syzbot


possible deadlock in io_poll_double_wake

Status: closed as dup on 2020/08/15 18:15
Subsystems: io-uring fs
[Documentation on labels]
Reported-by: syzbot+0d56cfeec64f045baffc@syzkaller.appspotmail.com
First crash: 1401d, last: 1373d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
general protection fault in io_poll_double_wake io-uring fs C done 8 1373d 1401d
Discussions (1)
Title Replies (including bot) Last reply
possible deadlock in io_poll_double_wake 2 (6) 2020/08/15 18:15
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in io_poll_double_wake (2) io-uring fs C error error 431 1164d 1356d 20/27 fixed on 2021/04/09 19:46
upstream possible deadlock in io_poll_double_wake (3) io-uring fs C error done 703 886d 1160d 20/27 fixed on 2022/03/08 16:11

Sample crash report:
============================================
WARNING: possible recursive locking detected
5.8.0-syzkaller #0 Not tainted
--------------------------------------------
syz-executor337/6845 is trying to acquire lock:
ffff8880a1ff8530 (&tty->write_wait){-.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
ffff8880a1ff8530 (&tty->write_wait){-.-.}-{2:2}, at: io_poll_double_wake+0x12a/0x3f0 fs/io_uring.c:4599

but task is already holding lock:
ffff8880a1ff8530 (&tty->write_wait){-.-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&tty->write_wait);
  lock(&tty->write_wait);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

4 locks held by syz-executor337/6845:
 #0: ffff8880a1ff8098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267
 #1: ffff8880a1ff82e8 (&tty->termios_rwsem){++++}-{3:3}, at: tty_set_termios+0xec/0x840 drivers/tty/tty_ioctl.c:328
 #2: ffff8880a1ff8098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x1d/0x80 drivers/tty/tty_ldisc.c:288
 #3: ffff8880a1ff8530 (&tty->write_wait){-.-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122

stack backtrace:
CPU: 1 PID: 6845 Comm: syz-executor337 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 print_deadlock_bug kernel/locking/lockdep.c:2391 [inline]
 check_deadlock kernel/locking/lockdep.c:2432 [inline]
 validate_chain kernel/locking/lockdep.c:3202 [inline]
 __lock_acquire.cold+0x115/0x396 kernel/locking/lockdep.c:4426
 lock_acquire+0x1f1/0xad0 kernel/locking/lockdep.c:5005
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:354 [inline]
 io_poll_double_wake+0x12a/0x3f0 fs/io_uring.c:4599
 __wake_up_common+0x147/0x650 kernel/sched/wait.c:93
 __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:123
 n_tty_set_termios+0x73d/0x1010 drivers/tty/n_tty.c:1874
 tty_set_termios+0x5eb/0x840 drivers/tty/tty_ioctl.c:341
 set_termios.part.0+0x2be/0x4d0 drivers/tty/tty_ioctl.c:414
 set_termios drivers/tty/tty_ioctl.c:368 [inline]
 tty_mode_ioctl+0x899/0xb60 drivers/tty/tty_ioctl.c:745
 n_tty_ioctl_helper+0x55/0x3a0 drivers/tty/tty_ioctl.c:940
 n_tty_ioctl+0x56/0x370 drivers/tty/n_tty.c:2466
 tty_ioctl+0x10c5/0x15f0 drivers/tty/tty_io.c:2665
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4405b9
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffddb7dcb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004405b9
RDX: 0000000020000000 RSI: 0000000000005404 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401e20
R13: 0000000000401eb0 R14: 0000000000000000 R15: 0000000000000000

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/16 01:55 upstream c9c9735c46f5 424dd8e7 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/08/15 18:14 upstream c9c9735c46f5 424dd8e7 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/09/12 15:11 upstream 729e3d091984 ce441f06 .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/09/11 14:07 upstream 581cb3a26baf adfb8b4e .config console log report syz ci-upstream-kasan-gce-root
2020/09/07 15:56 upstream a8205e310011 abf9ba4f .config console log report syz ci-upstream-kasan-gce-smack-root
2020/09/08 14:45 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/08 14:14 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/08 12:05 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce-root
2020/09/08 10:25 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/08 09:16 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce-root
2020/09/08 08:29 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/07 18:59 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/07 15:34 upstream a8205e310011 abf9ba4f .config console log report ci-upstream-kasan-gce-smack-root
2020/08/15 17:55 upstream c9c9735c46f5 424dd8e7 .config console log report ci-upstream-kasan-gce-smack-root
2020/09/08 15:08 linux-next 7a6956579ce6 abf9ba4f .config console log report ci-upstream-linux-next-kasan-gce-root
2020/09/08 10:14 linux-next 7a6956579ce6 abf9ba4f .config console log report ci-upstream-linux-next-kasan-gce-root
2020/09/06 14:42 linux-next 7a6956579ce6 abf9ba4f .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.