possible deadlock in io_poll_double

possible deadlock in io_poll_double_wake (2)
Status: upstream: reported syz repro on 2020/09/29 02:28
Reported-by: syzbot+28abd693db9e92c160d8@syzkaller.appspotmail.com
First crash: 31d, last: 25d

Cause bisection: failed (bisect log)
similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	possible deadlock in io_poll_double_wake	C			17	43d	71d	0/17	closed as dup on 2020/08/15 18:15
Sample crash report:
============================================
WARNING: possible recursive locking detected
5.9.0-rc7-syzkaller #0 Not tainted
--------------------------------------------
syz-executor.0/8365 is trying to acquire lock:
ffff88807ae18130 (&runtime->sleep){..-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
ffff88807ae18130 (&runtime->sleep){..-.}-{2:2}, at: io_poll_double_wake+0x156/0x510 fs/io_uring.c:4749

but task is already holding lock:
ffff88808fca0130 (&runtime->sleep){..-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&runtime->sleep);
  lock(&runtime->sleep);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

4 locks held by syz-executor.0/8365:
 #0: ffff88807a65c440 (&runtime->oss.params_lock){+.+.}-{3:3}, at: snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1081 [inline]
 #0: ffff88807a65c440 (&runtime->oss.params_lock){+.+.}-{3:3}, at: snd_pcm_oss_make_ready+0xc4/0x2e0 sound/core/oss/pcm_oss.c:1143
 #1: ffffc90000da8d68 ((&dpcm->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline]
 #1: ffffc90000da8d68 ((&dpcm->timer)){+.-.}-{0:0}, at: call_timer_fn+0xdb/0x760 kernel/time/timer.c:1403
 #2: ffff888099d03108 (&group->lock){..-.}-{2:2}, at: _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170
 #3: ffff88808fca0130 (&runtime->sleep){..-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122

