* [syzbot] [serial?] possible deadlock in console_lock_spinning_enable (5)
@ 2024-08-17 16:39 syzbot
2024-10-03 20:37 ` [syzbot] [cgroups?] " syzbot
2025-01-17 12:34 ` syzbot
0 siblings, 2 replies; 6+ messages in thread
From: syzbot @ 2024-08-17 16:39 UTC (permalink / raw)
To: gregkh, jirislaby, linux-kernel, linux-serial, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 8867bbd4a056 mm: arm64: Fix the out-of-bounds issue in con..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=11626d7d980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc88a9f65787e86
dashboard link: https://syzkaller.appspot.com/bug?extid=622acb507894a48b2ce9
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5ef30d34e749/disk-8867bbd4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a21c2389ebfb/vmlinux-8867bbd4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9720b12c3f99/Image-8867bbd4.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+622acb507894a48b2ce9@syzkaller.appspotmail.com
sp0: Synchronizing with TNC
------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
6.10.0-rc2-syzkaller-g8867bbd4a056 #0 Tainted: G W
------------------------------------------------------
syz.2.1398/12737 is trying to acquire lock:
ffff80008f58d020 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x88/0xec kernel/printk/printk.c:1866
but task is already holding lock:
ffff800094049db8 (&port_lock_key){-.-.}-{2:2}, at: uart_port_lock_irqsave include/linux/serial_core.h:618 [inline]
ffff800094049db8 (&port_lock_key){-.-.}-{2:2}, at: uart_write+0x114/0x2ec drivers/tty/serial/serial_core.c:624
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&port_lock_key){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
uart_port_lock_irqsave include/linux/serial_core.h:618 [inline]
pl011_console_write+0x148/0x724 drivers/tty/serial/amba-pl011.c:2316
console_emit_next_record kernel/printk/printk.c:2928 [inline]
console_flush_all+0x5cc/0xb74 kernel/printk/printk.c:2994
console_unlock+0xec/0x3d4 kernel/printk/printk.c:3063
vprintk_emit+0x1ec/0x350 kernel/printk/printk.c:2345
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2360
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2370
register_console+0x700/0xa8c kernel/printk/printk.c:3596
uart_configure_port drivers/tty/serial/serial_core.c:2664 [inline]
serial_core_add_one_port drivers/tty/serial/serial_core.c:3192 [inline]
serial_core_register_port+0x1428/0x1bf4 drivers/tty/serial/serial_core.c:3429
serial_ctrl_register_port+0x28/0x38 drivers/tty/serial/serial_ctrl.c:41
uart_add_one_port+0x28/0x38 drivers/tty/serial/serial_port.c:136
pl011_register_port+0x1b4/0x44c drivers/tty/serial/amba-pl011.c:2744
sbsa_uart_probe+0x488/0x608 drivers/tty/serial/amba-pl011.c:2914
platform_probe+0x148/0x1c0 drivers/base/platform.c:1404
really_probe+0x38c/0x8fc drivers/base/dd.c:656
__driver_probe_device+0x194/0x374 drivers/base/dd.c:798
driver_probe_device+0x78/0x330 drivers/base/dd.c:828
__device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:956
bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:457
__device_attach+0x2b4/0x434 drivers/base/dd.c:1028
device_initial_probe+0x24/0x34 drivers/base/dd.c:1077
bus_probe_device+0x178/0x240 drivers/base/bus.c:532
device_add+0x728/0xa6c drivers/base/core.c:3721
platform_device_add+0x3e8/0x6e8 drivers/base/platform.c:716
platform_device_register_full+0x4ec/0x604 drivers/base/platform.c:844
acpi_create_platform_device+0x5bc/0x744 drivers/acpi/acpi_platform.c:177
acpi_default_enumeration+0x6c/0xdc drivers/acpi/scan.c:2184
acpi_bus_attach+0x8b8/0xaa8 drivers/acpi/scan.c:2293
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1143
device_for_each_child+0xec/0x174 drivers/base/core.c:4050
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1155
acpi_bus_attach+0x358/0xaa8 drivers/acpi/scan.c:2298
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1143
device_for_each_child+0xec/0x174 drivers/base/core.c:4050
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1155
acpi_bus_attach+0x358/0xaa8 drivers/acpi/scan.c:2298
acpi_bus_scan+0x118/0x4f0 drivers/acpi/scan.c:2579
acpi_scan_init+0x214/0x6b0 drivers/acpi/scan.c:2714
acpi_init+0x190/0x254 drivers/acpi/bus.c:1460
do_one_initcall+0x254/0x9e4 init/main.c:1267
do_initcall_level+0x154/0x214 init/main.c:1329
do_initcalls+0x58/0xac init/main.c:1345
do_basic_setup+0x8c/0xa0 init/main.c:1364
kernel_init_freeable+0x324/0x478 init/main.c:1578
kernel_init+0x24/0x2a0 init/main.c:1467
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
-> #0 (console_owner){-.-.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x3384/0x763c kernel/locking/lockdep.c:5137
lock_acquire+0x248/0x73c kernel/locking/lockdep.c:5754
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1870
console_emit_next_record kernel/printk/printk.c:2922 [inline]
console_flush_all+0x58c/0xb74 kernel/printk/printk.c:2994
console_unlock+0xec/0x3d4 kernel/printk/printk.c:3063
vprintk_emit+0x1ec/0x350 kernel/printk/printk.c:2345
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2360
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2370
__report_bug lib/bug.c:195 [inline]
report_bug+0x3b8/0x5b0 lib/bug.c:219
bug_handler+0x50/0x1fc arch/arm64/kernel/traps.c:978
call_break_hook arch/arm64/kernel/debug-monitors.c:321 [inline]
brk_handler+0x17c/0x2e0 arch/arm64/kernel/debug-monitors.c:328
do_debug_exception+0x1e4/0x398 arch/arm64/mm/fault.c:909
el1_dbg+0x64/0x80 arch/arm64/kernel/entry-common.c:472
el1h_64_sync_handler+0x40/0xac arch/arm64/kernel/entry-common.c:512
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:593
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:669 [inline]
