net/rfkill: WARNING in rfkill_fop_read

[Dmitry Vyukov]

Hello,

The following program triggers WARNING message in rfkill_fop_read:

------------[ cut here ]------------
WARNING: CPU: 2 PID: 6975 at kernel/sched/core.c:7663
__might_sleep+0x138/0x1a0()
do not call blocking ops when !TASK_RUNNING; state=1 set at
[<ffffffff81436e01>] prepare_to_wait_event+0x141/0x410
kernel/sched/wait.c:210
Modules linked in:
CPU: 2 PID: 6975 Comm: a.out Not tainted 4.5.0-rc1+ #283
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
00000000ffffffff ffff88003369f908 ffffffff8299a06d ffff88003369f978
ffff8800338e0000 ffffffff864453c0 ffff88003369f948 ffffffff8134fcf9
ffffffff813c9cf8 ffffed00066d3f2b ffffffff864453c0 0000000000001def
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff8299a06d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
[<ffffffff8134fcf9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
[<ffffffff8134fe09>] warn_slowpath_fmt+0xa9/0xd0 kernel/panic.c:494
[<ffffffff813c9cf8>] __might_sleep+0x138/0x1a0 kernel/sched/core.c:7658
[<ffffffff8634f934>] mutex_lock_nested+0x74/0xa50 kernel/locking/mutex.c:617
[< inline >] rfkill_readable net/rfkill/core.c:1102
[<ffffffff8613403d>] rfkill_fop_read+0x23d/0x3e0 net/rfkill/core.c:1125
[<ffffffff817a9831>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719
[<ffffffff817ad698>] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849
[<ffffffff817ad803>] vfs_readv+0x83/0xb0 fs/read_write.c:873
[< inline >] SYSC_readv fs/read_write.c:899
[<ffffffff817b0771>] SyS_readv+0x111/0x2b0 fs/read_write.c:891
[<ffffffff86359636>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
---[ end trace 8fc3336c73e4219c ]---


// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <pthread.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/wait.h>
#include <stdlib.h>

long r[8];

void* thr(void* arg)
{
switch ((long)arg) {
case 0:
r[0] = syscall(SYS_mmap, 0x20000000ul, 0x50000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
break;
case 1:
r[2] = open("/dev/rfkill", O_RDWR);
break;
case 2:
*(uint64_t*)0x20042fe0 = (uint64_t)0x20042ff9;
*(uint64_t*)0x20042fe8 = (uint64_t)0x7;
*(uint64_t*)0x20042ff0 = (uint64_t)0x20032fa1;
*(uint64_t*)0x20042ff8 = (uint64_t)0xf4;
r[7] = syscall(SYS_readv, r[2], 0x20042fe0ul, 0x2ul, 0, 0, 0);
break;
}
return 0;
}

void worker()
{
long i;
pthread_t th[3];

memset(r, -1, sizeof(r));
for (i = 0; i < 3; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
usleep(10000);
}
for (i = 0; i < 3; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
if (i % 2 == 0)
usleep(10000);
}
usleep(100000);
}

int main()
{
int i, status, pids[16];

for (;;) {
for (i = 0; i < 16; i++) {
if ((pids[i] = fork()) == 0) {
worker();
exit(0);
}
}
for (i = 0; i < 16; i++) {
while (waitpid(pids[i], &status, __WALL) != pids[i]) {
}
}
}
return 0;
}

On commit 92e963f50fc74041b5e9e744c330dca48e04f08d (Jan 24).

[Johannes Berg]

On Tue, 2016-01-26 at 10:55 +0100, Dmitry Vyukov wrote:
> Hello,
>
> The following program triggers WARNING message in rfkill_fop_read:
>
> ------------[ cut here ]------------
> WARNING: CPU: 2 PID: 6975 at kernel/sched/core.c:7663
> __might_sleep+0x138/0x1a0()
> do not call blocking ops when !TASK_RUNNING; state=1 set at
> [<ffffffff81436e01>] prepare_to_wait_event+0x141/0x410
> kernel/sched/wait.c:210

>  [<     inline     >] rfkill_readable net/rfkill/core.c:1102

Yeah, this should not acquire the mutex ... but luckily it's not a
problem not to anyway, so it's easy to fix. Thanks! I'll send out a fix
once I've tested it.

> // autogenerated by syzkaller (http://github.com/google/syzkaller)

gotta love the raw mmap etc. :)

johannes