stack backtrace:
CPU: 1 PID: 8365 Comm: syz-executor.0 Not tainted 5.9.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fd lib/dump_stack.c:118
 print_deadlock_bug kernel/locking/lockdep.c:2391 [inline]
 check_deadlock kernel/locking/lockdep.c:2432 [inline]
 validate_chain kernel/locking/lockdep.c:3202 [inline]
 __lock_acquire.cold+0x148/0x3b0 kernel/locking/lockdep.c:4441
 lock_acquire+0x1f3/0xaf0 kernel/locking/lockdep.c:5029
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:354 [inline]
 io_poll_double_wake+0x156/0x510 fs/io_uring.c:4749
 __wake_up_common+0x147/0x650 kernel/sched/wait.c:93
 __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:123
 snd_pcm_update_state+0x46a/0x540 sound/core/pcm_lib.c:203
 snd_pcm_update_hw_ptr0+0xac9/0x1ac0 sound/core/pcm_lib.c:464
 snd_pcm_period_elapsed+0x160/0x250 sound/core/pcm_lib.c:1805
 loopback_jiffies_timer_function+0x1a8/0x220 sound/drivers/aloop.c:669
 call_timer_fn+0x1ac/0x760 kernel/time/timer.c:1413
 expire_timers kernel/time/timer.c:1458 [inline]
 __run_timers.part.0+0x67c/0xaa0 kernel/time/timer.c:1755
 __run_timers kernel/time/timer.c:1736 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1768
 __do_softirq+0x1f8/0xb23 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x9b/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu kernel/softirq.c:423 [inline]
 irq_exit_rcu+0x235/0x280 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x51/0xf0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:770 [inline]
RIP: 0010:seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline]
RIP: 0010:read_seqcount_t_begin include/linux/seqlock.h:311 [inline]
RIP: 0010:read_seqbegin include/linux/seqlock.h:752 [inline]
RIP: 0010:zone_span_seqbegin include/linux/memory_hotplug.h:80 [inline]
RIP: 0010:page_outside_zone_boundaries+0x100/0x340 mm/page_alloc.c:561
Code: 08 48 c7 c0 e8 6b fc 89 48 c1 e8 03 80 3c 28 00 0f 85 f4 01 00 00 48 83 3d 84 a6 4e 08 00 0f 84 0e 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 4c 8d 8b 98 00 00 00 4c 89 c8 48 c1 e8 03 0f b6 04
RSP: 0018:ffffc9000ab0f258 EFLAGS: 00000286
RAX: 1ffffffff13f8d7d RBX: ffff88812fffb700 RCX: ffffffff815b7ef2
RDX: ffffffff81ae6033 RSI: 0000000000000000 RDI: 0000000000000286
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffffff8d0c0ac7
R10: 1ffffffff13f8d7e R11: 0000000000000000 R12: 000000000008fd85
R13: fffffbfff13f8d7c R14: 0000000000000000 R15: ffff88812fffb7a0
 bad_range mm/page_alloc.c:590 [inline]
 rmqueue mm/page_alloc.c:3409 [inline]
 get_page_from_freelist+0x893/0x3b40 mm/page_alloc.c:3828
 __alloc_pages_nodemask+0x2cf/0x790 mm/page_alloc.c:4882
 alloc_pages_current+0x191/0x2a0 mm/mempolicy.c:2275
 alloc_pages include/linux/gfp.h:545 [inline]
 __vmalloc_area_node+0x3e3/0x7a0 mm/vmalloc.c:2445
 __vmalloc_node_range mm/vmalloc.c:2511 [inline]
 __vmalloc_node mm/vmalloc.c:2554 [inline]
 __vmalloc+0x114/0x1a0 mm/vmalloc.c:2568
 snd_dma_alloc_pages+0x2dc/0x3f0 sound/core/memalloc.c:148
 do_alloc_pages+0x9b/0x160 sound/core/pcm_memory.c:43
 snd_pcm_lib_malloc_pages+0x3ec/0x6f0 sound/core/pcm_memory.c:409
 snd_pcm_hw_params+0x13fe/0x1920 sound/core/pcm_native.c:705
 snd_pcm_kernel_ioctl+0xd1/0x240 sound/core/pcm_native.c:3325
 snd_pcm_oss_change_params_locked+0x130a/0x3420 sound/core/oss/pcm_oss.c:941
 snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1084 [inline]
 snd_pcm_oss_make_ready+0xe6/0x2e0 sound/core/oss/pcm_oss.c:1143
 snd_pcm_oss_sync+0x2e0/0x800 sound/core/oss/pcm_oss.c:1642
 snd_pcm_oss_release+0x276/0x300 sound/core/oss/pcm_oss.c:2546
 __fput+0x285/0x920 fs/file_table.c:281
 task_work_run+0xdd/0x190 kernel/task_work.c:141
 exit_task_work include/linux/task_work.h:25 [inline]
 do_exit+0xb7d/0x29f0 kernel/exit.c:806
 do_group_exit+0x125/0x310 kernel/exit.c:903
 get_signal+0x428/0x1f00 kernel/signal.c:2757
 arch_do_signal+0x82/0x2520 arch/x86/kernel/signal.c:811
 exit_to_user_mode_loop kernel/entry/common.c:161 [inline]
 exit_to_user_mode_prepare+0x1ae/0x200 kernel/entry/common.c:192
 syscall_exit_to_user_mode+0x7e/0x2e0 kernel/entry/common.c:267
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45dd99
Code: Bad RIP value.
RSP: 002b:00007fbe1187bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffff97 RBX: 000000000001dac0 RCX: 000000000045dd99
RDX: 0000000020000000 RSI: 00000000000089f1 RDI: 0000000000000007
RBP: 000000000118c0b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118c07c
R13: 00007fff399e38cf R14: 00007fbe1187c9c0 R15: 000000000118c07c
general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
CPU: 1 PID: 8365 Comm: syz-executor.0 Not tainted 5.9.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:io_poll_get_single fs/io_uring.c:4672 [inline]
RIP: 0010:io_poll_double_wake+0x51/0x510 fs/io_uring.c:4739
Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9e 03 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 5d 08 48 8d 7b 48 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 63 03 00 00 0f b6 6b 48 bf 06 00 00
RSP: 0018:ffffc90000da8980 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000009 RSI: ffffffff81d9f29d RDI: 0000000000000048
RBP: dffffc0000000000 R08: ffff8880a25c9e18 R09: ffffc90000da8a70
R10: fffff520001b5135 R11: 0000000000000001 R12: 0000000000000000
R13: ffff8880a25c9e18 R14: ffff8880a25c9e20 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000009e8d000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __wake_up_common+0x147/0x650 kernel/sched/wait.c:93