uart_write+0x280/0x2ec drivers/tty/serial/serial_core.c:626
tnc_init drivers/net/hamradio/6pack.c:531 [inline]
sixpack_open+0x5d8/0x8b0 drivers/net/hamradio/6pack.c:628
tty_ldisc_open+0x9c/0x14c drivers/tty/tty_ldisc.c:432
tty_set_ldisc+0x2f8/0x4e0 drivers/tty/tty_ldisc.c:563
tiocsetd+0x100/0x13c drivers/tty/tty_io.c:2439
tty_ioctl+0xba0/0xd8c drivers/tty/tty_io.c:2739
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&port_lock_key);
lock(console_owner);
lock(&port_lock_key);
lock(console_owner);
*** DEADLOCK ***
5 locks held by syz.2.1398/12737:
#0: ffff0000ed2011c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_lock+0x78/0xc8 drivers/tty/tty_mutex.c:18
#1: ffff0000ed2010a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_write+0x3c/0x4c drivers/tty/tty_ldsem.c:366
#2: ffff800094049db8 (&port_lock_key){-.-.}-{2:2}, at: uart_port_lock_irqsave include/linux/serial_core.h:618 [inline]
#2: ffff800094049db8 (&port_lock_key){-.-.}-{2:2}, at: uart_write+0x114/0x2ec drivers/tty/serial/serial_core.c:624
#3: ffff80008f474940 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x1d0/0x350 kernel/printk/printk.c:2344
#4: ffff80008f474570 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire+0x10/0x4c include/linux/rcupdate.h:333
stack backtrace:
CPU: 0 PID: 12737 Comm: syz.2.1398 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:317
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:114
dump_stack+0x1c/0x28 lib/dump_stack.c:123
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2060
check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x3384/0x763c kernel/locking/lockdep.c:5137
lock_acquire+0x248/0x73c kernel/locking/lockdep.c:5754
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1870
console_emit_next_record kernel/printk/printk.c:2922 [inline]
console_flush_all+0x58c/0xb74 kernel/printk/printk.c:2994
console_unlock+0xec/0x3d4 kernel/printk/printk.c:3063
vprintk_emit+0x1ec/0x350 kernel/printk/printk.c:2345
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2360
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2370
__report_bug lib/bug.c:195 [inline]
report_bug+0x3b8/0x5b0 lib/bug.c:219
bug_handler+0x50/0x1fc arch/arm64/kernel/traps.c:978
call_break_hook arch/arm64/kernel/debug-monitors.c:321 [inline]
brk_handler+0x17c/0x2e0 arch/arm64/kernel/debug-monitors.c:328
do_debug_exception+0x1e4/0x398 arch/arm64/mm/fault.c:909
el1_dbg+0x64/0x80 arch/arm64/kernel/entry-common.c:472
el1h_64_sync_handler+0x40/0xac arch/arm64/kernel/entry-common.c:512
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:593
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:669 [inline]
uart_write+0x280/0x2ec drivers/tty/serial/serial_core.c:626
tnc_init drivers/net/hamradio/6pack.c:531 [inline]
sixpack_open+0x5d8/0x8b0 drivers/net/hamradio/6pack.c:628
tty_ldisc_open+0x9c/0x14c drivers/tty/tty_ldisc.c:432
tty_set_ldisc+0x2f8/0x4e0 drivers/tty/tty_ldisc.c:563
tiocsetd+0x100/0x13c drivers/tty/tty_io.c:2439
tty_ioctl+0xba0/0xd8c drivers/tty/tty_io.c:2739
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
WARNING: CPU: 0 PID: 12737 at drivers/tty/serial/serial_core.c:625 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
WARNING: CPU: 0 PID: 12737 at drivers/tty/serial/serial_core.c:625 uart_port_unlock_irqrestore include/linux/serial_core.h:669 [inline]
WARNING: CPU: 0 PID: 12737 at drivers/tty/serial/serial_core.c:625 uart_write+0x280/0x2ec drivers/tty/serial/serial_core.c:626
Modules linked in:
CPU: 0 PID: 12737 Comm: syz.2.1398 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : uart_write+0x280/0x2ec include/linux/spinlock.h:406
lr : uart_write+0x278/0x2ec drivers/tty/serial/serial_core.c:625
sp : ffff800097fc7ad0
x29: ffff800097fc7ad0 x28: 1ffff00012ff8f68 x27: dfff800000000000
x26: 0000000000000001 x25: dfff800000000000 x24: ffff0000c9708f48
x23: 0000000000000000 x22: ffff800094049da0 x21: ffff800097fc7b60
x20: 0000000000000001 x19: ffff0000c9708be8 x18: ffff800097fc7780
x17: 00000000000411dd x16: ffff8000803514ec x15: ffff700012ff8f40
x14: 1ffff00012ff8f40 x13: 0000000000000004 x12: ffffffffffffffff
x11: 0000000000040000 x10: 000000000001f74c x9 : ffff8000ab01c000
x8 : 000000000001f74d x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff80008035161c
x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff800094049da0
Call trace:
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:669 [inline]
uart_write+0x280/0x2ec drivers/tty/serial/serial_core.c:626
tnc_init drivers/net/hamradio/6pack.c:531 [inline]
sixpack_open+0x5d8/0x8b0 drivers/net/hamradio/6pack.c:628
tty_ldisc_open+0x9c/0x14c drivers/tty/tty_ldisc.c:432
tty_set_ldisc+0x2f8/0x4e0 drivers/tty/tty_ldisc.c:563
tiocsetd+0x100/0x13c drivers/tty/tty_io.c:2439
tty_ioctl+0xba0/0xd8c drivers/tty/tty_io.c:2739
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
irq event stamp: 1952
hardirqs last enabled at (1951): [<ffff8000803794d8>] __up_console_sem kernel/printk/printk.c:341 [inline]
hardirqs last enabled at (1951): [<ffff8000803794d8>] __console_unlock kernel/printk/printk.c:2746 [inline]
hardirqs last enabled at (1951): [<ffff8000803794d8>] console_unlock+0x17c/0x3d4 kernel/printk/printk.c:3065
hardirqs last disabled at (1952): [<ffff80008b2f9ba8>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (1952): [<ffff80008b2f9ba8>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162
softirqs last enabled at (1800): [<ffff8000893ef2dc>] neigh_parms_alloc+0x330/0x464 net/core/neighbour.c:1738
softirqs last disabled at (1798): [<ffff8000893ef230>] neigh_parms_alloc+0x284/0x464 net/core/neighbour.c:1736
