linux-kernel - possible deadlock in ftrace_profile_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <f4f5e803bcb8934e190563610bfb@google.com>
Date:   Mon, 22 Jan 2018 09:49:00 -0800
From:   syzbot 
        <syzbot+7b44b47914a5b3dc2038ff8f39e13a0e0f9e5f78@...kaller.appspotmail.com>
To:     linux-kernel@...r.kernel.org, mingo@...hat.com,
        rostedt@...dmis.org, syzkaller-bugs@...glegroups.com
Subject: possible deadlock in ftrace_profile_set_filter (2)

syzbot has found reproducer for the following crash on  
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/master commit
ebdd7b491b8a65d65936e07004caabca4a3c94a0 (Sun Jan 21 23:21:31 2018 +0000)
Merge branch 'mlxsw-Add-support-for-mirror-action-with-flower'

So far this crash happened 3 times on  
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/master,  
linux-next.
C reproducer is attached.
syzkaller reproducer is attached.
Raw console output is attached.
compiler: gcc (GCC) 7.1.1 20170620
.config is attached.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by:  
syzbot+7b44b47914a5b3dc2038ff8f39e13a0e0f9e5f78@...kaller.appspotmail.com
It will help syzbot understand when the bug is fixed.


======================================================
WARNING: possible circular locking dependency detected
4.15.0-rc8+ #1 Not tainted
------------------------------------------------------
syzkaller301315/3887 is trying to acquire lock:
  (event_mutex){+.+.}, at: [<00000000dfa1326b>]  
ftrace_profile_set_filter+0x7a/0x270 kernel/trace/trace_events_filter.c:2266

but task is already holding lock:
  (&cpuctx_mutex){+.+.}, at: [<00000000e276bad6>]  
perf_event_ctx_lock_nested+0x21b/0x450 kernel/events/core.c:1249

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #4 (&cpuctx_mutex){+.+.}:
        __mutex_lock_common kernel/locking/mutex.c:756 [inline]
        __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893
        mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
        perf_event_init_cpu+0xb6/0x160 kernel/events/core.c:11076
        perf_event_init+0x4e9/0x549 kernel/events/core.c:11123
        start_kernel+0x4cc/0x819 init/main.c:627
        x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:378
        x86_64_start_kernel+0x77/0x7a arch/x86/kernel/head64.c:359
        secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:237

-> #3 (pmus_lock){+.+.}:
        __mutex_lock_common kernel/locking/mutex.c:756 [inline]
        __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893
        mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
        perf_event_init_cpu+0x2f/0x160 kernel/events/core.c:11070
        cpuhp_invoke_callback+0x2ea/0x1d20 kernel/cpu.c:182
        cpuhp_up_callbacks kernel/cpu.c:477 [inline]
        _cpu_up+0x216/0x510 kernel/cpu.c:1036
        do_cpu_up+0x73/0xa0 kernel/cpu.c:1066
        cpu_up+0x18/0x20 kernel/cpu.c:1074
        smp_init+0x13a/0x152 kernel/smp.c:578
        kernel_init_freeable+0x2fe/0x521 init/main.c:1067
        kernel_init+0x13/0x180 init/main.c:999
        ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:541

-> #2 (cpu_hotplug_lock.rw_sem){++++}:
        percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36  
[inline]
        percpu_down_read include/linux/percpu-rwsem.h:59 [inline]
        cpus_read_lock+0x42/0x90 kernel/cpu.c:293
        static_key_slow_inc+0x9d/0x3c0 kernel/jump_label.c:123
        tracepoint_add_func kernel/tracepoint.c:223 [inline]
        tracepoint_probe_register_prio+0x80d/0x9a0 kernel/tracepoint.c:283
        tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304
        trace_event_reg+0x167/0x320 kernel/trace/trace_events.c:305
        perf_trace_event_reg kernel/trace/trace_event_perf.c:122 [inline]
        perf_trace_event_init kernel/trace/trace_event_perf.c:197 [inline]
        perf_trace_init+0x4ef/0xab0 kernel/trace/trace_event_perf.c:221
        perf_tp_event_init+0x7d/0xf0 kernel/events/core.c:7959
        perf_try_init_event+0xc9/0x1f0 kernel/events/core.c:9192
        perf_init_event kernel/events/core.c:9230 [inline]
        perf_event_alloc+0x1cc6/0x2b00 kernel/events/core.c:9494
        SYSC_perf_event_open+0x84e/0x2e00 kernel/events/core.c:9949


View attachment "raw.log.txt" of type "text/plain" (5062 bytes)

View attachment "repro.syz.txt" of type "text/plain" (859 bytes)

View attachment "repro.c.txt" of type "text/plain" (5852 bytes)

View attachment "config.txt" of type "text/plain" (135631 bytes)