From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
syzbot <syzkaller@googlegroups.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.14 02/45] ax25: fix inconsistent lock state in ax25_destroy_timer
Date: Thu, 20 Jun 2019 19:57:04 +0200 [thread overview]
Message-ID: <20190620174329.954085990@linuxfoundation.org> (raw)
In-Reply-To: <20190620174328.608036501@linuxfoundation.org>
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit d4d5d8e83c9616aeef28a2869cea49cc3fb35526 ]
Before thread in process context uses bh_lock_sock()
we must disable bh.
sysbot reported :
WARNING: inconsistent lock state
5.2.0-rc3+ #32 Not tainted
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
blkid/26581 [HC0[0]:SC1[1]:HE1:SE0] takes:
00000000e0da85ee (slock-AF_AX25){+.?.}, at: spin_lock include/linux/spinlock.h:338 [inline]
00000000e0da85ee (slock-AF_AX25){+.?.}, at: ax25_destroy_timer+0x53/0xc0 net/ax25/af_ax25.c:275
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4303
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
spin_lock include/linux/spinlock.h:338 [inline]
ax25_rt_autobind+0x3ca/0x720 net/ax25/ax25_route.c:429
ax25_connect.cold+0x30/0xa4 net/ax25/af_ax25.c:1221
__sys_connect+0x264/0x330 net/socket.c:1834
__do_sys_connect net/socket.c:1845 [inline]
__se_sys_connect net/socket.c:1842 [inline]
__x64_sys_connect+0x73/0xb0 net/socket.c:1842
do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe
irq event stamp: 2272
hardirqs last enabled at (2272): [<ffffffff810065f3>] trace_hardirqs_on_thunk+0x1a/0x1c
hardirqs last disabled at (2271): [<ffffffff8100660f>] trace_hardirqs_off_thunk+0x1a/0x1c
softirqs last enabled at (1522): [<ffffffff87400654>] __do_softirq+0x654/0x94c kernel/softirq.c:320
softirqs last disabled at (2267): [<ffffffff81449010>] invoke_softirq kernel/softirq.c:374 [inline]
softirqs last disabled at (2267): [<ffffffff81449010>] irq_exit+0x180/0x1d0 kernel/softirq.c:414
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(slock-AF_AX25);
<Interrupt>
lock(slock-AF_AX25);
*** DEADLOCK ***
1 lock held by blkid/26581:
#0: 0000000010fd154d ((&ax25->dtimer)){+.-.}, at: lockdep_copy_map include/linux/lockdep.h:175 [inline]
#0: 0000000010fd154d ((&ax25->dtimer)){+.-.}, at: call_timer_fn+0xe0/0x720 kernel/time/timer.c:1312
stack backtrace:
CPU: 1 PID: 26581 Comm: blkid Not tainted 5.2.0-rc3+ #32
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_usage_bug.cold+0x393/0x4a2 kernel/locking/lockdep.c:2935
valid_state kernel/locking/lockdep.c:2948 [inline]
mark_lock_irq kernel/locking/lockdep.c:3138 [inline]
mark_lock+0xd46/0x1370 kernel/locking/lockdep.c:3513
mark_irqflags kernel/locking/lockdep.c:3391 [inline]
__lock_acquire+0x159f/0x5490 kernel/locking/lockdep.c:3745
lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4303
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
spin_lock include/linux/spinlock.h:338 [inline]
ax25_destroy_timer+0x53/0xc0 net/ax25/af_ax25.c:275
call_timer_fn+0x193/0x720 kernel/time/timer.c:1322
expire_timers kernel/time/timer.c:1366 [inline]
__run_timers kernel/time/timer.c:1685 [inline]
__run_timers kernel/time/timer.c:1653 [inline]
run_timer_softirq+0x66f/0x1740 kernel/time/timer.c:1698
__do_softirq+0x25c/0x94c kernel/softirq.c:293
invoke_softirq kernel/softirq.c:374 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:414
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1068
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806
</IRQ>
RIP: 0033:0x7f858d5c3232
Code: 8b 61 08 48 8b 84 24 d8 00 00 00 4c 89 44 24 28 48 8b ac 24 d0 00 00 00 4c 8b b4 24 e8 00 00 00 48 89 7c 24 68 48 89 4c 24 78 <48> 89 44 24 58 8b 84 24 e0 00 00 00 89 84 24 84 00 00 00 8b 84 24
RSP: 002b:00007ffcaf0cf5c0 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
RAX: 00007f858d7d27a8 RBX: 00007f858d7d8820 RCX: 00007f858d3940d8
RDX: 00007ffcaf0cf798 RSI: 00000000f5e616f3 RDI: 00007f858d394fee
RBP: 0000000000000000 R08: 00007ffcaf0cf780 R09: 00007f858d7db480
R10: 0000000000000000 R11: 0000000009691a75 R12: 0000000000000005
R13: 00000000f5e616f3 R14: 0000000000000000 R15: 00007ffcaf0cf798
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ax25/ax25_route.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -443,9 +443,11 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25
}
if (ax25->sk != NULL) {
+ local_bh_disable();
bh_lock_sock(ax25->sk);
sock_reset_flag(ax25->sk, SOCK_ZAPPED);
bh_unlock_sock(ax25->sk);
+ local_bh_enable();
}
put:
next prev parent reply other threads:[~2019-06-20 18:24 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-20 17:57 [PATCH 4.14 00/45] 4.14.129-stable review Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 01/45] perf machine: Guard against NULL in machine__exit() Greg Kroah-Hartman
2019-06-20 17:57 ` Greg Kroah-Hartman [this message]
