[syzbot] INFO: trying to register non-static key in gsmld_write

[syzbot] INFO: trying to register non-static key in gsmld_write

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    ca688bff68bc Add linux-next specific files for 20220808
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1339918e080000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4c20e006003cdecb
dashboard link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 PID: 3731 Comm: syz-executor.0 Not tainted 5.19.0-next-20220808-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 assign_lock_key kernel/locking/lockdep.c:979 [inline]
 register_lock_class+0xf1b/0x1120 kernel/locking/lockdep.c:1292
 __lock_acquire+0x109/0x56d0 kernel/locking/lockdep.c:4932
 lock_acquire kernel/locking/lockdep.c:5666 [inline]
 lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
 gsmld_write+0x5e/0x140 drivers/tty/n_gsm.c:3023
 do_tty_write drivers/tty/tty_io.c:1024 [inline]
 file_tty_write.constprop.0+0x499/0x8f0 drivers/tty/tty_io.c:1095
 call_write_iter include/linux/fs.h:2192 [inline]
 do_iter_readv_writev+0x20b/0x3b0 fs/read_write.c:729
 do_iter_write+0x182/0x700 fs/read_write.c:855
 vfs_writev+0x1aa/0x630 fs/read_write.c:928
 do_writev+0x133/0x2f0 fs/read_write.c:971
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fd570e89279
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd572050168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007fd570f9bf80 RCX: 00007fd570e89279
RDX: 0000000000000001 RSI: 0000000020000480 RDI: 0000000000000003
RBP: 00007fd570ee3189 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc4cf5714f R14: 00007fd572050300 R15: 0000000000022000
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

Re: [syzbot] INFO: trying to register non-static key in gsmld_write

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    ca688bff68bc Add linux-next specific files for 20220808
git tree:       linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16c4c201080000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4c20e006003cdecb
dashboard link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=151f2b46080000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=143a3171080000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 PID: 3608 Comm: syz-executor156 Not tainted 5.19.0-next-20220808-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 assign_lock_key kernel/locking/lockdep.c:979 [inline]
 register_lock_class+0xf1b/0x1120 kernel/locking/lockdep.c:1292
 __lock_acquire+0x109/0x56d0 kernel/locking/lockdep.c:4932
 lock_acquire kernel/locking/lockdep.c:5666 [inline]
 lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
 gsmld_write+0x5e/0x140 drivers/tty/n_gsm.c:3023
 do_tty_write drivers/tty/tty_io.c:1024 [inline]
 file_tty_write.constprop.0+0x499/0x8f0 drivers/tty/tty_io.c:1095
 call_write_iter include/linux/fs.h:2192 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x9e9/0xdd0 fs/read_write.c:578
 ksys_write+0x127/0x250 fs/read_write.c:631
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f80104e30c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8010474268 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f801056b4d0 RCX: 00007f80104e30c9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f8010539010 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8010474280
R13: 6d74702f7665642f R14: 00007f801047427c R15: 00007f801056b4d8
 </TASK>

Re: [syzbot] INFO: trying to register non-static key in gsmld_write

[Jiri Slaby]

Cc Daniel

On 08. 08. 22, 15:21, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    ca688bff68bc Add linux-next specific files for 20220808
> git tree:       linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=16c4c201080000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=4c20e006003cdecb
> dashboard link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=151f2b46080000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=143a3171080000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com
> 
> INFO: trying to register non-static key.
> The code is fine but needs lockdep annotation, or maybe
> you didn't initialize this object before use?
> turning off the locking correctness validator.
> CPU: 0 PID: 3608 Comm: syz-executor156 Not tainted 5.19.0-next-20220808-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
> Call Trace:
>   <TASK>
>   __dump_stack lib/dump_stack.c:88 [inline]
>   dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
>   assign_lock_key kernel/locking/lockdep.c:979 [inline]
>   register_lock_class+0xf1b/0x1120 kernel/locking/lockdep.c:1292
>   __lock_acquire+0x109/0x56d0 kernel/locking/lockdep.c:4932
>   lock_acquire kernel/locking/lockdep.c:5666 [inline]
>   lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631
>   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
>   _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
>   gsmld_write+0x5e/0x140 drivers/tty/n_gsm.c:3023
>   do_tty_write drivers/tty/tty_io.c:1024 [inline]
>   file_tty_write.constprop.0+0x499/0x8f0 drivers/tty/tty_io.c:1095
>   call_write_iter include/linux/fs.h:2192 [inline]
>   new_sync_write fs/read_write.c:491 [inline]
>   vfs_write+0x9e9/0xdd0 fs/read_write.c:578
>   ksys_write+0x127/0x250 fs/read_write.c:631
>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f80104e30c9
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f8010474268 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 00007f801056b4d0 RCX: 00007f80104e30c9
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
> RBP: 00007f8010539010 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8010474280
> R13: 6d74702f7665642f R14: 00007f801047427c R15: 00007f801056b4d8
>   </TASK>
> 

