[PATCH] Input: serio - don't sleep on serio_mutex from drvctl_store()

[Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>]

Writing to the drvctl attribute takes serio_mutex while holding the
attribute's kernfs active reference. serio_unregister_port() does the
opposite: it holds serio_mutex and device_del() then waits for active
references to drain in kernfs_drain(). If a drvctl write is in flight
when the port is unregistered, the writer waits for serio_mutex and the
unregistering task waits for the writer, and neither makes progress.
Interruptibility of the lock does not help, as nothing signals the writer.

lockdep reports it as:

  WARNING: possible circular locking dependency detected
  repro/4908 is trying to acquire lock:
   (kn->active){++++}-{0:0}, at: __kernfs_remove+0x34c/0xb90
  but task is already holding lock:
   (serio_mutex){+.+.}-{4:4}, at: serio_unregister_port+0x1b/0x40
   drvctl_store
   sysfs_kf_write
   ...
   kernfs_drain
   device_del
   serio_destroy_port
   serio_unregister_port
   userio_char_release

Use mutex_trylock() and restart the syscall when the mutex is busy, so
the active reference is dropped before waiting. Once the port is being
removed the retried write fails with -ENODEV.

Reported-by: syzbot+1075f6dc93f398c1857e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1075f6dc93f398c1857e
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
Root cause: drvctl_store() runs with the attribute's kernfs active reference
held and then takes serio_mutex. serio_unregister_port() takes serio_mutex and
then device_del() -> kernfs_drain() waits for all active references to drop.
A drvctl write that is in flight when the port is unregistered therefore waits
for serio_mutex while the unregistering task waits for that writer: a real
AB-BA deadlock, not just a lockdep false positive. mutex_lock_interruptible()
does not help as nobody signals the writer.

Reproduced in QEMU (x86_64, syzbot config, lockdep): a small program creates
and closes /dev/userio ports in a loop while 4 threads write "psmouse" to the
new port's drvctl. Unpatched kernel: the same circular-dependency splat as the
syzbot report (kn->active <-> serio_mutex, drvctl_store vs
serio_unregister_port/userio_char_release). An earlier, cruder run also left
the unregistering task blocked for >143s (hung task). Patched kernel: 20
create/close rounds complete, no lockdep report, no hang.

Fix: take serio_mutex with mutex_trylock() and restart_syscall() if busy, so
the active reference is dropped before waiting; once removal has begun the
retried write fails with -ENODEV. The only former failure, -EINTR on a signal,
is now covered by the normal syscall restart path.

The Fixes tag points at the original import: the lock order predates git
history (serio_sem) and I could not find a narrower commit.

 drivers/input/serio/serio.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 54dd26249b02..811e65fd4eb3 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -357,7 +357,8 @@ static ssize_t drvctl_store(struct device *dev, struct device_attribute *attr, c
 	struct device_driver *drv;
 	int error;
 
-	scoped_cond_guard(mutex_intr, return -EINTR, &serio_mutex) {
+	/* Port removal holds serio_mutex and drains us: don't wait for it. */
+	scoped_cond_guard(mutex_try, return restart_syscall(), &serio_mutex) {
 		if (!strncmp(buf, "none", count)) {
 			serio_disconnect_port(serio);
 		} else if (!strncmp(buf, "reconnect", count)) {
-- 
2.43.0