[syzbot] [ppp?] possible deadlock in ppp_asynctty_receive
syzbot <[email protected]>
| Newsgroups | gmane.linux.ppp,gmane.linux.kernel,gmane.linux.network |
|---|---|
| Message-ID | <[email protected]> |
Hello, syzbot found the following issue on: HEAD commit: 8182d7a3f1b8 Merge tag 'ata-6.6-rc6' of git://git.kernel.o.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=161c4ead680000 kernel config: https://syzkaller.appspot.com/x/.config?x=11e478e28144788c dashboard link: https://syzkaller.appspot.com/bug?extid=e7b2dea78c7a2e0f8e2c compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/5f442c122125/disk-8182d7a3.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/ee2fd6e642c2/vmlinux-8182d7a3.xz kernel image: https://storage.googleapis.com/syzbot-assets/17f1572357f6/bzImage-8182d7a3.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: [email protected] ======================================================== WARNING: possible irq lock inversion dependency detected 6.6.0-rc5-syzkaller-00067-g8182d7a3f1b8 #0 Not tainted -------------------------------------------------------- kworker/u4:1/12 just changed the state of lock: ffffffff8dd82558 (disc_data_lock){.+..}-{2:2}, at: ap_get drivers/net/ppp/ppp_async.c:136 [inline] ffffffff8dd82558 (disc_data_lock){.+..}-{2:2}, at: ppp_asynctty_receive+0x40/0x2000 drivers/net/ppp/ppp_async.c:335 but this lock was taken by another, HARDIRQ-safe lock in the past: (&port_lock_key){-.-.}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(disc_data_lock); local_irq_disable(); lock(&port_lock_key); lock(disc_data_lock); <Interrupt> lock(&port_lock_key); *** DEADLOCK *** 4 locks held by kworker/u4:1/12: #0: ffff888012871938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2605 [inline] #0: ffff888012871938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x825/0x1400 kernel/workqueue.c:2703 #1: ffffc90000117d20 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2605 [inline] #1: ffffc90000117d20 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_scheduled_works+0x825/0x1400 kernel/workqueue.c:2703 #2: ffff88801c200ce8 (&buf->lock){+.+.}-{3:3}, at: flush_to_ldisc+0x38/0x850 drivers/tty/tty_buffer.c:467 #3: ffff88807744c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x1c/0x80 drivers/tty/tty_ldisc.c:263 the shortest dependencies between 2nd lock and 1st lock: -> (&port_lock_key){-.-.}-{2:2} { IN-HARDIRQ-W at: lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5753 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 serial8250_handle_irq+0x81/0x700 drivers/tty/serial/8250/8250_port.c:1921 serial8250_default_handle_irq+0xcc/0x1e0 drivers/tty/serial/8250/8250_port.c:1970 serial8250_interrupt+0xa5/0x1e0 drivers/tty/serial/8250/8250_core.c:127 __handle_irq_event_percpu+0x286/0xa20 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0x89/0x1f0 kernel/irq/handle.c:210 handle_edge_irq+0x249/0xbf0 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline] handle_irq arch/x86/kernel/irq.c:238 [inline] __common_interrupt+0x134/0x220 arch/x86/kernel/irq.c:257 common_interrupt+0xa3/0xc0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:636 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] acpi_safe_halt+0x20/0x30 drivers/acpi/processor_idle.c:112 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707 cpuidle_enter_state+0x10e/0x470 drivers/cpuidle/cpuidle.c:267 cpuidle_enter+0x5d/0x90 drivers/cpuidle/cpuidle.c:388 call_cpuidle kernel/sched/idle.c:134 [inline] cpuidle_idle_call kernel/sched/idle.c:215 [inline] do_idle+0x374/0x5c0 kernel/sched/idle.c:282 cpu_startup_entry+0x41/0x60 kernel/sched/idle.c:380 rest_init+0x2e0/0x300 init/main.c:726 arch_call_rest_init+0xe/0x10 init/main.c:823 start_kernel+0x46e/0x4f0 init/main.c:1068 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:556 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:537 