B.A.T.M.A.N February 2020

b.a.t.m.a.n@lists.open-mesh.org

21 participants
17 discussions

[PATCH maint] batman-adv: Don't schedule OGM for disabled interface
by Sven Eckelmann 17 Feb '20

17 Feb '20

A transmission scheduling for an interface which is currently dropped by batadv_iv_ogm_iface_disable could still be in progress. The B.A.T.M.A.N. V is simply cancelling the workqueue item in an synchronous way but this is not possible with B.A.T.M.A.N. IV because the OGM submissions are intertwined. Instead it has to stop submitting the OGM when it detect that the buffer pointer is set to NULL. Reported-by: syzbot+a98f2016f40b9cd3818a(a)syzkaller.appspotmail.com Reported-by: syzbot+ac36b6a33c28a491e929(a)syzkaller.appspotmail.com Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- Cc: Hillf Danton <hdanton(a)sina.com> I had this one in the pipeline but didn't find the time to correctly test it. You already send your one to syzkaller - do you want to rework your one (to also catch the broken submission on the same interface) and submit it? Or is this patch also ok for you? If it is, do you want to be mentioned in some way or form in this patch? --- net/batman-adv/bat_iv_ogm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index 5b0b20e6..bd514c36 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -789,6 +789,10 @@ static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface) lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex); + /* interface already disabled in batadv_iv_ogm_iface_disable */ + if (!*ogm_buff) + return; + /* the interface gets activated here to avoid race conditions between * the moment of activating the interface in * hardif_activate_interface() where the originator mac is set and -- 2.20.1

1 0

[PATCH] net: batman-adv: Use built-in RCU list checking
by madhuparnabhowmik10＠gmail.com 17 Feb '20

17 Feb '20

From: Madhuparna Bhowmik <madhuparnabhowmik10(a)gmail.com> hlist_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to hlist_for_each_entry_rcu() to silence false lockdep warnings when CONFIG_PROVE_RCU_LIST is enabled by default. Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10(a)gmail.com> --- net/batman-adv/translation-table.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 8a482c5ec67b..0e3c31cbe0e8 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -862,7 +862,8 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, u8 *tt_change_ptr; spin_lock_bh(&orig_node->vlan_list_lock); - hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) { + hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list, + lockdep_is_held(&orig_node->vlan_list_lock)) { num_vlan++; num_entries += atomic_read(&vlan->tt.num_entries); } @@ -888,7 +889,8 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, (*tt_data)->num_vlan = htons(num_vlan); tt_vlan = (struct batadv_tvlv_tt_vlan_data *)(*tt_data + 1); - hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) { + hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list, + lockdep_is_held(&orig_node->vlan_list_lock)) { tt_vlan->vid = htons(vlan->vid); tt_vlan->crc = htonl(vlan->tt.crc); @@ -937,7 +939,8 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, int change_offset; spin_lock_bh(&bat_priv->softif_vlan_list_lock); - hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) { + hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list, + lockdep_is_held(&bat_priv->softif_vlan_list_lock)) { vlan_entries = atomic_read(&vlan->tt.num_entries); if (vlan_entries < 1) continue; @@ -967,7 +970,8 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, (*tt_data)->num_vlan = htons(num_vlan); tt_vlan = (struct batadv_tvlv_tt_vlan_data *)(*tt_data + 1); - hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) { + hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list, + lockdep_is_held(&bat_priv->softif_vlan_list_lock)) { vlan_entries = atomic_read(&vlan->tt.num_entries); if (vlan_entries < 1) continue; -- 2.17.1

