[syzbot] possible deadlock in perf_event_ctx_lock_nested (2)
12 views
Skip to first unread message
syzbot
May 17, 2021, 7:17:18 AM5/17/21
to ac...@kernel.org, alexander...@linux.intel.com, and...@kernel.org, a...@kernel.org, b...@vger.kernel.org, dan...@iogearbox.net, john.fa...@gmail.com, jo...@redhat.com, ka...@fb.com, kps...@kernel.org, linux-...@vger.kernel.org, linux-pe...@vger.kernel.org, mark.r...@arm.com, mi...@redhat.com, namh...@kernel.org, net...@vger.kernel.org, pet...@infradead.org, songliu...@fb.com, syzkall...@googlegroups.com, y...@fb.com
Hello,
syzbot found the following issue on:
HEAD commit: 88b06399 Merge tag 'for-5.13-rc1-part2-tag' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15552e1bd00000
kernel config: https://syzkaller.appspot.com/x/.config?x=807beec6b4d66bf1
dashboard link: https://syzkaller.appspot.com/bug?extid=4b71bb3365e7d5228913
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4b71bb...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
5.13.0-rc1-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.0/26566 is trying to acquire lock:
ffff88808aa32b58 (&mm->mmap_lock#2){++++}-{3:3}, at: __might_fault+0xa3/0x180 mm/memory.c:5069
but task is already holding lock:
ffff8880b9c3a4b0 (&cpuctx_mutex){+.+.}-{3:3}, at: perf_event_ctx_lock_nested+0x26c/0x480 kernel/events/core.c:1356
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&cpuctx_mutex){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:949 [inline]
__mutex_lock+0x139/0x1120 kernel/locking/mutex.c:1096
perf_event_init_cpu+0x172/0x3e0 kernel/events/core.c:13236
perf_event_init+0x39d/0x408 kernel/events/core.c:13283
start_kernel+0x2b6/0x496 init/main.c:1001
secondary_startup_64_no_verify+0xb0/0xbb
-> #2 (pmus_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:949 [inline]
__mutex_lock+0x139/0x1120 kernel/locking/mutex.c:1096
perf_event_init_cpu+0xc4/0x3e0 kernel/events/core.c:13230
cpuhp_invoke_callback+0x3b5/0x9a0 kernel/cpu.c:179
cpuhp_invoke_callback_range kernel/cpu.c:654 [inline]
cpuhp_up_callbacks kernel/cpu.c:682 [inline]
_cpu_up+0x3ab/0x6b0 kernel/cpu.c:1301
cpu_up kernel/cpu.c:1336 [inline]
cpu_up+0xfe/0x1a0 kernel/cpu.c:1308
bringup_nonboot_cpus+0xfe/0x130 kernel/cpu.c:1398
smp_init+0x2e/0x145 kernel/smp.c:1090
kernel_init_freeable+0x402/0x6cc init/main.c:1552
kernel_init+0xd/0x1b8 init/main.c:1447
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
-> #1 (cpu_hotplug_lock){++++}-{0:0}:
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
cpus_read_lock+0x40/0x130 kernel/cpu.c:297
__static_key_slow_dec kernel/jump_label.c:254 [inline]
static_key_slow_dec+0x4f/0xc0 kernel/jump_label.c:270
sw_perf_event_destroy+0x99/0x140 kernel/events/core.c:9544
_free_event+0x2ee/0x1380 kernel/events/core.c:4949
put_event kernel/events/core.c:5043 [inline]
perf_mmap_close+0x572/0xe10 kernel/events/core.c:6088
remove_vma+0xae/0x170 mm/mmap.c:186
remove_vma_list mm/mmap.c:2659 [inline]
__do_munmap+0x74f/0x11a0 mm/mmap.c:2915
do_munmap mm/mmap.c:2923 [inline]
munmap_vma_range mm/mmap.c:604 [inline]
mmap_region+0x85a/0x1730 mm/mmap.c:1756
do_mmap+0xcff/0x11d0 mm/mmap.c:1587
vm_mmap_pgoff+0x1b7/0x290 mm/util.c:519
ksys_mmap_pgoff+0x4a8/0x620 mm/mmap.c:1638
do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (&mm->mmap_lock#2){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:2938 [inline]
check_prevs_add kernel/locking/lockdep.c:3061 [inline]
validate_chain kernel/locking/lockdep.c:3676 [inline]