 __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:123
 snd_pcm_update_state+0x46a/0x540 sound/core/pcm_lib.c:203
 snd_pcm_update_hw_ptr0+0xac9/0x1ac0 sound/core/pcm_lib.c:464
 snd_pcm_period_elapsed+0x160/0x250 sound/core/pcm_lib.c:1805
 loopback_jiffies_timer_function+0x1a8/0x220 sound/drivers/aloop.c:669
 call_timer_fn+0x1ac/0x760 kernel/time/timer.c:1413
 expire_timers kernel/time/timer.c:1458 [inline]
 __run_timers.part.0+0x67c/0xaa0 kernel/time/timer.c:1755
 __run_timers kernel/time/timer.c:1736 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1768
 __do_softirq+0x1f8/0xb23 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x9b/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu kernel/softirq.c:423 [inline]
 irq_exit_rcu+0x235/0x280 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x51/0xf0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:770 [inline]
RIP: 0010:seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline]
RIP: 0010:read_seqcount_t_begin include/linux/seqlock.h:311 [inline]
RIP: 0010:read_seqbegin include/linux/seqlock.h:752 [inline]
RIP: 0010:zone_span_seqbegin include/linux/memory_hotplug.h:80 [inline]
RIP: 0010:page_outside_zone_boundaries+0x100/0x340 mm/page_alloc.c:561
Code: 08 48 c7 c0 e8 6b fc 89 48 c1 e8 03 80 3c 28 00 0f 85 f4 01 00 00 48 83 3d 84 a6 4e 08 00 0f 84 0e 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 4c 8d 8b 98 00 00 00 4c 89 c8 48 c1 e8 03 0f b6 04
RSP: 0018:ffffc9000ab0f258 EFLAGS: 00000286
RAX: 1ffffffff13f8d7d RBX: ffff88812fffb700 RCX: ffffffff815b7ef2
RDX: ffffffff81ae6033 RSI: 0000000000000000 RDI: 0000000000000286
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffffff8d0c0ac7
R10: 1ffffffff13f8d7e R11: 0000000000000000 R12: 000000000008fd85
R13: fffffbfff13f8d7c R14: 0000000000000000 R15: ffff88812fffb7a0
 bad_range mm/page_alloc.c:590 [inline]
 rmqueue mm/page_alloc.c:3409 [inline]
 get_page_from_freelist+0x893/0x3b40 mm/page_alloc.c:3828
 __alloc_pages_nodemask+0x2cf/0x790 mm/page_alloc.c:4882
 alloc_pages_current+0x191/0x2a0 mm/mempolicy.c:2275
 alloc_pages include/linux/gfp.h:545 [inline]
 __vmalloc_area_node+0x3e3/0x7a0 mm/vmalloc.c:2445
 __vmalloc_node_range mm/vmalloc.c:2511 [inline]
 __vmalloc_node mm/vmalloc.c:2554 [inline]
 __vmalloc+0x114/0x1a0 mm/vmalloc.c:2568
 snd_dma_alloc_pages+0x2dc/0x3f0 sound/core/memalloc.c:148
 do_alloc_pages+0x9b/0x160 sound/core/pcm_memory.c:43
 snd_pcm_lib_malloc_pages+0x3ec/0x6f0 sound/core/pcm_memory.c:409
 snd_pcm_hw_params+0x13fe/0x1920 sound/core/pcm_native.c:705
 snd_pcm_kernel_ioctl+0xd1/0x240 sound/core/pcm_native.c:3325
 snd_pcm_oss_change_params_locked+0x130a/0x3420 sound/core/oss/pcm_oss.c:941
 snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1084 [inline]
 snd_pcm_oss_make_ready+0xe6/0x2e0 sound/core/oss/pcm_oss.c:1143
 snd_pcm_oss_sync+0x2e0/0x800 sound/core/oss/pcm_oss.c:1642
 snd_pcm_oss_release+0x276/0x300 sound/core/oss/pcm_oss.c:2546
 __fput+0x285/0x920 fs/file_table.c:281
 task_work_run+0xdd/0x190 kernel/task_work.c:141
 exit_task_work include/linux/task_work.h:25 [inline]
 do_exit+0xb7d/0x29f0 kernel/exit.c:806
 do_group_exit+0x125/0x310 kernel/exit.c:903
 get_signal+0x428/0x1f00 kernel/signal.c:2757
 arch_do_signal+0x82/0x2520 arch/x86/kernel/signal.c:811
 exit_to_user_mode_loop kernel/entry/common.c:161 [inline]
 exit_to_user_mode_prepare+0x1ae/0x200 kernel/entry/common.c:192
 syscall_exit_to_user_mode+0x7e/0x2e0 kernel/entry/common.c:267
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45dd99
Code: Bad RIP value.
RSP: 002b:00007fbe1187bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffff97 RBX: 000000000001dac0 RCX: 000000000045dd99
RDX: 0000000020000000 RSI: 00000000000089f1 RDI: 0000000000000007
RBP: 000000000118c0b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118c07c
R13: 00007fff399e38cf R14: 00007fbe1187c9c0 R15: 000000000118c07c
Modules linked in:
---[ end trace 89035ad470961c75 ]---
RIP: 0010:io_poll_get_single fs/io_uring.c:4672 [inline]
RIP: 0010:io_poll_double_wake+0x51/0x510 fs/io_uring.c:4739
Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9e 03 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 5d 08 48 8d 7b 48 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 63 03 00 00 0f b6 6b 48 bf 06 00 00
RSP: 0018:ffffc90000da8980 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000009 RSI: ffffffff81d9f29d RDI: 0000000000000048
RBP: dffffc0000000000 R08: ffff8880a25c9e18 R09: ffffc90000da8a70
R10: fffff520001b5135 R11: 0000000000000001 R12: 0000000000000000
R13: ffff8880a25c9e18 R14: ffff8880a25c9e20 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000009e8d000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Crashes (3):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	VM info	Maintainers
ci-upstream-kasan-gce	2020/10/01 04:55	upstream	02de58b2	8516f6d3	.config	log	report	syz		axboe@kernel.dk, io-uring@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk
ci-upstream-linux-next-kasan-gce-root	2020/09/25 02:21	linux-next	d1d2220c	54289b08	.config	log	report	syz		axboe@kernel.dk, io-uring@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk
ci-upstream-kasan-gce	2020/10/01 04:05	upstream	02de58b2	8516f6d3	.config	log	report		info	axboe@kernel.dk, io-uring@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk