syzbot

BUG: sleeping function called from invalid context at drivers/tty/vt/vt.c:2245
in_atomic(): 1, irqs_disabled(): 1, pid: 8021, name: syz-executor388
3 locks held by syz-executor388/8021:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff8355c6a2>] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284
 #1:  (&(&gsm->control_lock)->rlock){....}, at: [<ffffffff83573016>] gsm_control_send+0xf6/0x480 drivers/tty/n_gsm.c:1434
 #2:  (&(&gsm->tx_lock)->rlock){....}, at: [<ffffffff83572e41>] gsm_data_queue drivers/tty/n_gsm.c:845 [inline]
 #2:  (&(&gsm->tx_lock)->rlock){....}, at: [<ffffffff83572e41>] gsm_control_transmit+0x1f1/0x2d0 drivers/tty/n_gsm.c:1375
irq event stamp: 13522
hardirqs last  enabled at (13521): [<ffffffff8724c959>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
hardirqs last  enabled at (13521): [<ffffffff8724c959>] _raw_spin_unlock_irqrestore+0x79/0xe0 kernel/locking/spinlock.c:192
hardirqs last disabled at (13522): [<ffffffff8724c5e6>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (13522): [<ffffffff8724c5e6>] _raw_spin_lock_irqsave+0x66/0xc0 kernel/locking/spinlock.c:160
softirqs last  enabled at (12268): [<ffffffff8760068b>] __do_softirq+0x68b/0x9ff kernel/softirq.c:314
softirqs last disabled at (11951): [<ffffffff81322d13>] invoke_softirq kernel/softirq.c:368 [inline]
softirqs last disabled at (11951): [<ffffffff81322d13>] irq_exit+0x193/0x240 kernel/softirq.c:409
Preemption disabled at:
[<          (null)>]           (null)
CPU: 0 PID: 8021 Comm: syz-executor388 Not tainted 4.14.301-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6041
 do_con_write+0xd0/0x19b0 drivers/tty/vt/vt.c:2245
 con_write+0x21/0xa0 drivers/tty/vt/vt.c:2822
 gsmld_output+0xc3/0x190 drivers/tty/n_gsm.c:2312
 gsm_data_kick+0x266/0x9b0 drivers/tty/n_gsm.c:761
 gsm_data_queue drivers/tty/n_gsm.c:846 [inline]
 gsm_control_transmit+0x1ff/0x2d0 drivers/tty/n_gsm.c:1375
 gsm_control_send+0x38a/0x480 drivers/tty/n_gsm.c:1451
 gsm_disconnect drivers/tty/n_gsm.c:2110 [inline]
 gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636
 gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700
 tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f01f64c6329
RSP: 002b:00007ffc8a358f88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f01f64c6329
RDX: 0000000020000040 RSI: 00000000404c4701 RDI: 0000000000000005
RBP: 00007f01f648a1b0 R08: 000000000000000e R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f01f648a240
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

========================================================
WARNING: possible irq lock inversion dependency detected
4.14.301-syzkaller #0 Tainted: G        W      
--------------------------------------------------------
ksoftirqd/0/7 just changed the state of lock:
 (&(&gsm->control_lock)->rlock){..-.}, at: [<ffffffff83573a95>] gsm_control_retransmit+0x25/0x2c0 drivers/tty/n_gsm.c:1394
but this lock took another, SOFTIRQ-unsafe lock in the past:
 (console_lock){+.+.}


and interrupts could create inverse lock ordering between them.


other info that might help us debug this:
Chain exists of:
  &(&gsm->control_lock)->rlock --> &(&gsm->tx_lock)->rlock --> console_lock

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(console_lock);
                               local_irq_disable();
                               lock(&(&gsm->control_lock)->rlock);
                               lock(&(&gsm->tx_lock)->rlock);
  <Interrupt>
    lock(&(&gsm->control_lock)->rlock);

