possible deadlock in __might_fault

Status: fixed on 2020/01/18 20:51
Reported-by: syzbot+b59b126dd9ecef2f4ec9@syzkaller.appspotmail.com
Fix commit: 19e6317d24c2 usb: mon: Fix a deadlock in usbmon between mmap and read
First crash: 2663d, last: 2412d
Fix bisection: fixed by (bisect log) :
commit 3757e3818838828f969ea51bea9b0e4ba948575e
Author: Pete Zaitcev <zaitcev@redhat.com>
Date: Thu Dec 5 02:39:41 2019 +0000

  usb: mon: Fix a deadlock in usbmon between mmap and read

  
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in __might_fault staging 4 C 8978 3056d 3072d 4/29 fixed on 2018/03/23 18:14
linux-4.14 possible deadlock in __might_fault 4 C done 295 2421d 2662d 1/1 fixed on 2020/01/09 09:47
android-44 possible deadlock in __might_fault 4 C 6745 3046d 3073d 2/2 fixed on 2018/04/24 18:02
android-49 possible deadlock in __might_fault 4 C 10264 3051d 3073d 3/3 fixed on 2018/04/24 17:23
android-414 possible deadlock in __might_fault 4 136 2435d 2662d 0/1 auto-closed as invalid on 2020/03/25 09:38
upstream possible deadlock in __might_fault (3) usb 4 C 10722 2416d 2887d 0/29 closed as dup on 2018/09/16 01:51
upstream possible deadlock in __might_fault (2) net 4 C 20 3009d 3012d 8/29 fixed on 2018/07/09 18:05

Sample crash report:
audit: type=1400 audit(1571300957.875:37): avc:  denied  { map } for  pid=7661 comm="syz-executor968" path="/dev/usbmon0" dev="devtmpfs" ino=1549 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usbmon_device_t:s0 tclass=chr_file permissive=1
======================================================
WARNING: possible circular locking dependency detected
4.19.79 #0 Not tainted
------------------------------------------------------
syz-executor968/7663 is trying to acquire lock:
00000000fdab36f9 (&mm->mmap_sem){++++}, at: __might_fault+0xfb/0x1e0 mm/memory.c:4637

but task is already holding lock:
000000005b13b186 (&rp->fetch_lock){+.+.}, at: mon_bin_fetch+0x37/0x340 drivers/usb/mon/mon_bin.c:909

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&rp->fetch_lock){+.+.}:
       __mutex_lock_common kernel/locking/mutex.c:925 [inline]
       __mutex_lock+0xf7/0x1300 kernel/locking/mutex.c:1072
       mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
       mon_bin_vma_fault+0x73/0x2d0 drivers/usb/mon/mon_bin.c:1237
       __do_fault+0x111/0x480 mm/memory.c:3269
       do_cow_fault mm/memory.c:3710 [inline]
       do_fault mm/memory.c:3812 [inline]
       handle_pte_fault mm/memory.c:4041 [inline]
       __handle_mm_fault+0xf6d/0x3f80 mm/memory.c:4165
       handle_mm_fault+0x1b5/0x690 mm/memory.c:4202
       __do_page_fault+0x62a/0xe90 arch/x86/mm/fault.c:1390
       do_page_fault+0x71/0x57d arch/x86/mm/fault.c:1465
       page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1204

-> #0 (&mm->mmap_sem){++++}:
       lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3903
       __might_fault mm/memory.c:4638 [inline]
       __might_fault+0x15e/0x1e0 mm/memory.c:4623
       mon_bin_fetch+0x26f/0x340 drivers/usb/mon/mon_bin.c:928
       mon_bin_ioctl+0x21e/0xc80 drivers/usb/mon/mon_bin.c:1091
       vfs_ioctl fs/ioctl.c:46 [inline]
       file_ioctl fs/ioctl.c:501 [inline]
       do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
       ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
       __do_sys_ioctl fs/ioctl.c:712 [inline]
       __se_sys_ioctl fs/ioctl.c:710 [inline]
       __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
       do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&rp->fetch_lock);
                               lock(&mm->mmap_sem);
                               lock(&rp->fetch_lock);
  lock(&mm->mmap_sem);