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [cgroups?] possible deadlock in console_lock_spinning_enable (5)
2024-08-17 16:39 [syzbot] [serial?] possible deadlock in console_lock_spinning_enable (5) syzbot
@ 2024-10-03 20:37 ` syzbot
2025-01-22 10:35 ` Hillf Danton
2025-01-17 12:34 ` syzbot
1 sibling, 1 reply; 6+ messages in thread
From: syzbot @ 2024-10-03 20:37 UTC (permalink / raw)
To: cgroups, gregkh, jirislaby, len.brown, linux-kernel, linux-pm,
linux-serial, pavel, rafael, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 5f5673607153 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1237cb9f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=dedbcb1ff4387972
dashboard link: https://syzkaller.appspot.com/bug?extid=622acb507894a48b2ce9
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1637cb9f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17f0f580580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/40172aed5414/disk-5f567360.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/58372f305e9d/vmlinux-5f567360.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d2aae6fa798f/Image-5f567360.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/de597512c7c3/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+622acb507894a48b2ce9@syzkaller.appspotmail.com
------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted
------------------------------------------------------
kworker/0:2/5992 is trying to acquire lock:
ffff80008f7436e0 (console_owner){....}-{0:0}, at: console_lock_spinning_enable+0x88/0xec kernel/printk/printk.c:1869
but task is already holding lock:
ffff0001b36ade18 (&pool->lock){-.-.}-{2:2}, at: start_flush_work kernel/workqueue.c:4125 [inline]
ffff0001b36ade18 (&pool->lock){-.-.}-{2:2}, at: __flush_work+0x178/0x954 kernel/workqueue.c:4176
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&pool->lock){-.-.}-{2:2}:
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154
__queue_work+0x8b0/0x1308
queue_work_on+0xe0/0x1a0 kernel/workqueue.c:2392
queue_work include/linux/workqueue.h:621 [inline]
rpm_suspend+0xc20/0x1470 drivers/base/power/runtime.c:662
rpm_idle+0x570/0x8c0 drivers/base/power/runtime.c:536
__pm_runtime_idle+0x114/0x1d4 drivers/base/power/runtime.c:1104
pm_runtime_put include/linux/pm_runtime.h:448 [inline]
__device_attach+0x34c/0x434 drivers/base/dd.c:1047
device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
bus_probe_device+0x178/0x240 drivers/base/bus.c:532
device_add+0x728/0xa6c drivers/base/core.c:3682
serial_base_port_add+0x25c/0x370 drivers/tty/serial/serial_base_bus.c:179
serial_core_port_device_add drivers/tty/serial/serial_core.c:3388 [inline]
serial_core_register_port+0x2fc/0x1bf4 drivers/tty/serial/serial_core.c:3429
serial_ctrl_register_port+0x28/0x38 drivers/tty/serial/serial_ctrl.c:41
uart_add_one_port+0x28/0x38 drivers/tty/serial/serial_port.c:143
pl011_register_port+0x1b4/0x44c drivers/tty/serial/amba-pl011.c:2744
sbsa_uart_probe+0x488/0x608 drivers/tty/serial/amba-pl011.c:2914
platform_probe+0x148/0x1c0 drivers/base/platform.c:1404
really_probe+0x38c/0x8fc drivers/base/dd.c:657
__driver_probe_device+0x194/0x374 drivers/base/dd.c:799
driver_probe_device+0x78/0x330 drivers/base/dd.c:829
__device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:957
bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:457
__device_attach+0x2b4/0x434 drivers/base/dd.c:1029
device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
bus_probe_device+0x178/0x240 drivers/base/bus.c:532
device_add+0x728/0xa6c drivers/base/core.c:3682
platform_device_add+0x3e8/0x6e8 drivers/base/platform.c:716
platform_device_register_full+0x4f0/0x608 drivers/base/platform.c:844
acpi_create_platform_device+0x5bc/0x744 drivers/acpi/acpi_platform.c:177
acpi_default_enumeration+0x6c/0xdc drivers/acpi/scan.c:2193
acpi_bus_attach+0x804/0xad4 drivers/acpi/scan.c:2304
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1145
device_for_each_child+0xec/0x174 drivers/base/core.c:4011
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1157
acpi_bus_attach+0x868/0xad4 drivers/acpi/scan.c:2309
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1145
device_for_each_child+0xec/0x174 drivers/base/core.c:4011
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1157
acpi_bus_attach+0x868/0xad4 drivers/acpi/scan.c:2309
acpi_bus_scan+0x118/0x4f0 drivers/acpi/scan.c:2590
acpi_scan_init+0x214/0x6b0 drivers/acpi/scan.c:2727
acpi_init+0x190/0x254 drivers/acpi/bus.c:1462
do_one_initcall+0x24c/0x9c0 init/main.c:1267
do_initcall_level+0x154/0x214 init/main.c:1329
do_initcalls+0x58/0xac init/main.c:1345
do_basic_setup+0x8c/0xa0 init/main.c:1364
kernel_init_freeable+0x324/0x478 init/main.c:1578
kernel_init+0x24/0x2a0 init/main.c:1467
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
-> #2 (&dev->power.lock){-...}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
__pm_runtime_resume+0xf0/0x180 drivers/base/power/runtime.c:1171
pm_runtime_get include/linux/pm_runtime.h:396 [inline]
__uart_start+0x154/0x3d8 drivers/tty/serial/serial_core.c:148
uart_write+0x154/0x374 drivers/tty/serial/serial_core.c:633
process_output_block drivers/tty/n_tty.c:574 [inline]
n_tty_write+0xaec/0xed0 drivers/tty/n_tty.c:2389
iterate_tty_write drivers/tty/tty_io.c:1021 [inline]
file_tty_write+0x410/0x7b8 drivers/tty/tty_io.c:1096
tty_write drivers/tty/tty_io.c:1117 [inline]
redirected_tty_write+0xac/0x14c drivers/tty/tty_io.c:1140
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0x940/0xc80 fs/read_write.c:590
ksys_write+0x15c/0x26c fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:652
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