__lock_acquire+0x2a17/0x5230 kernel/locking/lockdep.c:4902
lock_acquire kernel/locking/lockdep.c:5512 [inline]
lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5477
__might_fault mm/memory.c:5070 [inline]
__might_fault+0x106/0x180 mm/memory.c:5055
_copy_to_user+0x27/0x150 lib/usercopy.c:28
copy_to_user include/linux/uaccess.h:200 [inline]
_perf_ioctl+0x882/0x2650 kernel/events/core.c:5603
perf_ioctl+0x76/0xb0 kernel/events/core.c:5683
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:1069 [inline]
__se_sys_ioctl fs/ioctl.c:1055 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:1055
do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of:
&mm->mmap_lock#2 --> pmus_lock --> &cpuctx_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&cpuctx_mutex);
lock(pmus_lock);
lock(&cpuctx_mutex);
lock(&mm->mmap_lock#2);
*** DEADLOCK ***
1 lock held by syz-executor.0/26566:
#0: ffff8880b9c3a4b0 (&cpuctx_mutex){+.+.}-{3:3}, at: perf_event_ctx_lock_nested+0x26c/0x480 kernel/events/core.c:1356
stack backtrace:
CPU: 1 PID: 26566 Comm: syz-executor.0 Not tainted 5.13.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2129
check_prev_add kernel/locking/lockdep.c:2938 [inline]
check_prevs_add kernel/locking/lockdep.c:3061 [inline]
validate_chain kernel/locking/lockdep.c:3676 [inline]
__lock_acquire+0x2a17/0x5230 kernel/locking/lockdep.c:4902
lock_acquire kernel/locking/lockdep.c:5512 [inline]
lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5477
__might_fault mm/memory.c:5070 [inline]
__might_fault+0x106/0x180 mm/memory.c:5055
_copy_to_user+0x27/0x150 lib/usercopy.c:28
copy_to_user include/linux/uaccess.h:200 [inline]
_perf_ioctl+0x882/0x2650 kernel/events/core.c:5603
perf_ioctl+0x76/0xb0 kernel/events/core.c:5683
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:1069 [inline]
__se_sys_ioctl fs/ioctl.c:1055 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:1055
do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f021b976188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9
RDX: 0000000020000000 RSI: 0000000080082407 RDI: 0000000000000003
RBP: 00000000004bfce1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffdd1a9f15f R14: 00007f021b976300 R15: 0000000000022000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 88b06399 Merge tag 'for-5.13-rc1-part2-tag' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15552e1bd00000
kernel config: https://syzkaller.appspot.com/x/.config?x=807beec6b4d66bf1
dashboard link: https://syzkaller.appspot.com/bug?extid=4b71bb3365e7d5228913
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4b71bb...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
5.13.0-rc1-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.0/26566 is trying to acquire lock:
ffff88808aa32b58 (&mm->mmap_lock#2){++++}-{3:3}, at: __might_fault+0xa3/0x180 mm/memory.c:5069
but task is already holding lock:
ffff8880b9c3a4b0 (&cpuctx_mutex){+.+.}-{3:3}, at: perf_event_ctx_lock_nested+0x26c/0x480 kernel/events/core.c:1356
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&cpuctx_mutex){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:949 [inline]
__mutex_lock+0x139/0x1120 kernel/locking/mutex.c:1096
perf_event_init_cpu+0x172/0x3e0 kernel/events/core.c:13236
perf_event_init+0x39d/0x408 kernel/events/core.c:13283
start_kernel+0x2b6/0x496 init/main.c:1001
secondary_startup_64_no_verify+0xb0/0xbb
-> #2 (pmus_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:949 [inline]
