syzbot


possible deadlock in hugetlb_cow

Status: fixed on 2021/03/10 01:48
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+5eee4145df3c15e96625@syzkaller.appspotmail.com
Fix commit: e7dd91c456a8 mm/hugetlb: fix deadlock in hugetlb_cow error path
First crash: 1271d, last: 1244d
Cause bisection: introduced by (bisect log) [no-op commit]:
commit 1592c4b9935fa8a3b7c297955bb872a357e5a3b6
Author: Linhua Xu <linhua.xu@unisoc.com>
Date: Wed Mar 25 08:25:28 2020 +0000

  pinctrl: sprd: Add pin high impedance mode support

Crash: WARNING in __local_bh_enable_ip (log)
Repro: syz .config
  
Discussions (4)
Title Replies (including bot) Last reply
[PATCH 5.10 00/63] 5.10.5-rc1 review 75 (75) 2021/01/07 08:13
[patch 02/16] mm/hugetlb: fix deadlock in hugetlb_cow error path 1 (1) 2020/12/29 23:14
[PATCH] mm/hugetlb: fix deadlock in hugetlb_cow error path 2 (2) 2020/12/15 22:39
possible deadlock in hugetlb_cow 0 (1) 2020/12/06 18:03

Sample crash report:
============================================
WARNING: possible recursive locking detected
5.10.0-rc6-syzkaller #0 Not tainted
--------------------------------------------
syz-executor036/9857 is trying to acquire lock:
ffff888011675698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: i_mmap_lock_write include/linux/fs.h:493 [inline]
ffff888011675698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: unmap_ref_private mm/hugetlb.c:4019 [inline]
ffff888011675698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: hugetlb_cow+0xedf/0x15f0 mm/hugetlb.c:4110

but task is already holding lock:
ffff888011675698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: i_mmap_lock_read include/linux/fs.h:508 [inline]
ffff888011675698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}, at: hugetlb_fault+0x26c/0x2330 mm/hugetlb.c:4485

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&hugetlbfs_i_mmap_rwsem_key);
  lock(&hugetlbfs_i_mmap_rwsem_key);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor036/9857:
 #0: ffff88801aed8128 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:56 [inline]
 #0: ffff88801aed8128 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x25c/0xb40 arch/x86/mm/fault.c:1313
 #1: ffff888011675698 (&hugetlbfs_i_mmap_rwsem_key){++++}-{3:3}
, at: i_mmap_lock_read include/linux/fs.h:508 [inline]
, at: hugetlb_fault+0x26c/0x2330 mm/hugetlb.c:4485
 #2: ffff8880147fe2a8 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x368/0x2330 mm/hugetlb.c:4499

stack backtrace:
CPU: 0 PID: 9857 Comm: syz-executor036 Not tainted 5.10.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 print_deadlock_bug kernel/locking/lockdep.c:2761 [inline]
 check_deadlock kernel/locking/lockdep.c:2804 [inline]
 validate_chain kernel/locking/lockdep.c:3595 [inline]
 __lock_acquire.cold+0x15e/0x3b0 kernel/locking/lockdep.c:4832
 lock_acquire kernel/locking/lockdep.c:5437 [inline]
 lock_acquire+0x29d/0x740 kernel/locking/lockdep.c:5402
 down_write+0x8d/0x150 kernel/locking/rwsem.c:1531
 i_mmap_lock_write include/linux/fs.h:493 [inline]
 unmap_ref_private mm/hugetlb.c:4019 [inline]
 hugetlb_cow+0xedf/0x15f0 mm/hugetlb.c:4110
 hugetlb_fault+0x155c/0x2330 mm/hugetlb.c:4562
 handle_mm_fault+0x11c3/0x55d0 mm/memory.c:4605
 do_user_addr_fault+0x55b/0xb40 arch/x86/mm/fault.c:1372
 handle_page_fault arch/x86/mm/fault.c:1429 [inline]
 exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1485
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:583
RIP: 0033:0x401d0f
Code: 00 00 31 c0 e8 52 a8 04 00 f0 83 2d 0a e3 2f 00 01 4c 89 e7 e8 42 ff ff ff eb b1 85 c0 75 ea b9 6e 00 00 00 4c 89 ef 4c 89 f6 <f3> 48 a5 ba 04 00 00 00 0f b7 06 be 00 0f 00 20 66 89 07 31 c0 bf
RSP: 002b:00007fc848488db0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000700028 RCX: 000000000000006e
RDX: 00000000000f4240 RSI: 00000000004b4a00 RDI: 0000000020000f00
RBP: 0000000000700020 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000070002c
R13: 0000000020000f00 R14: 00000000004b4a00 R15: 20c49ba5e353f7cf

Crashes (341):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/02 18:51 upstream 509a15421674 8c9190ef .config console log report syz C ci-upstream-kasan-gce
2020/12/02 21:20 upstream 509a15421674 8c9190ef .config console log report syz ci-upstream-kasan-gce-smack-root
2020/12/02 20:27 upstream 509a15421674 8c9190ef .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/12/02 18:31 upstream 509a15421674 8c9190ef .config console log report syz ci-upstream-kasan-gce
2020/12/02 22:41 linux-next 0eedceafd3a6 8c9190ef .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/12/29 22:49 upstream dea8dcf2a9fa 80910769 .config console log report info ci-upstream-kasan-gce
2020/12/29 18:38 upstream dea8dcf2a9fa 80910769 .config console log report info ci-upstream-kasan-gce-root
2020/12/29 15:55 upstream dea8dcf2a9fa 80910769 .config console log report info ci-upstream-kasan-gce-root
2020/12/29 09:16 upstream dea8dcf2a9fa 8259d56c .config console log report info ci-upstream-kasan-gce-root
2020/12/29 05:54 upstream dea8dcf2a9fa 8259d56c .config console log report info ci-qemu-upstream
2020/12/28 05:52 upstream 5c8fe583cce5 2242f77f .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/27 19:45 upstream f838f8d2b694 2242f77f .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/27 18:05 upstream f838f8d2b694 2242f77f .config console log report info ci-upstream-kasan-gce-root
2020/12/27 08:43 upstream f838f8d2b694 821e0b09 .config console log report info ci-upstream-kasan-gce
2020/12/27 07:24 upstream f838f8d2b694 821e0b09 .config console log report info ci-upstream-kasan-gce
2020/12/27 05:06 upstream f838f8d2b694 821e0b09 .config console log report info ci-upstream-kasan-gce
2020/12/26 19:57 upstream 40f78232f973 821e0b09 .config console log report info ci-upstream-kasan-gce
2020/12/26 17:38 upstream 40f78232f973 821e0b09 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/26 16:13 upstream 40f78232f973 821e0b09 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/26 15:11 upstream 40f78232f973 821e0b09 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/26 08:05 upstream 5814bc2d4cc2 821e0b09 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/26 06:02 upstream 5814bc2d4cc2 821e0b09 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/26 03:24 upstream 5814bc2d4cc2 821e0b09 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/26 00:43 upstream 5814bc2d4cc2 821e0b09 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/25 23:53 upstream 5814bc2d4cc2 b982b3ea .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/25 20:12 upstream 71c5f03154ac b982b3ea .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/25 18:17 upstream 71c5f03154ac b982b3ea .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/25 16:56 upstream 71c5f03154ac b982b3ea .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/25 12:30 upstream 71c5f03154ac b982b3ea .config console log report info ci-upstream-kasan-gce
2020/12/25 11:09 upstream 71c5f03154ac b982b3ea .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/25 07:35 upstream 3913d00ac51a c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/24 16:41 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/24 02:39 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce
2020/12/24 00:51 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce
2020/12/23 12:18 upstream 614cb5894306 c2c1d1dd .config console log report info ci-upstream-kasan-gce
2020/12/22 23:47 upstream 614cb5894306 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/22 11:59 upstream 8653b778e454 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/22 05:52 upstream 8653b778e454 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/22 00:46 upstream e37b12e4bb21 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/20 17:12 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/20 05:13 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/19 19:59 upstream 3644e2d2dda7 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/18 20:24 upstream a409ed156a90 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/18 13:17 upstream d64c6f96ba86 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/15 09:28 upstream 148842c98a24 97183ed7 .config console log report info ci-upstream-kasan-gce-smack-root
2020/12/29 23:41 upstream dea8dcf2a9fa 80910769 .config console log report info ci-upstream-kasan-gce-386
2020/12/29 19:52 upstream dea8dcf2a9fa 80910769 .config console log report info ci-upstream-kasan-gce-386
2020/12/21 01:13 upstream 6a447b0e3151 04201c06 .config console log report info ci-upstream-kasan-gce-386
2020/12/20 23:21 upstream 6a447b0e3151 04201c06 .config console log report info ci-upstream-kasan-gce-386
2020/12/08 20:09 upstream cd796ed33450 40cc414d .config console log report info ci-qemu-upstream-386
2020/12/02 17:55 upstream 509a15421674 eff43e99 .config console log report info ci-qemu-upstream-386
2020/12/20 02:30 linux-next 0d52778b8710 04201c06 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/20 02:30 linux-next 0d52778b8710 04201c06 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/18 16:36 linux-next 0d52778b8710 04201c06 .config console log report info ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.