linux-kernel - Re: [PATCH 12/15] tty: serial: switch from circ

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c990e6a7-cd4b-4178-94da-79f4ef84bdd8@kernel.org>
Date: Tue, 16 Apr 2024 09:04:56 +0200
From: Jiri Slaby <jirislaby@...nel.org>
To: Pengfei Xu <pengfei.xu@...el.com>
Cc: gregkh@...uxfoundation.org, linux-serial@...r.kernel.org,
 linux-kernel@...r.kernel.org, Al Cooper <alcooperx@...il.com>,
 Matthias Brugger <matthias.bgg@...il.com>,
 AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
 Kumaravel Thiagarajan <kumaravel.thiagarajan@...rochip.com>,
 Tharun Kumar P <tharunkumar.pasumarthi@...rochip.com>,
 Russell King <linux@...linux.org.uk>, Vineet Gupta <vgupta@...nel.org>,
 Richard Genoud <richard.genoud@...il.com>,
 Nicolas Ferre <nicolas.ferre@...rochip.com>,
 Alexandre Belloni <alexandre.belloni@...tlin.com>,
 Claudiu Beznea <claudiu.beznea@...on.dev>,
 Alexander Shiyan <shc_work@...l.ru>, Baruch Siach <baruch@...s.co.il>,
 "Maciej W. Rozycki" <macro@...am.me.uk>, Shawn Guo <shawnguo@...nel.org>,
 Sascha Hauer <s.hauer@...gutronix.de>, Fabio Estevam <festevam@...il.com>,
 Neil Armstrong <neil.armstrong@...aro.org>,
 Kevin Hilman <khilman@...libre.com>, Jerome Brunet <jbrunet@...libre.com>,
 Martin Blumenstingl <martin.blumenstingl@...glemail.com>,
 Taichi Sugaya <sugaya.taichi@...ionext.com>,
 Takao Orito <orito.takao@...ionext.com>,
 Bjorn Andersson <andersson@...nel.org>,
 Konrad Dybcio <konrad.dybcio@...aro.org>, Pali Rohár
 <pali@...nel.org>, Michael Ellerman <mpe@...erman.id.au>,
 Nicholas Piggin <npiggin@...il.com>,
 Christophe Leroy <christophe.leroy@...roup.eu>,
 "Aneesh Kumar K.V" <aneesh.kumar@...nel.org>,
 "Naveen N. Rao" <naveen.n.rao@...ux.ibm.com>,
 Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>,
 Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>,
 Alim Akhtar <alim.akhtar@...sung.com>, Laxman Dewangan
 <ldewangan@...dia.com>, Thierry Reding <thierry.reding@...il.com>,
 Jonathan Hunter <jonathanh@...dia.com>, Orson Zhai <orsonzhai@...il.com>,
 Baolin Wang <baolin.wang@...ux.alibaba.com>,
 Chunyan Zhang <zhang.lyra@...il.com>,
 Patrice Chotard <patrice.chotard@...s.st.com>,
 Maxime Coquelin <mcoquelin.stm32@...il.com>,
 Alexandre Torgue <alexandre.torgue@...s.st.com>,
 "David S. Miller" <davem@...emloft.net>, Hammer Hsieh
 <hammerh0314@...il.com>, Peter Korsgaard <jacmet@...site.dk>,
 Timur Tabi <timur@...nel.org>, Michal Simek <michal.simek@....com>,
 Sumit Semwal <sumit.semwal@...aro.org>,
 Christian König <christian.koenig@....com>
Subject: Re: [PATCH 12/15] tty: serial: switch from circ_buf to kfifo

Hi,

On 16. 04. 24, 5:24, Pengfei Xu wrote:
> On 2024-04-05 at 08:08:23 +0200, Jiri Slaby (SUSE) wrote:
>> Switch from struct circ_buf to proper kfifo. kfifo provides much better
>> API, esp. when wrap-around of the buffer needs to be taken into account.
>> Look at pl011_dma_tx_refill() or cpm_uart_tx_pump() changes for example.
..
> Greeting!
> I used syzkaller and Internal v6.9-rc4 kernel which include Linux next kernel,
> and found deadlock in console_flush_all issue, bisected the commit is:
> "
> 1788cf6a91d9 tty: serial: switch from circ_buf to kfifo
> "
..
> [   17.841628] ======================================================
> [   17.841631] WARNING: possible circular locking dependency detected
> [   17.841632] 6.9.0-rc4-df0b4fecf9eb+ #1 Not tainted
> [   17.841636] ------------------------------------------------------
> [   17.841638] repro/726 is trying to acquire lock:
> [   17.841641] ffffffff86d6da80 (console_owner){....}-{0:0}, at: console_flush_all+0x51a/0xc40
> [   17.841665]
> [   17.841665] but task is already holding lock:
> [   17.841667] ffffffff89aa52b8 (&port_lock_key){-...}-{2:2}, at: uart_put_char+0x118/0x510
> [   17.841684]
> [   17.841684] which lock already depends on the new lock.
..
> [   17.842133] stack backtrace:
..
> [   17.842461]  handle_bug+0xa2/0x130
> [   17.842469]  exc_invalid_op+0x3c/0x80
> [   17.842479]  asm_exc_invalid_op+0x1f/0x30
> [   17.842487] RIP: 0010:uart_put_char+0x3ac/0x510

So you hit a "WARNING" (see below). And printing pretty much anything 
(like the WARNING report) from this point inside uart_put_char() will 
lead to this deadlock.

..
> [   17.879899] WARNING: CPU: 0 PID: 726 at drivers/tty/serial/serial_core.c:561 uart_put_char+0x3ac/0x510

This is the real thing/root cause of the above.

WARN_ON_ONCE(!state->port.xmit_buf)) was hit in uart_put_char().

Let me see how kfifo changed xmit_buf handling.

> Hope reproduced code and bisection is helpful.

Thanks, let me investigate.

-- 
js
suse labs