syzbot


possible deadlock in io_submit_one

Status: fixed on 2019/12/17 14:31
Reported-by: syzbot+a382f9fc143e31d6afb6@syzkaller.appspotmail.com
Fix commit: 052b31810085 fs/userfaultfd.c: disable irqs for fault_pending and event locks
First crash: 2051d, last: 1874d
Fix bisection: fixed by (bisect log) :
commit 052b318100856aa86f4e0c03cfe43a1bb6bfb487
Author: Eric Biggers <ebiggers@google.com>
Date: Thu Jul 4 22:14:39 2019 +0000

  fs/userfaultfd.c: disable irqs for fault_pending and event locks

  
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in io_submit_one fs C done 1779 1946d 2116d 12/28 fixed on 2019/07/29 13:39
upstream possible deadlock in io_submit_one (2) fuse 353 1883d 1921d 13/28 fixed on 2019/10/15 23:40
upstream possible deadlock in io_submit_one (3) fs syz done 45 1686d 1693d 15/28 fixed on 2020/05/10 10:42

Sample crash report:
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
8021q: adding VLAN 0 to HW filter on device batadv0
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
4.19.57 #30 Not tainted
-----------------------------------------------------
syz-executor.3/8131 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
00000000110d9ec2 (&ctx->fd_wqh){....}, at: spin_lock include/linux/spinlock.h:329 [inline]
00000000110d9ec2 (&ctx->fd_wqh){....}, at: aio_poll fs/aio.c:1741 [inline]
00000000110d9ec2 (&ctx->fd_wqh){....}, at: __io_submit_one fs/aio.c:1849 [inline]
00000000110d9ec2 (&ctx->fd_wqh){....}, at: io_submit_one+0xef2/0x2eb0 fs/aio.c:1885

and this task is already holding:
000000005f298072 (&(&ctx->ctx_lock)->rlock){..-.}, at: spin_lock_irq include/linux/spinlock.h:354 [inline]
000000005f298072 (&(&ctx->ctx_lock)->rlock){..-.}, at: aio_poll fs/aio.c:1739 [inline]
000000005f298072 (&(&ctx->ctx_lock)->rlock){..-.}, at: __io_submit_one fs/aio.c:1849 [inline]
000000005f298072 (&(&ctx->ctx_lock)->rlock){..-.}, at: io_submit_one+0xead/0x2eb0 fs/aio.c:1885
which would create a new lock dependency:
 (&(&ctx->ctx_lock)->rlock){..-.} -> (&ctx->fd_wqh){....}

but this new dependency connects a SOFTIRQ-irq-safe lock:
 (&(&ctx->ctx_lock)->rlock){..-.}

