| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CA+icZUUbEHmzgaGFQFEvLPO6b+yuEpnZafT6ZDSkaRbiKYn2+g@mail.gmail.com>
Date: Thu, 24 Sep 2015 08:41:05 +0200
From: Sedat Dilek <sedat.dilek@...il.com>
To: Tejun Heo <tj@...nel.org>, Jiri Kosina <jkosina@...e.cz>
Cc: LKML <linux-kernel@...r.kernel.org>,
Darren Hart <dvhart@...ux.intel.com>,
Lai Jiangshan <jiangshanlai@...il.com>
Subject: Re: [Linux v4.2] workqueue: llvmlinux: acpid: BUG: sleeping function
called from invalid context at kernel/workqueue.c:2680
On Thu, Sep 10, 2015 at 3:04 AM, Lai Jiangshan <jiangshanlai@...il.com> wrote:
> Hi, TJ
>
> I think we need to add might_sleep() on the top of __cancel_work_timer().
> The might_sleep() on the start_flush_work() doesn't cover all the
> paths of __cancel_work_timer().
> And it can help to narrow the area of this bug.
>
> Hi Sedat Dilek
>
> [ 24.705704] irq event stamp: 19968
> [ 24.705706] hardirqs last enabled at (19967): [<ffffffff81917ff2>]
> _raw_spin_unlock_irq+0x32/0x60
> [ 24.705713] hardirqs last disabled at (19968): [<ffffffff81120477>]
> del_timer_sync+0x37/0x110
>
> Is it means the irq-disabled-event is leak by del_timer_sync()? It is
> impossible.
>
> usbhid_close()
> mutex_lock(); // it has might_sleep() check. So the problem seems to be
> // hidden at one of the following statements
> del_timer_sync();
> cancel_work_sync();
>
[ CC HID folks ]
I am seeing this call-trace when compiling a Linux v4.2.y or Linux
v4.3-rcN kernel with my llvm-toolchain and llvmlinux-amd64 patchset.
CLANG sometimes catches things which GCC does not.
Not sure if this is a workqueue or hid issue...
[ 24.824396] BUG: sleeping function called from invalid context at
kernel/workqueue.c:2767
[ 24.824511] in_atomic(): 0, irqs_disabled(): 1, pid: 1485, name: acpid
[ 24.824596] 3 locks held by acpid/1485:
[ 24.824599] #0: (&evdev->mutex){+.+...}, at: [<ffffffff8174a2bc>]
evdev_release+0xbc/0xf0
[ 24.824612] #1: (&dev->mutex#2){+.+...}, at: [<ffffffff817419d7>]
input_close_device+0x27/0x70
[ 24.824624] #2: (hid_open_mut){+.+...}, at: [<ffffffffa0056388>]
usbhid_close+0x28/0xb0 [usbhid]
[ 24.824636] irq event stamp: 7914
[ 24.824639] hardirqs last enabled at (7913): [<ffffffff8192a2b2>]
_raw_spin_unlock_irq+0x32/0x60
[ 24.824646] hardirqs last disabled at (7914): [<ffffffff81120e37>]
del_timer_sync+0x37/0x110
[ 24.824652] softirqs last enabled at (7220): [<ffffffff818b06a9>]
local_bh_enable+0x9/0x20
[ 24.824659] softirqs last disabled at (7218): [<ffffffff818b0689>]
local_bh_disable+0x9/0x20
[ 24.824666] CPU: 1 PID: 1485 Comm: acpid Not tainted
4.3.0-rc2-3-llvmlinux-amd64 #2
[ 24.824670] Hardware name: SAMSUNG ELECTRONICS CO., LTD.