__mutex_lock+0x139/0x1120 kernel/locking/mutex.c:1096
perf_event_init_cpu+0xc4/0x3e0 kernel/events/core.c:13230
cpuhp_invoke_callback+0x3b5/0x9a0 kernel/cpu.c:179
cpuhp_invoke_callback_range kernel/cpu.c:654 [inline]
cpuhp_up_callbacks kernel/cpu.c:682 [inline]
_cpu_up+0x3ab/0x6b0 kernel/cpu.c:1301
cpu_up kernel/cpu.c:1336 [inline]
cpu_up+0xfe/0x1a0 kernel/cpu.c:1308
bringup_nonboot_cpus+0xfe/0x130 kernel/cpu.c:1398
smp_init+0x2e/0x145 kernel/smp.c:1090
kernel_init_freeable+0x402/0x6cc init/main.c:1552
kernel_init+0xd/0x1b8 init/main.c:1447
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
-> #1 (cpu_hotplug_lock){++++}-{0:0}:
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
cpus_read_lock+0x40/0x130 kernel/cpu.c:297
__static_key_slow_dec kernel/jump_label.c:254 [inline]
static_key_slow_dec+0x4f/0xc0 kernel/jump_label.c:270
sw_perf_event_destroy+0x99/0x140 kernel/events/core.c:9544
_free_event+0x2ee/0x1380 kernel/events/core.c:4949
put_event kernel/events/core.c:5043 [inline]
perf_mmap_close+0x572/0xe10 kernel/events/core.c:6088
remove_vma+0xae/0x170 mm/mmap.c:186
remove_vma_list mm/mmap.c:2659 [inline]
__do_munmap+0x74f/0x11a0 mm/mmap.c:2915
do_munmap mm/mmap.c:2923 [inline]
munmap_vma_range mm/mmap.c:604 [inline]
mmap_region+0x85a/0x1730 mm/mmap.c:1756
do_mmap+0xcff/0x11d0 mm/mmap.c:1587
vm_mmap_pgoff+0x1b7/0x290 mm/util.c:519
ksys_mmap_pgoff+0x4a8/0x620 mm/mmap.c:1638
do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (&mm->mmap_lock#2){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:2938 [inline]
check_prevs_add kernel/locking/lockdep.c:3061 [inline]
validate_chain kernel/locking/lockdep.c:3676 [inline]
__lock_acquire+0x2a17/0x5230 kernel/locking/lockdep.c:4902
lock_acquire kernel/locking/lockdep.c:5512 [inline]
lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5477
__might_fault mm/memory.c:5070 [inline]
__might_fault+0x106/0x180 mm/memory.c:5055
_copy_to_user+0x27/0x150 lib/usercopy.c:28
copy_to_user include/linux/uaccess.h:200 [inline]
_perf_ioctl+0x882/0x2650 kernel/events/core.c:5603
perf_ioctl+0x76/0xb0 kernel/events/core.c:5683
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:1069 [inline]
__se_sys_ioctl fs/ioctl.c:1055 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:1055
do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of:
&mm->mmap_lock#2 --> pmus_lock --> &cpuctx_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&cpuctx_mutex);
lock(pmus_lock);
lock(&cpuctx_mutex);
lock(&mm->mmap_lock#2);
*** DEADLOCK ***
1 lock held by syz-executor.0/26566:
#0: ffff8880b9c3a4b0 (&cpuctx_mutex){+.+.}-{3:3}, at: perf_event_ctx_lock_nested+0x26c/0x480 kernel/events/core.c:1356
stack backtrace:
CPU: 1 PID: 26566 Comm: syz-executor.0 Not tainted 5.13.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2129
check_prev_add kernel/locking/lockdep.c:2938 [inline]
check_prevs_add kernel/locking/lockdep.c:3061 [inline]
validate_chain kernel/locking/lockdep.c:3676 [inline]
__lock_acquire+0x2a17/0x5230 kernel/locking/lockdep.c:4902
lock_acquire kernel/locking/lockdep.c:5512 [inline]
lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5477
__might_fault mm/memory.c:5070 [inline]
__might_fault+0x106/0x180 mm/memory.c:5055
_copy_to_user+0x27/0x150 lib/usercopy.c:28
copy_to_user include/linux/uaccess.h:200 [inline]
_perf_ioctl+0x882/0x2650 kernel/events/core.c:5603
perf_ioctl+0x76/0xb0 kernel/events/core.c:5683
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:1069 [inline]