... which became SOFTIRQ-irq-safe at:
  lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
  __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
  _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:160
  spin_lock_irq include/linux/spinlock.h:354 [inline]
  free_ioctx_users+0x2d/0x490 fs/aio.c:614
  percpu_ref_put_many include/linux/percpu-refcount.h:284 [inline]
  percpu_ref_put include/linux/percpu-refcount.h:300 [inline]
  percpu_ref_call_confirm_rcu lib/percpu-refcount.c:123 [inline]
  percpu_ref_switch_to_atomic_rcu+0x407/0x540 lib/percpu-refcount.c:158
  __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
  rcu_do_batch kernel/rcu/tree.c:2584 [inline]
  invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
  __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
  rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881
  __do_softirq+0x25c/0x921 kernel/softirq.c:292
  do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1067
  do_softirq.part.0+0x11a/0x170 kernel/softirq.c:336
  do_softirq kernel/softirq.c:328 [inline]
  __local_bh_enable_ip+0x211/0x270 kernel/softirq.c:189
  __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
  _raw_spin_unlock_bh+0x31/0x40 kernel/locking/spinlock.c:200
  spin_unlock_bh include/linux/spinlock.h:374 [inline]
  __ip6_ins_rt+0x5f/0x80 net/ipv6/route.c:1165
  ip6_route_add+0x5a/0xd0 net/ipv6/route.c:3210
  addrconf_prefix_route.isra.0+0x358/0x4f0 net/ipv6/addrconf.c:2346
  addrconf_add_linklocal+0x284/0x3c0 net/ipv6/addrconf.c:3137
  addrconf_addr_gen+0x34d/0x3a0 net/ipv6/addrconf.c:3262
  addrconf_dev_config+0x1ea/0x2c0 net/ipv6/addrconf.c:3305
  addrconf_notify+0x393/0x22e0 net/ipv6/addrconf.c:3536
  notifier_call_chain+0xc2/0x230 kernel/notifier.c:93
  __raw_notifier_call_chain kernel/notifier.c:394 [inline]
  raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401
  call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1747
  call_netdevice_notifiers net/core/dev.c:1765 [inline]
  __dev_notify_flags+0x121/0x2c0 net/core/dev.c:7536
  dev_change_flags+0x101/0x150 net/core/dev.c:7572
  do_setlink+0x1604/0x34c0 net/core/rtnetlink.c:2428
  rtnl_newlink+0xbad/0x1610 net/core/rtnetlink.c:3047
  rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:4747
  netlink_rcv_skb+0x17d/0x460 net/netlink/af_netlink.c:2454
  rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4765
  netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
  netlink_unicast+0x537/0x720 net/netlink/af_netlink.c:1343
  netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
  sock_sendmsg_nosec net/socket.c:622 [inline]
  sock_sendmsg+0xd7/0x130 net/socket.c:632
  __sys_sendto+0x262/0x380 net/socket.c:1787
  __do_sys_sendto net/socket.c:1799 [inline]
  __se_sys_sendto net/socket.c:1795 [inline]
  __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1795
  do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

to a SOFTIRQ-irq-unsafe lock:
 (&ctx->fault_pending_wqh){+.+.}

... which became SOFTIRQ-irq-unsafe at:
...
  lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
  spin_lock include/linux/spinlock.h:329 [inline]
  userfaultfd_release+0x4d6/0x720 fs/userfaultfd.c:922
  __fput+0x2dd/0x8b0 fs/file_table.c:278
  ____fput+0x16/0x20 fs/file_table.c:309
  task_work_run+0x145/0x1c0 kernel/task_work.c:113
  get_signal+0x1baa/0x1fc0 kernel/signal.c:2385
  do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
  exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
  prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
  do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:
  &(&ctx->ctx_lock)->rlock --> &ctx->fd_wqh --> &ctx->fault_pending_wqh

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&ctx->fault_pending_wqh);
                               local_irq_disable();
                               lock(&(&ctx->ctx_lock)->rlock);
                               lock(&ctx->fd_wqh);
  <Interrupt>
    lock(&(&ctx->ctx_lock)->rlock);

 *** DEADLOCK ***

1 lock held by syz-executor.3/8131:
 #0: 000000005f298072 (&(&ctx->ctx_lock)->rlock){..-.}, at: spin_lock_irq include/linux/spinlock.h:354 [inline]
 #0: 000000005f298072 (&(&ctx->ctx_lock)->rlock){..-.}, at: aio_poll fs/aio.c:1739 [inline]
 #0: 000000005f298072 (&(&ctx->ctx_lock)->rlock){..-.}, at: __io_submit_one fs/aio.c:1849 [inline]
 #0: 000000005f298072 (&(&ctx->ctx_lock)->rlock){..-.}, at: io_submit_one+0xead/0x2eb0 fs/aio.c:1885