3 6

general protection fault in batadv_iv_ogm_schedule_buff
by syzbot 17 Feb '20

17 Feb '20

Hello, syzbot found the following crash on: HEAD commit: 2019fc96 Merge git://git.kernel.org/pub/scm/linux/kernel/g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16ebaae6e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=735296e4dd620b10 dashboard link: https://syzkaller.appspot.com/bug?extid=a98f2016f40b9cd3818a compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+a98f2016f40b9cd3818a(a)syzkaller.appspotmail.com general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 PID: 21 Comm: kworker/u4:1 Not tainted 5.6.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet RIP: 0010:batadv_iv_ogm_schedule_buff+0x3f4/0x12d0 net/batman-adv/bat_iv_ogm.c:814 Code: c1 ea 03 80 3c 02 00 0f 85 e5 0d 00 00 4d 8b a7 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 16 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 b8 RSP: 0018:ffffc90000dd7bb8 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff1101537d9c1 RDX: 0000000000000002 RSI: ffffffff87cc2c28 RDI: 0000000000000016 RBP: ffffc90000dd7ca8 R08: 0000000000000004 R09: ffff8880a9bece10 R10: fffffbfff154b460 R11: ffffffff8aa5a307 R12: 0000000000000000 R13: 0000000000000001 R14: ffffc90000dd7c40 R15: ffff8880a9aa0800 FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 000000008f5a3000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:865 [inline] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:858 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x5da/0x7c0 net/batman-adv/bat_iv_ogm.c:1718 process_one_work+0xa05/0x17a0 kernel/workqueue.c:2264 worker_thread+0x98/0xe40 kernel/workqueue.c:2410 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Modules linked in: ---[ end trace 101b07e3062bfd0c ]--- RIP: 0010:batadv_iv_ogm_schedule_buff+0x3f4/0x12d0 net/batman-adv/bat_iv_ogm.c:814 Code: c1 ea 03 80 3c 02 00 0f 85 e5 0d 00 00 4d 8b a7 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 16 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 b8 RSP: 0018:ffffc90000dd7bb8 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff1101537d9c1 RDX: 0000000000000002 RSI: ffffffff87cc2c28 RDI: 0000000000000016 RBP: ffffc90000dd7ca8 R08: 0000000000000004 R09: ffff8880a9bece10 R10: fffffbfff154b460 R11: ffffffff8aa5a307 R12: 0000000000000000 R13: 0000000000000001 R14: ffffc90000dd7c40 R15: ffff8880a9aa0800 FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 000000009d9e7000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

2 1

[PATCH] batman-adv: Avoid RCU list-traversal in spinlock
by Sven Eckelmann 16 Feb '20

16 Feb '20

The new CONFIG_PROVE_RCU_LIST requires a condition statement in (h)list_for_each_entry_rcu when the code might be executed in a non RCU non-reader section with the writer lock. Otherwise lockdep might cause a false positive warning like ============================= WARNING: suspicious RCU usage ----------------------------- translation-table.c:940 RCU-list traversed in non-reader section!! batman-adv is (mostly) following the examples from the RCU documenation and is using the normal list-traversal primitives instead of the RCU list-traversal primitives when the writer (spin)lock is held. The remaining users of RCU list-traversal primitives with writer spinlock have to be converted to the same style as the rest of the code. Reported-by: Madhuparna Bhowmik <madhuparnabhowmik10(a)gmail.com> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/translation-table.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 85293283..2d52356a 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -862,7 +862,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, u8 *tt_change_ptr; spin_lock_bh(&orig_node->vlan_list_lock); - hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) { + hlist_for_each_entry(vlan, &orig_node->vlan_list, list) { num_vlan++; num_entries += atomic_read(&vlan->tt.num_entries); } @@ -888,7 +888,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, (*tt_data)->num_vlan = htons(num_vlan); tt_vlan = (struct batadv_tvlv_tt_vlan_data *)(*tt_data + 1); - hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) { + hlist_for_each_entry(vlan, &orig_node->vlan_list, list) { tt_vlan->vid = htons(vlan->vid); tt_vlan->crc = htonl(vlan->tt.crc); @@ -937,7 +937,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, int change_offset; spin_lock_bh(&bat_priv->softif_vlan_list_lock); - hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) { + hlist_for_each_entry(vlan, &bat_priv->softif_vlan_list, list) { vlan_entries = atomic_read(&vlan->tt.num_entries); if (vlan_entries < 1) continue; -- 2.20.1