-> #1 (&port_lock_key){....}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
uart_port_lock_irqsave include/linux/serial_core.h:618 [inline]
pl011_console_write+0x148/0x724 drivers/tty/serial/amba-pl011.c:2316
console_emit_next_record kernel/printk/printk.c:2983 [inline]
console_flush_all+0x570/0xafc kernel/printk/printk.c:3049
console_unlock+0xfc/0x3d4 kernel/printk/printk.c:3118
vprintk_emit+0x224/0x3a4 kernel/printk/printk.c:2348
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2363
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2373
register_console+0x6e8/0xa74 kernel/printk/printk.c:3654
uart_configure_port drivers/tty/serial/serial_core.c:2672 [inline]
serial_core_add_one_port drivers/tty/serial/serial_core.c:3200 [inline]
serial_core_register_port+0x1428/0x1bf4 drivers/tty/serial/serial_core.c:3437
serial_ctrl_register_port+0x28/0x38 drivers/tty/serial/serial_ctrl.c:41
uart_add_one_port+0x28/0x38 drivers/tty/serial/serial_port.c:143
pl011_register_port+0x1b4/0x44c drivers/tty/serial/amba-pl011.c:2744
sbsa_uart_probe+0x488/0x608 drivers/tty/serial/amba-pl011.c:2914
platform_probe+0x148/0x1c0 drivers/base/platform.c:1404
really_probe+0x38c/0x8fc drivers/base/dd.c:657
__driver_probe_device+0x194/0x374 drivers/base/dd.c:799
driver_probe_device+0x78/0x330 drivers/base/dd.c:829
__device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:957
bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:457
__device_attach+0x2b4/0x434 drivers/base/dd.c:1029
device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
bus_probe_device+0x178/0x240 drivers/base/bus.c:532
device_add+0x728/0xa6c drivers/base/core.c:3682
platform_device_add+0x3e8/0x6e8 drivers/base/platform.c:716
platform_device_register_full+0x4f0/0x608 drivers/base/platform.c:844
acpi_create_platform_device+0x5bc/0x744 drivers/acpi/acpi_platform.c:177
acpi_default_enumeration+0x6c/0xdc drivers/acpi/scan.c:2193
acpi_bus_attach+0x804/0xad4 drivers/acpi/scan.c:2304
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1145
device_for_each_child+0xec/0x174 drivers/base/core.c:4011
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1157
acpi_bus_attach+0x868/0xad4 drivers/acpi/scan.c:2309
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1145
device_for_each_child+0xec/0x174 drivers/base/core.c:4011
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1157
acpi_bus_attach+0x868/0xad4 drivers/acpi/scan.c:2309
acpi_bus_scan+0x118/0x4f0 drivers/acpi/scan.c:2590
acpi_scan_init+0x214/0x6b0 drivers/acpi/scan.c:2727
acpi_init+0x190/0x254 drivers/acpi/bus.c:1462
do_one_initcall+0x24c/0x9c0 init/main.c:1267
do_initcall_level+0x154/0x214 init/main.c:1329
do_initcalls+0x58/0xac init/main.c:1345
do_basic_setup+0x8c/0xa0 init/main.c:1364
kernel_init_freeable+0x324/0x478 init/main.c:1578
kernel_init+0x24/0x2a0 init/main.c:1467
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
-> #0 (console_owner){....}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x33d8/0x779c kernel/locking/lockdep.c:5142
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1873
console_emit_next_record kernel/printk/printk.c:2977 [inline]
console_flush_all+0x53c/0xafc kernel/printk/printk.c:3049
console_unlock+0xfc/0x3d4 kernel/printk/printk.c:3118
vprintk_emit+0x224/0x3a4 kernel/printk/printk.c:2348
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2363
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2373
__warn_printk+0x27c/0x484 kernel/panic.c:785
check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
start_flush_work kernel/workqueue.c:4139 [inline]
__flush_work+0x21c/0x954 kernel/workqueue.c:4176
flush_work kernel/workqueue.c:4233 [inline]
flush_delayed_work+0xcc/0xf8 kernel/workqueue.c:4255
hfs_file_fsync+0xec/0x148 fs/hfs/inode.c:681
vfs_fsync_range+0x168/0x188 fs/sync.c:188
generic_write_sync include/linux/fs.h:2822 [inline]
dio_complete+0x4f0/0x65c fs/direct-io.c:314
dio_aio_complete_work+0x28/0x38 fs/direct-io.c:326
process_one_work+0x79c/0x15b8 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x978/0xec4 kernel/workqueue.c:3389
kthread+0x288/0x310 kernel/kthread.c:389
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
other info that might help us debug this:
Chain exists of:
console_owner --> &dev->power.lock --> &pool->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&pool->lock);
lock(&dev->power.lock);
lock(&pool->lock);
lock(console_owner);
*** DEADLOCK ***
7 locks held by kworker/0:2/5992:
#0: ffff0000cc19e148 ((wq_completion)dio/loop0){+.+.}-{0:0}, at: process_one_work+0x624/0x15b8 kernel/workqueue.c:3205
#1: ffff8000a2e57c20 ((work_completion)(&dio->complete_work)){+.+.}-{0:0}, at: process_one_work+0x6a0/0x15b8 kernel/workqueue.c:3205
#2: ffff0000c5989620 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:800 [inline]
#2: ffff0000c5989620 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: hfs_file_fsync+0xa0/0x148 fs/hfs/inode.c:674
#3: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325
#4: ffff0001b36ade18 (&pool->lock){-.-.}-{2:2}, at: start_flush_work kernel/workqueue.c:4125 [inline]
#4: ffff0001b36ade18 (&pool->lock){-.-.}-{2:2}, at: __flush_work+0x178/0x954 kernel/workqueue.c:4176
#5: ffff80008f62b000 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x208/0x3a4 kernel/printk/printk.c:2347
#6: ffff80008f62ac30 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire+0x10/0x4c include/linux/rcupdate.h:330
stack backtrace:
CPU: 0 UID: 0 PID: 5992 Comm: kworker/0:2 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: dio/loop0 dio_aio_complete_work
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
dump_stack+0x1c/0x28 lib/dump_stack.c:128