secondary_startup_64_no_verify+0x167/0x16b IN-SOFTIRQ-W at: lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5753 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 serial8250_handle_irq+0x81/0x700 drivers/tty/serial/8250/8250_port.c:1921 serial8250_default_handle_irq+0xcc/0x1e0 drivers/tty/serial/8250/8250_port.c:1970 serial8250_interrupt+0xa5/0x1e0 drivers/tty/serial/8250/8250_core.c:127 __handle_irq_event_percpu+0x286/0xa20 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0x89/0x1f0 kernel/irq/handle.c:210 handle_edge_irq+0x249/0xbf0 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline] handle_irq arch/x86/kernel/irq.c:238 [inline] __common_interrupt+0x134/0x220 arch/x86/kernel/irq.c:257 common_interrupt+0x4e/0xc0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:636 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202 expire_timers kernel/time/timer.c:1750 [inline] __run_timers+0x640/0x860 kernel/time/timer.c:2022 __do_softirq+0x2ab/0x908 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu+0xf1/0x1b0 kernel/softirq.c:632 irq_exit_rcu+0x9/0x20 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1074 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] acpi_safe_halt+0x20/0x30 drivers/acpi/processor_idle.c:112 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707 cpuidle_enter_state+0x10e/0x470 drivers/cpuidle/cpuidle.c:267 cpuidle_enter+0x5d/0x90 drivers/cpuidle/cpuidle.c:388 call_cpuidle kernel/sched/idle.c:134 [inline] cpuidle_idle_call kernel/sched/idle.c:215 [inline] do_idle+0x374/0x5c0 kernel/sched/idle.c:282 cpu_startup_entry+0x41/0x60 kernel/sched/idle.c:380 rest_init+0x2e0/0x300 init/main.c:726 arch_call_rest_init+0xe/0x10 init/main.c:823 start_kernel+0x46e/0x4f0 init/main.c:1068 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:556 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:537 secondary_startup_64_no_verify+0x167/0x16b INITIAL USE at: lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5753 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 serial8250_do_set_termios+0x52b/0x1790 drivers/tty/serial/8250/8250_port.c:2801 uart_set_options+0x3e5/0x720 drivers/tty/serial/serial_core.c:2278 serial8250_console_setup+0x3c2/0x650 drivers/tty/serial/8250/8250_port.c:3515 univ8250_console_setup+0x3ad/0x470 drivers/tty/serial/8250/8250_core.c:632 try_enable_preferred_console+0x40f/0x560 kernel/printk/printk.c:3294 register_console+0x452/0x1080 kernel/printk/printk.c:3467 univ8250_console_init+0x45/0x50 drivers/tty/serial/8250/8250_core.c:717 console_init+0x193/0x670 kernel/printk/printk.c:3667 start_kernel+0x2d2/0x4f0 init/main.c:1004 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:556 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:537 secondary_startup_64_no_verify+0x167/0x16b } ... key at: [<ffffffff92217c80>] port_lock_key+0x0/0x20 ... acquired at: __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228 ap_get drivers/net/ppp/ppp_async.c:136 [inline] ppp_asynctty_wakeup+0x20/0x210 drivers/net/ppp/ppp_async.c:352 tty_wakeup+0xb7/0x100 drivers/tty/tty_io.c:523 tty_port_default_wakeup+0xa6/0xf0 drivers/tty/tty_port.c:69 serial8250_tx_chars+0x6b7/0x8b0 drivers/tty/serial/8250/8250_port.c:1843 __start_tx+0x312/0x450 drivers/tty/serial/8250/8250_port.c:1552 serial_port_runtime_resume+0x1ec/0x2a0 drivers/tty/serial/serial_port.c:40 __rpm_callback+0x2b9/0x7a0 drivers/base/power/runtime.c:392 rpm_callback drivers/base/power/runtime.c:446 [inline] rpm_resume+0x10ad/0x1af0 drivers/base/power/runtime.c:912 pm_runtime_work+0x147/0x210 drivers/base/power/runtime.c:977 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x90f/0x1400 kernel/workqueue.c:2703 worker_thread+0xa5f/0xff0 kernel/workqueue.c:2784 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 -> (disc_data_lock){.+..