linux-kernel - Re: [PATCH] net/nfc: Fix A-B/B-A deadlock between nfc_unregister_device and rfkill_fop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b8dc1074-725f-4048-9af5-6b62bd2150a3@kzalloc.com>
Date: Fri, 15 Aug 2025 17:23:53 +0900
From: Yunseong Kim <ysk@...lloc.com>
To: Krzysztof Kozlowski <krzk@...nel.org>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>
Cc: Simon Horman <horms@...nel.org>, Taehee Yoo <ap420073@...il.com>,
 Byungchul Park <byungchul@...com>, max.byungchul.park@...il.com,
 yeoreum.yun@....com, ppbuk5246@...il.com, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org, syzkaller@...glegroups.com
Subject: Re: [PATCH] net/nfc: Fix A-B/B-A deadlock between
 nfc_unregister_device and rfkill_fop_write

Hi Krzysztof,

Thank you for your review.

On 8/15/25 2:55 PM, Krzysztof Kozlowski wrote:
> On 14/08/2025 19:31, Yunseong Kim wrote:
>> A potential deadlock due to A-B/B-A deadlock exists between the NFC core
>> and the RFKill subsystem, involving the NFC device lock and the
>> rfkill_global_mutex.
>>
>> This issue is particularly visible on PREEMPT_RT kernels, which can
>> report the following warning:
> 
> Why are not you crediting syzbot and its report?
> 
> there is clear INSTRUCTION in that email from Syzbot.

I wanted to clarify that this report did not originate from syzbot.

I found this issue by building and running syzkaller locally on my own
Arm64 RADXA Orion6 board.

This is reproduction series on my local syzkaller.

WARNING in __rt_mutex_slowlock

#	Log	Report	Time	Tag
7	log	report	2025/08/14 20:01	
6	log	report	2025/08/14 05:55	
5	log	report	2025/08/14 02:31	
4	log	report	2025/08/12 09:38	
3	log	report	2025/07/30 07:09	
2	log	report	2025/07/27 23:29	
1	log	report	2025/07/26 04:18	
0	log	report	2025/07/26 04:17

The reason this is coming from syzbot recently is that I worked with Sebastian,
the RT maintainer, to fix KCOV to be PREEMPT_RT-aware. This was merged recently:
Link: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/commit/?h=usb-linus&id=9528d32873b38281ae105f2f5799e79ae9d086c2

So, syszbot now report it:
https://syzkaller.appspot.com/bug?extid=535bbe83dfc3ae8d4be3

>> | rtmutex deadlock detected
>> | WARNING: CPU: 0 PID: 22729 at kernel/locking/rtmutex.c:1674 rt_mutex_handle_deadlock+0x68/0xec kernel/locking/rtmutex.c:-1
>> | Modules linked in:
>> | CPU: 0 UID: 0 PID: 22729 Comm: syz.7.2187 Kdump: loaded Not tainted 6.17.0-rc1-00001-g1149a5db27c8-dirty #55 PREEMPT_RT
>> | Hardware name: QEMU KVM Virtual Machine, BIOS 2025.02-8ubuntu1 06/11/2025

As you might notice from the logs (e.g., "BIOS 2025.02-8ubuntu1"),
the environment is Ubuntu image on my machine, which, syzbot does not use.

>> | pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
>> | pc : rt_mutex_handle_deadlock+0x68/0xec kernel/locking/rtmutex.c:-1
>> | lr : rt_mutex_handle_deadlock+0x40/0xec kernel/locking/rtmutex.c:1674
>> | sp : ffff8000967c7720
>> | x29: ffff8000967c7720 x28: 1fffe0001946d182 x27: dfff800000000000
>> | x26: 0000000000000001 x25: 0000000000000003 x24: 1fffe0001946d00b
>> | x23: 1fffe0001946d182 x22: ffff80008aec8940 x21: dfff800000000000
>> | x20: ffff0000ca368058 x19: ffff0000ca368c10 x18: ffff80008af6b6e0
>> | x17: 1fffe000590b8088 x16: ffff80008046cc08 x15: 0000000000000001
>> | x14: 1fffe000590ba990 x13: 0000000000000000 x12: 0000000000000000
>> | x11: ffff6000590ba991 x10: 0000000000000002 x9 : 0fe446e029bcfe00
>> | x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f
>> | x5 : 0000000000000001 x4 : 0000000000001000 x3 : ffff800080503efc
>> | x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000001
> 
> This all is irrelevant, really. Trim the log.

My apologies if the formatting and the log length were not appropriate. I
will trim the log significantly and review the subsystem's git history to
ensure the commit message format aligns with the expected style for
the next version.

>> | Call trace:
>> |  rt_mutex_handle_deadlock+0x68/0xec kernel/locking/rtmutex.c:-1 (P)
>> |  __rt_mutex_slowlock+0x1cc/0x480 kernel/locking/rtmutex.c:1734
>> |  __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1760 [inline]
>> |  rt_mutex_slowlock+0x140/0x21c kernel/locking/rtmutex.c:1800
> Best regards,
> Krzysztof

I’ve added the syzkaller mailing list to Cc.

Thank you!

Yunseong Kim