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2059
check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x33d8/0x779c kernel/locking/lockdep.c:5142
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1873
console_emit_next_record kernel/printk/printk.c:2977 [inline]
console_flush_all+0x53c/0xafc kernel/printk/printk.c:3049
console_unlock+0xfc/0x3d4 kernel/printk/printk.c:3118
vprintk_emit+0x224/0x3a4 kernel/printk/printk.c:2348
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2363
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2373
__warn_printk+0x27c/0x484 kernel/panic.c:785
check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
start_flush_work kernel/workqueue.c:4139 [inline]
__flush_work+0x21c/0x954 kernel/workqueue.c:4176
flush_work kernel/workqueue.c:4233 [inline]
flush_delayed_work+0xcc/0xf8 kernel/workqueue.c:4255
hfs_file_fsync+0xec/0x148 fs/hfs/inode.c:681
vfs_fsync_range+0x168/0x188 fs/sync.c:188
generic_write_sync include/linux/fs.h:2822 [inline]
dio_complete+0x4f0/0x65c fs/direct-io.c:314
dio_aio_complete_work+0x28/0x38 fs/direct-io.c:326
process_one_work+0x79c/0x15b8 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x978/0xec4 kernel/workqueue.c:3389
kthread+0x288/0x310 kernel/kthread.c:389
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
workqueue: WQ_MEM_RECLAIM dio/loop0:dio_aio_complete_work is flushing !WQ_MEM_RECLAIM events_long:flush_mdb
WARNING: CPU: 0 PID: 5992 at kernel/workqueue.c:3706 check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
Modules linked in:
CPU: 0 UID: 0 PID: 5992 Comm: kworker/0:2 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: dio/loop0 dio_aio_complete_work
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
lr : check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
sp : ffff8000a2e57790
x29: ffff8000a2e57790 x28: 0000000000000000 x27: 1fffe0001858492b
x26: 0000000000000000 x25: ffff8000927b6000 x24: ffff0000cc19e000
x23: dfff800000000000 x22: ffff0000d12a2e18 x21: ffff0000cc19e170
x20: ffff800081211778 x19: ffff0000c0029000 x18: 0000000000000008
x17: 0000000000000000 x16: ffff800083032784 x15: 0000000000000001
x14: 1fffe000366d325a x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000003 x10: 0000000000ff0100 x9 : 9770cdebfc84a400
x8 : 9770cdebfc84a400 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000a2e56ed8 x4 : ffff80008f65b620 x3 : ffff8000806051a0
x2 : 0000000000000001 x1 : 0000000100000001 x0 : 0000000000000000
Call trace:
check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
start_flush_work kernel/workqueue.c:4139 [inline]
__flush_work+0x21c/0x954 kernel/workqueue.c:4176
flush_work kernel/workqueue.c:4233 [inline]
flush_delayed_work+0xcc/0xf8 kernel/workqueue.c:4255
hfs_file_fsync+0xec/0x148 fs/hfs/inode.c:681
vfs_fsync_range+0x168/0x188 fs/sync.c:188
generic_write_sync include/linux/fs.h:2822 [inline]
dio_complete+0x4f0/0x65c fs/direct-io.c:314
dio_aio_complete_work+0x28/0x38 fs/direct-io.c:326
process_one_work+0x79c/0x15b8 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x978/0xec4 kernel/workqueue.c:3389
kthread+0x288/0x310 kernel/kthread.c:389
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 73714
hardirqs last enabled at (73713): [<ffff80008b3388f8>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
hardirqs last enabled at (73713): [<ffff80008b3388f8>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
hardirqs last disabled at (73714): [<ffff80008b42e1b4>] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:117 [inline]
hardirqs last disabled at (73714): [<ffff80008b42e1b4>] _raw_spin_lock_irq+0x28/0x70 kernel/locking/spinlock.c:170
softirqs last enabled at (73712): [<ffff8000801f8e88>] softirq_handle_end kernel/softirq.c:400 [inline]
softirqs last enabled at (73712): [<ffff8000801f8e88>] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582
softirqs last disabled at (73693): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588
---[ end trace 0000000000000000 ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [cgroups?] possible deadlock in console_lock_spinning_enable (5)
2024-08-17 16:39 [syzbot] [serial?] possible deadlock in console_lock_spinning_enable (5) syzbot
2024-10-03 20:37 ` [syzbot] [cgroups?] " syzbot
@ 2025-01-17 12:34 ` syzbot
2025-01-21 18:29 ` Michal Koutný
1 sibling, 1 reply; 6+ messages in thread
From: syzbot @ 2025-01-17 12:34 UTC (permalink / raw)
To: andrii, ast, bpf, cgroups, daniel, davem, elic, gregkh, hannes,
hawk, jasowang, jirislaby, john.fastabend, kafai, kpsingh, kuba,
len.brown, linux-kernel, linux-pm, linux-serial, mingo, mkoutny,
mst, netdev, parav, pavel, rafael, rostedt, songliubraving,
syzkaller-bugs, tj, yhs
syzbot has bisected this issue to:
commit bc0d90ee021f1baecd6aaa010d787eb373aa74dd
Author: Parav Pandit <parav@nvidia.com>
Date: Tue Jan 5 10:32:02 2021 +0000
vdpa: Enable user to query vdpa device info
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1440c2b0580000
start commit: 619f0b6fad52 Merge tag 'seccomp-v6.13-rc8' of git://git.ke..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=1640c2b0580000
console output: https://syzkaller.appspot.com/x/log.txt?x=1240c2b0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d1cb4a1f148c0861
dashboard link: https://syzkaller.appspot.com/bug?extid=622acb507894a48b2ce9
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=175029df980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f29a18580000
Reported-by: syzbot+622acb507894a48b2ce9@syzkaller.appspotmail.com
Fixes: bc0d90ee021f ("vdpa: Enable user to query vdpa device info")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [cgroups?] possible deadlock in console_lock_spinning_enable (5)
