| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CANikGpe4pbGxQV+CCvSF6U+4cGHLWBzY_WXGSV9m+prBE6tYEQ@mail.gmail.com>
Date: Sat, 24 Aug 2024 16:08:32 -0700
From: Juefei Pu <juefei.pu@...il.ucr.edu>
To: perex@...ex.cz, tiwai@...e.com, linux-sound@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: BUG: INFO: task hung in seq_free_client
Hello,
We found the following issue using syzkaller on Linux v6.10.
In `seq_free_client`, the task hangs when trying to acquire lock
`register_mutex`.
Unfortunately, the syzkaller failed to generate a reproducer.
But at least we have the report:
INFO: task syz.0.38:8767 blocked for more than 143 seconds.
Not tainted 6.10.0 #13
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.38 state:D stack:24680 pid:8767 tgid:8767
ppid:8050 flags:0x00000004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5407 [inline]
__schedule+0xf4a/0x15e0 kernel/sched/core.c:6748
__schedule_loop kernel/sched/core.c:6825 [inline]
schedule+0x143/0x310 kernel/sched/core.c:6840
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6897
__mutex_lock_common kernel/locking/mutex.c:684 [inline]
__mutex_lock+0x69a/0xd50 kernel/locking/mutex.c:752
seq_free_client+0x27/0x180 sound/core/seq/seq_clientmgr.c:298
snd_seq_release+0x44/0xc0 sound/core/seq/seq_clientmgr.c:387
__fput+0x24a/0x8a0 fs/file_table.c:422
task_work_run+0x239/0x2f0 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x12d/0x280 kernel/entry/common.c:218
do_syscall_64+0x8a/0x150 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7f9a0cf809b9
RSP: 002b:00007ffc31b75f88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f9a0d147a80 RCX: 00007f9a0cf809b9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f9a0d147a80 R08: 0000000000000006 R09: 00007ffc31b7626f
R10: 00000000003ffcd0 R11: 0000000000000246 R12: 00000000000248af
R13: 00007ffc31b76080 R14: 00007ffc31b760a0 R15: ffffffffffffffff
</TASK>
Showing all locks held in the system:
3 locks held by kworker/0:1/10:
#0: ffff88801307a948 ((wq_completion)events){+.+.}-{0:0}, at:
process_one_work kernel/workqueue.c:3223 [inline]
#0: ffff88801307a948 ((wq_completion)events){+.+.}-{0:0}, at:
process_scheduled_works+0x8fb/0x1410 kernel/workqueue.c:3329
#1: ffffc900000cfd20
((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at:
process_one_work kernel/workqueue.c:3224 [inline]
#1: ffffc900000cfd20
((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at:
process_scheduled_works+0x922/0x1410 kernel/workqueue.c:3329
#2: ffff888100af7240 (&data->fib_lock){+.+.}-{3:3}, at:
nsim_fib_event_work+0x2de/0x4050 drivers/net/netdevsim/fib.c:1489
1 lock held by khungtaskd/25:
#0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at:
rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock
include/linux/rcupdate.h:781 [inline]
#0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at:
debug_show_all_locks+0x54/0x2d0 kernel/locking/lockdep.c:6614
2 locks held by kworker/u4:9/2825:
1 lock held by systemd-udevd/4506:
1 lock held by in:imklog/7643:
1 lock held by syz.1.37/8761:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
seq_free_client+0x27/0x180 sound/core/seq/seq_clientmgr.c:298
1 lock held by syz.0.38/8767:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
seq_free_client+0x27/0x180 sound/core/seq/seq_clientmgr.c:298
1 lock held by syz.0.44/9437:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.1.46/9506:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.1.46/9508:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.1.46/9509:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.0.53/10021:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.0.53/10022:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.1.57/10085:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.1.57/10091:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.0.64/10607:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.1.66/10653:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.0.70/11162:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.1.68/11179:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.0.71/11691:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.1.72/11705:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.1.74/12211:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.0.81/12259:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
2 locks held by syz-executor/12269:
1 lock held by systemd-udevd/12279:
2 locks held by syz-executor/12313:
1 lock held by syz.1.82/12748:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
1 lock held by syz.0.83/12763:
#0: ffffffff8ecc0b08 (register_mutex#3){+.+.}-{3:3}, at:
snd_seq_open+0x42/0x4a0 sound/core/seq/seq_clientmgr.c:335
Powered by blists - more mailing lists