1 0

general protection fault in batadv_iv_ogm_schedule
by syzbot 08 Feb '20

08 Feb '20

Hello, syzbot found the following crash on: HEAD commit: f7571657 Merge tag 'fuse-fixes-5.6-rc1' of git://git.kerne.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12dddbbee00000 kernel config: https://syzkaller.appspot.com/x/.config?x=7f1d914a74bd6ddc dashboard link: https://syzkaller.appspot.com/bug?extid=ac36b6a33c28a491e929 compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+ac36b6a33c28a491e929(a)syzkaller.appspotmail.com general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 PID: 465 Comm: kworker/u4:5 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet RIP: 0010:batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:814 [inline] RIP: 0010:batadv_iv_ogm_schedule+0x220/0xf00 net/batman-adv/bat_iv_ogm.c:865 Code: e8 35 ef bf f9 4c 89 ad 60 ff ff ff 4d 8b 75 00 66 41 c1 c7 08 49 8d 5e 16 48 89 d8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 8a 04 28 84 c0 0f 85 e0 0b 00 00 66 44 89 3b 4c 89 a5 78 ff ff RSP: 0018:ffffc90002887b78 EFLAGS: 00010203 RAX: 0000000000000002 RBX: 0000000000000016 RCX: 1ffff11012580611 RDX: 0000000000000000 RSI: ffff8880a80449b0 RDI: 0000000000000282 RBP: ffffc90002887c38 R08: dffffc0000000000 R09: fffffbfff12d3605 R10: fffffbfff12d3605 R11: 0000000000000000 R12: ffff888092c03000 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000075bfd4 CR3: 0000000090ab0000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: batadv_iv_send_outstanding_bat_ogm_packet+0x664/0x770 net/batman-adv/bat_iv_ogm.c:1718 process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410 kthread+0x332/0x350 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Modules linked in: ---[ end trace eddf69e5e4c9f596 ]--- RIP: 0010:batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:814 [inline] RIP: 0010:batadv_iv_ogm_schedule+0x220/0xf00 net/batman-adv/bat_iv_ogm.c:865 Code: e8 35 ef bf f9 4c 89 ad 60 ff ff ff 4d 8b 75 00 66 41 c1 c7 08 49 8d 5e 16 48 89 d8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 8a 04 28 84 c0 0f 85 e0 0b 00 00 66 44 89 3b 4c 89 a5 78 ff ff RSP: 0018:ffffc90002887b78 EFLAGS: 00010203 RAX: 0000000000000002 RBX: 0000000000000016 RCX: 1ffff11012580611 RDX: 0000000000000000 RSI: ffff8880a80449b0 RDI: 0000000000000282 RBP: ffffc90002887c38 R08: dffffc0000000000 R09: fffffbfff12d3605 R10: fffffbfff12d3605 R11: 0000000000000000 R12: ffff888092c03000 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000075bfd4 CR3: 000000009c67b000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0

can't find logged information
by Steve Newcomb 07 Feb '20

07 Feb '20

Here in upstate New York, USA, I'm having difficulty with 2 meshes, each with 4 nodes, both meshes running BATMAN_IV. All nodes are TP-Link Archer C7 or A7 routers running the latest OpenWRT trunk. All nodes are stationary. The radio environment is pretty quiet, I think. There is only one gateway in each mesh. Nothing ever changes. (A map of the layout can be found at rosepark dot us hash map.) Nevertheless, each mesh stops working at least once or twice per day. If I reboot the gateway node of the one that stops working, the mesh starts working again. In order to keep the meshes running, sort of, they now run a script I wrote that reboots them when they stop being able to ping each other. It is not a very satisfactory solution. If I could see what's going on, I might see how to make the meshes more stable, but I can't find any debug messages. I compiled batctl-full and the kernel module with all options, including all debug options. Here's a portion of a "make menuconfig" screen: <*> kmod-batman-adv......................................... B.A.T.M.A.N. Adv [*] B.A.T.M.A.N. V protocol [*] Bridge Loop Avoidance [*] Distributed ARP Table [*] Network Coding [*] Multicast optimisation [*] batman-adv debugfs entries [*] B.A.T.M.A.N. debugging [*] batman-adv sysfs entries [*] B.A.T.M.A.N. tracing support I run "batctl ll all" followed by "batctl ll" and I see: @rpc152:/tmp/log# batctl ll [ ] all debug output disabled (none) [x] messages related to routing / flooding / broadcasting (batman) [x] messages related to route added / changed / deleted (routes) [x] messages related to translation table operations (tt) [x] messages related to bridge loop avoidance (bla) [x] messages related to arp snooping and distributed arp table (dat) [x] messages related to network coding (nc) [x] messages related to multicast (mcast) [x] messages related to throughput meter (tp) But the only debug-related log messages I see are: @rpc152:/tmp/log# echo "$(dmesg)" | grep batman [ 18.672978] batman_adv: B.A.T.M.A.N. advanced 2019.5-openwrt-0 (compatibility version 15) loaded [ 42.067698] batman_adv: bat0: Adding interface: mesh0 [ 42.073065] batman_adv: bat0: The MTU of interface mesh0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would \ solve the problem. [ 42.098069] batman_adv: bat0: Interface activated: mesh0 [174193.938445] batman_adv: [Deprecated]: batctl (pid 22747) Use of debugfs file "nc_nodes". @rpc152:/tmp/log# echo "$(logread)" | grep batman Thu Feb 6 15:21:13 2020 kern.warn kernel: [174193.938445] batman_adv: [Deprecated]: batctl (pid 22747) Use of debugfs file "nc_nodes". @rpc152:/tmp/log# What have I missed? Thanks. Steve Newcomb