530U3BI/530U4BI/530U4BH/530U3BI/530U4BI/530U4BH, BIOS 13XK 03/28/2013
[ 24.824673] ffff8800d4806948 0000000000000096 0000000000000000
ffff8800b8933bf8
[ 24.824680] ffffffff8149a4ad ffff8800b8933c28 ffffffff810cd53a
ffffffff81c56fcc
[ 24.824686] ffff8801185f4240 0000000000000000 0000000000000acf
ffff8800b8933c68
[ 24.824693] Call Trace:
[ 24.824699] [<ffffffff8149a4ad>] dump_stack+0x7d/0xa0
[ 24.824705] [<ffffffff810cd53a>] ___might_sleep+0x28a/0x2a0
[ 24.824709] [<ffffffff810cd23f>] __might_sleep+0x4f/0xc0
[ 24.824715] [<ffffffff810b01de>] __cancel_work_timer+0x2e/0x270
[ 24.824720] [<ffffffff8192a252>] ? _raw_spin_unlock_irqrestore+0x52/0x80
[ 24.824725] [<ffffffff81120ded>] ? try_to_del_timer_sync+0xad/0xc0
[ 24.824730] [<ffffffff810b01a8>] cancel_work_sync+0x18/0x20
[ 24.824736] [<ffffffffa00563d5>] usbhid_close+0x75/0xb0 [usbhid]
[ 24.824744] [<ffffffffa00394d1>] hidinput_close+0x31/0x40 [hid]
[ 24.824751] [<ffffffffa00394a0>] ? hidinput_open+0x40/0x40 [hid]
[ 24.824756] [<ffffffff817419f8>] input_close_device+0x48/0x70
[ 24.824761] [<ffffffff8174a2d6>] evdev_release+0xd6/0xf0
[ 24.824766] [<ffffffff81271dc7>] __fput+0x107/0x240
[ 24.824771] [<ffffffff81271c56>] ____fput+0x16/0x20
[ 24.824776] [<ffffffff810b979c>] task_work_run+0x6c/0xe0
[ 24.824781] [<ffffffff81003b8a>] prepare_exit_to_usermode+0x13a/0x140
[ 24.824786] [<ffffffff81003e11>] syscall_return_slowpath+0x281/0x2f0
[ 24.824791] [<ffffffff8126e4a5>] ? filp_close+0x65/0x90
[ 24.824796] [<ffffffff81003017>] ? trace_hardirqs_on_thunk+0x17/0x19
[ 24.824802] [<ffffffff8192afe2>] int_ret_from_sys_call+0x25/0x9f
Lai pointed to these parts in...
[ drivers/hid/usbhid/hid-core.c ]
...
void usbhid_close(struct hid_device *hid)
{
struct usbhid_device *usbhid = hid->driver_data;
mutex_lock(&hid_open_mut);
/* protecting hid->open to make sure we don't restart
* data acquistion due to a resumption we no longer
* care about
*/
spin_lock_irq(&usbhid->lock);
if (!--hid->open) {
spin_unlock_irq(&usbhid->lock);
hid_cancel_delayed_stuff(usbhid); <--- XXX
if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL)) {
usb_kill_urb(usbhid->urbin);
usbhid->intf->needs_remote_wakeup = 0;
}
} else {
spin_unlock_irq(&usbhid->lock);
}
mutex_unlock(&hid_open_mut);
}
...
static void hid_cancel_delayed_stuff(struct usbhid_device *usbhid)
{
del_timer_sync(&usbhid->io_retry);
cancel_work_sync(&usbhid->reset_work);
}
...
So can people from HID look at this, too?
Thanks.
- Sedat -
>
> On Wed, Sep 9, 2015 at 6:24 PM, Sedat Dilek <sedat.dilek@...il.com> wrote:
>> [ TO WORKQUEUE maintainers ]
>>
>> Hi,
>>
>> I encountered a BUG with a llvmlinux compiled kernel here on
>> Ubuntu/precise AMD64 touching the workqueue area.
>>
>> [ 24.705463] BUG: sleeping function called from invalid context at
>> kernel/workqueue.c:2680
>> [ 24.705576] in_atomic(): 0, irqs_disabled(): 1, pid: 1447, name: acpid
>> [ 24.705662] 3 locks held by acpid/1447:
>> [ 24.705664] #0: (&evdev->mutex){+.+...}, at: [<ffffffff8173b9ac>]
>> evdev_release+0xbc/0xf0
>> [ 24.705678] #1: (&dev->mutex#2){+.+...}, at: [<ffffffff81733117>]
>> input_close_device+0x27/0x70
>> [ 24.705691] #2: (hid_open_mut){+.+...}, at: [<ffffffffa0056378>]
>> usbhid_close+0x28/0xb0 [usbhid]
>> [ 24.705704] irq event stamp: 19968
>> [ 24.705706] hardirqs last enabled at (19967): [<ffffffff81917ff2>]
>> _raw_spin_unlock_irq+0x32/0x60
>> [ 24.705713] hardirqs last disabled at (19968): [<ffffffff81120477>]
>> del_timer_sync+0x37/0x110
>> [ 24.705720] softirqs last enabled at (18890): [<ffffffff8189e7c9>]
>> local_bh_enable+0x9/0x20
>> [ 24.705726] softirqs last disabled at (18888): [<ffffffff8189e7a9>]
>> local_bh_disable+0x9/0x20
>> [ 24.705734] CPU: 2 PID: 1447 Comm: acpid Not tainted
>> 4.2.0-2-llvmlinux-small #2
>> [ 24.705737] Hardware name: SAMSUNG ELECTRONICS CO., LTD.
