syzbot


possible deadlock in loop_probe

Status: fixed on 2021/11/10 00:50
Reported-by: syzbot+6a8a0d93c91e8fbf2e80@syzkaller.appspotmail.com
Fix commit: 962bf783ef65 mtd: break circular locks in register_mtd_blktrans
First crash: 383d, last: 355d

Cause bisection: introduced by (bisect log) :
commit 5befc7c26e5a98cd49789fb1beb52c62bd472dba
Author: Keith Busch <kbusch@kernel.org>
Date: Wed Mar 24 23:18:05 2021 +0000

  nvme: implement non-mdts command limits

Crash: WARNING: ODEBUG bug in netdev_run_todo (log)
Repro: C syz .config
duplicates (2):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
possible deadlock in loop_add C done 23846 315d 356d 0/22 closed as dup on 2021/08/08 12:58
possible deadlock in brd_probe C unreliable 15204 310d 591d 0/22 closed as dup on 2021/08/08 13:02
Patch testing requests:
Created Duration User Patch Repo Result
2021/06/18 11:46 19m penguin-kernel@i-love.sakura.ne.jp patch upstream OK
2021/06/17 13:52 19m desmondcheongzx@gmail.com patch upstream OK
2021/06/17 08:40 18m desmondcheongzx@gmail.com patch upstream OK
2021/06/17 03:27 10m desmondcheongzx@gmail.com patch upstream report log

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
5.13.0-syzkaller #0 Not tainted
------------------------------------------------------
systemd-udevd/8740 is trying to acquire lock:
ffffffff8cc7c968 (loop_ctl_mutex){+.+.}-{3:3}, at: loop_probe+0xc7/0x150 drivers/block/loop.c:2397

but task is already holding lock:
ffffffff8c9e9ba8 (major_names_lock){+.+.}-{3:3}, at: blk_request_module+0x25/0x1d0 block/genhd.c:657

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (major_names_lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:959 [inline]
       __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
       __register_blkdev+0x2b/0x3e0 block/genhd.c:216
       register_mtd_blktrans+0x85/0x3c0 drivers/mtd/mtd_blkdevs.c:531
       do_one_initcall+0x103/0x650 init/main.c:1246
       do_initcall_level init/main.c:1319 [inline]
       do_initcalls init/main.c:1335 [inline]
       do_basic_setup init/main.c:1355 [inline]
       kernel_init_freeable+0x6b8/0x741 init/main.c:1557
       kernel_init+0x1a/0x1d0 init/main.c:1449
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

-> #2 (mtd_table_mutex){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:959 [inline]
       __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
       blktrans_open+0x69/0x600 drivers/mtd/mtd_blkdevs.c:210
       blkdev_get_whole+0xa1/0x420 fs/block_dev.c:1251
       blkdev_get_by_dev.part.0+0x30c/0xdd0 fs/block_dev.c:1415
       blkdev_get_by_dev fs/block_dev.c:1504 [inline]
       blkdev_open+0x295/0x300 fs/block_dev.c:1510
       do_dentry_open+0x4c8/0x11c0 fs/open.c:826
       do_open fs/namei.c:3361 [inline]
       path_openat+0x1c0e/0x27e0 fs/namei.c:3494
       do_filp_open+0x190/0x3d0 fs/namei.c:3521
       do_sys_openat2+0x16d/0x420 fs/open.c:1195
       do_sys_open fs/open.c:1211 [inline]
       __do_sys_open fs/open.c:1219 [inline]
       __se_sys_open fs/open.c:1215 [inline]
       __x64_sys_open+0x119/0x1c0 fs/open.c:1215
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #1 (&disk->open_mutex){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:959 [inline]
       __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
       del_gendisk+0x8b/0x770 block/genhd.c:587
       loop_remove drivers/block/loop.c:2344 [inline]
       loop_control_ioctl drivers/block/loop.c:2443 [inline]
       loop_control_ioctl+0x3e7/0x480 drivers/block/loop.c:2403
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:1069 [inline]
       __se_sys_ioctl fs/ioctl.c:1055 [inline]
       __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:1055
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #0 (loop_ctl_mutex){+.+.}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3051 [inline]
       check_prevs_add kernel/locking/lockdep.c:3174 [inline]
       validate_chain kernel/locking/lockdep.c:3789 [inline]
       __lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
       lock_acquire kernel/locking/lockdep.c:5625 [inline]
       lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
       __mutex_lock_common kernel/locking/mutex.c:959 [inline]
       __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
       loop_probe+0xc7/0x150 drivers/block/loop.c:2397
       blk_request_module+0x111/0x1d0 block/genhd.c:660
       blkdev_get_no_open+0x1d5/0x250 fs/block_dev.c:1332
       blkdev_get_by_dev.part.0+0x25/0xdd0 fs/block_dev.c:1395
       blkdev_get_by_dev fs/block_dev.c:1504 [inline]
       blkdev_open+0x295/0x300 fs/block_dev.c:1510
       do_dentry_open+0x4c8/0x11c0 fs/open.c:826
       do_open fs/namei.c:3361 [inline]
       path_openat+0x1c0e/0x27e0 fs/namei.c:3494
       do_filp_open+0x190/0x3d0 fs/namei.c:3521
       do_sys_openat2+0x16d/0x420 fs/open.c:1195
       do_sys_open fs/open.c:1211 [inline]
       __do_sys_open fs/open.c:1219 [inline]
       __se_sys_open fs/open.c:1215 [inline]
       __x64_sys_open+0x119/0x1c0 fs/open.c:1215
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae

other info that might help us debug this:

Chain exists of:
  loop_ctl_mutex --> mtd_table_mutex --> major_names_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(major_names_lock);
                               lock(mtd_table_mutex);
                               lock(major_names_lock);
  lock(loop_ctl_mutex);

 *** DEADLOCK ***

1 lock held by systemd-udevd/8740:
 #0: ffffffff8c9e9ba8 (major_names_lock){+.+.}-{3:3}, at: blk_request_module+0x25/0x1d0 block/genhd.c:657

stack backtrace:
CPU: 0 PID: 8740 Comm: systemd-udevd Not tainted 5.13.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96
 check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2131
 check_prev_add kernel/locking/lockdep.c:3051 [inline]
 check_prevs_add kernel/locking/lockdep.c:3174 [inline]
 validate_chain kernel/locking/lockdep.c:3789 [inline]
 __lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
 lock_acquire kernel/locking/lockdep.c:5625 [inline]
 lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
 __mutex_lock_common kernel/locking/mutex.c:959 [inline]
 __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
 loop_probe+0xc7/0x150 drivers/block/loop.c:2397
 blk_request_module+0x111/0x1d0 block/genhd.c:660
 blkdev_get_no_open+0x1d5/0x250 fs/block_dev.c:1332
 blkdev_get_by_dev.part.0+0x25/0xdd0 fs/block_dev.c:1395
 blkdev_get_by_dev fs/block_dev.c:1504 [inline]
 blkdev_open+0x295/0x300 fs/block_dev.c:1510
 do_dentry_open+0x4c8/0x11c0 fs/open.c:826
 do_open fs/namei.c:3361 [inline]
 path_openat+0x1c0e/0x27e0 fs/namei.c:3494
 do_filp_open+0x190/0x3d0 fs/namei.c:3521
 do_sys_openat2+0x16d/0x420 fs/open.c:1195
 do_sys_open fs/open.c:1211 [inline]
 __do_sys_open fs/open.c:1219 [inline]
 __se_sys_open fs/open.c:1215 [inline]
 __x64_sys_open+0x119/0x1c0 fs/open.c:1215
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f8f34e56840
Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24
RSP: 002b:00007ffcd8c5a778 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00005615b087e810 RCX: 00007f8f34e56840
RDX: 00005615b06c1fe3 RSI: 00000000000a0800 RDI: 00005615b08831b0
RBP: 00007ffcd8c5a8f0 R08: 00005615b06c1670 R09: 0000000000000010
R10: 00007f8f34bd0d70 R11: 0000000000000246 R12: 00007ffcd8c5a840
R13: 00005615b0884e10 R14: 0000000000000003 R15: 000000000000000e