-- 
js
suse labs

Re: [syzbot] INFO: trying to register non-static key in gsmld_write

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com

Tested on:

commit:         ca688bff Add linux-next specific files for 20220808
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=10fd0705080000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4c20e006003cdecb
dashboard link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch:          https://syzkaller.appspot.com/x/patch.diff?x=168d3fe1080000

Note: testing is done by a robot and is best-effort only.

[PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()

[Tetsuo Handa]

syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for
commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
allows accessing gsm->tx_lock before gsm_activate_mux() initializes it.

Since object initialization should be done right after allocation in order
to avoid accessing uninitialized memory, move initialization of
timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to
gsm_alloc_mux().

Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1]
Reported-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
---
 drivers/tty/n_gsm.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index caa5c14ed57f..70cd90474679 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
 	if (dlci == NULL)
 		return -ENOMEM;
 
-	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
-	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
-	INIT_WORK(&gsm->tx_work, gsmld_write_task);
-	init_waitqueue_head(&gsm->event);
-	spin_lock_init(&gsm->control_lock);
-	spin_lock_init(&gsm->tx_lock);
-
 	if (gsm->encoding == 0)
 		gsm->receive = gsm0_receive;
 	else
@@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void)
 	kref_init(&gsm->ref);
 	INIT_LIST_HEAD(&gsm->tx_ctrl_list);
 	INIT_LIST_HEAD(&gsm->tx_data_list);
+	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
+	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
+	INIT_WORK(&gsm->tx_work, gsmld_write_task);
+	init_waitqueue_head(&gsm->event);
+	spin_lock_init(&gsm->control_lock);
+	spin_lock_init(&gsm->tx_lock);
 
 	gsm->t1 = T1;
 	gsm->t2 = T2;
@@ -2946,10 +2945,6 @@ static int gsmld_open(struct tty_struct *tty)
 
 	gsmld_attach_gsm(tty, gsm);
 
-	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
-	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
-	INIT_WORK(&gsm->tx_work, gsmld_write_task);
-
 	return 0;
 }
 
-- 
2.34.1

Re: [PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()

[Jiri Slaby]

On 27. 08. 22, 15:47, Tetsuo Handa wrote:
> syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for
> commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
> allows accessing gsm->tx_lock before gsm_activate_mux() initializes it.
> 
> Since object initialization should be done right after allocation in order
> to avoid accessing uninitialized memory, move initialization of
> timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to
> gsm_alloc_mux().

LGTM, I wonder why this was not like this forever.

Acked-by: Jiri Slaby <jirislaby@kernel.org>

> Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1]
> Reported-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Tested-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
> Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
> ---
>   drivers/tty/n_gsm.c | 17 ++++++-----------
>   1 file changed, 6 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
> index caa5c14ed57f..70cd90474679 100644
> --- a/drivers/tty/n_gsm.c
> +++ b/drivers/tty/n_gsm.c
> @@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
>   	if (dlci == NULL)
>   		return -ENOMEM;
>   
> -	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
> -	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
> -	INIT_WORK(&gsm->tx_work, gsmld_write_task);
> -	init_waitqueue_head(&gsm->event);
> -	spin_lock_init(&gsm->control_lock);
> -	spin_lock_init(&gsm->tx_lock);
> -
>   	if (gsm->encoding == 0)
>   		gsm->receive = gsm0_receive;
>   	else
> @@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void)
>   	kref_init(&gsm->ref);
>   	INIT_LIST_HEAD(&gsm->tx_ctrl_list);
>   	INIT_LIST_HEAD(&gsm->tx_data_list);
> +	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
> +	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
> +	INIT_WORK(&gsm->tx_work, gsmld_write_task);
> +	init_waitqueue_head(&gsm->event);
> +	spin_lock_init(&gsm->control_lock);
> +	spin_lock_init(&gsm->tx_lock);
>   
>   	gsm->t1 = T1;
>   	gsm->t2 = T2;
> @@ -2946,10 +2945,6 @@ static int gsmld_open(struct tty_struct *tty)
>   
>   	gsmld_attach_gsm(tty, gsm);
>   
> -	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
> -	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
> -	INIT_WORK(&gsm->tx_work, gsmld_write_task);
> -
>   	return 0;
>   }
>   

-- 
js
suse labs