linux-kernel - BUG: INFO: task hung in gsm_cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CANikGpcUOLC06-Mfq296LeXxudpO6732vWM58-Zfv14GqoJE7w@mail.gmail.com>
Date: Sat, 24 Aug 2024 14:04:55 -0700
From: Juefei Pu <juefei.pu@...il.ucr.edu>
To: gregkh@...uxfoundation.org, jirislaby@...nel.org, 
	linux-kernel@...r.kernel.org, linux-serial@...r.kernel.org
Subject: BUG: INFO: task hung in gsm_cleanup_mux

Hello,
We found the following issue using syzkaller on Linux v6.10.

In function `gsm_cleanup_mux`,  the kernel hangs when waiting for
`dlci->state` to become `DLCI_CLOSED`. It seems that
`gsm_dlci_begin_close` failed to close the dlci.

The full report including the Syzkaller reproducer:
https://gist.github.com/TomAPU/38bb00292b33d52a6dd2d1b629247146

The brief report is below:

INFO: task syz.1.466:13387 blocked for more than 143 seconds.
      Not tainted 6.10.0 #13
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.466       state:D stack:27400 pid:13387 tgid:13304
ppid:8048   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5407 [inline]
 __schedule+0xf4a/0x15e0 kernel/sched/core.c:6748
 __schedule_loop kernel/sched/core.c:6825 [inline]
 schedule+0x143/0x310 kernel/sched/core.c:6840
 gsm_cleanup_mux+0x344/0x930 drivers/tty/n_gsm.c:3136
 gsm_config drivers/tty/n_gsm.c:3408 [inline]
 gsmld_ioctl+0x13c4/0x2540 drivers/tty/n_gsm.c:3839
 tty_ioctl+0x98f/0xdb0 drivers/tty/tty_io.c:2812
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x7e/0x150 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7fafaef809b9
RSP: 002b:00007fafafe0a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fafaf146130 RCX: 00007fafaef809b9
RDX: 0000000020000100 RSI: 00000000404c4701 RDI: 0000000000000004
RBP: 00007fafaeff4f70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fafaf146130 R15: 00007ffd1b6e06a8
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/25:
 #0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at:
rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
 #0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock
include/linux/rcupdate.h:781 [inline]
 #0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at:
debug_show_all_locks+0x54/0x2d0 kernel/locking/lockdep.c:6614
1 lock held by systemd-journal/4495:
1 lock held by systemd-udevd/4507:
1 lock held by in:imklog/7662:
2 locks held by agetty/7949:
 #0: ffff88802e7850a0 (&tty->ldisc_sem){++++}-{0:0}, at:
tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900040dc2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at:
n_tty_read+0x712/0x1e80 drivers/tty/n_tty.c:2211
2 locks held by syz-executor/8032:
2 locks held by syz.1.466/13387:
 #0: ffff8880285170a0 (&tty->ldisc_sem){++++}-{0:0}, at:
tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffff8880193520b0 (&gsm->mutex){+.+.}-{3:3}, at:
gsm_cleanup_mux+0xb7/0x930 drivers/tty/n_gsm.c:3130
1 lock held by syz.1.796/18097:
2 locks held by syz-executor/18310:
1 lock held by systemd-sysctl/18525:
1 lock held by syz.0.834/18561:
 #0: ffff888020337398 (&mm->mmap_lock){++++}-{3:3}, at:
mmap_read_lock_killable+0x18/0x60 include/linux/mmap_lock.h:153
2 locks held by syz.0.834/18562:
 #0: ffff888020337398 (&mm->mmap_lock){++++}-{3:3}, at:
mmap_write_lock_killable include/linux/mmap_lock.h:122 [inline]
 #0: ffff888020337398 (&mm->mmap_lock){++++}-{3:3}, at:
vm_mmap_pgoff+0x173/0x3a0 mm/util.c:571
 #1: ffffffff8db383f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at:
exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
 #1: ffffffff8db383f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at:
synchronize_rcu_expedited+0x37c/0x810 kernel/rcu/tree_exp.h:939