syzbot


possible deadlock in snd_timer_interrupt (2)
Status: upstream: reported C repro on 2021/11/21 18:39
Reported-by: syzbot+1ee0910eca9c94f71f25@syzkaller.appspotmail.com
First crash: 188d, last: 28d

Cause bisection: failed (bisect log)
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in snd_timer_interrupt C done 41 203d 303d 22/22 fixed on 2021/11/10 00:50
Patch testing requests:
Created Duration User Patch Repo Result
2022/03/07 10:34 12m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ 38f80f42147f OK
2022/03/07 08:05 9m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ 38f80f42147f report log

Sample crash report:
========================================================
WARNING: possible irq lock inversion dependency detected
5.17.0-rc6-syzkaller-00184-g38f80f42147f #0 Not tainted
--------------------------------------------------------
syz-executor142/4157 just changed the state of lock:
ffff888022ba0948 (&timer->lock){..-.}-{2:2}, at: snd_timer_interrupt.part.0+0x34/0xcf0 sound/core/timer.c:856
but this lock took another, SOFTIRQ-READ-unsafe lock in the past:
 (tasklist_lock){.+.+}-{2:2}


and interrupts could create inverse lock ordering between them.


other info that might help us debug this:
Chain exists of:
  &timer->lock --> &new->fa_lock --> tasklist_lock

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(tasklist_lock);
                               local_irq_disable();
                               lock(&timer->lock);
                               lock(&new->fa_lock);
  <Interrupt>
    lock(&timer->lock);

 *** DEADLOCK ***

4 locks held by syz-executor142/4157:
 #0: ffff88807e9b4460 (sb_writers#4){.+.+}-{0:0}, at: ksys_write+0x12d/0x250 fs/read_write.c:643
 #1: ffffffff8bc64e28 (oom_adj_mutex){+.+.}-{3:3}, at: __set_oom_adj.isra.0+0x68/0xf50 fs/proc/base.c:1071
 #2: ffffffff8bb845e0 (rcu_read_lock){....}-{1:2}, at: has_ns_capability_noaudit+0x0/0x240 kernel/capability.c:318
 #3: ffffc90000dc0d70 ((&priv->tlist)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline]
 #3: ffffc90000dc0d70 ((&priv->tlist)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1411

the shortest dependencies between 2nd lock and 1st lock:
   -> (tasklist_lock){.+.+}-{2:2} {
      HARDIRQ-ON-R at:
                          lock_acquire kernel/locking/lockdep.c:5639 [inline]
                          lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                          __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                          _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228
                          do_wait+0x284/0xce0 kernel/exit.c:1518
                          kernel_wait+0x9c/0x150 kernel/exit.c:1708
                          call_usermodehelper_exec_sync kernel/umh.c:139 [inline]
                          call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166
                          process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
                          worker_thread+0x657/0x1110 kernel/workqueue.c:2454
                          kthread+0x2e9/0x3a0 kernel/kthread.c:377
                          ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
      SOFTIRQ-ON-R at:
                          lock_acquire kernel/locking/lockdep.c:5639 [inline]
                          lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                          __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                          _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228
                          do_wait+0x284/0xce0 kernel/exit.c:1518
                          kernel_wait+0x9c/0x150 kernel/exit.c:1708
                          call_usermodehelper_exec_sync kernel/umh.c:139 [inline]
                          call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166
                          process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
                          worker_thread+0x657/0x1110 kernel/workqueue.c:2454
                          kthread+0x2e9/0x3a0 kernel/kthread.c:377
                          ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
      INITIAL USE at:
                         lock_acquire kernel/locking/lockdep.c:5639 [inline]
                         lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                         __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline]
                         _raw_write_lock_irq+0x32/0x50 kernel/locking/spinlock.c:326
                         copy_process+0x486a/0x7250 kernel/fork.c:2295
                         kernel_clone+0xe7/0xab0 kernel/fork.c:2565
                         kernel_thread+0xb5/0xf0 kernel/fork.c:2617
                         rest_init+0x23/0x3e0 init/main.c:690
                         start_kernel+0x47a/0x49b init/main.c:1138
                         secondary_startup_64_no_verify+0xc3/0xcb
      INITIAL READ USE at:
                              lock_acquire kernel/locking/lockdep.c:5639 [inline]
                              lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                              __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                              _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228
                              do_wait+0x284/0xce0 kernel/exit.c:1518
                              kernel_wait+0x9c/0x150 kernel/exit.c:1708
                              call_usermodehelper_exec_sync kernel/umh.c:139 [inline]
                              call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166
                              process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
                              worker_thread+0x657/0x1110 kernel/workqueue.c:2454
                              kthread+0x2e9/0x3a0 kernel/kthread.c:377
                              ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
    }
    ... key      at: [<ffffffff8b80a098>] tasklist_lock+0x18/0x40
    ... acquired at:
   __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
   _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228
   send_sigio+0xab/0x380 fs/fcntl.c:810
   kill_fasync_rcu fs/fcntl.c:1021 [inline]
   kill_fasync fs/fcntl.c:1035 [inline]
   kill_fasync+0x1f8/0x470 fs/fcntl.c:1028
   snd_timer_user_ccallback+0x298/0x330 sound/core/timer.c:1386
   snd_timer_notify1+0x11c/0x3b0 sound/core/timer.c:516
   snd_timer_stop1+0x496/0x860 sound/core/timer.c:657
   snd_timer_stop sound/core/timer.c:710 [inline]
   snd_timer_close_locked+0x20f/0xbb0 sound/core/timer.c:408
   snd_timer_close+0x87/0xf0 sound/core/timer.c:463
   __snd_timer_user_ioctl.isra.0+0x10e2/0x2490 sound/core/timer.c:1762
   snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:874 [inline]
   __se_sys_ioctl fs/ioctl.c:860 [inline]
   __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x44/0xae

  -> (&f->f_owner.lock){....}-{2:2} {
     INITIAL USE at:
                       lock_acquire kernel/locking/lockdep.c:5639 [inline]
                       lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                       __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline]
                       _raw_write_lock_irq+0x32/0x50 kernel/locking/spinlock.c:326
                       f_modown+0x2a/0x390 fs/fcntl.c:91
                       __f_setown fs/fcntl.c:110 [inline]
                       f_setown+0xd7/0x230 fs/fcntl.c:138
                       do_fcntl+0x749/0x1210 fs/fcntl.c:393
                       __do_sys_fcntl fs/fcntl.c:472 [inline]
                       __se_sys_fcntl fs/fcntl.c:457 [inline]
                       __x64_sys_fcntl+0x165/0x1e0 fs/fcntl.c:457
                       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
                       entry_SYSCALL_64_after_hwframe+0x44/0xae
     INITIAL READ USE at:
                            lock_acquire kernel/locking/lockdep.c:5639 [inline]
                            lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                            __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
                            _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236
                            send_sigio+0x24/0x380 fs/fcntl.c:796
                            kill_fasync_rcu fs/fcntl.c:1021 [inline]
                            kill_fasync fs/fcntl.c:1035 [inline]
                            kill_fasync+0x1f8/0x470 fs/fcntl.c:1028
                            snd_timer_user_ccallback+0x298/0x330 sound/core/timer.c:1386
                            snd_timer_notify1+0x11c/0x3b0 sound/core/timer.c:516
                            snd_timer_start1+0x4d4/0x800 sound/core/timer.c:578
                            snd_timer_start sound/core/timer.c:696 [inline]
                            snd_timer_start sound/core/timer.c:689 [inline]
                            snd_timer_user_start.isra.0+0x1e3/0x260 sound/core/timer.c:1984
                            __snd_timer_user_ioctl.isra.0+0xda8/0x2490 sound/core/timer.c:2107
                            snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128
                            vfs_ioctl fs/ioctl.c:51 [inline]
                            __do_sys_ioctl fs/ioctl.c:874 [inline]
                            __se_sys_ioctl fs/ioctl.c:860 [inline]
                            __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
                            do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                            do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
                            entry_SYSCALL_64_after_hwframe+0x44/0xae
   }
   ... key      at: [<ffffffff90585a40>] __key.5+0x0/0x40
   ... acquired at:
   __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
   _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236
   send_sigio+0x24/0x380 fs/fcntl.c:796
   kill_fasync_rcu fs/fcntl.c:1021 [inline]
   kill_fasync fs/fcntl.c:1035 [inline]
   kill_fasync+0x1f8/0x470 fs/fcntl.c:1028
   snd_timer_user_ccallback+0x298/0x330 sound/core/timer.c:1386
   snd_timer_notify1+0x11c/0x3b0 sound/core/timer.c:516
   snd_timer_start1+0x4d4/0x800 sound/core/timer.c:578
   snd_timer_start sound/core/timer.c:696 [inline]
   snd_timer_start sound/core/timer.c:689 [inline]
   snd_timer_user_start.isra.0+0x1e3/0x260 sound/core/timer.c:1984
   __snd_timer_user_ioctl.isra.0+0xda8/0x2490 sound/core/timer.c:2107
   snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:874 [inline]
   __se_sys_ioctl fs/ioctl.c:860 [inline]
   __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x44/0xae

