linux-kernel - Re: [syzbot] [kernel?] possible deadlock in console_flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 20 Mar 2024 00:12:19 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc: syzbot <syzbot+f78380e4eae53c64125c@...kaller.appspotmail.com>, 
	syzkaller-bugs <syzkaller-bugs@...glegroups.com>, Alexei Starovoitov <ast@...nel.org>, 
	Daniel Borkmann <daniel@...earbox.net>, John Fastabend <john.fastabend@...il.com>, 
	Petr Mladek <pmladek@...e.com>, Steven Rostedt <rostedt@...dmis.org>, 
	John Ogness <john.ogness@...utronix.de>, Sergey Senozhatsky <senozhatsky@...omium.org>, 
	Thomas Gleixner <tglx@...utronix.de>, LKML <linux-kernel@...r.kernel.org>, 
	bpf <bpf@...r.kernel.org>
Subject: Re: [syzbot] [kernel?] possible deadlock in console_flush_all (2)

On Wed, Mar 20, 2024 at 12:05 AM Tetsuo Handa
<penguin-kernel@...ove.sakura.ne.jp> wrote:
>
> On 2024/03/20 15:56, Alexei Starovoitov wrote:
> > This has nothing to do with bpf.
> > bpf never calls printk().
>
> Please see the Sample crash report in the dashboard.
> bpf program is hitting printk() via report_bug().

Exactly. local_bh_neable is simply asking for a splat.
_this_ bug is in printk.
It's a generic issue.

sockmap bug is orthogonal.
It's already being looked at.

> -> #0 (console_owner){....}-{0:0}:
>        check_prev_add kernel/locking/lockdep.c:3134 [inline]
>        check_prevs_add kernel/locking/lockdep.c:3253 [inline]
>        validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
>        __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
>        lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
>        console_lock_spinning_enable kernel/printk/printk.c:1873 [inline]
>        console_emit_next_record kernel/printk/printk.c:2901 [inline]
>        console_flush_all+0x810/0xfd0 kernel/printk/printk.c:2973
>        console_unlock+0x13b/0x4d0 kernel/printk/printk.c:3042
>        vprintk_emit+0x5a6/0x770 kernel/printk/printk.c:2342
>        _printk+0xd5/0x120 kernel/printk/printk.c:2367
>        __report_bug lib/bug.c:195 [inline]
>        report_bug+0x346/0x500 lib/bug.c:219
>        handle_bug+0x3e/0x70 arch/x86/kernel/traps.c:239
>        exc_invalid_op+0x1a/0x50 arch/x86/kernel/traps.c:260
>        asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
>        __local_bh_enable_ip+0x1be/0x200 kernel/softirq.c:362
>        spin_unlock_bh include/linux/spinlock.h:396 [inline]
>        __sock_map_delete net/core/sock_map.c:424 [inline]
>        sock_map_delete_elem+0xca/0x140 net/core/sock_map.c:446
>        bpf_prog_2c29ac5cdc6b1842+0x42/0x46
>        bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
>        __bpf_prog_run include/linux/filter.h:657 [inline]
>        bpf_prog_run include/linux/filter.h:664 [inline]
>        __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
>        bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422
>        trace_sched_switch include/trace/events/sched.h:222 [inline]
>        __schedule+0x250b/0x49d0 kernel/sched/core.c:6733
>        __schedule_loop kernel/sched/core.c:6813 [inline]
>        schedule+0x14b/0x320 kernel/sched/core.c:6828
>        ptrace_stop+0x5b4/0x940 kernel/signal.c:2358
>        ptrace_do_notify kernel/signal.c:2395 [inline]
>        ptrace_notify+0x255/0x380 kernel/signal.c:2407
>        ptrace_report_syscall include/linux/ptrace.h:415 [inline]
>        ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
>        syscall_exit_work+0xbd/0x170 kernel/entry/common.c:167
>        syscall_exit_to_user_mode_prepare kernel/entry/common.c:194 [inline]
>        __syscall_exit_to_user_mode_work kernel/entry/common.c:199 [inline]
>        syscall_exit_to_user_mode+0x273/0x360 kernel/entry/common.c:212
>        do_syscall_64+0x10a/0x240 arch/x86/entry/common.c:89
>        entry_SYSCALL_64_after_hwframe+0x6d/0x75
>
>