linux-kernel - Re: [Linux v4.2] workqueue: llvmlinux: acpid: BUG: sleeping function called from invalid context at kernel/workqueue.c:2680

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LNX.2.00.1509240941540.30132@pobox.suse.cz>
Date:	Thu, 24 Sep 2015 09:57:59 +0200 (CEST)
From:	Jiri Kosina <jikos@...nel.org>
To:	Sedat Dilek <sedat.dilek@...il.com>
cc:	Tejun Heo <tj@...nel.org>, LKML <linux-kernel@...r.kernel.org>,
	Darren Hart <dvhart@...ux.intel.com>,
	Lai Jiangshan <jiangshanlai@...il.com>
Subject: Re: [Linux v4.2] workqueue: llvmlinux: acpid: BUG: sleeping function
 called from invalid context at kernel/workqueue.c:2680

On Thu, 24 Sep 2015, Sedat Dilek wrote:

> I am seeing this call-trace when compiling a Linux v4.2.y or Linux
> v4.3-rcN kernel with my llvm-toolchain and llvmlinux-amd64 patchset.
> CLANG sometimes catches things which GCC does not.
> 
> Not sure if this is a workqueue or hid issue...
> 
> [   24.824396] BUG: sleeping function called from invalid context at
> kernel/workqueue.c:2767
> [   24.824511] in_atomic(): 0, irqs_disabled(): 1, pid: 1485, name: acpid
> [   24.824596] 3 locks held by acpid/1485:
> [   24.824599]  #0:  (&evdev->mutex){+.+...}, at: [<ffffffff8174a2bc>]
> evdev_release+0xbc/0xf0
> [   24.824612]  #1:  (&dev->mutex#2){+.+...}, at: [<ffffffff817419d7>]
> input_close_device+0x27/0x70
> [   24.824624]  #2:  (hid_open_mut){+.+...}, at: [<ffffffffa0056388>]
> usbhid_close+0x28/0xb0 [usbhid]
> [   24.824636] irq event stamp: 7914
> [   24.824639] hardirqs last  enabled at (7913): [<ffffffff8192a2b2>]
> _raw_spin_unlock_irq+0x32/0x60
> [   24.824646] hardirqs last disabled at (7914): [<ffffffff81120e37>]
> del_timer_sync+0x37/0x110
> [   24.824652] softirqs last  enabled at (7220): [<ffffffff818b06a9>]
> local_bh_enable+0x9/0x20
> [   24.824659] softirqs last disabled at (7218): [<ffffffff818b0689>]
> local_bh_disable+0x9/0x20
> [   24.824666] CPU: 1 PID: 1485 Comm: acpid Not tainted
> 4.3.0-rc2-3-llvmlinux-amd64 #2
> [   24.824670] Hardware name: SAMSUNG ELECTRONICS CO., LTD.
> 530U3BI/530U4BI/530U4BH/530U3BI/530U4BI/530U4BH, BIOS 13XK 03/28/2013
> [   24.824673]  ffff8800d4806948 0000000000000096 0000000000000000
> ffff8800b8933bf8
> [   24.824680]  ffffffff8149a4ad ffff8800b8933c28 ffffffff810cd53a
> ffffffff81c56fcc
> [   24.824686]  ffff8801185f4240 0000000000000000 0000000000000acf
> ffff8800b8933c68
> [   24.824693] Call Trace:
> [   24.824699]  [<ffffffff8149a4ad>] dump_stack+0x7d/0xa0
> [   24.824705]  [<ffffffff810cd53a>] ___might_sleep+0x28a/0x2a0
> [   24.824709]  [<ffffffff810cd23f>] __might_sleep+0x4f/0xc0
> [   24.824715]  [<ffffffff810b01de>] __cancel_work_timer+0x2e/0x270
> [   24.824720]  [<ffffffff8192a252>] ? _raw_spin_unlock_irqrestore+0x52/0x80
> [   24.824725]  [<ffffffff81120ded>] ? try_to_del_timer_sync+0xad/0xc0
> [   24.824730]  [<ffffffff810b01a8>] cancel_work_sync+0x18/0x20

Could you please (on a kernel compiled with debuginfo) resolve (using 
addr2line) those offsets to source code lines? Especially 
__cancel_work_timer+0x2e will be interesting in this case.

__cancel_work_timer() calls try_to_grab_pending() which disabled IRQs, but 
as far as I can see, the only way it goes to sleep then is when 
try_to_grab_pending() returned -ENOENT, but in such case it reenabled IRQs 
explicitly before.

Also the fact that "hardirqs last disabled at (7914): [<ffffffff81120e37>] 
del_timer_sync+0x37/0x110" is a bit puzzling as well, but AFAICS 
del_timer_sync is complete outside the codepath that's on stack.

[ ... snip ... ]
> >> [   24.705463] BUG: sleeping function called from invalid context at
> >> kernel/workqueue.c:2680
> >> [   24.705576] in_atomic(): 0, irqs_disabled(): 1, pid: 1447, name: acpid
> >> [   24.705662] 3 locks held by acpid/1447:
> >> [   24.705664]  #0:  (&evdev->mutex){+.+...}, at: [<ffffffff8173b9ac>]
> >> evdev_release+0xbc/0xf0
> >> [   24.705678]  #1:  (&dev->mutex#2){+.+...}, at: [<ffffffff81733117>]
> >> input_close_device+0x27/0x70
> >> [   24.705691]  #2:  (hid_open_mut){+.+...}, at: [<ffffffffa0056378>]
> >> usbhid_close+0x28/0xb0 [usbhid]
> >> [   24.705704] irq event stamp: 19968
> >> [   24.705706] hardirqs last  enabled at (19967): [<ffffffff81917ff2>]
> >> _raw_spin_unlock_irq+0x32/0x60
> >> [   24.705713] hardirqs last disabled at (19968): [<ffffffff81120477>]
> >> del_timer_sync+0x37/0x110
> >> [   24.705720] softirqs last  enabled at (18890): [<ffffffff8189e7c9>]
> >> local_bh_enable+0x9/0x20
> >> [   24.705726] softirqs last disabled at (18888): [<ffffffff8189e7a9>]
> >> local_bh_disable+0x9/0x20
> >> [   24.705734] CPU: 2 PID: 1447 Comm: acpid Not tainted
> >> 4.2.0-2-llvmlinux-small #2
> >> [   24.705737] Hardware name: SAMSUNG ELECTRONICS CO., LTD.
> >> 530U3BI/530U4BI/530U4BH/530U3BI/530U4BI/530U4BH, BIOS 13XK 03/28/2013
> >> [   24.705741]  ffff8800d57ea948 0000000000000092 0000000000000000
> >> ffff8800bb3e3aa8
> >> [   24.705748]  ffffffff8149287d ffff8800bb3e3ad8 ffffffff810cbf7a
> >> ffffffff81c51a34
> >> [   24.705754]  ffff8800d3095000 0000000000000000 0000000000000a78
> >> ffff8800bb3e3b18
> >> [   24.705761] Call Trace:
> >> [   24.705767]  [<ffffffff8149287d>] dump_stack+0x7d/0xa0
> >> [   24.705774]  [<ffffffff810cbf7a>] ___might_sleep+0x28a/0x2a0
> >> [   24.705779]  [<ffffffff810cbc7f>] __might_sleep+0x4f/0xc0
> >> [   24.705784]  [<ffffffff810ae8ff>] start_flush_work+0x2f/0x290
> >> [   24.705789]  [<ffffffff810ae8ac>] flush_work+0x5c/0x80
> >> [   24.705792]  [<ffffffff810ae86a>] ? flush_work+0x1a/0x80
> >> [   24.705799]  [<ffffffff810eddcd>] ? trace_hardirqs_off+0xd/0x10
> >> [   24.705804]  [<ffffffff810ad938>] ? try_to_grab_pending+0x48/0x360
> >> [   24.705810]  [<ffffffff81917e13>] ? _raw_spin_lock_irqsave+0x73/0x80
> >> [   24.705814]  [<ffffffff810aecf9>] __cancel_work_timer+0x179/0x260

This one is even more strange. It says that flush_work() is being called 
from __cancel_work_timer() with IRQs disabled, but flags are explicitly 
restored just one statement before that, and usbhid_close() explicitly 
calls cancel_work_sync() after unconditionally enabling interrupts.

So I am not able to make any sense of either of the traces really.

Are you seeing this with the same .config with GCC-compiled kernel as 
well?

-- 
Jiri Kosina
SUSE Labs

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/