 *** DEADLOCK ***

1 lock held by ksoftirqd/0/7:
 #0:  (((&gsm->t2_timer))){+.-.}, at: [<ffffffff814871a8>] lockdep_copy_map include/linux/lockdep.h:174 [inline]
 #0:  (((&gsm->t2_timer))){+.-.}, at: [<ffffffff814871a8>] call_timer_fn+0xb8/0x650 kernel/time/timer.c:1270

the shortest dependencies between 2nd lock and 1st lock:
  -> (console_lock){+.+.} ops: 2763 {
     HARDIRQ-ON-W at:
                        lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                        console_lock+0x42/0x70 kernel/printk/printk.c:2228
                        con_init+0x12/0x5d6 drivers/tty/vt/vt.c:3022
                        console_init+0x46/0x53 kernel/printk/printk.c:2809
                        start_kernel+0x521/0x763 init/main.c:638
                        secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240
     SOFTIRQ-ON-W at:
                        lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                        console_lock+0x42/0x70 kernel/printk/printk.c:2228
                        con_init+0x12/0x5d6 drivers/tty/vt/vt.c:3022
                        console_init+0x46/0x53 kernel/printk/printk.c:2809
                        start_kernel+0x521/0x763 init/main.c:638
                        secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240
     INITIAL USE at:
   }
   ... key      at: [<ffffffff88f6f3e0>] console_lock_dep_map+0x0/0x40
   ... acquired at:
   console_lock+0x42/0x70 kernel/printk/printk.c:2228
   do_con_write+0xd5/0x19b0 drivers/tty/vt/vt.c:2247
   con_write+0x21/0xa0 drivers/tty/vt/vt.c:2822
   gsmld_output+0xc3/0x190 drivers/tty/n_gsm.c:2312
   gsm_data_kick+0x266/0x9b0 drivers/tty/n_gsm.c:761
   gsm_data_queue drivers/tty/n_gsm.c:846 [inline]
   gsm_control_transmit+0x1ff/0x2d0 drivers/tty/n_gsm.c:1375
   gsm_control_send+0x38a/0x480 drivers/tty/n_gsm.c:1451
   gsm_disconnect drivers/tty/n_gsm.c:2110 [inline]
   gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636
   gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700
   tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670
   vfs_ioctl fs/ioctl.c:46 [inline]
   file_ioctl fs/ioctl.c:500 [inline]
   do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
   SYSC_ioctl fs/ioctl.c:701 [inline]
   SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
   do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
   entry_SYSCALL_64_after_hwframe+0x5e/0xd3

 -> (&(&gsm->tx_lock)->rlock){....} ops: 1 {
    INITIAL USE at:
                     lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                     __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                     _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
                     gsm_data_queue drivers/tty/n_gsm.c:845 [inline]
                     gsm_control_transmit+0x1f1/0x2d0 drivers/tty/n_gsm.c:1375
                     gsm_control_send+0x38a/0x480 drivers/tty/n_gsm.c:1451
                     gsm_disconnect drivers/tty/n_gsm.c:2110 [inline]
                     gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636
                     gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700
                     tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670
                     vfs_ioctl fs/ioctl.c:46 [inline]
                     file_ioctl fs/ioctl.c:500 [inline]
                     do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
                     SYSC_ioctl fs/ioctl.c:701 [inline]
                     SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
                     do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
                     entry_SYSCALL_64_after_hwframe+0x5e/0xd3
  }
  ... key      at: [<ffffffff8c8d3460>] __key.4+0x0/0x40
  ... acquired at:
   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
   _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
   gsm_data_queue drivers/tty/n_gsm.c:845 [inline]
   gsm_control_transmit+0x1f1/0x2d0 drivers/tty/n_gsm.c:1375
   gsm_control_send+0x38a/0x480 drivers/tty/n_gsm.c:1451
   gsm_disconnect drivers/tty/n_gsm.c:2110 [inline]
   gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636
   gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700
   tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670
   vfs_ioctl fs/ioctl.c:46 [inline]
   file_ioctl fs/ioctl.c:500 [inline]
   do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
   SYSC_ioctl fs/ioctl.c:701 [inline]
   SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
   do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
   entry_SYSCALL_64_after_hwframe+0x5e/0xd3

-> (&(&gsm->control_lock)->rlock){..-.} ops: 2 {
   IN-SOFTIRQ-W at:
                    lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                    __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                    _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
                    gsm_control_retransmit+0x25/0x2c0 drivers/tty/n_gsm.c:1394
                    call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280
                    expire_timers+0x232/0x4d0 kernel/time/timer.c:1319
                    __run_timers kernel/time/timer.c:1637 [inline]
                    run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650
                    __do_softirq+0x24d/0x9ff kernel/softirq.c:288
                    run_ksoftirqd+0x50/0x1a0 kernel/softirq.c:670
                    smpboot_thread_fn+0x5c1/0x920 kernel/smpboot.c:164
                    kthread+0x30d/0x420 kernel/kthread.c:232
                    ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406
   INITIAL USE at:
                   lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                   _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
                   gsm_control_send+0xf6/0x480 drivers/tty/n_gsm.c:1434
                   gsm_disconnect drivers/tty/n_gsm.c:2110 [inline]
                   gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636
                   gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700
                   tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670
                   vfs_ioctl fs/ioctl.c:46 [inline]
                   file_ioctl fs/ioctl.c:500 [inline]
                   do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
                   SYSC_ioctl fs/ioctl.c:701 [inline]
                   SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
                   do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
                   entry_SYSCALL_64_after_hwframe+0x5e/0xd3
 }
 ... key      at: [<ffffffff8c8d34a0>] __key.5+0x0/0x40
 ... acquired at:
   mark_lock_irq kernel/locking/lockdep.c:2804 [inline]
   mark_lock+0x3c7/0x1050 kernel/locking/lockdep.c:3194
   mark_irqflags kernel/locking/lockdep.c:3072 [inline]
   __lock_acquire+0xc81/0x3f20 kernel/locking/lockdep.c:3448
   lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
   _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
   gsm_control_retransmit+0x25/0x2c0 drivers/tty/n_gsm.c:1394
   call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280
   expire_timers+0x232/0x4d0 kernel/time/timer.c:1319
   __run_timers kernel/time/timer.c:1637 [inline]
   run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650
   __do_softirq+0x24d/0x9ff kernel/softirq.c:288
   run_ksoftirqd+0x50/0x1a0 kernel/softirq.c:670
   smpboot_thread_fn+0x5c1/0x920 kernel/smpboot.c:164
   kthread+0x30d/0x420 kernel/kthread.c:232
   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406


stack backtrace:
CPU: 0 PID: 7 Comm: ksoftirqd/0 Tainted: G        W       4.14.301-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_irq_inversion_bug.cold+0x313/0x346 kernel/locking/lockdep.c:2670
 check_usage_forwards+0x18f/0x2d0 kernel/locking/lockdep.c:2695
 mark_lock_irq kernel/locking/lockdep.c:2804 [inline]
 mark_lock+0x3c7/0x1050 kernel/locking/lockdep.c:3194
 mark_irqflags kernel/locking/lockdep.c:3072 [inline]
 __lock_acquire+0xc81/0x3f20 kernel/locking/lockdep.c:3448
 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
 gsm_control_retransmit+0x25/0x2c0 drivers/tty/n_gsm.c:1394
 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280
 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319
 __run_timers kernel/time/timer.c:1637 [inline]
 run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650
 __do_softirq+0x24d/0x9ff kernel/softirq.c:288
 run_ksoftirqd+0x50/0x1a0 kernel/softirq.c:670
 smpboot_thread_fn+0x5c1/0x920 kernel/smpboot.c:164
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406