 *** DEADLOCK ***

1 lock held by syz-executor968/7663:
 #0: 000000005b13b186 (&rp->fetch_lock){+.+.}, at: mon_bin_fetch+0x37/0x340 drivers/usb/mon/mon_bin.c:909

stack backtrace:
CPU: 0 PID: 7663 Comm: syz-executor968 Not tainted 4.19.79 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_circular_bug.isra.0.cold+0x1cc/0x28f kernel/locking/lockdep.c:1221
 check_prev_add kernel/locking/lockdep.c:1861 [inline]
 check_prevs_add kernel/locking/lockdep.c:1974 [inline]
 validate_chain kernel/locking/lockdep.c:2415 [inline]
 __lock_acquire+0x2e19/0x49c0 kernel/locking/lockdep.c:3411
 lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3903
 __might_fault mm/memory.c:4638 [inline]
 __might_fault+0x15e/0x1e0 mm/memory.c:4623
 mon_bin_fetch+0x26f/0x340 drivers/usb/mon/mon_bin.c:928
 mon_bin_ioctl+0x21e/0xc80 drivers/usb/mon/mon_bin.c:1091
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x44a099
Code: e8 4c bc 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb d2 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f68aefb4ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000006dbc38 RCX: 000000000044a099
RDX: 0000000020000140 RSI: 00000000c0109207 RDI: 0000000000000003
RBP: 00000000006dbc30 R08: 00007f68aefb5700 R09: 0000000000000000
R10: 00007f68aefb5700 R11: 0000000000000246 R12: 00000000006dbc3c
R13: 00007fff14c24f8f R14: 00007f68aefb59c0 R15: 000000000000002d

Crashes (385):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/17 08:33 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report syz C ci2-linux-4-19
2019/10/17 08:12 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report syz C ci2-linux-4-19
2019/10/17 07:51 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report syz C ci2-linux-4-19
2019/10/17 02:47 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report syz C ci2-linux-4-19
2019/10/17 02:24 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report syz C ci2-linux-4-19
2019/10/17 01:36 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report syz C ci2-linux-4-19
2019/06/08 00:54 linux-4.19.y e109a984cf38 cf9c3a50 .config console log report syz C ci2-linux-4-19
2019/04/25 21:29 linux-4.19.y c98875d930e9 f46aabc8 .config console log report syz C ci2-linux-4-19
2019/04/25 20:28 linux-4.19.y c98875d930e9 f46aabc8 .config console log report syz C ci2-linux-4-19
2019/04/25 08:12 linux-4.19.y c98875d930e9 8e3c52b1 .config console log report syz C ci2-linux-4-19
2019/04/25 04:56 linux-4.19.y c98875d930e9 8e3c52b1 .config console log report syz C ci2-linux-4-19
2019/04/24 01:12 linux-4.19.y c98875d930e9 2398edea .config console log report syz C ci2-linux-4-19
2019/04/19 20:05 linux-4.19.y 4b0e041c9dad b0e8efcb .config console log report syz C ci2-linux-4-19
2019/04/18 00:14 linux-4.19.y 4b0e041c9dad b0e8efcb .config console log report syz C ci2-linux-4-19
2019/10/17 07:02 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report syz ci2-linux-4-19
2019/10/17 04:48 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report syz ci2-linux-4-19
2019/10/16 23:56 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report syz ci2-linux-4-19
2019/12/19 00:31 linux-4.19.y 7d120bf21c05 79b211f7 .config console log report ci2-linux-4-19
2019/12/17 07:49 linux-4.19.y 312017a460d5 d13d7958 .config console log report ci2-linux-4-19
2019/12/16 09:34 linux-4.19.y 312017a460d5 0ae38e44 .config console log report ci2-linux-4-19
2019/12/16 07:18 linux-4.19.y 312017a460d5 eef6e580 .config console log report ci2-linux-4-19
2019/12/15 19:20 linux-4.19.y 312017a460d5 eef6e580 .config console log report ci2-linux-4-19
2019/12/12 18:29 linux-4.19.y fb683b5e3f53 08003f64 .config console log report ci2-linux-4-19
2019/12/11 15:01 linux-4.19.y fb683b5e3f53 0d368675 .config console log report ci2-linux-4-19
2019/12/10 22:30 linux-4.19.y fb683b5e3f53 101194eb .config console log report ci2-linux-4-19
2019/12/09 15:10 linux-4.19.y fb683b5e3f53 b31eda3d .config console log report ci2-linux-4-19
2019/12/09 13:41 linux-4.19.y fb683b5e3f53 b31eda3d .config console log report ci2-linux-4-19
2019/12/08 21:23 linux-4.19.y fb683b5e3f53 1508f453 .config console log report ci2-linux-4-19
2019/12/08 15:31 linux-4.19.y fb683b5e3f53 1508f453 .config console log report ci2-linux-4-19
2019/12/06 17:11 linux-4.19.y fb683b5e3f53 85f26751 .config console log report ci2-linux-4-19
2019/12/06 09:26 linux-4.19.y fb683b5e3f53 98b4ef2d .config console log report ci2-linux-4-19
2019/12/04 15:06 linux-4.19.y 174651bdf802 b2088328 .config console log report ci2-linux-4-19
2019/11/30 02:22 linux-4.19.y 14260788bbb9 3a75be00 .config console log report ci2-linux-4-19
2019/11/29 11:23 linux-4.19.y 14260788bbb9 4f7e1d0f .config console log report ci2-linux-4-19
2019/11/28 22:31 linux-4.19.y 14260788bbb9 76357d6f .config console log report ci2-linux-4-19
2019/11/26 19:57 linux-4.19.y 14260788bbb9 1048481f .config console log report ci2-linux-4-19
2019/11/26 10:10 linux-4.19.y 14260788bbb9 598ca6c8 .config console log report ci2-linux-4-19
2019/11/24 11:55 linux-4.19.y 14260788bbb9 598ca6c8 .config console log report ci2-linux-4-19
2019/11/24 03:43 linux-4.19.y c63ee2939dc1 598ca6c8 .config console log report ci2-linux-4-19
2019/11/23 16:39 linux-4.19.y c63ee2939dc1 598ca6c8 .config console log report ci2-linux-4-19
2019/11/22 10:53 linux-4.19.y c63ee2939dc1 598ca6c8 .config console log report ci2-linux-4-19
2019/11/22 09:44 linux-4.19.y c63ee2939dc1 8098ea0f .config console log report ci2-linux-4-19
2019/11/21 20:43 linux-4.19.y c63ee2939dc1 8098ea0f .config console log report ci2-linux-4-19
2019/11/21 00:04 linux-4.19.y c63ee2939dc1 8098ea0f .config console log report ci2-linux-4-19
2019/11/20 23:03 linux-4.19.y c63ee2939dc1 8098ea0f .config console log report ci2-linux-4-19
2019/11/20 19:41 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/20 11:17 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 18:01 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 11:25 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 09:45 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/17 02:49 linux-4.19.y c555efaf1402 cdac920b .config console log report ci2-linux-4-19
2019/11/17 01:22 linux-4.19.y c555efaf1402 cdac920b .config console log report ci2-linux-4-19
2019/11/14 22:11 linux-4.19.y c555efaf1402 048f2d49 .config console log report ci2-linux-4-19
2019/11/12 17:03 linux-4.19.y 7d8dbefc22ff 048f2d49 .config console log report ci2-linux-4-19
2019/11/02 22:07 linux-4.19.y ef244c308885 d603afc9 .config console log report ci2-linux-4-19
2019/11/02 16:05 linux-4.19.y ef244c308885 997ccc67 .config console log report ci2-linux-4-19
2019/10/29 20:27 linux-4.19.y ef244c308885 5ea87a66 .config console log report ci2-linux-4-19
2019/10/24 08:15 linux-4.19.y c3038e718a19 d01bb02a .config console log report ci2-linux-4-19
2019/10/14 06:48 linux-4.19.y dafd634415a7 2f661ec4 .config console log report ci2-linux-4-19
2019/10/14 02:13 linux-4.19.y dafd634415a7 2f661ec4 .config console log report ci2-linux-4-19
2019/10/13 23:17 linux-4.19.y dafd634415a7 2f661ec4 .config console log report ci2-linux-4-19
2019/10/13 09:30 linux-4.19.y dafd634415a7 2f661ec4 .config console log report ci2-linux-4-19
2019/04/12 03:46 linux-4.19.y 4d552acf3370 8916f5e1 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.