2 1

possible deadlock in pty_write
by syzbot 03 Feb '20

03 Feb '20

Hello, syzbot found the following crash on: HEAD commit: ccaaaf6f Merge tag 'mpx-for-linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=11bc585ee00000 kernel config: https://syzkaller.appspot.com/x/.config?x=879390c6b09ccf66 dashboard link: https://syzkaller.appspot.com/bug?extid=3118a33395397bb6b0ca compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165bda4ee00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1646a85ee00000 The bug was bisected to: commit 65b27995a4ab8fc51b4adc6b4dcdca20f7a595bb Author: Heiner Kallweit <hkallweit1(a)gmail.com> Date: Mon Aug 12 21:52:19 2019 +0000 net: phy: let phy_speed_down/up support speeds >1Gbps bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1764f735e00000 final crash: https://syzkaller.appspot.com/x/report.txt?x=14e4f735e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=10e4f735e00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+3118a33395397bb6b0ca(a)syzkaller.appspotmail.com Fixes: 65b27995a4ab ("net: phy: let phy_speed_down/up support speeds >1Gbps") ====================================================== WARNING: possible circular locking dependency detected 5.5.0-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor465/10262 is trying to acquire lock: ffffffff89b9f960 (console_owner){-.-.}, at: console_trylock_spinning kernel/printk/printk.c:1724 [inline] ffffffff89b9f960 (console_owner){-.-.}, at: vprintk_emit+0x3fd/0x700 kernel/printk/printk.c:1995 but task is already holding lock: ffff88808d6b7940 (&(&port->lock)->rlock){-.-.}, at: pty_write+0xff/0x200 drivers/tty/pty.c:120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&(&port->lock)->rlock){-.-.}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:159 tty_port_tty_get+0x24/0x100 drivers/tty/tty_port.c:287 tty_port_default_wakeup+0x16/0x40 drivers/tty/tty_port.c:47 tty_port_tty_wakeup+0x57/0x70 drivers/tty/tty_port.c:387 uart_write_wakeup+0x46/0x70 drivers/tty/serial/serial_core.c:104 serial8250_tx_chars+0x495/0xaf0 drivers/tty/serial/8250/8250_port.c:1760 serial8250_handle_irq.part.0+0x261/0x2b0 drivers/tty/serial/8250/8250_port.c:1833 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1819 [inline] serial8250_default_handle_irq+0xc0/0x150 drivers/tty/serial/8250/8250_port.c:1849 serial8250_interrupt+0xf1/0x1a0 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x15d/0x970 kernel/irq/handle.c:149 handle_irq_event_percpu+0x74/0x160 kernel/irq/handle.c:189 handle_irq_event+0xa7/0x134 kernel/irq/handle.c:206 handle_edge_irq+0x25e/0x8d0 kernel/irq/chip.c:830 generic_handle_irq_desc include/linux/irqdesc.h:156 [inline] do_IRQ+0xde/0x280 arch/x86/kernel/irq.c:250 ret_from_intr+0x0/0x36 arch_local_irq_restore arch/x86/include/asm/paravirt.h:752 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x90/0xe0 kernel/locking/spinlock.c:191 spin_unlock_irqrestore include/linux/spinlock.h:393 [inline] uart_write+0x3b6/0x6f0 drivers/tty/serial/serial_core.c:613 process_output_block drivers/tty/n_tty.c:595 [inline] n_tty_write+0x40e/0x1080 drivers/tty/n_tty.c:2333 do_tty_write drivers/tty/tty_io.c:962 [inline] tty_write+0x496/0x7f0 drivers/tty/tty_io.c:1046 redirected_tty_write+0xb2/0xc0 drivers/tty/tty_io.c:1067 __vfs_write+0x8a/0x110 fs/read_write.c:494 vfs_write+0x268/0x5d0 fs/read_write.c:558 ksys_write+0x14f/0x290 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:620 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #1 (&port_lock_key){-.-.}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:159 serial8250_console_write+0x253/0x9a0 drivers/tty/serial/8250/8250_port.c:3142 univ8250_console_write+0x5f/0x70 drivers/tty/serial/8250/8250_core.c:587 call_console_drivers kernel/printk/printk.c:1791 [inline] console_unlock+0xb7a/0xf00 kernel/printk/printk.c:2473 vprintk_emit+0x2a0/0x700 kernel/printk/printk.c:1996 vprintk_default+0x28/0x30 kernel/printk/printk.c:2023 vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386 printk+0xba/0xed kernel/printk/printk.c:2056 register_console+0x745/0xb50 kernel/printk/printk.c:2798 univ8250_console_init+0x3e/0x4b drivers/tty/serial/8250/8250_core.c:682 console_init+0x461/0x67b kernel/printk/printk.c:2884 start_kernel+0x653/0x8e2 init/main.c:713 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490 x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:471 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242 -> #0 (console_owner){-.-.}: check_prev_add kernel/locking/lockdep.c:2475 [inline] check_prevs_add kernel/locking/lockdep.c:2580 [inline] validate_chain kernel/locking/lockdep.c:2970 [inline] __lock_acquire+0x2596/0x4a00 kernel/locking/lockdep.c:3954 lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4484 console_trylock_spinning kernel/printk/printk.c:1745 [inline] vprintk_emit+0x43a/0x700 kernel/printk/printk.c:1995 vprintk_default+0x28/0x30 kernel/printk/printk.c:2023 vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386 printk+0xba/0xed kernel/printk/printk.c:2056 fail_dump lib/fault-inject.c:45 [inline] should_fail+0x708/0x852 lib/fault-inject.c:144 __should_failslab+0x121/0x190 mm/failslab.c:33 should_failslab+0x9/0x14 mm/slab_common.c:1811 slab_pre_alloc_hook mm/slab.h:567 [inline] slab_alloc mm/slab.c:3306 [inline] __do_kmalloc mm/slab.c:3654 [inline] __kmalloc+0x71/0x770 mm/slab.c:3665 kmalloc include/linux/slab.h:561 [inline] tty_buffer_alloc drivers/tty/tty_buffer.c:175 [inline] __tty_buffer_request_room+0x1fb/0x5c0 drivers/tty/tty_buffer.c:273 tty_insert_flip_string_fixed_flag+0x93/0x1f0 drivers/tty/tty_buffer.c:318 tty_insert_flip_string include/linux/tty_flip.h:37 [inline] pty_write+0x133/0x200 drivers/tty/pty.c:122 n_tty_write+0xb1d/0x1080 drivers/tty/n_tty.c:2356 do_tty_write drivers/tty/tty_io.c:962 [inline] tty_write+0x496/0x7f0 drivers/tty/tty_io.c:1046 do_loop_readv_writev fs/read_write.c:717 [inline] do_loop_readv_writev fs/read_write.c:701 [inline] do_iter_write fs/read_write.c:972 [inline] do_iter_write+0x4a0/0x610 fs/read_write.c:951 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1015 do_writev+0x15b/0x330 fs/read_write.c:1058 __do_sys_writev fs/read_write.c:1131 [inline] __se_sys_writev fs/read_write.c:1128 [inline] __x64_sys_writev+0x75/0xb0 fs/read_write.c:1128 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Chain exists of: console_owner --> &port_lock_key --> &(&port->lock)->rlock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&(&port->lock)->rlock); lock(&port_lock_key); lock(&(&port->lock)->rlock); lock(console_owner); *** DEADLOCK *** 5 locks held by syz-executor465/10262: #0: ffff88809dca8090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340 #1: ffff88809dca8118 (&tty->atomic_write_lock){+.