the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
-> (&(&ctx->ctx_lock)->rlock){..-.} ops: 33 {
   IN-SOFTIRQ-W at:
                    lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
                    __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                    _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:160
                    spin_lock_irq include/linux/spinlock.h:354 [inline]
                    free_ioctx_users+0x2d/0x490 fs/aio.c:614
                    percpu_ref_put_many include/linux/percpu-refcount.h:284 [inline]
                    percpu_ref_put include/linux/percpu-refcount.h:300 [inline]
                    percpu_ref_call_confirm_rcu lib/percpu-refcount.c:123 [inline]
                    percpu_ref_switch_to_atomic_rcu+0x407/0x540 lib/percpu-refcount.c:158
                    __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
                    rcu_do_batch kernel/rcu/tree.c:2584 [inline]
                    invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
                    __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
                    rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881
                    __do_softirq+0x25c/0x921 kernel/softirq.c:292
                    do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1067
                    do_softirq.part.0+0x11a/0x170 kernel/softirq.c:336
                    do_softirq kernel/softirq.c:328 [inline]
                    __local_bh_enable_ip+0x211/0x270 kernel/softirq.c:189
                    __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
                    _raw_spin_unlock_bh+0x31/0x40 kernel/locking/spinlock.c:200
                    spin_unlock_bh include/linux/spinlock.h:374 [inline]
                    __ip6_ins_rt+0x5f/0x80 net/ipv6/route.c:1165
                    ip6_route_add+0x5a/0xd0 net/ipv6/route.c:3210
                    addrconf_prefix_route.isra.0+0x358/0x4f0 net/ipv6/addrconf.c:2346
                    addrconf_add_linklocal+0x284/0x3c0 net/ipv6/addrconf.c:3137
                    addrconf_addr_gen+0x34d/0x3a0 net/ipv6/addrconf.c:3262
                    addrconf_dev_config+0x1ea/0x2c0 net/ipv6/addrconf.c:3305
                    addrconf_notify+0x393/0x22e0 net/ipv6/addrconf.c:3536
                    notifier_call_chain+0xc2/0x230 kernel/notifier.c:93
                    __raw_notifier_call_chain kernel/notifier.c:394 [inline]
                    raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401
                    call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1747
                    call_netdevice_notifiers net/core/dev.c:1765 [inline]
                    __dev_notify_flags+0x121/0x2c0 net/core/dev.c:7536
                    dev_change_flags+0x101/0x150 net/core/dev.c:7572
                    do_setlink+0x1604/0x34c0 net/core/rtnetlink.c:2428
                    rtnl_newlink+0xbad/0x1610 net/core/rtnetlink.c:3047
                    rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:4747
                    netlink_rcv_skb+0x17d/0x460 net/netlink/af_netlink.c:2454
                    rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4765
                    netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
                    netlink_unicast+0x537/0x720 net/netlink/af_netlink.c:1343
                    netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
                    sock_sendmsg_nosec net/socket.c:622 [inline]
                    sock_sendmsg+0xd7/0x130 net/socket.c:632
                    __sys_sendto+0x262/0x380 net/socket.c:1787
                    __do_sys_sendto net/socket.c:1799 [inline]
                    __se_sys_sendto net/socket.c:1795 [inline]
                    __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1795
                    do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
   INITIAL USE at:
                   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
                   __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                   _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:160
                   spin_lock_irq include/linux/spinlock.h:354 [inline]
                   free_ioctx_users+0x2d/0x490 fs/aio.c:614
                   percpu_ref_put_many include/linux/percpu-refcount.h:284 [inline]
                   percpu_ref_put include/linux/percpu-refcount.h:300 [inline]
                   percpu_ref_call_confirm_rcu lib/percpu-refcount.c:123 [inline]
                   percpu_ref_switch_to_atomic_rcu+0x407/0x540 lib/percpu-refcount.c:158
                   __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
                   rcu_do_batch kernel/rcu/tree.c:2584 [inline]
                   invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
                   __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
                   rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881
                   __do_softirq+0x25c/0x921 kernel/softirq.c:292
                   do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1067
                   do_softirq.part.0+0x11a/0x170 kernel/softirq.c:336
                   do_softirq kernel/softirq.c:328 [inline]
                   __local_bh_enable_ip+0x211/0x270 kernel/softirq.c:189
                   __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
                   _raw_spin_unlock_bh+0x31/0x40 kernel/locking/spinlock.c:200
                   spin_unlock_bh include/linux/spinlock.h:374 [inline]
                   __ip6_ins_rt+0x5f/0x80 net/ipv6/route.c:1165
                   ip6_route_add+0x5a/0xd0 net/ipv6/route.c:3210
                   addrconf_prefix_route.isra.0+0x358/0x4f0 net/ipv6/addrconf.c:2346
                   addrconf_add_linklocal+0x284/0x3c0 net/ipv6/addrconf.c:3137
                   addrconf_addr_gen+0x34d/0x3a0 net/ipv6/addrconf.c:3262
                   addrconf_dev_config+0x1ea/0x2c0 net/ipv6/addrconf.c:3305
                   addrconf_notify+0x393/0x22e0 net/ipv6/addrconf.c:3536
                   notifier_call_chain+0xc2/0x230 kernel/notifier.c:93
                   __raw_notifier_call_chain kernel/notifier.c:394 [inline]
                   raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401
                   call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1747
                   call_netdevice_notifiers net/core/dev.c:1765 [inline]
                   __dev_notify_flags+0x121/0x2c0 net/core/dev.c:7536
                   dev_change_flags+0x101/0x150 net/core/dev.c:7572
                   do_setlink+0x1604/0x34c0 net/core/rtnetlink.c:2428
                   rtnl_newlink+0xbad/0x1610 net/core/rtnetlink.c:3047
                   rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:4747
                   netlink_rcv_skb+0x17d/0x460 net/netlink/af_netlink.c:2454
                   rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4765
                   netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
                   netlink_unicast+0x537/0x720 net/netlink/af_netlink.c:1343
                   netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
                   sock_sendmsg_nosec net/socket.c:622 [inline]
                   sock_sendmsg+0xd7/0x130 net/socket.c:632
                   __sys_sendto+0x262/0x380 net/socket.c:1787
                   __do_sys_sendto net/socket.c:1799 [inline]
                   __se_sys_sendto net/socket.c:1795 [inline]
                   __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1795
                   do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
                   entry_SYSCALL_64_after_hwframe+0x49/0xbe
 }
 ... key      at: [<ffffffff8a3873a0>] __key.50195+0x0/0x40
 ... acquired at:
   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
   spin_lock include/linux/spinlock.h:329 [inline]
   aio_poll fs/aio.c:1741 [inline]
   __io_submit_one fs/aio.c:1849 [inline]
   io_submit_one+0xef2/0x2eb0 fs/aio.c:1885
   __do_sys_io_submit fs/aio.c:1929 [inline]
   __se_sys_io_submit fs/aio.c:1900 [inline]
   __x64_sys_io_submit+0x1aa/0x520 fs/aio.c:1900
   do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
   entry_SYSCALL_64_after_hwframe+0x49/0xbe