Crashes (20656):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2021/07/05 17:23 upstream 3dbdb38e2869 55aa55c2 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/02 10:19 upstream e058a84bfddc 658ebc66 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/27 01:16 upstream 625acffd7ae2 9d2ab5df .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/26 22:22 upstream 625acffd7ae2 9d2ab5df .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/26 11:29 upstream b7050b242430 9d2ab5df .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-smack-root 2021/06/26 10:37 upstream b7050b242430 9d2ab5df .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/26 08:58 upstream b7050b242430 9d2ab5df .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/25 05:42 upstream 4a09d388f2ab 0edbbe31 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/06/24 14:50 upstream 7426cedc7dad ec865f6a .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/23 22:58 upstream 7266f2030eb0 fe4ab389 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/23 06:44 upstream 0c18f29aae7c aba2b2fb .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/06/20 23:51 upstream cba5e97280f5 aba2b2fb .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-selinux-root 2021/06/18 23:04 upstream fd0aa1a4567d aba2b2fb .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/17 08:56 upstream 6b00bc639f1f aba2b2fb .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/06/15 07:20 upstream 009c9aa5be65 1ba81399 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-selinux-root 2021/06/15 02:19 upstream 009c9aa5be65 1ba81399 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-smack-root 2021/06/13 07:46 upstream 8ecfa36cd4db 1ba81399 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/06/13 05:47 upstream 8ecfa36cd4db 1ba81399 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/07/03 11:21 upstream 3dbdb38e2869 55aa55c2 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/06/18 07:48 upstream fd0aa1a4567d aba2b2fb .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/06/17 21:19 upstream 70585216fe77 aba2b2fb .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/06/13 07:00 upstream 8ecfa36cd4db 1ba81399 .config log report syz C possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/08 21:13 upstream 3dbdb38e2869 1b20171a .config log report syz possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/01 22:46 upstream dbe69e433722 658ebc66 .config log report syz possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/01 03:08 upstream df04fbe8680b 38a885d1 .config log report syz possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/27 18:18 upstream 625acffd7ae2 9d2ab5df .config log report syz possible deadlock in loop_probe
ci-upstream-kasan-gce-selinux-root 2021/06/25 23:55 upstream 44db63d1ad8d ae6bf8dd .config log report syz possible deadlock in loop_probe
ci-upstream-kasan-gce-smack-root 2021/06/15 19:34 upstream 009c9aa5be65 58636922 .config log report syz possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/06/13 06:06 upstream 8ecfa36cd4db 1ba81399 .config log report syz possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/06/23 09:31 upstream 0c18f29aae7c aba2b2fb .config log report syz possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/06/23 07:22 upstream 0c18f29aae7c aba2b2fb .config log report syz possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/11 17:56 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/11 16:55 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/11 16:16 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/11 15:14 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/11 14:32 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/11 13:25 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/11 12:38 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/11 11:34 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-selinux-root 2021/07/11 10:40 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/11 08:38 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/11 07:51 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/11 06:47 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/11 06:30 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/11 05:19 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/11 03:52 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/11 02:46 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/11 00:31 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/10 23:42 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/10 22:38 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-smack-root 2021/07/10 22:14 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/10 21:09 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/10 19:56 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/10 18:50 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/10 17:46 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-selinux-root 2021/07/10 15:33 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/10 14:25 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/10 13:05 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/10 12:51 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/10 11:47 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/10 10:46 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/10 09:42 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-selinux-root 2021/07/10 09:40 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-root 2021/07/10 07:31 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-smack-root 2021/07/10 06:27 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/10 05:55 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-smack-root 2021/07/10 04:38 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-selinux-root 2021/07/10 03:56 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce 2021/07/10 02:53 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-selinux-root 2021/07/10 02:03 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-smack-root 2021/07/10 01:38 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-smack-root 2021/07/10 01:07 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-qemu-upstream 2021/06/21 07:19 upstream 13311e74253f aba2b2fb .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/07/11 19:21 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/07/11 02:33 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/07/11 01:31 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/07/10 21:01 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/07/10 16:59 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/07/10 15:50 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-upstream-kasan-gce-386 2021/07/10 08:36 upstream 3dbdb38e2869 8f5a7b8c .config log report info possible deadlock in loop_probe
ci-qemu-upstream-386 2021/06/21 08:10 upstream 13311e74253f aba2b2fb .config log report info possible deadlock in loop_probe
ci-qemu-upstream-386 2021/06/12 21:09 upstream 141415d7379a 1ba81399 .config log report info possible deadlock in loop_probe