| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 15 Jan 2016 08:51:39 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Jiri Slaby <jslaby@...e.com>,
LKML <linux-kernel@...r.kernel.org>,
J Freyensee <james_p_freyensee@...ux.intel.com>
Cc: syzkaller <syzkaller@...glegroups.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>,
Eric Dumazet <edumazet@...gle.com>
Subject: Re: tty: deadlock between n_tracerouter_receivebuf and flush_to_ldisc
On Wed, Dec 30, 2015 at 11:44 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
> Hello,
>
> I've got the following lock order inversion report on
> 8513342170278468bac126640a5d2d12ffbff106 (Dec 28). Unfortunately I
> failed to find a reproducer for it.
Ping. This is the most frequent failure during my testing now. J
Freyensee, you seem to wrote drivers/tty/n_tracerouter.c. Please take
a look. Thanks.
> ======================================================
> [ INFO: possible circular locking dependency detected ]
> 4.4.0-rc7+ #181 Not tainted
> -------------------------------------------------------
> kworker/u9:2/35 is trying to acquire lock:
> (routelock){+.+...}, at: [<ffffffff82bc77c0>]
> n_tracerouter_receivebuf+0x20/0x40 drivers/tty/n_tracerouter.c:175
>
> but task is already holding lock:
> (&buf->lock){+.+...}, at: [<ffffffff82baf791>]
> flush_to_ldisc+0xe1/0x7f0 drivers/tty/tty_buffer.c:487
>
> which lock already depends on the new lock.
>
> the existing dependency chain (in reverse order) is:
>
> -> #3 (&buf->lock){+.+...}:
> [<ffffffff813f0acf>] lock_acquire+0x19f/0x3c0
> kernel/locking/lockdep.c:3585
> [< inline >] __raw_spin_lock_irqsave
> include/linux/spinlock_api_smp.h:112
> [<ffffffff85c8e790>] _raw_spin_lock_irqsave+0x50/0x70
> kernel/locking/spinlock.c:159
> [<ffffffff82b8c050>] tty_get_pgrp+0x20/0x80 drivers/tty/tty_io.c:2502
> [<ffffffff82b9a09a>] __isig+0x1a/0x50 drivers/tty/n_tty.c:1112
> [<ffffffff82b9c16e>] isig+0xae/0x2c0 drivers/tty/n_tty.c:1131
> [<ffffffff82b9ef02>] n_tty_receive_signal_char+0x22/0xf0
> drivers/tty/n_tty.c:1243
> [<ffffffff82ba4958>] n_tty_receive_char_special+0x1278/0x2bf0
> drivers/tty/n_tty.c:1289
> [< inline >] n_tty_receive_buf_fast drivers/tty/n_tty.c:1613
> [< inline >] __receive_buf drivers/tty/n_tty.c:1647
> [<ffffffff82ba7ca6>] n_tty_receive_buf_common+0x19d6/0x2450
> drivers/tty/n_tty.c:1745
> [<ffffffff82ba8753>] n_tty_receive_buf2+0x33/0x40
> drivers/tty/n_tty.c:1780
> [< inline >] receive_buf drivers/tty/tty_buffer.c:450
> [<ffffffff82bafa6f>] flush_to_ldisc+0x3bf/0x7f0
> drivers/tty/tty_buffer.c:517
> [<ffffffff8133833c>] process_one_work+0x76c/0x13e0
> kernel/workqueue.c:2030
> [<ffffffff81339093>] worker_thread+0xe3/0xe90 kernel/workqueue.c:2162
> [<ffffffff8134b63f>] kthread+0x23f/0x2d0 drivers/block/aoe/aoecmd.c:1303
> [<ffffffff85c8eeef>] ret_from_fork+0x3f/0x70
> arch/x86/entry/entry_64.S:468
>
> -> #2 (&o_tty->termios_rwsem/1){++++..}:
> [<ffffffff813f0acf>] lock_acquire+0x19f/0x3c0
> kernel/locking/lockdep.c:3585
> [<ffffffff85c899cc>] down_read+0x4c/0x70 kernel/locking/rwsem.c:22
> [<ffffffff82ba635d>] n_tty_receive_buf_common+0x8d/0x2450
> drivers/tty/n_tty.c:1708
> [<ffffffff82ba8753>] n_tty_receive_buf2+0x33/0x40
> drivers/tty/n_tty.c:1780
> [< inline >] receive_buf drivers/tty/tty_buffer.c:450
> [<ffffffff82bafa6f>] flush_to_ldisc+0x3bf/0x7f0
> drivers/tty/tty_buffer.c:517
> [<ffffffff8133833c>] process_one_work+0x76c/0x13e0
> kernel/workqueue.c:2030
> [<ffffffff81339093>] worker_thread+0xe3/0xe90 kernel/workqueue.c:2162
> [<ffffffff8134b63f>] kthread+0x23f/0x2d0 drivers/block/aoe/aoecmd.c:1303
> [<ffffffff85c8eeef>] ret_from_fork+0x3f/0x70
> arch/x86/entry/entry_64.S:468
>
> -> #1 (&port->buf.lock/1){+.+...}:
> [<ffffffff813f0acf>] lock_acquire+0x19f/0x3c0
> kernel/locking/lockdep.c:3585
> [< inline >] __mutex_lock_common kernel/locking/mutex.c:518
> [<ffffffff85c86ba6>] mutex_lock_nested+0xb6/0x940
> kernel/locking/mutex.c:618
> [<ffffffff82bc77ff>] n_tracerouter_open+0x1f/0x210
> drivers/tty/n_tracerouter.c:75
> [<ffffffff82bacd78>] tty_ldisc_open.isra.2+0x78/0xd0
> drivers/tty/tty_ldisc.c:447
> [<ffffffff82bad43a>] tty_set_ldisc+0x1ca/0xa30
> drivers/tty/tty_ldisc.c:567
> [< inline >] tiocsetd drivers/tty/tty_io.c:2650
> [<ffffffff82b9483a>] tty_ioctl+0xb2a/0x2160 drivers/tty/tty_io.c:2883
> [< inline >] vfs_ioctl fs/ioctl.c:43
> [<ffffffff81750d41>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607
> [< inline >] SYSC_ioctl fs/ioctl.c:622
> [<ffffffff8175158f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
> [<ffffffff85c8eb36>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
>
> -> #0 (routelock){+.+...}:
> [< inline >] check_prev_add kernel/locking/lockdep.c:1853
> [< inline >] check_prevs_add kernel/locking/lockdep.c:1958
> [< inline >] validate_chain kernel/locking/lockdep.c:2144
> [<ffffffff813ee02e>] __lock_acquire+0x345e/0x3ca0
> kernel/locking/lockdep.c:3206
> [<ffffffff813f0acf>] lock_acquire+0x19f/0x3c0
> kernel/locking/lockdep.c:3585
> [< inline >] __mutex_lock_common kernel/locking/mutex.c:518
> [<ffffffff85c86ba6>] mutex_lock_nested+0xb6/0x940
> kernel/locking/mutex.c:618
> [<ffffffff82bc77c0>] n_tracerouter_receivebuf+0x20/0x40
> drivers/tty/n_tracerouter.c:175
> [< inline >] receive_buf drivers/tty/tty_buffer.c:454
> [<ffffffff82bafc34>] flush_to_ldisc+0x584/0x7f0
> drivers/tty/tty_buffer.c:517
> [<ffffffff8133833c>] process_one_work+0x76c/0x13e0
> kernel/workqueue.c:2030
> [<ffffffff81339093>] worker_thread+0xe3/0xe90 kernel/workqueue.c:2162
> [<ffffffff8134b63f>] kthread+0x23f/0x2d0 drivers/block/aoe/aoecmd.c:1303
> [<ffffffff85c8eeef>] ret_from_fork+0x3f/0x70
> arch/x86/entry/entry_64.S:468
>
> other info that might help us debug this:
>
> Chain exists of:
> routelock --> &o_tty->termios_rwsem/1 --> &buf->lock
>
> Possible unsafe locking scenario:
>
> CPU0 CPU1
> ---- ----
> lock(&buf->lock);
> lock(&o_tty->termios_rwsem/1);
> lock(&buf->lock);
> lock(routelock);
>
> *** DEADLOCK ***
>
> 4 locks held by kworker/u9:2/35:
> #0: ("events_unbound"){.+.+.+}, at: [< inline >]
> __write_once_size include/linux/compiler.h:247
> #0: ("events_unbound"){.+.+.+}, at: [< inline >]
> atomic64_set ./arch/x86/include/asm/atomic64_64.h:33
> #0: ("events_unbound"){.+.+.+}, at: [< inline >]
> atomic_long_set include/asm-generic/atomic-long.h:56
> #0: ("events_unbound"){.+.+.+}, at: [< inline >]
> set_work_data kernel/workqueue.c:614
> #0: ("events_unbound"){.+.+.+}, at: [< inline >]
> set_work_pool_and_clear_pending kernel/workqueue.c:641
> #0: ("events_unbound"){.+.+.+}, at: [<ffffffff81338242>]
> process_one_work+0x672/0x13e0 kernel/workqueue.c:2023
> #1: ((&buf->work)){+.+...}, at: [<ffffffff81338272>]
> process_one_work+0x6a2/0x13e0 kernel/workqueue.c:2027
> #2: (&tty->ldisc_sem){++++++}, at: [<ffffffff82bac99b>]
> tty_ldisc_ref+0x1b/0x80 drivers/tty/tty_ldisc.c:283
> #3: (&buf->lock){+.+...}, at: [<ffffffff82baf791>]
> flush_to_ldisc+0xe1/0x7f0 drivers/tty/tty_buffer.c:487
>
> stack backtrace:
> CPU: 0 PID: 35 Comm: kworker/u9:2 Not tainted 4.4.0-rc7+ #181
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Workqueue: events_unbound flush_to_ldisc
> 00000000ffffffff ffff88003d8e77f8 ffffffff8289d9dd ffffffff8866fbf0
> ffffffff8863f050 ffffffff886422f0 ffff88003d8e7840 ffffffff813e7081
> ffff88003d8e7930 000000003d8b1780 ffff88003d8b1fc0 ffff88003d8b1fe2
> Call Trace:
> [< inline >] validate_chain kernel/locking/lockdep.c:2144
> [<ffffffff813ee02e>] __lock_acquire+0x345e/0x3ca0 kernel/locking/lockdep.c:3206
> [<ffffffff813f0acf>] lock_acquire+0x19f/0x3c0 kernel/locking/lockdep.c:3585
> [< inline >] __mutex_lock_common kernel/locking/mutex.c:518
> [<ffffffff85c86ba6>] mutex_lock_nested+0xb6/0x940 kernel/locking/mutex.c:618
> [<ffffffff82bc77c0>] n_tracerouter_receivebuf+0x20/0x40
> drivers/tty/n_tracerouter.c:175
> [< inline >] receive_buf drivers/tty/tty_buffer.c:454
> [<ffffffff82bafc34>] flush_to_ldisc+0x584/0x7f0 drivers/tty/tty_buffer.c:517
> [<ffffffff8133833c>] process_one_work+0x76c/0x13e0 kernel/workqueue.c:2030
> [<ffffffff81339093>] worker_thread+0xe3/0xe90 kernel/workqueue.c:2162
> [<ffffffff8134b63f>] kthread+0x23f/0x2d0 drivers/block/aoe/aoecmd.c:1303
> [<ffffffff85c8eeef>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468
> ======================================================
Powered by blists - more mailing lists