__se_sys_ioctl fs/ioctl.c:1055 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:1055
do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f021b976188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9
RDX: 0000000020000000 RSI: 0000000080082407 RDI: 0000000000000003
RBP: 00000000004bfce1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffdd1a9f15f R14: 00007f021b976300 R15: 0000000000022000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Oct 19, 2021, 8:50:23 AM10/19/21
to ac...@kernel.org, alexander...@linux.intel.com, and...@kernel.org, a...@kernel.org, b...@vger.kernel.org, dan...@iogearbox.net, john.fa...@gmail.com, jo...@redhat.com, ka...@fb.com, kps...@kernel.org, linux-...@vger.kernel.org, linux-pe...@vger.kernel.org, mark.r...@arm.com, mi...@redhat.com, namh...@kernel.org, net...@vger.kernel.org, pet...@infradead.org, songliu...@fb.com, syzkall...@googlegroups.com, y...@fb.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 60e8840126bd Add linux-next specific files for 20211018
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=15c92b80b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=4bd44cafcda7632e
dashboard link: https://syzkaller.appspot.com/bug?extid=4b71bb3365e7d5228913
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11eccf58b00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4b71bb...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
5.15.0-rc5-next-20211018-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.1/30066 is trying to acquire lock:
ffff88807cb88f28 (&mm->mmap_lock#2){++++}-{3:3}, at: __might_fault+0xa1/0x170 mm/memory.c:5243
but task is already holding lock:
ffff8880b9c3fab0 (&cpuctx_mutex){+.+.}-{3:3}, at: perf_event_ctx_lock_nested+0x23a/0x490 kernel/events/core.c:1357
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&cpuctx_mutex){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:599 [inline]
__mutex_lock+0x12f/0x12f0 kernel/locking/mutex.c:732
perf_event_init_cpu+0x172/0x3e0 kernel/events/core.c:13325
perf_event_init+0x39d/0x408 kernel/events/core.c:13372
start_kernel+0x2bb/0x49b init/main.c:1063
__mutex_lock+0x12f/0x12f0 kernel/locking/mutex.c:732
perf_event_init_cpu+0xc4/0x3e0 kernel/events/core.c:13319
cpuhp_invoke_callback+0x3b5/0x9a0 kernel/cpu.c:190
cpuhp_invoke_callback_range kernel/cpu.c:665 [inline]
cpuhp_up_callbacks kernel/cpu.c:693 [inline]
_cpu_up+0x3b0/0x790 kernel/cpu.c:1368
cpu_up kernel/cpu.c:1404 [inline]
cpu_up+0xfe/0x1a0 kernel/cpu.c:1376
bringup_nonboot_cpus+0xfe/0x130 kernel/cpu.c:1470
smp_init+0x2e/0x145 kernel/smp.c:1092
kernel_init_freeable+0x477/0x73a init/main.c:1618
kernel_init+0x1a/0x1d0 init/main.c:1515
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (cpu_hotplug_lock){++++}-{0:0}:
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
cpus_read_lock+0x3e/0x140 kernel/cpu.c:308
wake_up_all_idle_cpus+0x13/0x80 kernel/smp.c:1173
cpu_latency_qos_apply kernel/power/qos.c:249 [inline]
cpu_latency_qos_remove_request.part.0+0xc4/0x2f0 kernel/power/qos.c:328
cpu_latency_qos_remove_request+0x65/0x80 kernel/power/qos.c:330
snd_pcm_hw_params+0x1481/0x1990 sound/core/pcm_native.c:784
snd_pcm_kernel_ioctl+0x164/0x310 sound/core/pcm_native.c:3355
snd_pcm_oss_change_params_locked+0x1936/0x3a60 sound/core/oss/pcm_oss.c:947
snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1091 [inline]
snd_pcm_oss_mmap+0x442/0x550 sound/core/oss/pcm_oss.c:2910
call_mmap include/linux/fs.h:2164 [inline]
