bisecting fixing commit since f25804f389846835535db255e7ba80eeed967ed7 building syzkaller on 59b57593586656c1d5be820aeed0e751087e6ac6 testing commit f25804f389846835535db255e7ba80eeed967ed7 with gcc (GCC) 8.1.0 kernel signature: 3afdfb3c0e94cb327f0f8f79bd8f3890c7517c7efdef45b0347441c2f01a75f6 run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #7: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #8: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #9: crashed: INFO: task hung in paste_selection testing current HEAD 54b4fa6d39551639cb10664f6ac78b01993a1d7e testing commit 54b4fa6d39551639cb10664f6ac78b01993a1d7e with gcc (GCC) 8.1.0 kernel signature: 6ac93c2bdc9f161e045007ae899e444f6c7588cfc4c0019b08c7fdad29f8208c all runs: OK # git bisect start 54b4fa6d39551639cb10664f6ac78b01993a1d7e f25804f389846835535db255e7ba80eeed967ed7 Bisecting: 234 revisions left to test after this (roughly 8 steps) [b0c95d336123de55faf3528c97718a4e7607b54c] dmaengine: tegra-apb: Fix use-after-free testing commit b0c95d336123de55faf3528c97718a4e7607b54c with gcc (GCC) 8.1.0 kernel signature: 10259abdcae323f45426ef33d6fb73659fe2dd93b412890cbeb57786f4dc4c34 all runs: OK # git bisect bad b0c95d336123de55faf3528c97718a4e7607b54c Bisecting: 117 revisions left to test after this (roughly 7 steps) [2c3b6d7c25cda181481e28294b678327fc0e8be9] net: ena: ethtool: use correct value for crc32 hash testing commit 2c3b6d7c25cda181481e28294b678327fc0e8be9 with gcc (GCC) 8.1.0 kernel signature: 5edc93cabf64f3f43ed601468381ac9273f07da8166f619f5b768dae340c5508 run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #7: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #8: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #9: OK # git bisect good 2c3b6d7c25cda181481e28294b678327fc0e8be9 Bisecting: 58 revisions left to test after this (roughly 6 steps) [95722ea2a194dd6933ace84188f6b2a8b987a6f4] thermal: brcmstb_thermal: Do not use DT coefficients testing commit 95722ea2a194dd6933ace84188f6b2a8b987a6f4 with gcc (GCC) 8.1.0 kernel signature: 9f22b89374771a16df5c3b74161053fd6a12d16a3d3e5cc64f7ff341316a04d5 all runs: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common # git bisect good 95722ea2a194dd6933ace84188f6b2a8b987a6f4 Bisecting: 29 revisions left to test after this (roughly 5 steps) [4430620d88b4bda46cba9f48cc17940e34296f5b] watchdog: da9062: do not ping the hw during stop() testing commit 4430620d88b4bda46cba9f48cc17940e34296f5b with gcc (GCC) 8.1.0 kernel signature: 3577aa6d41b4e801de588d57571368e4f21e807d075e0d24aed21bddd5e5fca7 run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #7: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #8: OK run #9: OK # git bisect good 4430620d88b4bda46cba9f48cc17940e34296f5b Bisecting: 14 revisions left to test after this (roughly 4 steps) [e02865dbd31188a7fcec76f5f44c84ab872d597d] usb: core: hub: fix unhandled return by employing a void function testing commit e02865dbd31188a7fcec76f5f44c84ab872d597d with gcc (GCC) 8.1.0 kernel signature: bfc7c78edd69a43e6a5a7e5de6469925a3b6681729d2d24ec3ee86fbc14102ea all runs: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common # git bisect good e02865dbd31188a7fcec76f5f44c84ab872d597d Bisecting: 7 revisions left to test after this (roughly 3 steps) [6f0416c0a89f94389ee20471ee623e8f0bbc15b7] arm: dts: dra76x: Fix mmc3 max-frequency testing commit 6f0416c0a89f94389ee20471ee623e8f0bbc15b7 with gcc (GCC) 8.1.0 kernel signature: 4ff07f5ddec929bf763052577f56912aac783f6f59f715fbb408ce152d93e7eb run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #7: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common run #8: OK run #9: OK # git bisect good 6f0416c0a89f94389ee20471ee623e8f0bbc15b7 Bisecting: 3 revisions left to test after this (roughly 2 steps) [efaef8463e1a9c20aa19c3de2b2d19f885e0315e] vt: selection, push console lock down testing commit efaef8463e1a9c20aa19c3de2b2d19f885e0315e with gcc (GCC) 8.1.0 kernel signature: ca6a428be381f9880ee98006402e11c119abc84dd0349ed5e996922c92846f8e run #0: crashed: WARNING: possible circular locking dependency detected run #1: crashed: possible deadlock in n_tty_receive_buf_common run #2: crashed: possible deadlock in n_tty_receive_buf_common run #3: crashed: possible deadlock in n_tty_receive_buf_common run #4: crashed: possible deadlock in n_tty_receive_buf_common run #5: crashed: possible deadlock in n_tty_receive_buf_common run #6: crashed: possible deadlock in n_tty_receive_buf_common run #7: crashed: possible deadlock in n_tty_receive_buf_common run #8: crashed: possible deadlock in n_tty_receive_buf_common run #9: crashed: possible deadlock in n_tty_receive_buf_common # git bisect good efaef8463e1a9c20aa19c3de2b2d19f885e0315e Bisecting: 1 revision left to test after this (roughly 1 step) [7e46d9838ff8d445618428dc5852953629c44b4f] media: v4l2-mem2mem.c: fix broken links testing commit 7e46d9838ff8d445618428dc5852953629c44b4f with gcc (GCC) 8.1.0 kernel signature: 442ebab18ed01915657bbda34345c2d8b12ae645eba2f8b796230f5337872da9 all runs: OK # git bisect bad 7e46d9838ff8d445618428dc5852953629c44b4f Bisecting: 0 revisions left to test after this (roughly 0 steps) [b4492f1e7456bd162714c0ec2815c2749d930844] vt: selection, push sel_lock up testing commit b4492f1e7456bd162714c0ec2815c2749d930844 with gcc (GCC) 8.1.0 kernel signature: 12efe8ca412df1508cf7e84381dca58ec9d22ca30b690f7721df02798f5d442b all runs: OK # git bisect bad b4492f1e7456bd162714c0ec2815c2749d930844 b4492f1e7456bd162714c0ec2815c2749d930844 is the first bad commit commit b4492f1e7456bd162714c0ec2815c2749d930844 Author: Jiri Slaby Date: Fri Feb 28 12:54:06 2020 +0100 vt: selection, push sel_lock up commit e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 upstream. sel_lock cannot nest in the console lock. Thanks to syzkaller, the kernel states firmly: > WARNING: possible circular locking dependency detected > 5.6.0-rc3-syzkaller #0 Not tainted > ------------------------------------------------------ > syz-executor.4/20336 is trying to acquire lock: > ffff8880a2e952a0 (&tty->termios_rwsem){++++}, at: tty_unthrottle+0x22/0x100 drivers/tty/tty_ioctl.c:136 > > but task is already holding lock: > ffffffff89462e70 (sel_lock){+.+.}, at: paste_selection+0x118/0x470 drivers/tty/vt/selection.c:374 > > which lock already depends on the new lock. > > the existing dependency chain (in reverse order) is: > > -> #2 (sel_lock){+.+.}: > mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:1118 > set_selection_kernel+0x3b8/0x18a0 drivers/tty/vt/selection.c:217 > set_selection_user+0x63/0x80 drivers/tty/vt/selection.c:181 > tioclinux+0x103/0x530 drivers/tty/vt/vt.c:3050 > vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364 This is ioctl(TIOCL_SETSEL). Locks held on the path: console_lock -> sel_lock > -> #1 (console_lock){+.+.}: > console_lock+0x46/0x70 kernel/printk/printk.c:2289 > con_flush_chars+0x50/0x650 drivers/tty/vt/vt.c:3223 > n_tty_write+0xeae/0x1200 drivers/tty/n_tty.c:2350 > do_tty_write drivers/tty/tty_io.c:962 [inline] > tty_write+0x5a1/0x950 drivers/tty/tty_io.c:1046 This is write(). Locks held on the path: termios_rwsem -> console_lock > -> #0 (&tty->termios_rwsem){++++}: > down_write+0x57/0x140 kernel/locking/rwsem.c:1534 > tty_unthrottle+0x22/0x100 drivers/tty/tty_ioctl.c:136 > mkiss_receive_buf+0x12aa/0x1340 drivers/net/hamradio/mkiss.c:902 > tty_ldisc_receive_buf+0x12f/0x170 drivers/tty/tty_buffer.c:465 > paste_selection+0x346/0x470 drivers/tty/vt/selection.c:389 > tioclinux+0x121/0x530 drivers/tty/vt/vt.c:3055 > vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364 This is ioctl(TIOCL_PASTESEL). Locks held on the path: sel_lock -> termios_rwsem > other info that might help us debug this: > > Chain exists of: > &tty->termios_rwsem --> console_lock --> sel_lock Clearly. From the above, we have: console_lock -> sel_lock sel_lock -> termios_rwsem termios_rwsem -> console_lock Fix this by reversing the console_lock -> sel_lock dependency in ioctl(TIOCL_SETSEL). First, lock sel_lock, then console_lock. Signed-off-by: Jiri Slaby Reported-by: syzbot+26183d9746e62da329b8@syzkaller.appspotmail.com Fixes: 07e6124a1a46 ("vt: selection, close sel_buffer race") Cc: stable Link: https://lore.kernel.org/r/20200228115406.5735-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman drivers/tty/vt/selection.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) culprit signature: 12efe8ca412df1508cf7e84381dca58ec9d22ca30b690f7721df02798f5d442b parent signature: ca6a428be381f9880ee98006402e11c119abc84dd0349ed5e996922c92846f8e revisions tested: 11, total time: 3h12m59.463585836s (build: 1h36m30.351525977s, test: 1h35m39.217741263s) first good commit: b4492f1e7456bd162714c0ec2815c2749d930844 vt: selection, push sel_lock up cc: ["gregkh@linuxfoundation.org" "jslaby@suse.com" "jslaby@suse.cz" "linux-kernel@vger.kernel.org"]