2019-06-20 17:57 ` [PATCH 4.14 03/45] be2net: Fix number of Rx queues used for flow hashing Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 04/45] ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 05/45] lapb: fixed leak of control-blocks Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 06/45] neigh: fix use-after-free read in pneigh_get_next Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 07/45] net: openvswitch: do not free vport if register_netdevice() is failed Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 08/45] sctp: Free cookie before we memdup a new one Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 09/45] sunhv: Fix device naming inconsistency between sunhv_console and sunhv_reg Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 10/45] Staging: vc04_services: Fix a couple error codes Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 11/45] perf/x86/intel/ds: Fix EVENT vs. UEVENT PEBS constraints Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 12/45] netfilter: nf_queue: fix reinject verdict handling Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 13/45] ipvs: Fix use-after-free in ip_vs_in Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 14/45] selftests: netfilter: missing error check when setting up veth interface Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 15/45] clk: ti: clkctrl: Fix clkdm_clk handling Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 16/45] powerpc/powernv: Return for invalid IMC domain Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 17/45] mISDN: make sure device name is NUL terminated Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 18/45] x86/CPU/AMD: Dont force the CPB cap when running under a hypervisor Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 19/45] perf/ring_buffer: Fix exposing a temporarily decreased data_head Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 20/45] perf/ring_buffer: Add ordering to rb->nest increment Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 21/45] perf/ring-buffer: Always use {READ,WRITE}_ONCE() for rb->user_page data Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 22/45] gpio: fix gpio-adp5588 build errors Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 23/45] net: tulip: de4x5: Drop redundant MODULE_DEVICE_TABLE() Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 24/45] net: aquantia: fix LRO with FCS error Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 25/45] i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 26/45] ALSA: hda - Force polling mode on CNL for fixing codec communication Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 27/45] configfs: Fix use-after-free when accessing sd->s_dentry Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 28/45] perf data: Fix strncat may truncate build failure with recent gcc Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 29/45] perf record: Fix s390 missing module symbol and warning for non-root users Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 30/45] ia64: fix build errors by exporting paddr_to_nid() Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 31/45] KVM: PPC: Book3S: Use new mutex to synchronize access to rtas token list Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 32/45] KVM: PPC: Book3S HV: Dont take kvm->lock around kvm_for_each_vcpu Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 33/45] net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and RZ/A1 SoCs Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 34/45] net: phy: dp83867: Set up RGMII TX delay Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 35/45] scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route() Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 36/45] scsi: smartpqi: properly set both the DMA mask and the coherent DMA mask Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 37/45] scsi: scsi_dh_alua: Fix possible null-ptr-deref Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 38/45] scsi: libsas: delete sas port if expander discover failed Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 39/45] mlxsw: spectrum: Prevent force of 56G Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 40/45] HID: wacom: Dont set tool type until were in range Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 41/45] HID: wacom: Dont report anything prior to the tool entering range Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 42/45] HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 43/45] coredump: fix race condition between collapse_huge_page() and core dumping Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 44/45] infiniband: fix race condition between infiniband mlx4, mlx5 driver " Greg Kroah-Hartman
2019-06-20 17:57 ` [PATCH 4.14 45/45] Abort file_remove_privs() for non-reg. files Greg Kroah-Hartman
2019-06-20 21:51 ` [PATCH 4.14 00/45] 4.14.129-stable review kernelci.org bot
2019-06-21 3:49 ` Naresh Kamboju
2019-06-22 0:44 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190620174329.954085990@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).