+.}, at: tty_write_lock+0x23/0x90 drivers/tty/tty_io.c:888 #2: ffff88809dca82a0 (&tty->termios_rwsem){++++}, at: n_tty_write+0x1b5/0x1080 drivers/tty/n_tty.c:2316 #3: ffffc90007a67360 (&ldata->output_lock){+.+.}, at: n_tty_write+0xadd/0x1080 drivers/tty/n_tty.c:2355 #4: ffff88808d6b7940 (&(&port->lock)->rlock){-.-.}, at: pty_write+0xff/0x200 drivers/tty/pty.c:120 stack backtrace: CPU: 0 PID: 10262 Comm: syz-executor465 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_circular_bug.isra.0.cold+0x163/0x172 kernel/locking/lockdep.c:1684 check_noncircular+0x32e/0x3e0 kernel/locking/lockdep.c:1808 check_prev_add kernel/locking/lockdep.c:2475 [inline] check_prevs_add kernel/locking/lockdep.c:2580 [inline] validate_chain kernel/locking/lockdep.c:2970 [inline] __lock_acquire+0x2596/0x4a00 kernel/locking/lockdep.c:3954 lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4484 console_trylock_spinning kernel/printk/printk.c:1745 [inline] vprintk_emit+0x43a/0x700 kernel/printk/printk.c:1995 vprintk_default+0x28/0x30 kernel/printk/printk.c:2023 vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386 printk+0xba/0xed kernel/printk/printk.c:2056 fail_dump lib/fault-inject.c:45 [inline] should_fail+0x708/0x852 lib/fault-inject.c:144 __should_failslab+0x121/0x190 mm/failslab.c:33 should_failslab+0x9/0x14 mm/slab_common.c:1811 slab_pre_alloc_hook mm/slab.h:567 [inline] slab_alloc mm/slab.c:3306 [inline] __do_kmalloc mm/slab.c:3654 [inline] __kmalloc+0x71/0x770 mm/slab.c:3665 kmalloc include/linux/slab.h:561 [inline] tty_buffer_alloc drivers/tty/tty_buffer.c:175 [inline] __tty_buffer_request_room+0x1fb/0x5c0 drivers/tty/tty_buffer.c:273 tty_insert_flip_string_fixed_flag+0x93/0x1f0 drivers/tty/tty_buffer.c:318 tty_insert_flip_string include/linux/tty_flip.h:37 [inline] pty_write+0x133/0x200 drivers/tty/pty.c:122 n_tty_write+0xb1d/0x1080 drivers/tty/n_tty.c:2356 do_tty_write drivers/tty/tty_io.c:962 [inline] tty_write+0x496/0x7f0 drivers/tty/tty_io.c:1046 do_loop_readv_writev fs/read_write.c:717 [inline] do_loop_readv_writev fs/read_write.c:701 [inline] do_iter_write fs/read_write.c:972 [inline] do_iter_write+0x4a0/0x610 fs/read_write.c:951 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1015 do_writev+0x15b/0x330 fs/read_write.c:1058 __do_sys_writev fs/read_write.c:1131 [inline] __se_sys_writev fs/read_write.c:1128 [inline] __x64_sys_writev+0x75/0xb0 fs/read_write.c:1128 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4437c9 Code: e8 0c e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 6b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffe144fe178 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004437c9 RDX: 1000000000000252 RSI: 00000000200023c0 RDI: 0000000000000005 RBP: 00000000000385a4 R08: 0000000000000001 R09: 0000000000400033 R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N February 2020