possible deadlock in perf_trace_destroy (2)

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 171fc237 Merge 4.14.111 into android-4.14
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=119acda7200000
kernel config: https://syzkaller.appspot.com/x/.config?x=19963a41b6ae10e6
dashboard link: https://syzkaller.appspot.com/bug?extid=2d2973d863a2455155ed
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2d2973...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
4.14.111+ #50 Not tainted
------------------------------------------------------
syz-executor.4/15346 is trying to acquire lock:
(event_mutex){+.+.}, at: [<00000000c5396a4c>]
perf_trace_destroy+0x23/0x100 kernel/trace/trace_event_perf.c:234

but task is already holding lock:
(&event->child_mutex){+.+.}, at: [<00000000c4d81918>]
perf_event_release_kernel+0x1fc/0x870 kernel/events/core.c:4402

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #8 (&event->child_mutex){+.+.}:

-> #7 (&cpuctx_mutex){+.+.}:

-> #6 (pmus_lock){+.+.}:

-> #5 (cpu_hotplug_lock.rw_sem){++++}:

-> #4 (&sb->s_type->i_mutex_key#10){+.+.}:

-> #3 (ashmem_mutex){+.+.}:

-> #2 (&mm->mmap_sem){++++}:

-> #1 (&sb->s_type->i_mutex_key#5){++++}:

-> #0 (event_mutex){+.+.}:

other info that might help us debug this:

Chain exists of:
event_mutex --> &cpuctx_mutex --> &event->child_mutex

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&event->child_mutex);
lock(&cpuctx_mutex);
lock(&event->child_mutex);
lock(event_mutex);

*** DEADLOCK ***

2 locks held by syz-executor.4/15346:
#0: (&ctx->mutex){+.+.}, at: [<00000000c300d21e>]
perf_event_release_kernel+0x1f2/0x870 kernel/events/core.c:4401
#1: (&event->child_mutex){+.+.}, at: [<00000000c4d81918>]
perf_event_release_kernel+0x1fc/0x870 kernel/events/core.c:4402

stack backtrace:
CPU: 1 PID: 15346 Comm: syz-executor.4 Not tainted 4.14.111+ #50
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x10e lib/dump_stack.c:53
print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.