BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!

BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit:    cf08baa29613 Add linux-next specific files for 20190306
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=15bc76c7200000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c8b6073d992e8217
dashboard link: https://syzkaller.appspot.com/bug?extid=91fd909b6e62ebe06131
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+91fd909b6e62ebe06131@syzkaller.appspotmail.com

BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!
turning off the locking correctness validator.
CPU: 0 PID: 11902 Comm: kworker/u5:27 Not tainted 5.0.0-next-20190306 #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: hci94 hci_power_on
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x172/0x1f0 lib/dump_stack.c:113
  add_chain_cache kernel/locking/lockdep.c:2582 [inline]
  lookup_chain_cache_add kernel/locking/lockdep.c:2656 [inline]
  validate_chain kernel/locking/lockdep.c:2676 [inline]
  __lock_acquire.cold+0x250/0x50d kernel/locking/lockdep.c:3692
  lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4202
  __flush_work+0x677/0x8a0 kernel/workqueue.c:3034
  flush_work+0x18/0x20 kernel/workqueue.c:3060
  hci_dev_do_open+0xa92/0x1780 net/bluetooth/hci_core.c:1543
  hci_power_on+0x10d/0x580 net/bluetooth/hci_core.c:2173
  process_one_work+0x98e/0x1790 kernel/workqueue.c:2269
  worker_thread+0x98/0xe40 kernel/workqueue.c:2415
  kthread+0x357/0x430 kernel/kthread.c:253
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with  
syzbot.

Re: BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit:    771acc7e Bluetooth: btusb: request wake pin with NOAUTOEN
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15f58add200000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4fb64439e07a1ec0
dashboard link: https://syzkaller.appspot.com/bug?extid=91fd909b6e62ebe06131
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11770a8f200000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=128c945b200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+91fd909b6e62ebe06131@syzkaller.appspotmail.com

BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!
turning off the locking correctness validator.
CPU: 0 PID: 1174 Comm: kworker/u5:0 Not tainted 5.1.0-rc4+ #63
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: hci1 hci_power_on
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x172/0x1f0 lib/dump_stack.c:113
  add_chain_cache kernel/locking/lockdep.c:2591 [inline]
  lookup_chain_cache_add kernel/locking/lockdep.c:2665 [inline]
  validate_chain kernel/locking/lockdep.c:2685 [inline]
  __lock_acquire.cold+0x250/0x50d kernel/locking/lockdep.c:3701
  lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
  __mutex_lock_common kernel/locking/mutex.c:925 [inline]
  __mutex_lock+0xf7/0x1310 kernel/locking/mutex.c:1072
  mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
  hci_dev_do_close+0x317/0xf20 net/bluetooth/hci_core.c:1696
  hci_power_on+0x1d2/0x580 net/bluetooth/hci_core.c:2191
  process_one_work+0x98e/0x1790 kernel/workqueue.c:2269
  worker_thread+0x98/0xe40 kernel/workqueue.c:2415
  kthread+0x357/0x430 kernel/kthread.c:253
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Re: BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!

[syzbot]

syzbot has bisected this bug to:

commit 726e41097920a73e4c7c33385dcc0debb1281e18
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Tue Jul 10 00:29:10 2018 +0000

     drivers: core: Remove glue dirs from sysfs earlier

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=15f69eaf200000
start commit:   771acc7e Bluetooth: btusb: request wake pin with NOAUTOEN
git tree:       upstream
final crash:    https://syzkaller.appspot.com/x/report.txt?x=17f69eaf200000
console output: https://syzkaller.appspot.com/x/log.txt?x=13f69eaf200000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4fb64439e07a1ec0
dashboard link: https://syzkaller.appspot.com/bug?extid=91fd909b6e62ebe06131
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11770a8f200000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=128c945b200000

Reported-by: syzbot+91fd909b6e62ebe06131@syzkaller.appspotmail.com
Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs earlier")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!

[Benjamin Herrenschmidt]

On Thu, 2019-04-11 at 05:14 -0700, syzbot wrote:
> syzbot has bisected this bug to:
> 
> commit 726e41097920a73e4c7c33385dcc0debb1281e18
> Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> Date:   Tue Jul 10 00:29:10 2018 +0000
> 
>      drivers: core: Remove glue dirs from sysfs earlier

Greg, any idea what this is ? The log isn't terribly readable. The
above patch fixes a real bug that causes use after free and memory
corruption under some circumstances. I wonder if the BT stack is itself
manipulating stale objects ?

Ben.

> bisection log:  
> https://syzkaller.appspot.com/x/bisect.txt?x=15f69eaf200000
> start commit:   771acc7e Bluetooth: btusb: request wake pin with
> NOAUTOEN
> git tree:       upstream
> final crash:    
> https://syzkaller.appspot.com/x/report.txt?x=17f69eaf200000
> console output: 
> https://syzkaller.appspot.com/x/log.txt?x=13f69eaf200000
> kernel config:  
> https://syzkaller.appspot.com/x/.config?x=4fb64439e07a1ec0
> dashboard link: 
> https://syzkaller.appspot.com/bug?extid=91fd909b6e62ebe06131
> syz repro:      
> https://syzkaller.appspot.com/x/repro.syz?x=11770a8f200000
> C reproducer:   
> https://syzkaller.appspot.com/x/repro.c?x=128c945b200000
> 
> Reported-by: syzbot+91fd909b6e62ebe06131@syzkaller.appspotmail.com
> Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs
> earlier")
> 
> For information about bisection process see: 
> https://goo.gl/tpsmEJ#bisection