syzbot


possible deadlock in chaoskey_open

Status: upstream: reported C repro on 2024/10/09 03:00
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+5f1ce62e956b7b19610e@syzkaller.appspotmail.com
Fix commit: USB: chaoskey: Fix possible deadlock chaoskey_list_lock
Patched on: [ci-upstream-linux-next-kasan-gce-root ci2-upstream-usb], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce]
First crash: 31d, last: 22d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [usb?] possible deadlock in chaoskey_open 2 (5) 2024/10/09 14:22
Last patch testing requests (2)
Created Duration User Patch Repo Result
2024/10/09 09:03 22m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing OK log
2024/10/09 08:37 9m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing report log

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted
------------------------------------------------------
syz-executor145/2655 is trying to acquire lock:
ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_open+0xdd/0x220 drivers/usb/misc/chaoskey.c:274

but task is already holding lock:
ffffffff899dadb0 (minor_rwsem){++++}-{3:3}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (minor_rwsem){++++}-{3:3}:
       down_write+0x93/0x200 kernel/locking/rwsem.c:1577
       usb_deregister_dev+0x7c/0x1e0 drivers/usb/core/file.c:186
       chaoskey_disconnect+0xb7/0x2a0 drivers/usb/misc/chaoskey.c:236
       usb_unbind_interface+0x1e8/0x970 drivers/usb/core/driver.c:461
       device_remove drivers/base/dd.c:569 [inline]
       device_remove+0x122/0x170 drivers/base/dd.c:561
       __device_release_driver drivers/base/dd.c:1273 [inline]
       device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1296
       bus_remove_device+0x22f/0x420 drivers/base/bus.c:576
       device_del+0x396/0x9f0 drivers/base/core.c:3864
       usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1418
       usb_disconnect+0x2e1/0x920 drivers/usb/core/hub.c:2304
       hub_port_connect drivers/usb/core/hub.c:5361 [inline]
       hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
       port_event drivers/usb/core/hub.c:5821 [inline]
       hub_event+0x1bed/0x4f40 drivers/usb/core/hub.c:5903
       process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
       process_scheduled_works kernel/workqueue.c:3310 [inline]
       worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 (chaoskey_list_lock){+.+.}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3161 [inline]
       check_prevs_add kernel/locking/lockdep.c:3280 [inline]
       validate_chain kernel/locking/lockdep.c:3904 [inline]
       __lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202
       lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       chaoskey_open+0xdd/0x220 drivers/usb/misc/chaoskey.c:274
       usb_open+0x186/0x220 drivers/usb/core/file.c:47
       chrdev_open+0x237/0x6a0 fs/char_dev.c:414
       do_dentry_open+0x6cb/0x1390 fs/open.c:958
       vfs_open+0x82/0x3f0 fs/open.c:1088
       do_open fs/namei.c:3774 [inline]
       path_openat+0x1e6a/0x2d60 fs/namei.c:3933
       do_filp_open+0x1dc/0x430 fs/namei.c:3960
       do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
       do_sys_open fs/open.c:1430 [inline]
       __do_sys_openat fs/open.c:1446 [inline]
       __se_sys_openat fs/open.c:1441 [inline]
       __x64_sys_openat+0x175/0x210 fs/open.c:1441
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  rlock(minor_rwsem);
                               lock(chaoskey_list_lock);
                               lock(minor_rwsem);
  lock(chaoskey_list_lock);

 *** DEADLOCK ***

1 lock held by syz-executor145/2655:
 #0: ffffffff899dadb0 (minor_rwsem){++++}-{3:3}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38

stack backtrace:
CPU: 0 UID: 0 PID: 2655 Comm: syz-executor145 Not tainted 6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_circular_bug+0x41c/0x610 kernel/locking/lockdep.c:2074
 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2206
 check_prev_add kernel/locking/lockdep.c:3161 [inline]
 check_prevs_add kernel/locking/lockdep.c:3280 [inline]
 validate_chain kernel/locking/lockdep.c:3904 [inline]
 __lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202
 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
 chaoskey_open+0xdd/0x220 drivers/usb/misc/chaoskey.c:274
 usb_open+0x186/0x220 drivers/usb/core/file.c:47
 chrdev_open+0x237/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x6cb/0x1390 fs/open.c:958
 vfs_open+0x82/0x3f0 fs/open.c:1088
 do_open fs/namei.c:3774 [inline]
 path_openat+0x1e6a/0x2d60 fs/namei.c:3933
 do_filp_open+0x1dc/0x430 fs/namei.c:3960
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
 do_sys_open fs/open.c:1430 [inline]
 __do_sys_openat fs/open.c:1446 [inline]
 __se_sys_openat fs/open.c:1441 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1441
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb0ccb4d361
Code: 75 57 89 f0 25 00 00 41 00 3d 00 00 41 00 74 49 80 3d 2a 8d 07 00 00 74 6d 89 da 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 93 00 00 00 48 8b 54 24 28 64 48 2b 14 25
RSP: 002b:00007fff9c9d3660 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fb0ccb4d361
RDX: 0000000000000002 RSI: 00007fff9c9d36e0 RDI: 00000000ffffff9c
RBP: 00007fff9c9d36e0 R08: 000000000000000f R09: 00007fff9c9d3477
R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff9c9d377c
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>

Crashes (475):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/10/12 09:13 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/05 06:38 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 d7906eff .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/05 05:29 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 d7906eff .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/14 09:37 linux-next d61a00525464 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in chaoskey_open
2024/10/13 12:12 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/13 10:40 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/13 09:38 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/13 08:27 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/13 07:19 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/13 05:17 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/13 03:36 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/13 00:51 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/13 00:20 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 22:20 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 20:57 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 19:52 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 18:36 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 17:36 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 16:28 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 15:20 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 13:25 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 12:25 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 11:29 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 10:22 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 08:31 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 07:09 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 06:28 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 05:24 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 04:13 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 02:59 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 01:43 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/12 00:29 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 22:45 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 21:32 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 20:21 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 20:02 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 18:07 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 16:40 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 15:24 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 12:12 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 10:13 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 08:53 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 07:49 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 06:47 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 05:44 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 04:21 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 8fbfc0c8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 02:56 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 8fbfc0c8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
2024/10/11 01:28 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4a9fe2a8ac53 8fbfc0c8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in chaoskey_open
* Struck through repros no longer work on HEAD.