 -> (&new->fa_lock){....}-{2:2} {
    INITIAL USE at:
                     lock_acquire kernel/locking/lockdep.c:5639 [inline]
                     lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                     __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline]
                     _raw_write_lock_irq+0x32/0x50 kernel/locking/spinlock.c:326
                     fasync_remove_entry+0xb6/0x1f0 fs/fcntl.c:891
                     fasync_helper+0x9e/0xb0 fs/fcntl.c:994
                     __fput+0x846/0x9f0 fs/file_table.c:314
                     task_work_run+0xdd/0x1a0 kernel/task_work.c:164
                     exit_task_work include/linux/task_work.h:32 [inline]
                     do_exit+0xb29/0x2a30 kernel/exit.c:806
                     do_group_exit+0xd2/0x2f0 kernel/exit.c:935
                     __do_sys_exit_group kernel/exit.c:946 [inline]
                     __se_sys_exit_group kernel/exit.c:944 [inline]
                     __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:944
                     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                     do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
                     entry_SYSCALL_64_after_hwframe+0x44/0xae
    INITIAL READ USE at:
                          lock_acquire kernel/locking/lockdep.c:5639 [inline]
                          lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                          __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
                          _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236
                          kill_fasync_rcu fs/fcntl.c:1014 [inline]
                          kill_fasync fs/fcntl.c:1035 [inline]
                          kill_fasync+0x136/0x470 fs/fcntl.c:1028
                          snd_timer_user_ccallback+0x298/0x330 sound/core/timer.c:1386
                          snd_timer_notify1+0x11c/0x3b0 sound/core/timer.c:516
                          snd_timer_start1+0x4d4/0x800 sound/core/timer.c:578
                          snd_timer_start sound/core/timer.c:696 [inline]
                          snd_timer_start sound/core/timer.c:689 [inline]
                          snd_timer_user_start.isra.0+0x1e3/0x260 sound/core/timer.c:1984
                          __snd_timer_user_ioctl.isra.0+0xda8/0x2490 sound/core/timer.c:2107
                          snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128
                          vfs_ioctl fs/ioctl.c:51 [inline]
                          __do_sys_ioctl fs/ioctl.c:874 [inline]
                          __se_sys_ioctl fs/ioctl.c:860 [inline]
                          __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
                          do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                          do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
                          entry_SYSCALL_64_after_hwframe+0x44/0xae
  }
  ... key      at: [<ffffffff90586820>] __key.0+0x0/0x40
  ... acquired at:
   __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
   _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236
   kill_fasync_rcu fs/fcntl.c:1014 [inline]
   kill_fasync fs/fcntl.c:1035 [inline]
   kill_fasync+0x136/0x470 fs/fcntl.c:1028
   snd_timer_user_ccallback+0x298/0x330 sound/core/timer.c:1386
   snd_timer_notify1+0x11c/0x3b0 sound/core/timer.c:516
   snd_timer_start1+0x4d4/0x800 sound/core/timer.c:578
   snd_timer_start sound/core/timer.c:696 [inline]
   snd_timer_start sound/core/timer.c:689 [inline]
   snd_timer_user_start.isra.0+0x1e3/0x260 sound/core/timer.c:1984
   __snd_timer_user_ioctl.isra.0+0xda8/0x2490 sound/core/timer.c:2107
   snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:874 [inline]
   __se_sys_ioctl fs/ioctl.c:860 [inline]
   __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x44/0xae

-> (&timer->lock){..-.}-{2:2} {
   IN-SOFTIRQ-W at:
                    lock_acquire kernel/locking/lockdep.c:5639 [inline]
                    lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                    __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                    _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
                    snd_timer_interrupt.part.0+0x34/0xcf0 sound/core/timer.c:856
                    snd_timer_interrupt sound/core/timer.c:1154 [inline]
                    snd_timer_s_function+0x14b/0x200 sound/core/timer.c:1154
                    call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
                    expire_timers kernel/time/timer.c:1466 [inline]
                    __run_timers.part.0+0x67c/0xa30 kernel/time/timer.c:1734
                    __run_timers kernel/time/timer.c:1715 [inline]
                    run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
                    __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
                    invoke_softirq kernel/softirq.c:432 [inline]
                    __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
                    irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
                    sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
                    asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
                    check_kcov_mode kernel/kcov.c:168 [inline]
                    __sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:200
                    kref_get include/linux/kref.h:45 [inline]
                    aa_get_label security/apparmor/include/label.h:382 [inline]
                    aa_get_label security/apparmor/include/label.h:379 [inline]
                    aa_get_newest_label security/apparmor/include/label.h:436 [inline]
                    aa_get_newest_cred_label security/apparmor/include/cred.h:63 [inline]
                    apparmor_capable+0x1eb/0x460 security/apparmor/lsm.c:186
                    security_capable+0x5c/0xc0 security/security.c:806
                    has_ns_capability_noaudit+0xb6/0x240 kernel/capability.c:341
                    __set_oom_adj.isra.0+0x657/0xf50 fs/proc/base.c:1111
                    oom_score_adj_write+0x1a8/0x1f0 fs/proc/base.c:1238
                    vfs_write+0x28e/0xae0 fs/read_write.c:588
                    ksys_write+0x12d/0x250 fs/read_write.c:643
                    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                    do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
                    entry_SYSCALL_64_after_hwframe+0x44/0xae
   INITIAL USE at:
                   lock_acquire kernel/locking/lockdep.c:5639 [inline]
                   lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
                   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                   _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
                   snd_timer_stop1+0x5c/0x860 sound/core/timer.c:626
                   snd_timer_stop sound/core/timer.c:710 [inline]
                   snd_timer_user_start.isra.0+0x8b/0x260 sound/core/timer.c:1981
                   __snd_timer_user_ioctl.isra.0+0xda8/0x2490 sound/core/timer.c:2107
                   snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128
                   vfs_ioctl fs/ioctl.c:51 [inline]
                   __do_sys_ioctl fs/ioctl.c:874 [inline]
                   __se_sys_ioctl fs/ioctl.c:860 [inline]
                   __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
                   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
                   entry_SYSCALL_64_after_hwframe+0x44/0xae
 }
 ... key      at: [<ffffffff908843c0>] __key.12+0x0/0x40
 ... acquired at:
   mark_lock kernel/locking/lockdep.c:4569 [inline]
   mark_usage kernel/locking/lockdep.c:4500 [inline]
   __lock_acquire+0x11e3/0x56c0 kernel/locking/lockdep.c:4981
   lock_acquire kernel/locking/lockdep.c:5639 [inline]
   lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
   _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
   snd_timer_interrupt.part.0+0x34/0xcf0 sound/core/timer.c:856
   snd_timer_interrupt sound/core/timer.c:1154 [inline]
   snd_timer_s_function+0x14b/0x200 sound/core/timer.c:1154
   call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
   expire_timers kernel/time/timer.c:1466 [inline]
   __run_timers.part.0+0x67c/0xa30 kernel/time/timer.c:1734
   __run_timers kernel/time/timer.c:1715 [inline]
   run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
   __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
   invoke_softirq kernel/softirq.c:432 [inline]
   __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
   irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
   sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
   asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
   check_kcov_mode kernel/kcov.c:168 [inline]
   __sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:200
   kref_get include/linux/kref.h:45 [inline]
   aa_get_label security/apparmor/include/label.h:382 [inline]
   aa_get_label security/apparmor/include/label.h:379 [inline]
   aa_get_newest_label security/apparmor/include/label.h:436 [inline]
   aa_get_newest_cred_label security/apparmor/include/cred.h:63 [inline]
   apparmor_capable+0x1eb/0x460 security/apparmor/lsm.c:186
   security_capable+0x5c/0xc0 security/security.c:806
   has_ns_capability_noaudit+0xb6/0x240 kernel/capability.c:341
   __set_oom_adj.isra.0+0x657/0xf50 fs/proc/base.c:1111
   oom_score_adj_write+0x1a8/0x1f0 fs/proc/base.c:1238
   vfs_write+0x28e/0xae0 fs/read_write.c:588
   ksys_write+0x12d/0x250 fs/read_write.c:643
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x44/0xae


stack backtrace:
CPU: 1 PID: 4157 Comm: syz-executor142 Not tainted 5.17.0-rc6-syzkaller-00184-g38f80f42147f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_irq_inversion_bug kernel/locking/lockdep.c:194 [inline]
 check_usage_forwards kernel/locking/lockdep.c:4043 [inline]
 mark_lock_irq kernel/locking/lockdep.c:4175 [inline]
 mark_lock.part.0.cold+0x86/0xd8 kernel/locking/lockdep.c:4605
 mark_lock kernel/locking/lockdep.c:4569 [inline]
 mark_usage kernel/locking/lockdep.c:4500 [inline]
 __lock_acquire+0x11e3/0x56c0 kernel/locking/lockdep.c:4981
 lock_acquire kernel/locking/lockdep.c:5639 [inline]
 lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
 snd_timer_interrupt.part.0+0x34/0xcf0 sound/core/timer.c:856
 snd_timer_interrupt sound/core/timer.c:1154 [inline]
 snd_timer_s_function+0x14b/0x200 sound/core/timer.c:1154
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x67c/0xa30 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:200
Code: 81 e1 00 01 00 00 65 48 8b 14 25 00 70 02 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 a4 15 00 00 85 c0 74 2b 8b 82 80 15 00 00 <83> f8 02 75 20 48 8b 8a 88 15 00 00 8b 92 84 15 00 00 48 8b 01 48
RSP: 0018:ffffc9000334fc88 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88807e1c5700 RSI: ffffffff83ab4cdb RDI: 0000000000000003
RBP: ffff888010dbcab0 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff83ab4ba3 R11: 0000000000000000 R12: 0000000000000018
R13: 0000000000000002 R14: ffff888010dbcaf0 R15: ffff88801da15100
 kref_get include/linux/kref.h:45 [inline]
 aa_get_label security/apparmor/include/label.h:382 [inline]
 aa_get_label security/apparmor/include/label.h:379 [inline]
 aa_get_newest_label security/apparmor/include/label.h:436 [inline]
 aa_get_newest_cred_label security/apparmor/include/cred.h:63 [inline]
 apparmor_capable+0x1eb/0x460 security/apparmor/lsm.c:186
 security_capable+0x5c/0xc0 security/security.c:806
 has_ns_capability_noaudit+0xb6/0x240 kernel/capability.c:341
 __set_oom_adj.isra.0+0x657/0xf50 fs/proc/base.c:1111
 oom_score_adj_write+0x1a8/0x1f0 fs/proc/base.c:1238
 vfs_write+0x28e/0xae0 fs/read_write.c:588
 ksys_write+0x12d/0x250 fs/read_write.c:643
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f5213c0d493
Code: e8 5b 5d 41 5c 41 5d c3 89 ef 41 bd 01 00 00 00 e8 a2 00 00 00 eb e0 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
RSP: 002b:00007ffe7ba3ce18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f5213c0d493
RDX: 0000000000000004 RSI: 00007ffe7ba3ce40 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 00007ffe7ba3cd90
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe7ba3ce40
R13: 0000000000000000 R14: 00007ffe7ba3d340 R15: 00007ffe7ba3d330
 </TASK>
----------------
Code disassembly (best guess):
   0:	81 e1 00 01 00 00    	and    $0x100,%ecx
   6:	65 48 8b 14 25 00 70 	mov    %gs:0x27000,%rdx
   d:	02 00
   f:	a9 00 01 ff 00       	test   $0xff0100,%eax
  14:	74 0e                	je     0x24
  16:	85 c9                	test   %ecx,%ecx
  18:	74 35                	je     0x4f
  1a:	8b 82 a4 15 00 00    	mov    0x15a4(%rdx),%eax
  20:	85 c0                	test   %eax,%eax
  22:	74 2b                	je     0x4f
  24:	8b 82 80 15 00 00    	mov    0x1580(%rdx),%eax
* 2a:	83 f8 02             	cmp    $0x2,%eax <-- trapping instruction
  2d:	75 20                	jne    0x4f
  2f:	48 8b 8a 88 15 00 00 	mov    0x1588(%rdx),%rcx
  36:	8b 92 84 15 00 00    	mov    0x1584(%rdx),%edx
  3c:	48 8b 01             	mov    (%rcx),%rax
  3f:	48                   	rex.W

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce 2022/04/18 20:25 upstream b2d229d4ddb1 45a13a73 .config log report syz C
Crashes (23):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce 2022/03/04 17:35 upstream 38f80f42147f 45a13a73 .config log report syz C possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/03/04 14:46 upstream 38f80f42147f 45a13a73 .config log report syz C possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce 2022/02/04 02:12 upstream 1f2cfdd349b7 30646bfe .config log report syz possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce 2022/04/26 09:27 upstream d615b5416f8a 1fa34c1b .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce 2022/03/19 20:05 upstream 97e9c8eb4bb1 e2d91b1d .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce 2022/03/16 18:05 upstream 56e337f2cf13 dfa9a8ed .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/03/05 22:23 upstream 0014404f9c18 7bdd8b2c .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/03/05 20:57 upstream 0014404f9c18 7bdd8b2c .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/03/04 14:12 upstream 38f80f42147f 45a13a73 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/02/08 13:58 upstream 555f3d7be91a 0b33604d .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-smack-root 2022/01/29 11:26 upstream 169387e2aa29 495e00c5 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/01/20 18:15 upstream fa2e1ba3e9e3 b838eb76 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/01/18 23:20 upstream 99613159ad74 731a2d23 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/01/16 10:47 upstream d0a231f01e5b 723cfaf0 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/01/09 20:44 upstream 4634129ad9fd 2ca0d385 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/01/07 15:54 upstream ddec8ed2d490 2ca0d385 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/01/06 14:54 upstream 75acfdb6fd92 6acc789a .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2022/01/03 08:22 upstream c9e6606c7fe9 e1768e9c .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-smack-root 2021/12/28 18:01 upstream a8ad9a2434dc 76c8cf06 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce 2021/12/25 00:58 upstream b927dfc67d05 6caa12e4 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-root 2021/11/25 01:56 upstream 5f53fa508db0 545ab074 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-kasan-gce-selinux-root 2021/11/17 18:35 upstream ee1703cda8dc cafff8b6 .config log report info possible deadlock in snd_timer_interrupt
ci-upstream-linux-next-kasan-gce-root 2022/03/08 18:56 linux-next 91265a6da44d 9e8eaa75 .config log report info possible deadlock in snd_timer_interrupt