From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932308AbdJ0PMH (ORCPT ); Fri, 27 Oct 2017 11:12:07 -0400 Received: from merlin.infradead.org ([205.233.59.134]:32818 "EHLO merlin.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751818AbdJ0PME (ORCPT ); Fri, 27 Oct 2017 11:12:04 -0400 Date: Fri, 27 Oct 2017 17:11:37 +0200 From: Peter Zijlstra To: syzbot Cc: acme@kernel.org, alexander.shishkin@linux.intel.com, linux-kernel@vger.kernel.org, mingo@redhat.com, syzkaller-bugs@googlegroups.com, Thomas Gleixner Subject: Re: possible deadlock in perf_event_ctx_lock_nested Message-ID: <20171027151137.GC3165@worktop.lehotels.local> References: <001a11448f6c0346ec055c831a71@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <001a11448f6c0346ec055c831a71@google.com> User-Agent: Mutt/1.5.22.1 (2013-10-16) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Oct 27, 2017 at 01:30:30AM -0700, syzbot wrote: > ====================================================== > WARNING: possible circular locking dependency detected > 4.13.0-next-20170911+ #19 Not tainted > ------------------------------------------------------ > syz-executor2/12380 is trying to acquire lock: > (&ctx->mutex){+.+.}, at: [] > perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210 > > but task is already holding lock: > (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested > fs/pipe.c:66 [inline] > (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x56/0x70 > fs/pipe.c:74 > > which lock already depends on the new lock. ARRGH!! that translates like the below, which is an absolute maze and requires at least 5 concurrent callstacks, possibly more. We already had a lot of fun with hotplug-perf-ftrace, but the below contains more. Let me try and page that previous crap back. perf_ioctl() #0 perf_event_ctx_lock() [ctx->mutex] perf_event_set_filter #1 ftrace_profile_set_filter [event_mutex] sys_perf_event_open ... perf_trace_init #1 mutex_lock [event_mutex] trace_event_reg tracepoint_probe_register #2 mutex_lock() [tracepoints_mutex] tracepoint_add_func() #3 static_key_slow_inc() [cpuhotplug_lock] cpuhp_setup_state_nocalls #3 cpus_read_lock [cpuhotplug_lock] __cpuhp_setup_state_cpuslocked #4 mutex_lock [cpuhp_state_mutex] cpuhp_issue_call #5 cpuhp_invoke_ap_callback() [cpuhp_state] #5 cpuhp_invoke_callback [cpuhp_state] ... devtmpfs_create_node #6 wait_for_completion() [&req.done] devtmpfsd handle_create #7 filename_create [sb_writers] #6 complete [&req.done] do_splice #7 file_start_write() [sb_writers] do_splice_from iter_file_splice_write #8 pipe_lock [pipe->mutex] do_splice #8 pipe_lock [pipe->mutex] do_splice_to ... #0 perf_read() [ctx->mutex]