}-{2:2} { HARDIRQ-ON-R at: lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5753 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228 ap_get drivers/net/ppp/ppp_async.c:136 [inline] ppp_asynctty_receive+0x40/0x2000 drivers/net/ppp/ppp_async.c:335 tty_ldisc_receive_buf+0x120/0x160 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x6d/0xa0 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:445 [inline] flush_to_ldisc+0x324/0x850 drivers/tty/tty_buffer.c:495 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x90f/0x1400 kernel/workqueue.c:2703 worker_thread+0xa5f/0xff0 kernel/workqueue.c:2784 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 INITIAL READ USE at: lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5753 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228 ap_get drivers/net/ppp/ppp_async.c:136 [inline] ppp_asynctty_wakeup+0x20/0x210 drivers/net/ppp/ppp_async.c:352 tty_wakeup+0xb7/0x100 drivers/tty/tty_io.c:523 tty_port_default_wakeup+0xa6/0xf0 drivers/tty/tty_port.c:69 serial8250_tx_chars+0x6b7/0x8b0 drivers/tty/serial/8250/8250_port.c:1843 __start_tx+0x312/0x450 drivers/tty/serial/8250/8250_port.c:1552 serial_port_runtime_resume+0x1ec/0x2a0 drivers/tty/serial/serial_port.c:40 __rpm_callback+0x2b9/0x7a0 drivers/base/power/runtime.c:392 rpm_callback drivers/base/power/runtime.c:446 [inline] rpm_resume+0x10ad/0x1af0 drivers/base/power/runtime.c:912 pm_runtime_work+0x147/0x210 drivers/base/power/runtime.c:977 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x90f/0x1400 kernel/workqueue.c:2703 worker_thread+0xa5f/0xff0 kernel/workqueue.c:2784 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 } ... key at: [<ffffffff8dd82558>] disc_data_lock+0x18/0x60 ... acquired at: mark_lock+0x21b/0x340 kernel/locking/lockdep.c:4677 mark_usage kernel/locking/lockdep.c:4578 [inline] __lock_acquire+0x1114/0x7f70 kernel/locking/lockdep.c:5090 lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5753 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228 ap_get drivers/net/ppp/ppp_async.c:136 [inline] ppp_asynctty_receive+0x40/0x2000 drivers/net/ppp/ppp_async.c:335 tty_ldisc_receive_buf+0x120/0x160 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x6d/0xa0 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:445 [inline] flush_to_ldisc+0x324/0x850 drivers/tty/tty_buffer.c:495 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x90f/0x1400 kernel/workqueue.c:2703 worker_thread+0xa5f/0xff0 kernel/workqueue.c:2784 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 stack backtrace: CPU: 1 PID: 12 Comm: kworker/u4:1 Not tainted 6.6.0-rc5-syzkaller-00067-g8182d7a3f1b8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 Workqueue: events_unbound flush_to_ldisc Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 mark_lock_irq+0x837/0xba0 kernel/locking/lockdep.c:4235 mark_lock+0x21b/0x340 kernel/locking/lockdep.c:4677 mark_usage kernel/locking/lockdep.c:4578 [inline] __lock_acquire+0x1114/0x7f70 kernel/locking/lockdep.c:5090 lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5753 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228 ap_get drivers/net/ppp/ppp_async.c:136 [inline] ppp_asynctty_receive+0x40/0x2000 drivers/net/ppp/ppp_async.c:335 tty_ldisc_receive_buf+0x120/0x160 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x6d/0xa0 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:445 [inline] flush_to_ldisc+0x324/0x850 drivers/tty/tty_buffer.c:495 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x90f/0x1400 kernel/workqueue.c:2703 worker_thread+0xa5f/0xff0 kernel/workqueue.c:2784 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at [email protected]. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the bug is already fixed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite bug's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the bug is a duplicate of another bug, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup