syzbot

 sign-in | mailing list | source | docs
🐞 Open [1024] ≡ Subsystems 🐞 Fixed [5278] 🐞 Invalid [12603] ⬇ Missing Backports [86] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

possible deadlock in ap_get

Status: auto-obsoleted due to no activity on 2023/12/30 09:46
Subsystems: ppp
[Documentation on labels]
Reported-by: syzbot+cb575960cbf993938435@syzkaller.appspotmail.com
First crash: 281d, last: 222d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [ppp?] possible deadlock in ap_get 0 (1) 2023/08/06 04:19

Sample crash report:
========================================================
WARNING: possible irq lock inversion dependency detected
6.6.0-rc3-syzkaller-00146-g9f3ebbef746f #0 Not tainted
--------------------------------------------------------
kworker/u4:5/11895 just changed the state of lock:
ffffffff8db5d498 (disc_data_lock){.+..}-{2:2}, at: ap_get+0x18/0xf0 drivers/net/ppp/ppp_async.c:136
but this lock was taken by another, HARDIRQ-safe lock in the past:
 (&port_lock_key){-.-.}-{2:2}


and interrupts could create inverse lock ordering between them.


other info that might help us debug this:
 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(disc_data_lock);
                               local_irq_disable();
                               lock(&port_lock_key);
                               lock(disc_data_lock);
  <Interrupt>
    lock(&port_lock_key);

 *** DEADLOCK ***

4 locks held by kworker/u4:5/11895:
 #0: ffff888012c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x787/0x15c0 kernel/workqueue.c:2605
 #1: ffffc900052ffd80 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_one_work+0x7e9/0x15c0 kernel/workqueue.c:2606
 #2: ffff88801c820ce8 (&buf->lock){+.+.}-{3:3}, at: flush_to_ldisc+0x31/0x780 drivers/tty/tty_buffer.c:467
 #3: ffff888077d6d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x1c/0x80 drivers/tty/tty_ldisc.c:263

the shortest dependencies between 2nd lock and 1st lock:
 -> (&port_lock_key){-.-.}-{2:2} {
    IN-HARDIRQ-W at:
                      lock_acquire kernel/locking/lockdep.c:5753 [inline]
                      lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718
                      __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                      _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162
                      serial8250_handle_irq+0x91/0xbd0 drivers/tty/serial/8250/8250_port.c:1921
                      serial8250_default_handle_irq+0x94/0x210 drivers/tty/serial/8250/8250_port.c:1967
                      serial8250_interrupt+0xfc/0x200 drivers/tty/serial/8250/8250_core.c:127
                      __handle_irq_event_percpu+0x22a/0x740 kernel/irq/handle.c:158
                      handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
                      handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
                      handle_edge_irq+0x261/0xcf0 kernel/irq/chip.c:831
                      generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
                      handle_irq arch/x86/kernel/irq.c:238 [inline]
                      __common_interrupt+0xdb/0x240 arch/x86/kernel/irq.c:257
                      common_interrupt+0xa9/0xd0 arch/x86/kernel/irq.c:247
                      asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:636
                      __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
                      _raw_spin_unlock_irqrestore+0x31/0x70 kernel/locking/spinlock.c:194
                      spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
                      serial_port_runtime_resume+0x2ae/0x330 drivers/tty/serial/serial_port.c:41
                      __rpm_callback+0xc5/0x4c0 drivers/base/power/runtime.c:392
                      rpm_callback+0x1da/0x220 drivers/base/power/runtime.c:446
                      rpm_resume+0xdb5/0x1980 drivers/base/power/runtime.c:912
                      pm_runtime_work+0x12e/0x180 drivers/base/power/runtime.c:977
                      process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
                      process_scheduled_works kernel/workqueue.c:2703 [inline]
                      worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
                      kthread+0x33c/0x440 kernel/kthread.c:388
                      ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
                      ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
    IN-SOFTIRQ-W at:
                      lock_acquire kernel/locking/lockdep.c:5753 [inline]
                      lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718
                      __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                      _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162
                      serial8250_handle_irq+0x91/0xbd0 drivers/tty/serial/8250/8250_port.c:1921
                      serial8250_default_handle_irq+0x94/0x210 drivers/tty/serial/8250/8250_port.c:1967
                      serial8250_interrupt+0xfc/0x200 drivers/tty/serial/8250/8250_core.c:127
                      __handle_irq_event_percpu+0x22a/0x740 kernel/irq/handle.c:158
                      handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
                      handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
                      handle_edge_irq+0x261/0xcf0 kernel/irq/chip.c:831
                      generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
                      handle_irq arch/x86/kernel/irq.c:238 [inline]
                      __common_interrupt+0xdb/0x240 arch/x86/kernel/irq.c:257
                      common_interrupt+0x51/0xd0 arch/x86/kernel/irq.c:247
                      asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:636
                      unwind_next_frame+0x622/0x2390 arch/x86/kernel/unwind_orc.c:512
                      __unwind_start+0x5a4/0x880 arch/x86/kernel/unwind_orc.c:760
                      unwind_start arch/x86/include/asm/unwind.h:64 [inline]
                      arch_stack_walk+0xaf/0x170 arch/x86/kernel/stacktrace.c:24
                      stack_trace_save+0x96/0xd0 kernel/stacktrace.c:122
                      kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
                      kasan_set_track+0x25/0x30 mm/kasan/common.c:52
                      kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522
                      ____kasan_slab_free mm/kasan/common.c:236 [inline]
                      ____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200
                      kasan_slab_free include/linux/kasan.h:164 [inline]
                      slab_free_hook mm/slub.c:1800 [inline]
                      slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826
                      slab_free mm/slub.c:3809 [inline]
                      kmem_cache_free+0xf0/0x480 mm/slub.c:3831
                      file_free_rcu+0xd9/0x130 fs/file_table.c:72
                      rcu_do_batch kernel/rcu/tree.c:2139 [inline]
                      rcu_core+0x805/0x1bb0 kernel/rcu/tree.c:2403
                      __do_softirq+0x218/0x965 kernel/softirq.c:553
                      invoke_softirq kernel/softirq.c:427 [inline]
                      __irq_exit_rcu kernel/softirq.c:632 [inline]
                      irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
                      sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1074
                      asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
                      native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
                      arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline]
                      acpi_safe_halt+0x1b/0x20 drivers/acpi/processor_idle.c:112
                      acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:707
                      cpuidle_enter_state+0x82/0x500 drivers/cpuidle/cpuidle.c:267
                      cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:388
                      cpuidle_idle_call kernel/sched/idle.c:215 [inline]
                      do_idle+0x315/0x3f0 kernel/sched/idle.c:282
                      cpu_startup_entry+0x50/0x60 kernel/sched/idle.c:380
                      start_secondary+0x20e/0x2a0 arch/x86/kernel/smpboot.c:326
                      secondary_startup_64_no_verify+0x166/0x16b
    INITIAL USE at:
                     lock_acquire kernel/locking/lockdep.c:5753 [inline]
                     lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718
                     __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                     _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162
                     serial8250_do_set_termios+0x334/0x1240 drivers/tty/serial/8250/8250_port.c:2798
                     serial8250_set_termios+0x6b/0x80 drivers/tty/serial/8250/8250_port.c:2917
                     uart_set_options+0x316/0x5f0 drivers/tty/serial/serial_core.c:2278
                     serial8250_console_setup+0x18a/0x430 drivers/tty/serial/8250/8250_port.c:3512
                     univ8250_console_setup+0x168/0x210 drivers/tty/serial/8250/8250_core.c:632
                     try_enable_preferred_console+0x24d/0x470 kernel/printk/printk.c:3294
                     register_console+0x331/0x10d0 kernel/printk/printk.c:3467
                     univ8250_console_init+0x35/0x50 drivers/tty/serial/8250/8250_core.c:717
                     console_init+0xba/0x5c0 kernel/printk/printk.c:3667
                     start_kernel+0x25a/0x480 init/main.c:1004
                     x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:556
                     x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:537
                     secondary_startup_64_no_verify+0x166/0x16b
  }
  ... key      at: [<ffffffff92560a80>] port_lock_key+0x0/0x40
  ... acquired at:
   __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
   _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228
   ap_get+0x18/0xf0 drivers/net/ppp/ppp_async.c:136
   ppp_asynctty_wakeup+0x18/0xb0 drivers/net/ppp/ppp_async.c:352
   tty_wakeup+0xe5/0x120 drivers/tty/tty_io.c:523
   tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
   serial8250_tx_chars+0x542/0xf60 drivers/tty/serial/8250/8250_port.c:1843
   __start_tx drivers/tty/serial/8250/8250_port.c:1552 [inline]
   serial8250_start_tx+0x7a8/0x980 drivers/tty/serial/8250/8250_port.c:1661
   serial_port_runtime_resume+0x29e/0x330 drivers/tty/serial/serial_port.c:40
   __rpm_callback+0xc5/0x4c0 drivers/base/power/runtime.c:392
   rpm_callback+0x1da/0x220 drivers/base/power/runtime.c:446
   rpm_resume+0xdb5/0x1980 drivers/base/power/runtime.c:912
   pm_runtime_work+0x12e/0x180 drivers/base/power/runtime.c:977
   process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
   process_scheduled_works kernel/workqueue.c:2703 [inline]
   worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
   kthread+0x33c/0x440 kernel/kthread.c:388
   ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
   ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

-> (disc_data_lock){.+..}-{2:2} {
   HARDIRQ-ON-R at:
                    lock_acquire kernel/locking/lockdep.c:5753 [inline]
                    lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718
                    __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                    _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228
                    ap_get+0x18/0xf0 drivers/net/ppp/ppp_async.c:136
                    ppp_asynctty_receive+0x2d/0x15a0 drivers/net/ppp/ppp_async.c:335
                    tty_ldisc_receive_buf+0x14c/0x180 drivers/tty/tty_buffer.c:391
                    tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37
                    receive_buf drivers/tty/tty_buffer.c:445 [inline]
                    flush_to_ldisc+0x261/0x780 drivers/tty/tty_buffer.c:495
                    process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
                    process_scheduled_works kernel/workqueue.c:2703 [inline]
                    worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
                    kthread+0x33c/0x440 kernel/kthread.c:388
                    ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
                    ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
   INITIAL READ USE at:
                        lock_acquire kernel/locking/lockdep.c:5753 [inline]
                        lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718
                        __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                        _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228
                        ap_get+0x18/0xf0 drivers/net/ppp/ppp_async.c:136
                        ppp_asynctty_wakeup+0x18/0xb0 drivers/net/ppp/ppp_async.c:352
                        tty_wakeup+0xe5/0x120 drivers/tty/tty_io.c:523
                        tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
                        serial8250_tx_chars+0x542/0xf60 drivers/tty/serial/8250/8250_port.c:1843
                        __start_tx drivers/tty/serial/8250/8250_port.c:1552 [inline]
                        serial8250_start_tx+0x7a8/0x980 drivers/tty/serial/8250/8250_port.c:1661
                        serial_port_runtime_resume+0x29e/0x330 drivers/tty/serial/serial_port.c:40
                        __rpm_callback+0xc5/0x4c0 drivers/base/power/runtime.c:392
                        rpm_callback+0x1da/0x220 drivers/base/power/runtime.c:446
                        rpm_resume+0xdb5/0x1980 drivers/base/power/runtime.c:912
                        pm_runtime_work+0x12e/0x180 drivers/base/power/runtime.c:977
                        process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
                        process_scheduled_works kernel/workqueue.c:2703 [inline]
                        worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
                        kthread+0x33c/0x440 kernel/kthread.c:388
                        ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
                        ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 }
 ... key      at: [<ffffffff8db5d498>] disc_data_lock+0x18/0x60
 ... acquired at:
   mark_usage kernel/locking/lockdep.c:4578 [inline]
   __lock_acquire+0x13a5/0x5de0 kernel/locking/lockdep.c:5090
   lock_acquire kernel/locking/lockdep.c:5753 [inline]
   lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718
   __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
   _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228
   ap_get+0x18/0xf0 drivers/net/ppp/ppp_async.c:136
   ppp_asynctty_receive+0x2d/0x15a0 drivers/net/ppp/ppp_async.c:335
   tty_ldisc_receive_buf+0x14c/0x180 drivers/tty/tty_buffer.c:391
   tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37
   receive_buf drivers/tty/tty_buffer.c:445 [inline]
   flush_to_ldisc+0x261/0x780 drivers/tty/tty_buffer.c:495
   process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
   process_scheduled_works kernel/workqueue.c:2703 [inline]
   worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
   kthread+0x33c/0x440 kernel/kthread.c:388
   ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
   ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304


stack backtrace:
CPU: 0 PID: 11895 Comm: kworker/u4:5 Not tainted 6.6.0-rc3-syzkaller-00146-g9f3ebbef746f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: events_unbound flush_to_ldisc
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_irq_inversion_bug.part.0+0x3e1/0x590 kernel/locking/lockdep.c:4079
 print_irq_inversion_bug kernel/locking/lockdep.c:4032 [inline]
 check_usage_forwards kernel/locking/lockdep.c:4110 [inline]
 mark_lock_irq kernel/locking/lockdep.c:4242 [inline]
 mark_lock+0x920/0x1950 kernel/locking/lockdep.c:4677
 mark_usage kernel/locking/lockdep.c:4578 [inline]
 __lock_acquire+0x13a5/0x5de0 kernel/locking/lockdep.c:5090
 lock_acquire kernel/locking/lockdep.c:5753 [inline]
 lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718
 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
 _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228
 ap_get+0x18/0xf0 drivers/net/ppp/ppp_async.c:136
 ppp_asynctty_receive+0x2d/0x15a0 drivers/net/ppp/ppp_async.c:335
 tty_ldisc_receive_buf+0x14c/0x180 drivers/tty/tty_buffer.c:391
 tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37
 receive_buf drivers/tty/tty_buffer.c:445 [inline]
 flush_to_ldisc+0x261/0x780 drivers/tty/tty_buffer.c:495
 process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
 process_scheduled_works kernel/workqueue.c:2703 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
 kthread+0x33c/0x440 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/09/30 10:45 upstream 9f3ebbef746f 8e26a358 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in ap_get
2023/09/25 01:10 upstream 6465e260f487 0b6a67ac .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in ap_get
2023/08/30 01:13 upstream d68b4b6f307d b42ca3a7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in ap_get
2023/08/22 14:19 upstream f7757129e3de b81ca3f6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in ap_get
2023/08/10 02:15 upstream 13b937206866 13ca4cd6 .config console log report info ci-upstream-kasan-gce possible deadlock in ap_get
2023/08/06 01:04 upstream f6a691685962 4ffcc9ef .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in ap_get
2023/08/02 20:54 upstream 4b954598a47b 39a91c18 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in ap_get
2023/08/02 10:01 upstream 5d0c230f1de8 df07ffe8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in ap_get
2023/08/02 04:16 upstream 5d0c230f1de8 df07ffe8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in ap_get
2023/08/17 16:47 upstream 16931859a650 74b106b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in ap_get
* Struck through repros no longer work on HEAD.