syzbot


possible deadlock in get_user_pages_unlocked

Status: fixed on 2018/03/23 18:14
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+bacbe5d8791f30c9cee5@syzkaller.appspotmail.com
Fix commit: 96312e61282a mm/gup.c: teach get_user_pages_unlocked to handle FOLL_NOWAIT
First crash: 2297d, last: 2274d
Discussions (1)
Title Replies (including bot) Last reply
possible deadlock in get_user_pages_unlocked 8 (9) 2018/03/10 04:15
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in get_user_pages_unlocked (2) mm C done 4 1809d 1813d 0/26 closed as invalid on 2019/06/23 22:16

Sample crash report:
============================================
WARNING: possible recursive locking detected
4.15.0+ #291 Not tainted
--------------------------------------------
syzkaller746568/4446 is trying to acquire lock:
 (&mm->mmap_sem){++++}, at: [<000000006212449e>] __get_user_pages_locked mm/gup.c:909 [inline]
 (&mm->mmap_sem){++++}, at: [<000000006212449e>] get_user_pages_unlocked+0x218/0x4f0 mm/gup.c:990

but task is already holding lock:
 (&mm->mmap_sem){++++}, at: [<000000009bfdb3c4>] get_user_pages_unlocked+0xff/0x4f0 mm/gup.c:989

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&mm->mmap_sem);
  lock(&mm->mmap_sem);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syzkaller746568/4446:
 #0:  (&vcpu->mutex){+.+.}, at: [<00000000d22fa6cb>] vcpu_load+0x1c/0x70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:158
 #1:  (&kvm->srcu){....}, at: [<000000007ac6ea14>] vcpu_enter_guest arch/x86/kvm/x86.c:7064 [inline]
 #1:  (&kvm->srcu){....}, at: [<000000007ac6ea14>] vcpu_run arch/x86/kvm/x86.c:7143 [inline]
 #1:  (&kvm->srcu){....}, at: [<000000007ac6ea14>] kvm_arch_vcpu_ioctl_run+0x1b11/0x5bf0 arch/x86/kvm/x86.c:7310
 #2:  (&mm->mmap_sem){++++}, at: [<000000009bfdb3c4>] get_user_pages_unlocked+0xff/0x4f0 mm/gup.c:989

stack backtrace:
CPU: 0 PID: 4446 Comm: syzkaller746568 Not tainted 4.15.0+ #291
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 print_deadlock_bug kernel/locking/lockdep.c:1761 [inline]
 check_deadlock kernel/locking/lockdep.c:1805 [inline]
 validate_chain kernel/locking/lockdep.c:2401 [inline]
 __lock_acquire+0xe8f/0x3e00 kernel/locking/lockdep.c:3431
 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
 down_read+0x96/0x150 kernel/locking/rwsem.c:24
 __get_user_pages_locked mm/gup.c:909 [inline]
 get_user_pages_unlocked+0x218/0x4f0 mm/gup.c:990
 hva_to_pfn_slow arch/x86/kvm/../../../virt/kvm/kvm_main.c:1388 [inline]
 hva_to_pfn arch/x86/kvm/../../../virt/kvm/kvm_main.c:1493 [inline]
 __gfn_to_pfn_memslot+0x386/0xf80 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1549
 try_async_pf+0x13b/0xc40 arch/x86/kvm/mmu.c:3802
 tdp_page_fault+0x40a/0xa70 arch/x86/kvm/mmu.c:3898
 kvm_mmu_page_fault+0x10d/0x2f0 arch/x86/kvm/mmu.c:4928
 handle_ept_violation+0x198/0x550 arch/x86/kvm/vmx.c:6550
 vmx_handle_exit+0x25d/0x1ce0 arch/x86/kvm/vmx.c:8893
 vcpu_enter_guest arch/x86/kvm/x86.c:7081 [inline]
 vcpu_run arch/x86/kvm/x86.c:7143 [inline]
 kvm_arch_vcpu_ioctl_run+0x1c69/0x5bf0 arch/x86/kvm/x86.c:7310
 kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2564
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
 entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x448fc9
RSP: 002b:00007ff4b260ada8 EFLAGS: 00000297 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff4b260b700 RCX: 0000000000448fc9
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000008
RBP: 00007fffca7f9900 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000000
R13: 00007fffca7f985f R14: 00007ff4b260b9c0 R15: 000000000000000d
WARNING: CPU: 0 PID: 4446 at mm/gup.c:498 faultin_page mm/gup.c:498 [inline]
WARNING: CPU: 0 PID: 4446 at mm/gup.c:498 __get_user_pages+0x10a7/0x15f0 mm/gup.c:699

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/02/02 00:37 upstream 7109a04eae81 67bd3383 .config console log report syz C ci-upstream-kasan-gce
2018/02/25 00:22 upstream 9cb9c07d6b0c 5c1e0207 .config console log report ci-upstream-kasan-gce
2018/02/08 16:28 upstream 581e400ff935 9fb5ec43 .config console log report ci-upstream-kasan-gce
2018/02/02 00:05 upstream 7109a04eae81 67bd3383 .config console log report ci-upstream-kasan-gce
2018/02/25 00:44 upstream 9cb9c07d6b0c 5c1e0207 .config console log report ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.