From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1ECC5C433B4 for ; Thu, 15 Apr 2021 07:39:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CD7C5610C8 for ; Thu, 15 Apr 2021 07:39:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231358AbhDOHkE (ORCPT ); Thu, 15 Apr 2021 03:40:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230090AbhDOHkD (ORCPT ); Thu, 15 Apr 2021 03:40:03 -0400 Received: from mail-qk1-x731.google.com (mail-qk1-x731.google.com [IPv6:2607:f8b0:4864:20::731]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 47DCDC061574 for ; Thu, 15 Apr 2021 00:39:41 -0700 (PDT) Received: by mail-qk1-x731.google.com with SMTP id o5so24325721qkb.0 for ; Thu, 15 Apr 2021 00:39:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=RQ4Q87xBrzCDyq10w6Xjp2756dW0ujWlXDbBBS5gu3g=; b=TH83Sm2XDd8xPQ3hDBxUDg3ty0nGrnvVdnVbOMVdR174U9BJUkMz8JM2K7i9z/q2eo xPtmQ85CYtbrW5R7xZ/Kpt0qmD3IPFzqoM6qEo0Pe4VwzGc0JX9aKY+4kVbaGWPFGit5 iCP++hPrlKkZV925xgmkWkYkPJiCenAo6+sOW36UX0KLGH1XN68SfMjrQCmVCIiknI+f QP84IPgsnb3IDI4ShxL1nppD0CrCqOViWHlfPIbd3JfycH9G0CGIcrGSj9G1x02UWBSM qipZnCBC5W2d0zWOX2guBqZXHC6ZOGH6uV/nW51qw7+4XfqonialxtrLswU3dYEwQU9H hBfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=RQ4Q87xBrzCDyq10w6Xjp2756dW0ujWlXDbBBS5gu3g=; b=VHaTC935EXIjPkapAk8yqpQn3lfuEaNUnPeVXDW08Nf7UJuVgzM/MUKIJyYFAEUXGB yf76lVYplQZ2jSMKZ1OWsOvqUsNWuPpfigQtIV0MwEz2G+Yh22aOtiYoE/BzFZH3njQA djLzBdrIis1YV0xuorEVAaGXT2WZOh9n9bVXxwLYXBguG7alRTtVMMtRh1fQzYWNNtl6 d3HBvo9ybqu+sbE4zu0iBYZnx10cGsR96uEbQ9dHAfGjBvGTl3OYpagYdcqUrng5AFQa ZVAcQ9dH5XmEiHqWNotF55sXn4geYK2WtBKOCanraQkTKnfikQiCOpPou9OmSSfQXWdw t1Rw== X-Gm-Message-State: AOAM530CmTGIwrtjbO/oR9QW+SZmoPKDjzz9h0N3ZLAAxziyHkcKUCAL y/3GDITRVEwDoB3eM+K0yLMx8Vjwavcr/Q+YK0O3NA== X-Google-Smtp-Source: ABdhPJzQYDJ19v6r6vobTgNRmzq6or+GRPWPSG3B3q75i30MJId/Xl2qbljRywyB69CyppZNiFmSmrp0sXmIAbL3tpI= X-Received: by 2002:a37:a993:: with SMTP id s141mr2142569qke.265.1618472380261; Thu, 15 Apr 2021 00:39:40 -0700 (PDT) MIME-Version: 1.0 References: <000000000000d5358b05bfe10354@google.com> <20210415072313.629-1-hdanton@sina.com> In-Reply-To: <20210415072313.629-1-hdanton@sina.com> From: Dmitry Vyukov Date: Thu, 15 Apr 2021 09:39:28 +0200 Message-ID: Subject: Re: [syzbot] possible deadlock in io_poll_double_wake (3) To: Hillf Danton Cc: syzbot , Pavel Begunkov , Jens Axboe , io-uring@vger.kernel.org, LKML , syzkaller-bugs Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: io-uring@vger.kernel.org On Thu, Apr 15, 2021 at 9:23 AM Hillf Danton wrote: > > On Tue, 13 Apr 2021 14:07:16 > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: 17e7124a Merge tag '5.12-rc6-smb3' of git://git.samba.org/.. > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=102c3891d00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=9320464bf47598bd > > dashboard link: https://syzkaller.appspot.com/bug?extid=e654d4e15e6b3b9deb53 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15fe3096d00000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=147b9431d00000 > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by: syzbot+e654d4e15e6b3b9deb53@syzkaller.appspotmail.com > > > > ============================================ > > WARNING: possible recursive locking detected > > 5.12.0-rc6-syzkaller #0 Not tainted > > -------------------------------------------- > > swapper/0/0 is trying to acquire lock: > > ffff88802108c130 (&runtime->sleep){..-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline] > > ffff88802108c130 (&runtime->sleep){..-.}-{2:2}, at: io_poll_double_wake+0x25f/0x6a0 fs/io_uring.c:4988 > > > > but task is already holding lock: > > ffff888014fd8130 (&runtime->sleep){..-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:137 > > > > other info that might help us debug this: > > Possible unsafe locking scenario: > > > > CPU0 > > ---- > > lock(&runtime->sleep); > > lock(&runtime->sleep); > > > > *** DEADLOCK *** > > Wasnt it fixed by 1c3b3e6527e57, given the same call trace at the first > glance? 1c3b3e6527e57 is present in the tested tree on 17e7124a. So syzbot just gave the answer to your question. > > May be due to missing lock nesting notation > > > > 2 locks held by swapper/0/0: > > #0: ffff888020d18108 (&group->lock){..-.}-{2:2}, at: _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170 > > #1: ffff888014fd8130 (&runtime->sleep){..-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:137 > > > > stack backtrace: > > CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc6-syzkaller #0 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > > Call Trace: > > > > __dump_stack lib/dump_stack.c:79 [inline] > > dump_stack+0x141/0x1d7 lib/dump_stack.c:120 > > print_deadlock_bug kernel/locking/lockdep.c:2829 [inline] > > check_deadlock kernel/locking/lockdep.c:2872 [inline] > > validate_chain kernel/locking/lockdep.c:3661 [inline] > > __lock_acquire.cold+0x14c/0x3b4 kernel/locking/lockdep.c:4900 > > lock_acquire kernel/locking/lockdep.c:5510 [inline] > > lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5475 > > __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] > > _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151 > > spin_lock include/linux/spinlock.h:354 [inline] > > io_poll_double_wake+0x25f/0x6a0 fs/io_uring.c:4988 > > __wake_up_common+0x147/0x650 kernel/sched/wait.c:108 > > __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:138 > > snd_pcm_update_state+0x46a/0x540 sound/core/pcm_lib.c:203 > > snd_pcm_update_hw_ptr0+0xa75/0x1a50 sound/core/pcm_lib.c:464 > > snd_pcm_period_elapsed+0x160/0x250 sound/core/pcm_lib.c:1805 > > dummy_hrtimer_callback+0x94/0x1b0 sound/drivers/dummy.c:377 > > __run_hrtimer kernel/time/hrtimer.c:1537 [inline] > > __hrtimer_run_queues+0x609/0xe40 kernel/time/hrtimer.c:1601 > > hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1618 > > __do_softirq+0x29b/0x9f6 kernel/softirq.c:345 > > invoke_softirq kernel/softirq.c:221 [inline] > > __irq_exit_rcu kernel/softirq.c:422 [inline] > > irq_exit_rcu+0x134/0x200 kernel/softirq.c:434 > > sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100 > > > > asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632 > > RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline] > > RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline] > > RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:137 [inline] > > RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline] > > RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 drivers/acpi/processor_idle.c:517 > > Code: cd cb 6e f8 84 db 75 ac e8 14 c5 6e f8 e8 1f b4 74 f8 e9 0c 00 00 00 e8 05 c5 6e f8 0f 00 2d 0e 18 c8 00 e8 f9 c4 6e f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 04 cd 6e f8 48 85 db > > RSP: 0018:ffffffff8bc07d60 EFLAGS: 00000293 > > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 > > RDX: ffffffff8bcbc400 RSI: ffffffff89052c17 RDI: 0000000000000000 > > RBP: ffff888015078064 R08: 0000000000000001 R09: 0000000000000001 > > R10: ffffffff8179e058 R11: 0000000000000000 R12: 0000000000000001 > > R13: ffff888015078000 R14: ffff888015078064 R15: ffff888143a48004 > > acpi_idle_enter+0x361/0x500 drivers/acpi/processor_idle.c:654 > > cpuidle_enter_state+0x1b1/0xc80 drivers/cpuidle/cpuidle.c:237 > > cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:351 > > call_cpuidle kernel/sched/idle.c:158 [inline] > > cpuidle_idle_call kernel/sched/idle.c:239 [inline] > > do_idle+0x3e1/0x590 kernel/sched/idle.c:300 > > > > > > --- > > This report is generated by a bot. It may contain errors. > > See https://goo.gl/tpsmEJ for more information about syzbot. > > syzbot engineers can be reached at syzkaller@googlegroups.com. > > > > syzbot will keep track of this issue. See: > > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > syzbot can test patches for this issue, for details see: > > https://goo.gl/tpsmEJ#testing-patches