>> 530U3BI/530U4BI/530U4BH/530U3BI/530U4BI/530U4BH, BIOS 13XK 03/28/2013
>> [ 24.705741] ffff8800d57ea948 0000000000000092 0000000000000000
>> ffff8800bb3e3aa8
>> [ 24.705748] ffffffff8149287d ffff8800bb3e3ad8 ffffffff810cbf7a
>> ffffffff81c51a34
>> [ 24.705754] ffff8800d3095000 0000000000000000 0000000000000a78
>> ffff8800bb3e3b18
>> [ 24.705761] Call Trace:
>> [ 24.705767] [<ffffffff8149287d>] dump_stack+0x7d/0xa0
>> [ 24.705774] [<ffffffff810cbf7a>] ___might_sleep+0x28a/0x2a0
>> [ 24.705779] [<ffffffff810cbc7f>] __might_sleep+0x4f/0xc0
>> [ 24.705784] [<ffffffff810ae8ff>] start_flush_work+0x2f/0x290
>> [ 24.705789] [<ffffffff810ae8ac>] flush_work+0x5c/0x80
>> [ 24.705792] [<ffffffff810ae86a>] ? flush_work+0x1a/0x80
>> [ 24.705799] [<ffffffff810eddcd>] ? trace_hardirqs_off+0xd/0x10
>> [ 24.705804] [<ffffffff810ad938>] ? try_to_grab_pending+0x48/0x360
>> [ 24.705810] [<ffffffff81917e13>] ? _raw_spin_lock_irqsave+0x73/0x80
>> [ 24.705814] [<ffffffff810aecf9>] __cancel_work_timer+0x179/0x260
>> [ 24.705820] [<ffffffff81917f92>] ? _raw_spin_unlock_irqrestore+0x52/0x80
>> [ 24.705825] [<ffffffff8112042d>] ? try_to_del_timer_sync+0xad/0xc0
>> [ 24.705829] [<ffffffff810aeb78>] cancel_work_sync+0x18/0x20
>> [ 24.705835] [<ffffffffa00563c5>] usbhid_close+0x75/0xb0 [usbhid]
>> [ 24.705844] [<ffffffffa0039431>] hidinput_close+0x31/0x40 [hid]
>> [ 24.705851] [<ffffffffa0039400>] ? hidinput_open+0x40/0x40 [hid]
>> [ 24.705856] [<ffffffff81733138>] input_close_device+0x48/0x70
>> [ 24.705861] [<ffffffff8173b9c6>] evdev_release+0xd6/0xf0
>> [ 24.705867] [<ffffffff8126ed37>] __fput+0x107/0x240
>> [ 24.705872] [<ffffffff8126ebc6>] ____fput+0x16/0x20
>> [ 24.705877] [<ffffffff810b8107>] task_work_run+0x87/0x130
>> [ 24.705883] [<ffffffff810173ef>] do_notify_resume+0x9cf/0xa00
>> [ 24.705888] [<ffffffff810edddd>] ? trace_hardirqs_on+0xd/0x10
>> [ 24.705895] [<ffffffff811d1cc3>] ? context_tracking_user_enter+0x13/0x20
>> [ 24.705900] [<ffffffff81029c31>] ? syscall_trace_leave+0x111/0x340
>> [ 24.705905] [<ffffffff8126eb56>] ? fput+0x76/0xd0
>> [ 24.705909] [<ffffffff8126b415>] ? filp_close+0x65/0x90
>> [ 24.705915] [<ffffffff81003017>] ? trace_hardirqs_on_thunk+0x17/0x19
>> [ 24.705920] [<ffffffff81918dae>] int_signal+0x12/0x17
>>
>> Attached are the full dmesg-log and my kernel-config.
>>
>> Which area in the kernel is the root cause? CC more people?
>>
>> Do you need more informations?
>> How can I help?
>>
>> Regards,
>> - Sedat -
View attachment "dmesg_4.3.0-rc2-3-llvmlinux-amd64_wq-hid-issue.txt" of type "text/plain" (59520 bytes)
Download attachment "config-4.3.0-rc2-3-llvmlinux-amd64" of type "application/octet-stream" (130219 bytes)
Powered by blists - more mailing lists