mmap_region+0xd8c/0x1650 mm/mmap.c:1787
do_mmap+0x869/0xfb0 mm/mmap.c:1575
vm_mmap_pgoff+0x1b7/0x290 mm/util.c:519
ksys_mmap_pgoff+0x49f/0x620 mm/mmap.c:1624
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
check_prevs_add kernel/locking/lockdep.c:3186 [inline]
validate_chain kernel/locking/lockdep.c:3801 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5027
lock_acquire kernel/locking/lockdep.c:5637 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602
__might_fault mm/memory.c:5244 [inline]
__might_fault+0x104/0x170 mm/memory.c:5229
__perf_read kernel/events/core.c:5396 [inline]
perf_read+0x736/0x900 kernel/events/core.c:5415
do_loop_readv_writev fs/read_write.c:750 [inline]
do_loop_readv_writev fs/read_write.c:737 [inline]
do_iter_read+0x501/0x760 fs/read_write.c:792
vfs_readv+0xe5/0x150 fs/read_write.c:910
do_readv+0x139/0x300 fs/read_write.c:947
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
#0: ffff8880b9c3fab0 (&cpuctx_mutex){+.+.}-{3:3}, at: perf_event_ctx_lock_nested+0x23a/0x490 kernel/events/core.c:1357
stack backtrace:
CPU: 0 PID: 30066 Comm: syz-executor.1 Not tainted 5.15.0-rc5-next-20211018-syzkaller #0
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2143
check_prev_add kernel/locking/lockdep.c:3063 [inline]
check_prevs_add kernel/locking/lockdep.c:3186 [inline]
validate_chain kernel/locking/lockdep.c:3801 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5027
lock_acquire kernel/locking/lockdep.c:5637 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602
__might_fault mm/memory.c:5244 [inline]
__might_fault+0x104/0x170 mm/memory.c:5229
__perf_read kernel/events/core.c:5396 [inline]
perf_read+0x736/0x900 kernel/events/core.c:5415
do_loop_readv_writev fs/read_write.c:750 [inline]
do_loop_readv_writev fs/read_write.c:737 [inline]
do_iter_read+0x501/0x760 fs/read_write.c:792
vfs_readv+0xe5/0x150 fs/read_write.c:910
do_readv+0x139/0x300 fs/read_write.c:947
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f78228c6a39
RAX: ffffffffffffffda RBX: 00007f78229ca0e0 RCX: 00007f78228c6a39
RDX: 0000000000000001 RSI: 00000000200002c0 RDI: 0000000000000007
RBP: 00007f7822920c5f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd71dc7def R14: 00007f7821ffa300 R15: 0000000000022000
</TASK>
HEAD commit: 60e8840126bd Add linux-next specific files for 20211018
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=15c92b80b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=4bd44cafcda7632e
dashboard link: https://syzkaller.appspot.com/bug?extid=4b71bb3365e7d5228913
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11eccf58b00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4b71bb...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
------------------------------------------------------
syz-executor.1/30066 is trying to acquire lock:
ffff88807cb88f28 (&mm->mmap_lock#2){++++}-{3:3}, at: __might_fault+0xa1/0x170 mm/memory.c:5243
but task is already holding lock:
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&cpuctx_mutex){+.+.}-{3:3}:
__mutex_lock+0x12f/0x12f0 kernel/locking/mutex.c:732
perf_event_init_cpu+0x172/0x3e0 kernel/events/core.c:13325
perf_event_init+0x39d/0x408 kernel/events/core.c:13372
start_kernel+0x2bb/0x49b init/main.c:1063
secondary_startup_64_no_verify+0xb0/0xbb
-> #2 (pmus_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:599 [inline]
-> #2 (pmus_lock){+.+.}-{3:3}:
__mutex_lock+0x12f/0x12f0 kernel/locking/mutex.c:732
perf_event_init_cpu+0xc4/0x3e0 kernel/events/core.c:13319
cpuhp_invoke_callback+0x3b5/0x9a0 kernel/cpu.c:190
cpuhp_invoke_callback_range kernel/cpu.c:665 [inline]
cpuhp_up_callbacks kernel/cpu.c:693 [inline]
_cpu_up+0x3b0/0x790 kernel/cpu.c:1368
cpu_up kernel/cpu.c:1404 [inline]
cpu_up+0xfe/0x1a0 kernel/cpu.c:1376
bringup_nonboot_cpus+0xfe/0x130 kernel/cpu.c:1470
smp_init+0x2e/0x145 kernel/smp.c:1092
kernel_init_freeable+0x477/0x73a init/main.c:1618
kernel_init+0x1a/0x1d0 init/main.c:1515
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (cpu_hotplug_lock){++++}-{0:0}:
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
wake_up_all_idle_cpus+0x13/0x80 kernel/smp.c:1173
cpu_latency_qos_apply kernel/power/qos.c:249 [inline]
cpu_latency_qos_remove_request.part.0+0xc4/0x2f0 kernel/power/qos.c:328
cpu_latency_qos_remove_request+0x65/0x80 kernel/power/qos.c:330
snd_pcm_hw_params+0x1481/0x1990 sound/core/pcm_native.c:784
snd_pcm_kernel_ioctl+0x164/0x310 sound/core/pcm_native.c:3355
snd_pcm_oss_change_params_locked+0x1936/0x3a60 sound/core/oss/pcm_oss.c:947
snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1091 [inline]
snd_pcm_oss_mmap+0x442/0x550 sound/core/oss/pcm_oss.c:2910
call_mmap include/linux/fs.h:2164 [inline]
mmap_region+0xd8c/0x1650 mm/mmap.c:1787
do_mmap+0x869/0xfb0 mm/mmap.c:1575
vm_mmap_pgoff+0x1b7/0x290 mm/util.c:519
ksys_mmap_pgoff+0x49f/0x620 mm/mmap.c:1624
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (&mm->mmap_lock#2){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3063 [inline]
-> #0 (&mm->mmap_lock#2){++++}-{3:3}:
check_prevs_add kernel/locking/lockdep.c:3186 [inline]
validate_chain kernel/locking/lockdep.c:3801 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5027
lock_acquire kernel/locking/lockdep.c:5637 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602
__might_fault mm/memory.c:5244 [inline]
__might_fault+0x104/0x170 mm/memory.c:5229
_copy_to_user+0x27/0x150 lib/usercopy.c:28
copy_to_user include/linux/uaccess.h:200 [inline]
perf_read_group kernel/events/core.c:5329 [inline]
copy_to_user include/linux/uaccess.h:200 [inline]
__perf_read kernel/events/core.c:5396 [inline]
perf_read+0x736/0x900 kernel/events/core.c:5415
do_loop_readv_writev fs/read_write.c:750 [inline]
do_loop_readv_writev fs/read_write.c:737 [inline]
do_iter_read+0x501/0x760 fs/read_write.c:792
vfs_readv+0xe5/0x150 fs/read_write.c:910
do_readv+0x139/0x300 fs/read_write.c:947
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of:
&mm->mmap_lock#2 --> pmus_lock --> &cpuctx_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&cpuctx_mutex);
lock(pmus_lock);
lock(&cpuctx_mutex);
lock(&mm->mmap_lock#2);
*** DEADLOCK ***
1 lock held by syz-executor.1/30066:
other info that might help us debug this:
Chain exists of:
&mm->mmap_lock#2 --> pmus_lock --> &cpuctx_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&cpuctx_mutex);
lock(pmus_lock);
lock(&cpuctx_mutex);
lock(&mm->mmap_lock#2);
*** DEADLOCK ***
#0: ffff8880b9c3fab0 (&cpuctx_mutex){+.+.}-{3:3}, at: perf_event_ctx_lock_nested+0x23a/0x490 kernel/events/core.c:1357
stack backtrace:
CPU: 0 PID: 30066 Comm: syz-executor.1 Not tainted 5.15.0-rc5-next-20211018-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2143
check_prev_add kernel/locking/lockdep.c:3063 [inline]
check_prevs_add kernel/locking/lockdep.c:3186 [inline]
validate_chain kernel/locking/lockdep.c:3801 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5027
lock_acquire kernel/locking/lockdep.c:5637 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602
__might_fault mm/memory.c:5244 [inline]
__might_fault+0x104/0x170 mm/memory.c:5229
_copy_to_user+0x27/0x150 lib/usercopy.c:28
copy_to_user include/linux/uaccess.h:200 [inline]
perf_read_group kernel/events/core.c:5329 [inline]
copy_to_user include/linux/uaccess.h:200 [inline]
__perf_read kernel/events/core.c:5396 [inline]
perf_read+0x736/0x900 kernel/events/core.c:5415
do_loop_readv_writev fs/read_write.c:750 [inline]
do_loop_readv_writev fs/read_write.c:737 [inline]
do_iter_read+0x501/0x760 fs/read_write.c:792
vfs_readv+0xe5/0x150 fs/read_write.c:910
do_readv+0x139/0x300 fs/read_write.c:947
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f78228c6a39
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7821ffa188 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 00007f78229ca0e0 RCX: 00007f78228c6a39
RDX: 0000000000000001 RSI: 00000000200002c0 RDI: 0000000000000007
RBP: 00007f7822920c5f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd71dc7def R14: 00007f7821ffa300 R15: 0000000000022000
</TASK>
syzbot
Oct 19, 2021, 1:09:14 PM10/19/21
to ac...@kernel.org, alexander...@linux.intel.com, and...@kernel.org, a...@kernel.org, big...@linutronix.de, b...@vger.kernel.org, bri...@redhat.com, bse...@google.com, dan...@iogearbox.net, dietmar....@arm.com, g...@linux.ibm.com, jgr...@suse.com, john.fa...@gmail.com, jo...@redhat.com, juri....@redhat.com, ka...@fb.com, kps...@kernel.org, linux-...@vger.kernel.org, linux-pe...@vger.kernel.org, mark.r...@arm.com, mgo...@suse.de, mi...@redhat.com, namh...@kernel.org, na...@vmware.com, net...@vger.kernel.org, pet...@infradead.org, ros...@goodmis.org, songliu...@fb.com, syzkall...@googlegroups.com, vincent...@linaro.org, y...@fb.com
syzbot has bisected this issue to:
commit 8850cb663b5cda04d33f9cfbc38889d73d3c8e24
Author: Peter Zijlstra <pet...@infradead.org>
Date: Tue Sep 21 20:16:02 2021 +0000
sched: Simplify wake_up_*idle*()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=166a8c90b00000
start commit: 60e8840126bd Add linux-next specific files for 20211018
git tree: linux-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=156a8c90b00000
console output: https://syzkaller.appspot.com/x/log.txt?x=116a8c90b00000
Reported-by: syzbot+4b71bb...@syzkaller.appspotmail.com
Fixes: 8850cb663b5c ("sched: Simplify wake_up_*idle*()")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 8850cb663b5cda04d33f9cfbc38889d73d3c8e24
Author: Peter Zijlstra <pet...@infradead.org>
Date: Tue Sep 21 20:16:02 2021 +0000
sched: Simplify wake_up_*idle*()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=166a8c90b00000
start commit: 60e8840126bd Add linux-next specific files for 20211018
git tree: linux-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=156a8c90b00000
console output: https://syzkaller.appspot.com/x/log.txt?x=116a8c90b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=4bd44cafcda7632e
dashboard link: https://syzkaller.appspot.com/bug?extid=4b71bb3365e7d5228913
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11eccf58b00000
dashboard link: https://syzkaller.appspot.com/bug?extid=4b71bb3365e7d5228913
Reported-by: syzbot+4b71bb...@syzkaller.appspotmail.com
Fixes: 8850cb663b5c ("sched: Simplify wake_up_*idle*()")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Oct 17, 2022, 4:54:31 AM10/17/22
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages