51 54 ca 09 00 74 06 5b e9 01 4d 00 00
RSP: 0018:ffffc90003427c28 EFLAGS: 00000202
RAX: 0000000000000213 RBX: ffffffff90cb9920 RCX: 0000000000000080
RDX: 0000000000000001 RSI: ffffffff8e6212d7 RDI: 0000000000000001
RBP: 0000000000000060 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024b5d000
R13: 0000000069727785 R14: ffffffff8be00000 R15: 000000000000002a
 pci_user_write_config_dword+0x150/0x230 drivers/pci/access.c:278
 proc_bus_pci_write+0x531/0x5e0 drivers/pci/proc.c:173
 pde_write fs/proc/inode.c:330 [inline]
 proc_reg_write+0x240/0x330 fs/proc/inode.c:342
 vfs_write+0x2aa/0x1050 fs/read_write.c:685
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4a3819f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4a3900a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4a38425fa0 RCX: 00007f4a3819f559
RDX: 000000000000008e RSI: 0000200000000140 RDI: 0000000000000003
RBP: 00007f4a38236b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4a38426038 R14: 00007f4a38425fa0 R15: 00007ffc1e640068
 </TASK>
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9
index 16382 is out of range for type 'long unsigned int [8]'
CPU: 0 UID: 0 PID: 9534 Comm: syz.5.1087 Tainted: G             L       syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
 decode_tail kernel/locking/qspinlock.h:68 [inline]
 __pv_queued_spin_lock_slowpath+0xbd7/0xc00 kernel/locking/qspinlock.c:307
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:37 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:71 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:115 [inline]
 do_raw_spin_lock+0x1e0/0x260 kernel/locking/spinlock_debug.c:116
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:156 [inline]
 _raw_spin_lock_irqsave+0x42/0x60 kernel/locking/spinlock.c:181
 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:594 [inline]
 try_to_wake_up+0xbd/0x1ca0 kernel/sched/core.c:4365
 hrtimer_wakeup+0x47/0x60 kernel/time/hrtimer.c:2331
 __run_hrtimer kernel/time/hrtimer.c:2075 [inline]
 __hrtimer_run_queues+0x448/0x9a0 kernel/time/hrtimer.c:2132
 hrtimer_interrupt+0x441/0xaa0 kernel/time/hrtimer.c:2251
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x109/0x470 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:220 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:229
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 0a a0 fa f5 48 89 df e8 92 f6 fa f5 e8 2d ed 27 f6 fb bf 01 00 00 00 <e8> f2 b9 e9 f5 65 48 83 3d 51 54 ca 09 00 74 06 5b e9 01 4d 00 00
RSP: 0018:ffffc90003427c28 EFLAGS: 00000202
RAX: 0000000000000213 RBX: ffffffff90cb9920 RCX: 0000000000000080
RDX: 0000000000000001 RSI: ffffffff8e6212d7 RDI: 0000000000000001
RBP: 0000000000000060 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024b5d000
R13: 0000000069727785 R14: ffffffff8be00000 R15: 000000000000002a
 pci_user_write_config_dword+0x150/0x230 drivers/pci/access.c:278
 proc_bus_pci_write+0x531/0x5e0 drivers/pci/proc.c:173
 pde_write fs/proc/inode.c:330 [inline]
 proc_reg_write+0x240/0x330 fs/proc/inode.c:342
 vfs_write+0x2aa/0x1050 fs/read_write.c:685
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4a3819f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4a3900a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4a38425fa0 RCX: 00007f4a3819f559
RDX: 000000000000008e RSI: 0000200000000140 RDI: 0000000000000003
RBP: 00007f4a38236b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4a38426038 R14: 00007f4a38425fa0 R15: 00007ffc1e640068
 </TASK>
---[ end trace ]---
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	f3 0f 1e fa          	endbr64
   5:	53                   	push   %rbx
   6:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	48 83 c7 18          	add    $0x18,%rdi
  12:	e8 0a a0 fa f5       	call   0xf5faa021
  17:	48 89 df             	mov    %rbx,%rdi
  1a:	e8 92 f6 fa f5       	call   0xf5faf6b1
  1f:	e8 2d ed 27 f6       	call   0xf627ed51
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 f2 b9 e9 f5       	call   0xf5e9ba21 <-- trapping instruction
  2f:	65 48 83 3d 51 54 ca 	cmpq   $0x0,%gs:0x9ca5451(%rip)        # 0x9ca5489
  36:	09 00
  38:	74 06                	je     0x40
  3a:	5b                   	pop    %rbx
  3b:	e9 01 4d 00 00       	jmp    0x4d41

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/28 19:58 upstream 65ba8f34ec88 858db2ec .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: spinlock bad magic in try_to_wake_up
* Struck through repros no longer work on HEAD.