2025-01-17 12:34 ` syzbot
@ 2025-01-21 18:29 ` Michal Koutný
0 siblings, 0 replies; 6+ messages in thread
From: Michal Koutný @ 2025-01-21 18:29 UTC (permalink / raw)
To: syzbot
Cc: andrii, ast, bpf, cgroups, daniel, davem, elic, gregkh, hannes,
hawk, jasowang, jirislaby, john.fastabend, kafai, kpsingh, kuba,
len.brown, linux-kernel, linux-pm, linux-serial, mingo, mst,
netdev, parav, pavel, rafael, rostedt, songliubraving,
syzkaller-bugs, tj, yhs
[-- Attachment #1: Type: text/plain, Size: 802 bytes --]
On Fri, Jan 17, 2025 at 04:34:03AM -0800, syzbot <syzbot+622acb507894a48b2ce9@syzkaller.appspotmail.com> wrote:
> syzbot has bisected this issue to:
>
> commit bc0d90ee021f1baecd6aaa010d787eb373aa74dd
> Author: Parav Pandit <parav@nvidia.com>
> Date: Tue Jan 5 10:32:02 2021 +0000
>
> vdpa: Enable user to query vdpa device info
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1440c2b0580000
syzbot got this somehow wrong, it started with the lockdep bug but then
switched to a different
| crash: BUG: unable to handle kernel paging request in bpf_trace_run3
so the bisecting session yielded (I believe) random commit, didn't it?
(The lockdep appears valid, with PSI enabled and the fault injection at
unfortunate place (with BPF'd tracepoint).)
Michal
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [cgroups?] possible deadlock in console_lock_spinning_enable (5)
2024-10-03 20:37 ` [syzbot] [cgroups?] " syzbot
@ 2025-01-22 10:35 ` Hillf Danton
2025-01-22 10:54 ` syzbot
0 siblings, 1 reply; 6+ messages in thread
From: Hillf Danton @ 2025-01-22 10:35 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Thu, 03 Oct 2024 13:37:23 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 5f5673607153 Merge branch 'for-next/core' into for-kernelci
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17f0f580580000
#syz test upstream master
--- x/kernel/workqueue.c
+++ y/kernel/workqueue.c
@@ -7815,7 +7815,7 @@ void __init workqueue_init_early(void)
system_wq = alloc_workqueue("events", 0, 0);
system_highpri_wq = alloc_workqueue("events_highpri", WQ_HIGHPRI, 0);
- system_long_wq = alloc_workqueue("events_long", 0, 0);
+ system_long_wq = alloc_workqueue("events_long", WQ_MEM_RECLAIM, 0);
system_unbound_wq = alloc_workqueue("events_unbound", WQ_UNBOUND,
WQ_MAX_ACTIVE);
system_freezable_wq = alloc_workqueue("events_freezable",
--
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [cgroups?] possible deadlock in console_lock_spinning_enable (5)
2025-01-22 10:35 ` Hillf Danton
@ 2025-01-22 10:54 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2025-01-22 10:54 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in console_lock_spinning_enable
FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 1
======================================================
WARNING: possible circular locking dependency detected
6.13.0-syzkaller-gc4b9570cfb63-dirty #0 Not tainted
------------------------------------------------------
syz.1.427/7673 is trying to acquire lock:
ffffffff8e0cb740 (console_owner){-...}-{0:0}, at: console_lock_spinning_enable+0x9f/0xd0 kernel/printk/printk.c:1924
but task is already holding lock:
ffff8880b863ec18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (&rq->__lock){-.-.}-{2:2}:
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598
raw_spin_rq_lock kernel/sched/sched.h:1519 [inline]
task_rq_lock+0xcf/0x3b0 kernel/sched/core.c:700
cgroup_move_task+0x82/0x250 kernel/sched/psi.c:1161
css_set_move_task+0x288/0x5f0 kernel/cgroup/cgroup.c:898
cgroup_post_fork+0x1c6/0x910 kernel/cgroup/cgroup.c:6691
copy_process+0x5034/0x8d10 kernel/fork.c:2617
kernel_clone+0xfd/0x960 kernel/fork.c:2803
user_mode_thread+0xb4/0xf0 kernel/fork.c:2881
rest_init+0x23/0x2b0 init/main.c:712
start_kernel+0x3e9/0x4d0 init/main.c:1103
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #3 (&p->pi_lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0xb6/0x1490 kernel/sched/core.c:4209
__wake_up_common+0x131/0x1e0 kernel/sched/wait.c:89
__wake_up_common_lock kernel/sched/wait.c:106 [inline]
__wake_up+0x31/0x60 kernel/sched/wait.c:127
tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1841
serial8250_handle_irq+0x74d/0xc80 drivers/tty/serial/8250/8250_port.c:1949
serial8250_default_handle_irq+0x9a/0x210 drivers/tty/serial/8250/8250_port.c:1969
serial8250_interrupt+0x103/0x210 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:247 [inline]
call_irq_handler arch/x86/kernel/irq.c:259 [inline]
__common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285
common_interrupt+0x61/0xe0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
variable_ffs arch/x86/include/asm/bitops.h:321 [inline]
handle_softirqs+0x1da/0x8f0 kernel/softirq.c:549
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline]
acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:111
acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:699
cpuidle_enter_state+0xaa/0x4f0 drivers/cpuidle/cpuidle.c:268
cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:389
cpuidle_idle_call kernel/sched/idle.c:230 [inline]
do_idle+0x310/0x3f0 kernel/sched/idle.c:325
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:423
start_secondary+0x222/0x2b0 arch/x86/kernel/smpboot.c:315
common_startup_64+0x13e/0x148
-> #2 (&tty->write_wait){-.-.}-{3:3}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
__wake_up_common_lock kernel/sched/wait.c:105 [inline]
__wake_up+0x1c/0x60 kernel/sched/wait.c:127
tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1841
serial8250_handle_irq+0x74d/0xc80 drivers/tty/serial/8250/8250_port.c:1949
