From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754852AbcHVJVe (ORCPT ); Mon, 22 Aug 2016 05:21:34 -0400 Received: from mx2.suse.de ([195.135.220.15]:53575 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752087AbcHVJVc (ORCPT ); Mon, 22 Aug 2016 05:21:32 -0400 Date: Mon, 22 Aug 2016 11:21:30 +0200 Message-ID: From: Takashi Iwai To: "Dmitry Vyukov" Cc: , "Jaroslav Kysela" , "LKML" , "Alexander Potapenko" , "Kostya Serebryany" , "syzkaller" Subject: Re: sound: deadlock snd_rawmidi_kernel_open/check_and_subscribe_port In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/24.5 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 22 Aug 2016 02:15:48 +0200, Dmitry Vyukov wrote: > > On Sat, Aug 13, 2016 at 2:43 PM, Dmitry Vyukov wrote: > > Hello, > > > > While running syzkaller fuzzer on > > f31494bd05b06b0cdb4da6aebe92eaafab970df6 (Aug 12), I've got the > > following deadlock report: > > > > ====================================================== > > [ INFO: possible circular locking dependency detected ] > > 4.8.0-rc1+ #11 Not tainted > > ------------------------------------------------------- > > syz-executor/7154 is trying to acquire lock: > > (register_mutex#5){+.+.+.}, at: [] > > snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341 > > > > but task is already holding lock: > > (&grp->list_mutex){++++.+}, at: [] > > check_and_subscribe_port+0x5b/0x5c0 sound/core/seq/seq_ports.c:495 > > > > which lock already depends on the new lock. > > > > the existing dependency chain (in reverse order) is: > > > > -> #1 (&grp->list_mutex){++++.+}: > > [] lock_acquire+0x208/0x430 > > kernel/locking/lockdep.c:3746 > > [] down_read+0x49/0xc0 kernel/locking/rwsem.c:22 > > [< inline >] deliver_to_subscribers > > sound/core/seq/seq_clientmgr.c:681 > > [] snd_seq_deliver_event+0x35e/0x890 > > sound/core/seq/seq_clientmgr.c:822 > > [] snd_seq_kernel_client_dispatch+0x126/0x170 > > sound/core/seq/seq_clientmgr.c:2418 > > [] snd_seq_system_broadcast+0xb2/0xf0 > > sound/core/seq/seq_system.c:101 > > [] snd_seq_create_kernel_client+0x24a/0x330 > > sound/core/seq/seq_clientmgr.c:2297 > > [< inline >] snd_virmidi_dev_attach_seq > > sound/core/seq/seq_virmidi.c:383 > > [] snd_virmidi_dev_register+0x29f/0x750 > > sound/core/seq/seq_virmidi.c:450 > > [] snd_rawmidi_dev_register+0x30c/0xd40 > > sound/core/rawmidi.c:1645 > > [] __snd_device_register.part.0+0x63/0xc0 > > sound/core/device.c:164 > > [< inline >] __snd_device_register sound/core/device.c:162 > > [] snd_device_register_all+0xad/0x110 > > sound/core/device.c:212 > > [] snd_card_register+0xef/0x6c0 sound/core/init.c:749 > > [] snd_virmidi_probe+0x3ef/0x590 > > sound/drivers/virmidi.c:123 > > [] platform_drv_probe+0x8b/0x170 > > drivers/base/platform.c:564 > > [< inline >] really_probe drivers/base/dd.c:377 > > [] driver_probe_device+0x563/0xcc0 > > drivers/base/dd.c:499 > > [] __device_attach_driver+0x21d/0x2e0 > > drivers/base/dd.c:594 > > [] bus_for_each_drv+0x13f/0x1d0 drivers/base/bus.c:463 > > [] __device_attach+0x1ef/0x300 drivers/base/dd.c:651 > > [] device_initial_probe+0x1a/0x20 drivers/base/dd.c:698 > > [] bus_probe_device+0x1e9/0x290 drivers/base/bus.c:557 > > [] device_add+0xc49/0x14c0 drivers/base/core.c:1120 > > [] platform_device_add+0x2f9/0x7b0 > > drivers/base/platform.c:403 > > [] platform_device_register_full+0x392/0x4b0 > > drivers/base/platform.c:536 > > [< inline >] platform_device_register_resndata > > ./include/linux/platform_device.h:111 > > [< inline >] platform_device_register_simple > > ./include/linux/platform_device.h:140 > > [] alsa_card_virmidi_init+0x104/0x1da > > sound/drivers/virmidi.c:172 > > [] do_one_initcall+0xa0/0x2b0 init/main.c:778 > > [< inline >] do_initcall_level init/main.c:843 > > [< inline >] do_initcalls init/main.c:851 > > [< inline >] do_basic_setup init/main.c:869 > > [] kernel_init_freeable+0x47b/0x534 init/main.c:1016 > > [] kernel_init+0x13/0x180 init/main.c:942 > > [] ret_from_fork+0x1f/0x40 > > arch/x86/entry/entry_64.S:393 > > > > -> #0 (register_mutex#5){+.+.+.}: > > [< inline >] check_prev_add kernel/locking/lockdep.c:1829 > > [< inline >] check_prevs_add kernel/locking/lockdep.c:1939 > > [< inline >] validate_chain kernel/locking/lockdep.c:2266 > > [] __lock_acquire+0x4d44/0x4d80 > > kernel/locking/lockdep.c:3335 > > [] lock_acquire+0x208/0x430 > > kernel/locking/lockdep.c:3746 > > [< inline >] __mutex_lock_common kernel/locking/mutex.c:521 > > [] mutex_lock_nested+0xb1/0xa20 > > kernel/locking/mutex.c:621 > > [] snd_rawmidi_kernel_open+0x4b/0x260 > > sound/core/rawmidi.c:341 > > [] midisynth_subscribe+0xf7/0x350 > > sound/core/seq/seq_midi.c:188 > > [< inline >] subscribe_port sound/core/seq/seq_ports.c:427 > > [] check_and_subscribe_port+0x467/0x5c0 > > sound/core/seq/seq_ports.c:510 > > [] snd_seq_port_connect+0x2c9/0x500 > > sound/core/seq/seq_ports.c:579 > > [] snd_seq_ioctl_subscribe_port+0x1d8/0x2b0 > > sound/core/seq/seq_clientmgr.c:1480 > > [] snd_seq_do_ioctl+0x184/0x1e0 > > sound/core/seq/seq_clientmgr.c:2225 > > [] snd_seq_kernel_client_ctl+0xa8/0x110 > > sound/core/seq/seq_clientmgr.c:2440 > > [] snd_seq_oss_midi_open+0x3b4/0x610 > > sound/core/seq/oss/seq_oss_midi.c:375 > > [] snd_seq_oss_synth_setup_midi+0x107/0x4c0 > > sound/core/seq/oss/seq_oss_synth.c:281 > > [] snd_seq_oss_open+0x748/0x8d0 > > sound/core/seq/oss/seq_oss_init.c:274 > > [] odev_open+0x6a/0x90 sound/core/seq/oss/seq_oss.c:138 > > [] soundcore_open+0x30f/0x640 sound/sound_core.c:639 > > [] chrdev_open+0x22a/0x4c0 fs/char_dev.c:392 > > [] do_dentry_open+0x69f/0xca0 fs/open.c:736 > > [] vfs_open+0x105/0x220 fs/open.c:849 > > [< inline >] do_last fs/namei.c:3374 > > [] path_openat+0x1efd/0x2f60 fs/namei.c:3497 > > [] do_filp_open+0x18e/0x250 fs/namei.c:3532 > > [] do_sys_open+0x201/0x420 fs/open.c:1036 > > [< inline >] SYSC_open fs/open.c:1054 > > [] SyS_open+0x2d/0x40 fs/open.c:1049 > > [] entry_SYSCALL_64_fastpath+0x23/0xc1 > > arch/x86/entry/entry_64.S:207 > > > > other info that might help us debug this: > > > > Possible unsafe locking scenario: > > > > CPU0 CPU1 > > ---- ---- > > lock(&grp->list_mutex); > > lock(register_mutex#5); > > lock(&grp->list_mutex); > > lock(register_mutex#5); > > > > *** DEADLOCK *** > > > > 2 locks held by syz-executor/7154: > > #0: (register_mutex#4){+.+.+.}, at: [] > > odev_open+0x5f/0x90 sound/core/seq/oss/seq_oss.c:137 > > #1: (&grp->list_mutex){++++.+}, at: [] > > check_and_subscribe_port+0x5b/0x5c0 sound/core/seq/seq_ports.c:495 > > > > stack backtrace: > > CPU: 0 PID: 7154 Comm: syz-executor Not tainted 4.8.0-rc1+ #11 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > > ffffffff878b7680 ffff880038b670f0 ffffffff82a5f719 ffffffff00000000 > > fffffbfff0f16ed0 ffffffff8901a0d0 ffffffff8901a0d0 ffffffff890191a0 > > ffff88003da2cf08 ffff88003da2c6c0 ffff880038b67140 ffffffff814708a8 > > Call Trace: > > [< inline >] __dump_stack lib/dump_stack.c:15 > > [] dump_stack+0x12e/0x185 lib/dump_stack.c:51 > > [] print_circular_bug+0x288/0x340 > > kernel/locking/lockdep.c:1202 > > [< inline >] check_prev_add kernel/locking/lockdep.c:1829 > > [< inline >] check_prevs_add kernel/locking/lockdep.c:1939 > > [< inline >] validate_chain kernel/locking/lockdep.c:2266 > > [] __lock_acquire+0x4d44/0x4d80 kernel/locking/lockdep.c:3335 > > [] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746 > > [< inline >] __mutex_lock_common kernel/locking/mutex.c:521 > > [] mutex_lock_nested+0xb1/0xa20 kernel/locking/mutex.c:621 > > [] snd_rawmidi_kernel_open+0x4b/0x260 > > sound/core/rawmidi.c:341 > > [] midisynth_subscribe+0xf7/0x350 > > sound/core/seq/seq_midi.c:188 > > [< inline >] subscribe_port sound/core/seq/seq_ports.c:427 > > [] check_and_subscribe_port+0x467/0x5c0 > > sound/core/seq/seq_ports.c:510 > > [] snd_seq_port_connect+0x2c9/0x500 > > sound/core/seq/seq_ports.c:579 > > [] snd_seq_ioctl_subscribe_port+0x1d8/0x2b0 > > sound/core/seq/seq_clientmgr.c:1480 > > [] snd_seq_do_ioctl+0x184/0x1e0 > > sound/core/seq/seq_clientmgr.c:2225 > > [] snd_seq_kernel_client_ctl+0xa8/0x110 > > sound/core/seq/seq_clientmgr.c:2440 > > [] snd_seq_oss_midi_open+0x3b4/0x610 > > sound/core/seq/oss/seq_oss_midi.c:375 > > [] snd_seq_oss_synth_setup_midi+0x107/0x4c0 > > sound/core/seq/oss/seq_oss_synth.c:281 > > [] snd_seq_oss_open+0x748/0x8d0 > > sound/core/seq/oss/seq_oss_init.c:274 > > [] odev_open+0x6a/0x90 sound/core/seq/oss/seq_oss.c:138 > > [] soundcore_open+0x30f/0x640 sound/sound_core.c:639 > > [] chrdev_open+0x22a/0x4c0 fs/char_dev.c:392 > > [] do_dentry_open+0x69f/0xca0 fs/open.c:736 > > [] vfs_open+0x105/0x220 fs/open.c:849 > > [< inline >] do_last fs/namei.c:3374 > > [] path_openat+0x1efd/0x2f60 fs/namei.c:3497 > > [] do_filp_open+0x18e/0x250 fs/namei.c:3532 > > [] do_sys_open+0x201/0x420 fs/open.c:1036 > > [< inline >] SYSC_open fs/open.c:1054 > > [] SyS_open+0x2d/0x40 fs/open.c:1049 > > [] entry_SYSCALL_64_fastpath+0x23/0xc1 > > arch/x86/entry/entry_64.S:207 > > > Ping. Still happens on HEAD. Sorry, I've been on vacation in the last week. I'll take a look once after digesting the whole backlogs... thanks, Takashi