the dependencies between the lock to be acquired
 and SOFTIRQ-irq-unsafe lock:
 -> (&ctx->fault_pending_wqh){+.+.} ops: 182 {
    HARDIRQ-ON-W at:
                      lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
                      __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                      _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
                      spin_lock include/linux/spinlock.h:329 [inline]
                      userfaultfd_release+0x4d6/0x720 fs/userfaultfd.c:922
                      __fput+0x2dd/0x8b0 fs/file_table.c:278
                      ____fput+0x16/0x20 fs/file_table.c:309
                      task_work_run+0x145/0x1c0 kernel/task_work.c:113
                      get_signal+0x1baa/0x1fc0 kernel/signal.c:2385
                      do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
                      exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
                      prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
                      syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
                      do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
                      entry_SYSCALL_64_after_hwframe+0x49/0xbe
    SOFTIRQ-ON-W at:
                      lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
                      __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                      _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
                      spin_lock include/linux/spinlock.h:329 [inline]
                      userfaultfd_release+0x4d6/0x720 fs/userfaultfd.c:922
                      __fput+0x2dd/0x8b0 fs/file_table.c:278
                      ____fput+0x16/0x20 fs/file_table.c:309
                      task_work_run+0x145/0x1c0 kernel/task_work.c:113
                      get_signal+0x1baa/0x1fc0 kernel/signal.c:2385
                      do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
                      exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
                      prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
                      syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
                      do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
                      entry_SYSCALL_64_after_hwframe+0x49/0xbe
    INITIAL USE at:
                     lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
                     __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                     _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
                     spin_lock include/linux/spinlock.h:329 [inline]
                     userfaultfd_ctx_read fs/userfaultfd.c:1046 [inline]
                     userfaultfd_read+0x394/0x18c0 fs/userfaultfd.c:1204
                     __vfs_read+0x114/0x800 fs/read_write.c:416
                     vfs_read+0x194/0x3d0 fs/read_write.c:452
                     ksys_read+0x14f/0x2d0 fs/read_write.c:579
                     __do_sys_read fs/read_write.c:589 [inline]
                     __se_sys_read fs/read_write.c:587 [inline]
                     __x64_sys_read+0x73/0xb0 fs/read_write.c:587
                     do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
  }
  ... key      at: [<ffffffff8a3871e0>] __key.43729+0x0/0x40
  ... acquired at:
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
   spin_lock include/linux/spinlock.h:329 [inline]
   userfaultfd_ctx_read fs/userfaultfd.c:1046 [inline]
   userfaultfd_read+0x394/0x18c0 fs/userfaultfd.c:1204
   __vfs_read+0x114/0x800 fs/read_write.c:416
   vfs_read+0x194/0x3d0 fs/read_write.c:452
   ksys_read+0x14f/0x2d0 fs/read_write.c:579
   __do_sys_read fs/read_write.c:589 [inline]
   __se_sys_read fs/read_write.c:587 [inline]
   __x64_sys_read+0x73/0xb0 fs/read_write.c:587
   do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
   entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> (&ctx->fd_wqh){....} ops: 184 {
   INITIAL USE at:
                   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
                   __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                   _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:160
                   spin_lock_irq include/linux/spinlock.h:354 [inline]
                   userfaultfd_ctx_read fs/userfaultfd.c:1042 [inline]
                   userfaultfd_read+0x262/0x18c0 fs/userfaultfd.c:1204
                   __vfs_read+0x114/0x800 fs/read_write.c:416
                   vfs_read+0x194/0x3d0 fs/read_write.c:452
                   ksys_read+0x14f/0x2d0 fs/read_write.c:579
                   __do_sys_read fs/read_write.c:589 [inline]
                   __se_sys_read fs/read_write.c:587 [inline]
                   __x64_sys_read+0x73/0xb0 fs/read_write.c:587
                   do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
                   entry_SYSCALL_64_after_hwframe+0x49/0xbe
 }
 ... key      at: [<ffffffff8a387120>] __key.43732+0x0/0x40
 ... acquired at:
   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
   spin_lock include/linux/spinlock.h:329 [inline]
   aio_poll fs/aio.c:1741 [inline]
   __io_submit_one fs/aio.c:1849 [inline]
   io_submit_one+0xef2/0x2eb0 fs/aio.c:1885
   __do_sys_io_submit fs/aio.c:1929 [inline]
   __se_sys_io_submit fs/aio.c:1900 [inline]
   __x64_sys_io_submit+0x1aa/0x520 fs/aio.c:1900
   do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
   entry_SYSCALL_64_after_hwframe+0x49/0xbe


stack backtrace:
CPU: 0 PID: 8131 Comm: syz-executor.3 Not tainted 4.19.57 #30
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_bad_irq_dependency kernel/locking/lockdep.c:1568 [inline]
 check_usage.cold+0x611/0x946 kernel/locking/lockdep.c:1600
 check_irq_usage kernel/locking/lockdep.c:1656 [inline]
 check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline]
 check_prev_add kernel/locking/lockdep.c:1866 [inline]
 check_prevs_add kernel/locking/lockdep.c:1974 [inline]
 validate_chain kernel/locking/lockdep.c:2415 [inline]
 __lock_acquire+0x1ee4/0x48f0 kernel/locking/lockdep.c:3411
 lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
 spin_lock include/linux/spinlock.h:329 [inline]
 aio_poll fs/aio.c:1741 [inline]
 __io_submit_one fs/aio.c:1849 [inline]
 io_submit_one+0xef2/0x2eb0 fs/aio.c:1885
 __do_sys_io_submit fs/aio.c:1929 [inline]
 __se_sys_io_submit fs/aio.c:1900 [inline]
 __x64_sys_io_submit+0x1aa/0x520 fs/aio.c:1900
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4597c9
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f2276776c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004597c9
RDX: 0000000020000000 RSI: 0000000000000001 RDI: 00007f2276778000
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22767776d4
R13: 00000000004c0b97 R14: 00000000004d3908 R15: 00000000ffffffff
kobject: 'loop3' (00000000cca82e5a): kobject_uevent_env
kobject: 'loop3' (00000000cca82e5a): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'loop2' (00000000c9df48b7): kobject_uevent_env
kobject: 'loop2' (00000000c9df48b7): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'loop1' (00000000ff887faa): kobject_uevent_env
kobject: 'loop1' (00000000ff887faa): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop4' (00000000dcf095d7): kobject_uevent_env
kobject: 'loop4' (00000000dcf095d7): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'loop5' (000000000e2a3a1d): kobject_uevent_env
kobject: 'loop5' (000000000e2a3a1d): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop0' (000000003e3fdb66): kobject_uevent_env
kobject: 'loop0' (000000003e3fdb66): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop3' (00000000cca82e5a): kobject_uevent_env
kobject: 'loop3' (00000000cca82e5a): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'loop2' (00000000c9df48b7): kobject_uevent_env
kobject: 'loop2' (00000000c9df48b7): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'loop5' (000000000e2a3a1d): kobject_uevent_env
kobject: 'loop5' (000000000e2a3a1d): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop4' (00000000dcf095d7): kobject_uevent_env
kobject: 'loop4' (00000000dcf095d7): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'loop1' (00000000ff887faa): kobject_uevent_env
kobject: 'loop1' (00000000ff887faa): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop0' (000000003e3fdb66): kobject_uevent_env
kobject: 'loop0' (000000003e3fdb66): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000c9df48b7): kobject_uevent_env
kobject: 'loop2' (00000000c9df48b7): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'loop5' (000000000e2a3a1d): kobject_uevent_env
kobject: 'loop5' (000000000e2a3a1d): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop3' (00000000cca82e5a): kobject_uevent_env
kobject: 'loop3' (00000000cca82e5a): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'loop4' (00000000dcf095d7): kobject_uevent_env
kobject: 'loop4' (00000000dcf095d7): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'loop1' (00000000ff887faa): kobject_uevent_env
kobject: 'loop1' (00000000ff887faa): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop0' (000000003e3fdb66): kobject_uevent_env
kobject: 'loop0' (000000003e3fdb66): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000c9df48b7): kobject_uevent_env
kobject: 'loop2' (00000000c9df48b7): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'loop5' (000000000e2a3a1d): kobject_uevent_env
kobject: 'loop5' (000000000e2a3a1d): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop3' (00000000cca82e5a): kobject_uevent_env
kobject: 'loop3' (00000000cca82e5a): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'loop1' (00000000ff887faa): kobject_uevent_env
kobject: 'loop1' (00000000ff887faa): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop4' (00000000dcf095d7): kobject_uevent_env
kobject: 'loop4' (00000000dcf095d7): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'loop0' (000000003e3fdb66): kobject_uevent_env
kobject: 'loop0' (000000003e3fdb66): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000c9df48b7): kobject_uevent_env
kobject: 'loop2' (00000000c9df48b7): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'loop5' (000000000e2a3a1d): kobject_uevent_env
kobject: 'loop5' (000000000e2a3a1d): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop3' (00000000cca82e5a): kobject_uevent_env
kobject: 'loop3' (00000000cca82e5a): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'loop1' (00000000ff887faa): kobject_uevent_env
kobject: 'loop1' (00000000ff887faa): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop4' (00000000dcf095d7): kobject_uevent_env
kobject: 'loop4' (00000000dcf095d7): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'loop0' (000000003e3fdb66): kobject_uevent_env
kobject: 'loop0' (000000003e3fdb66): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000c9df48b7): kobject_uevent_env
kobject: 'loop2' (00000000c9df48b7): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'loop5' (000000000e2a3a1d): kobject_uevent_env
kobject: 'loop5' (000000000e2a3a1d): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop1' (00000000ff887faa): kobject_uevent_env
kobject: 'loop1' (00000000ff887faa): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop3' (00000000cca82e5a): kobject_uevent_env
kobject: 'loop3' (00000000cca82e5a): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'loop4' (00000000dcf095d7): kobject_uevent_env
kobject: 'loop4' (00000000dcf095d7): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'loop0' (000000003e3fdb66): kobject_uevent_env
kobject: 'loop0' (000000003e3fdb66): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000c9df48b7): kobject_uevent_env
kobject: 'loop2' (00000000c9df48b7): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'loop3' (00000000cca82e5a): kobject_uevent_env
kobject: 'loop3' (00000000cca82e5a): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'loop5' (000000000e2a3a1d): kobject_uevent_env
kobject: 'loop5' (000000000e2a3a1d): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop1' (00000000ff887faa): kobject_uevent_env
kobject: 'loop1' (00000000ff887faa): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop4' (00000000dcf095d7): kobject_uevent_env
kobject: 'loop4' (00000000dcf095d7): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'loop0' (000000003e3fdb66): kobject_uevent_env
kobject: 'loop0' (000000003e3fdb66): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000c9df48b7): kobject_uevent_env
kobject: 'loop2' (00000000c9df48b7): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'loop3' (00000000cca82e5a): kobject_uevent_env
kobject: 'loop3' (00000000cca82e5a): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'loop5' (000000000e2a3a1d): kobject_uevent_env
kobject: 'loop5' (000000000e2a3a1d): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop1' (00000000ff887faa): kobject_uevent_env
kobject: 'loop1' (00000000ff887faa): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop4' (00000000dcf095d7): kobject_uevent_env
kobject: 'loop4' (00000000dcf095d7): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'loop0' (000000003e3fdb66): kobject_uevent_env
kobject: 'loop0' (000000003e3fdb66): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000c9df48b7): kobject_uevent_env
kobject: 'loop2' (00000000c9df48b7): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'loop3' (00000000cca82e5a): kobject_uevent_env
kobject: 'loop3' (00000000cca82e5a): fill_kobj_path: path = '/devices/virtual/block/loop3'

Crashes (406):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/05 20:45 linux-4.19.y 1a0592436669 f62e1e85 .config console log report syz ci2-linux-4-19
2019/07/03 01:30 linux-4.19.y aec3002d07fd 55565fa0 .config console log report syz ci2-linux-4-19
2019/06/29 19:56 linux-4.19.y aec3002d07fd 7509bf36 .config console log report syz ci2-linux-4-19
2019/06/29 14:55 linux-4.19.y aec3002d07fd 7509bf36 .config console log report syz ci2-linux-4-19
2019/06/27 18:09 linux-4.19.y aec3002d07fd 7509bf36 .config console log report syz ci2-linux-4-19
2019/06/21 13:43 linux-4.19.y 9f31eb60d7a2 34bf9440 .config console log report syz ci2-linux-4-19
2019/06/19 18:01 linux-4.19.y 9f31eb60d7a2 34bf9440 .config console log report syz ci2-linux-4-19
2019/06/18 18:16 linux-4.19.y 6500aa436df4 e3f76baa .config console log report syz ci2-linux-4-19
2019/06/17 18:01 linux-4.19.y 7aa823a959e1 442206d7 .config console log report syz ci2-linux-4-19
2019/06/17 10:32 linux-4.19.y 7aa823a959e1 442206d7 .config console log report syz ci2-linux-4-19
2019/06/10 04:34 linux-4.19.y bb7b450e61a1 0159583c .config console log report syz ci2-linux-4-19
2019/10/05 04:33 linux-4.19.y 555161ee1b7a f3f7d9c8 .config console log report ci2-linux-4-19
2019/10/03 16:36 linux-4.19.y 555161ee1b7a fc17ba49 .config console log report ci2-linux-4-19
2019/10/02 15:18 linux-4.19.y 555161ee1b7a 2e29b534 .config console log report ci2-linux-4-19
2019/10/02 06:27 linux-4.19.y 555161ee1b7a b7a87a83 .config console log report ci2-linux-4-19
2019/10/01 07:13 linux-4.19.y 555161ee1b7a c7a4fb99 .config console log report ci2-linux-4-19
2019/10/01 06:30 linux-4.19.y d573e8a79f70 c7a4fb99 .config console log report ci2-linux-4-19
2019/10/01 01:15 linux-4.19.y d573e8a79f70 c7a4fb99 .config console log report ci2-linux-4-19
2019/09/30 16:53 linux-4.19.y d573e8a79f70 c7a4fb99 .config console log report ci2-linux-4-19
2019/09/30 13:35 linux-4.19.y d573e8a79f70 c7a4fb99 .config console log report ci2-linux-4-19
2019/09/30 12:14 linux-4.19.y d573e8a79f70 c7a4fb99 .config console log report ci2-linux-4-19
2019/09/30 04:38 linux-4.19.y d573e8a79f70 c1ad5441 .config console log report ci2-linux-4-19
2019/09/30 00:30 linux-4.19.y d573e8a79f70 c1ad5441 .config console log report ci2-linux-4-19
2019/09/29 20:19 linux-4.19.y d573e8a79f70 c1ad5441 .config console log report ci2-linux-4-19
2019/09/29 08:35 linux-4.19.y d573e8a79f70 c1ad5441 .config console log report ci2-linux-4-19
2019/09/29 06:41 linux-4.19.y d573e8a79f70 eb6b9855 .config console log report ci2-linux-4-19
2019/09/28 19:00 linux-4.19.y d573e8a79f70 eb6b9855 .config console log report ci2-linux-4-19
2019/09/28 11:31 linux-4.19.y d573e8a79f70 eb6b9855 .config console log report ci2-linux-4-19
2019/09/28 07:18 linux-4.19.y d573e8a79f70 d8074e0b .config console log report ci2-linux-4-19
2019/09/28 05:34 linux-4.19.y d573e8a79f70 d8074e0b .config console log report ci2-linux-4-19
2019/09/27 22:38 linux-4.19.y d573e8a79f70 d8074e0b .config console log report ci2-linux-4-19
2019/09/27 12:58 linux-4.19.y d573e8a79f70 d8074e0b .config console log report ci2-linux-4-19
2019/09/27 11:54 linux-4.19.y d573e8a79f70 d8074e0b .config console log report ci2-linux-4-19
2019/09/27 05:37 linux-4.19.y d573e8a79f70 2f1548bc .config console log report ci2-linux-4-19
2019/09/26 21:19 linux-4.19.y d573e8a79f70 2f1548bc .config console log report ci2-linux-4-19
2019/09/25 22:24 linux-4.19.y d573e8a79f70 a3355dba .config console log report ci2-linux-4-19
2019/09/25 14:23 linux-4.19.y d573e8a79f70 a3355dba .config console log report ci2-linux-4-19
2019/09/25 01:26 linux-4.19.y d573e8a79f70 e38a6630 .config console log report ci2-linux-4-19
2019/09/24 22:07 linux-4.19.y d573e8a79f70 e38a6630 .config console log report ci2-linux-4-19
2019/09/24 20:44 linux-4.19.y d573e8a79f70 f8368f99 .config console log report ci2-linux-4-19
2019/09/24 09:50 linux-4.19.y d573e8a79f70 f8368f99 .config console log report ci2-linux-4-19
2019/09/24 07:10 linux-4.19.y d573e8a79f70 c68252d2 .config console log report ci2-linux-4-19
2019/09/24 02:59 linux-4.19.y d573e8a79f70 c68252d2 .config console log report ci2-linux-4-19
2019/09/23 17:01 linux-4.19.y d573e8a79f70 c68252d2 .config console log report ci2-linux-4-19
2019/09/23 14:20 linux-4.19.y d573e8a79f70 1e9788a0 .config console log report ci2-linux-4-19
2019/09/23 10:59 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/23 06:53 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/23 04:52 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/22 22:32 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/22 19:49 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/22 17:52 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/22 16:07 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/22 03:42 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/22 02:03 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/21 23:25 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/21 19:04 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/04/10 16:51 linux-4.19.y 4d552acf3370 65b612b7 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.