serial8250_default_handle_irq+0x9a/0x210 drivers/tty/serial/8250/8250_port.c:1969
serial8250_interrupt+0x103/0x210 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:247 [inline]
call_irq_handler arch/x86/kernel/irq.c:259 [inline]
__common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285
common_interrupt+0x61/0xe0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
variable_ffs arch/x86/include/asm/bitops.h:321 [inline]
handle_softirqs+0x1da/0x8f0 kernel/softirq.c:549
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:786 [inline]
uart_write+0x2a4/0xb30 drivers/tty/serial/serial_core.c:636
process_output_block drivers/tty/n_tty.c:574 [inline]
n_tty_write+0x419/0x1140 drivers/tty/n_tty.c:2389
iterate_tty_write drivers/tty/tty_io.c:1015 [inline]
file_tty_write.constprop.0+0x506/0x9a0 drivers/tty/tty_io.c:1090
tty_write drivers/tty/tty_io.c:1111 [inline]
redirected_tty_write drivers/tty/tty_io.c:1134 [inline]
redirected_tty_write+0xcc/0x140 drivers/tty/tty_io.c:1114
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0x5ae/0x1150 fs/read_write.c:679
ksys_write+0x12b/0x250 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&port_lock_key){-.-.}-{3:3}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
uart_port_lock_irqsave include/linux/serial_core.h:715 [inline]
serial8250_console_write+0xb56/0x17c0 drivers/tty/serial/8250/8250_port.c:3372
console_emit_next_record kernel/printk/printk.c:3122 [inline]
console_flush_all+0x803/0xc60 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
_printk+0xc8/0x100 kernel/printk/printk.c:2457
register_console+0xbfd/0x1170 kernel/printk/printk.c:4099
univ8250_console_init+0x5f/0x90 drivers/tty/serial/8250/8250_core.c:513
console_init+0x154/0x690 kernel/printk/printk.c:4292
start_kernel+0x29f/0x4d0 init/main.c:1038
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #0 (console_owner){-...}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain kernel/locking/lockdep.c:3906 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
console_lock_spinning_enable+0xb0/0xd0 kernel/printk/printk.c:1924
console_emit_next_record kernel/printk/printk.c:3116 [inline]
console_flush_all+0x7ac/0xc60 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
_printk+0xc8/0x100 kernel/printk/printk.c:2457
fail_dump lib/fault-inject.c:46 [inline]
should_fail_ex+0x46c/0x5b0 lib/fault-inject.c:154
__copy_to_user_inatomic include/linux/uaccess.h:132 [inline]
copy_to_user_nofault+0xac/0x180 mm/maccess.c:156
____bpf_probe_write_user kernel/trace/bpf_trace.c:348 [inline]
bpf_probe_write_user+0xaf/0xf0 kernel/trace/bpf_trace.c:326
bpf_prog_6303d92f98284ad8+0x44/0x48
bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
__bpf_prog_run include/linux/filter.h:701 [inline]
bpf_prog_run include/linux/filter.h:708 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline]
bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2406
__bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222
__traceiter_sched_switch+0x6c/0xc0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x180b/0x5b60 kernel/sched/core.c:6757
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7082
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
arch_local_irq_restore arch/x86/include/asm/irqflags.h:154 [inline]
lock_acquire.part.0+0x155/0x380 kernel/locking/lockdep.c:5854
rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
__fget_files+0x46/0x3a0 fs/file.c:1049
__fget_light fs/file.c:1152 [inline]
fdget fs/file.c:1160 [inline]
fdget_pos+0x2fc/0x390 fs/file.c:1187
class_fd_pos_constructor include/linux/file.h:85 [inline]
ksys_write+0x72/0x250 fs/read_write.c:722
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
console_owner --> &p->pi_lock --> &rq->__lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock(console_owner);
*** DEADLOCK ***
5 locks held by syz.1.427/7673:
#0: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: __fget_files+0x40/0x3a0 fs/file.c:1049
#1: ffff8880b863ec18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598
#2: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#2: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2362 [inline]
#2: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run4+0x1d6/0x5a0 kernel/trace/bpf_trace.c:2406
#3: ffffffff8e1abb80 (console_lock){+.+.}-{0:0}, at: _printk+0xc8/0x100 kernel/printk/printk.c:2457
#4: ffffffff8e1abbf0 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:342 [inline]
#4: ffffffff8e1abbf0 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:304 [inline]
#4: ffffffff8e1abbf0 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:288 [inline]
#4: ffffffff8e1abbf0 (console_srcu){....}-{0:0}, at: console_flush_all+0x159/0xc60 kernel/printk/printk.c:3187
stack backtrace:
CPU: 0 UID: 0 PID: 7673 Comm: syz.1.427 Not tainted 6.13.0-syzkaller-gc4b9570cfb63-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x490/0x760 kernel/locking/lockdep.c:2076
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2208
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain kernel/locking/lockdep.c:3906 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
console_lock_spinning_enable+0xb0/0xd0 kernel/printk/printk.c:1924
console_emit_next_record kernel/printk/printk.c:3116 [inline]
console_flush_all+0x7ac/0xc60 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
_printk+0xc8/0x100 kernel/printk/printk.c:2457
fail_dump lib/fault-inject.c:46 [inline]
should_fail_ex+0x46c/0x5b0 lib/fault-inject.c:154
__copy_to_user_inatomic include/linux/uaccess.h:132 [inline]
copy_to_user_nofault+0xac/0x180 mm/maccess.c:156
