linux-kernel - Re: [syzbot] [kernel?] possible deadlock in __hrtimer_run

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZF9aWEeQ5+Xvc+oF@shredder>
Date:   Sat, 13 May 2023 12:37:28 +0300
From:   Ido Schimmel <idosch@...dia.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     syzbot <syzbot+3384541342de0ca933f1@...kaller.appspotmail.com>,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [syzbot] [kernel?] possible deadlock in __hrtimer_run_queues

On Fri, May 12, 2023 at 01:41:47PM +0200, Thomas Gleixner wrote:
> No problem. The lockdep splat is enough data.
> 
> Fix below.

Thomas, I applied the fix on top of net-next (which includes
0af462f19e63). I'm getting the splat below during boot and then the
systems hangs.

Thanks

[    1.708425] ============================================                           
[    1.709253] WARNING: possible recursive locking detected                           
[    1.710079] 6.4.0-rc1-custom-gba79e9a73284-dirty #52 Not tainted                   
[    1.711016] --------------------------------------------                                                                                                                  
[    1.711842] swapper/0/0 is trying to acquire lock:                                                                                                                        
[    1.712593] ffffffff8863bfb0 (&obj_hash[i].lock){....}-{2:2}, at: debug_object_activate+0x149/0x560
[    1.714037]                                                                        
[    1.714037] but task is already holding lock:
[    1.714947] ffffffff8863bfb0 (&obj_hash[i].lock){....}-{2:2}, at: debug_object_assert_init+0x279/0x410
[    1.716411] 
[    1.716411] other info that might help us debug this:
[    1.717419]  Possible unsafe locking scenario:
[    1.717419] 
[    1.718332]        CPU0
[    1.718716]        ----
[    1.719099]   lock(&obj_hash[i].lock);
[    1.719695]   lock(&obj_hash[i].lock);
[    1.720282] 
[    1.720282]  *** DEADLOCK ***
[    1.720282] 
[    1.721195]  May be due to missing lock nesting notation
[    1.721195] 
[    1.722245] 2 locks held by swapper/0/0:
[    1.722861]  #0: ffffffff8863bfb0 (&obj_hash[i].lock){....}-{2:2}, at: debug_object_assert_init+0x279/0x410
[    1.724393]  #1: ffff8881f61e9618 (&base->lock){....}-{2:2}, at: lock_timer_base+0x5f/0x200
[    1.725718] 
[    1.725718] stack backtrace:
[    1.726396] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-rc1-custom-gba79e9a73284-dirty #52
[    1.727737] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc37 04/01/2014
[    1.729091] Call Trace:
[    1.729473]  <TASK>
[    1.729816]  dump_stack_lvl+0x91/0xf0
[    1.730400]  check_deadlock+0x618/0xb10
[    1.731023]  __lock_acquire+0x2226/0x62d0
[    1.731664]  ? lockdep_hardirqs_on_prepare+0x420/0x420
[    1.732475]  lock_acquire+0x1a7/0x4e0
[    1.733057]  ? debug_object_activate+0x149/0x560
[    1.733791]  ? lock_sync+0x180/0x180
[    1.734354]  ? lock_acquired+0x238/0xa30
[    1.735000]  ? lock_acquire+0x1a7/0x4e0
[    1.735613]  ? find_held_lock+0x34/0x110
[    1.736238]  _raw_spin_lock_irqsave+0x46/0x90
[    1.736936]  ? debug_object_activate+0x149/0x560
[    1.737669]  debug_object_activate+0x149/0x560
[    1.738372]  ? debug_object_destroy+0x210/0x210
[    1.739095]  ? _raw_spin_lock_irqsave+0x60/0x90
[    1.739820]  ? lock_timer_base+0x184/0x200
[    1.740469]  __mod_timer+0x820/0xea0
[    1.741047]  ? timer_fixup_activate+0x2c0/0x2c0
[    1.741770]  ? find_held_lock+0x34/0x110
[    1.742397]  ? lock_release+0x3b5/0xbd0
[    1.743013]  add_timer+0x67/0x90
[    1.743528]  __queue_delayed_work+0x1a2/0x270
[    1.744226]  queue_delayed_work_on+0xce/0xd0
[    1.744912]  crng_reseed+0x124/0x270
[    1.745485]  ? random_write_iter+0x20/0x20
[    1.746137]  ? add_device_randomness+0xbd/0xf0
[    1.746851]  ? blake2s_update+0x106/0x4e0
[    1.747492]  random_init+0xcd/0x1a0
[    1.748054]  ? random_init_early+0x2a0/0x2a0
[    1.748739]  ? hrtimers_prepare_cpu+0xab/0x330
[    1.749446]  start_kernel+0x226/0x520
[    1.750039]  x86_64_start_reservations+0x18/0x30
[    1.750776]  x86_64_start_kernel+0xf4/0x150
[    1.751432]  secondary_startup_64_no_verify+0x106/0x10b
[    1.752264]  </TASK>