____bpf_probe_write_user kernel/trace/bpf_trace.c:348 [inline]
bpf_probe_write_user+0xaf/0xf0 kernel/trace/bpf_trace.c:326
bpf_prog_6303d92f98284ad8+0x44/0x48
bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
__bpf_prog_run include/linux/filter.h:701 [inline]
bpf_prog_run include/linux/filter.h:708 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline]
bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2406
__bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222
__traceiter_sched_switch+0x6c/0xc0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x180b/0x5b60 kernel/sched/core.c:6757
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7082
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire.part.0+0x155/0x380 kernel/locking/lockdep.c:5816
Code: b8 ff ff ff ff 65 0f c1 05 00 a8 8b 7e 83 f8 01 0f 85 d0 01 00 00 9c 58 f6 c4 02 0f 85 e5 01 00 00 48 85 ed 0f 85 b6 01 00 00 <48> b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00 00 00 00 48 c7
RSP: 0018:ffffc900046c7d28 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 1ffff920008d8fa6 RCX: 00000000d439196c
RDX: 0000000000000001 RSI: ffffffff8b6cdcc0 RDI: ffffffff8bd2c740
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff2dd0d98
R10: ffffffff96e86cc7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8e1be440 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
__fget_files+0x46/0x3a0 fs/file.c:1049
__fget_light fs/file.c:1152 [inline]
fdget fs/file.c:1160 [inline]
fdget_pos+0x2fc/0x390 fs/file.c:1187
class_fd_pos_constructor include/linux/file.h:85 [inline]
ksys_write+0x72/0x250 fs/read_write.c:722
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f751a1847df
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f751b083030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f751a1847df
RDX: 0000000000000001 RSI: 00007f751b0830a0 RDI: 0000000000000005
RBP: 00007f751b083090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 0000000000000000 R14: 00007f751a375fa0 R15: 00007fff4f6d3d38
</TASK>
CPU: 0 UID: 0 PID: 7673 Comm: syz.1.427 Not tainted 6.13.0-syzkaller-gc4b9570cfb63-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
fail_dump lib/fault-inject.c:53 [inline]
should_fail_ex+0x497/0x5b0 lib/fault-inject.c:154
__copy_to_user_inatomic include/linux/uaccess.h:132 [inline]
copy_to_user_nofault+0xac/0x180 mm/maccess.c:156
____bpf_probe_write_user kernel/trace/bpf_trace.c:348 [inline]
bpf_probe_write_user+0xaf/0xf0 kernel/trace/bpf_trace.c:326
bpf_prog_6303d92f98284ad8+0x44/0x48
bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
__bpf_prog_run include/linux/filter.h:701 [inline]
bpf_prog_run include/linux/filter.h:708 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline]
bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2406
__bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222
__traceiter_sched_switch+0x6c/0xc0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x180b/0x5b60 kernel/sched/core.c:6757
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7082
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire.part.0+0x155/0x380 kernel/locking/lockdep.c:5816
Code: b8 ff ff ff ff 65 0f c1 05 00 a8 8b 7e 83 f8 01 0f 85 d0 01 00 00 9c 58 f6 c4 02 0f 85 e5 01 00 00 48 85 ed 0f 85 b6 01 00 00 <48> b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00 00 00 00 48 c7
RSP: 0018:ffffc900046c7d28 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 1ffff920008d8fa6 RCX: 00000000d439196c
RDX: 0000000000000001 RSI: ffffffff8b6cdcc0 RDI: ffffffff8bd2c740
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff2dd0d98
R10: ffffffff96e86cc7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8e1be440 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
__fget_files+0x46/0x3a0 fs/file.c:1049
__fget_light fs/file.c:1152 [inline]
fdget fs/file.c:1160 [inline]
fdget_pos+0x2fc/0x390 fs/file.c:1187
class_fd_pos_constructor include/linux/file.h:85 [inline]
ksys_write+0x72/0x250 fs/read_write.c:722
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f751a1847df
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f751b083030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f751a1847df
RDX: 0000000000000001 RSI: 00007f751b0830a0 RDI: 0000000000000005
RBP: 00007f751b083090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 0000000000000000 R14: 00007f751a375fa0 R15: 00007fff4f6d3d38
</TASK>
----------------
Code disassembly (best guess):
0: b8 ff ff ff ff mov $0xffffffff,%eax
5: 65 0f c1 05 00 a8 8b xadd %eax,%gs:0x7e8ba800(%rip) # 0x7e8ba80d
c: 7e
d: 83 f8 01 cmp $0x1,%eax
10: 0f 85 d0 01 00 00 jne 0x1e6
16: 9c pushf
17: 58 pop %rax
18: f6 c4 02 test $0x2,%ah
1b: 0f 85 e5 01 00 00 jne 0x206
21: 48 85 ed test %rbp,%rbp
24: 0f 85 b6 01 00 00 jne 0x1e0
* 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
31: fc ff df
34: 48 01 c3 add %rax,%rbx
37: 48 c7 03 00 00 00 00 movq $0x0,(%rbx)
3e: 48 rex.W
3f: c7 .byte 0xc7
Tested on:
commit: c4b9570c Merge tag 'audit-pr-20250121' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=135a1824580000
kernel config: https://syzkaller.appspot.com/x/.config?x=899f38f532606c8e
dashboard link: https://syzkaller.appspot.com/bug?extid=622acb507894a48b2ce9
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1343c5df980000
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-01-22 10:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-17 16:39 [syzbot] [serial?] possible deadlock in console_lock_spinning_enable (5) syzbot
2024-10-03 20:37 ` [syzbot] [cgroups?] " syzbot
2025-01-22 10:35 ` Hillf Danton
2025-01-22 10:54 ` syzbot
2025-01-17 12:34 ` syzbot
2025-01-21 18:29 ` Michal Koutný
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox