]>
Commit | Line | Data |
---|---|---|
cc95841f GKH |
1 | From foo@baz Wed 19 Jun 2019 02:34:37 PM CEST |
2 | From: Eric Dumazet <edumazet@google.com> | |
3 | Date: Sat, 15 Jun 2019 16:40:52 -0700 | |
4 | Subject: ax25: fix inconsistent lock state in ax25_destroy_timer | |
5 | ||
6 | From: Eric Dumazet <edumazet@google.com> | |
7 | ||
8 | [ Upstream commit d4d5d8e83c9616aeef28a2869cea49cc3fb35526 ] | |
9 | ||
10 | Before thread in process context uses bh_lock_sock() | |
11 | we must disable bh. | |
12 | ||
13 | sysbot reported : | |
14 | ||
15 | WARNING: inconsistent lock state | |
16 | 5.2.0-rc3+ #32 Not tainted | |
17 | ||
18 | inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. | |
19 | blkid/26581 [HC0[0]:SC1[1]:HE1:SE0] takes: | |
20 | 00000000e0da85ee (slock-AF_AX25){+.?.}, at: spin_lock include/linux/spinlock.h:338 [inline] | |
21 | 00000000e0da85ee (slock-AF_AX25){+.?.}, at: ax25_destroy_timer+0x53/0xc0 net/ax25/af_ax25.c:275 | |
22 | {SOFTIRQ-ON-W} state was registered at: | |
23 | lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4303 | |
24 | __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] | |
25 | _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151 | |
26 | spin_lock include/linux/spinlock.h:338 [inline] | |
27 | ax25_rt_autobind+0x3ca/0x720 net/ax25/ax25_route.c:429 | |
28 | ax25_connect.cold+0x30/0xa4 net/ax25/af_ax25.c:1221 | |
29 | __sys_connect+0x264/0x330 net/socket.c:1834 | |
30 | __do_sys_connect net/socket.c:1845 [inline] | |
31 | __se_sys_connect net/socket.c:1842 [inline] | |
32 | __x64_sys_connect+0x73/0xb0 net/socket.c:1842 | |
33 | do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 | |
34 | entry_SYSCALL_64_after_hwframe+0x49/0xbe | |
35 | irq event stamp: 2272 | |
36 | hardirqs last enabled at (2272): [<ffffffff810065f3>] trace_hardirqs_on_thunk+0x1a/0x1c | |
37 | hardirqs last disabled at (2271): [<ffffffff8100660f>] trace_hardirqs_off_thunk+0x1a/0x1c | |
38 | softirqs last enabled at (1522): [<ffffffff87400654>] __do_softirq+0x654/0x94c kernel/softirq.c:320 | |
39 | softirqs last disabled at (2267): [<ffffffff81449010>] invoke_softirq kernel/softirq.c:374 [inline] | |
40 | softirqs last disabled at (2267): [<ffffffff81449010>] irq_exit+0x180/0x1d0 kernel/softirq.c:414 | |
41 | ||
42 | other info that might help us debug this: | |
43 | Possible unsafe locking scenario: | |
44 | ||
45 | CPU0 | |
46 | ---- | |
47 | lock(slock-AF_AX25); | |
48 | <Interrupt> | |
49 | lock(slock-AF_AX25); | |
50 | ||
51 | *** DEADLOCK *** | |
52 | ||
53 | 1 lock held by blkid/26581: | |
54 | #0: 0000000010fd154d ((&ax25->dtimer)){+.-.}, at: lockdep_copy_map include/linux/lockdep.h:175 [inline] | |
55 | #0: 0000000010fd154d ((&ax25->dtimer)){+.-.}, at: call_timer_fn+0xe0/0x720 kernel/time/timer.c:1312 | |
56 | ||
57 | stack backtrace: | |
58 | CPU: 1 PID: 26581 Comm: blkid Not tainted 5.2.0-rc3+ #32 | |
59 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 | |
60 | Call Trace: | |
61 | <IRQ> | |
62 | __dump_stack lib/dump_stack.c:77 [inline] | |
63 | dump_stack+0x172/0x1f0 lib/dump_stack.c:113 | |
64 | print_usage_bug.cold+0x393/0x4a2 kernel/locking/lockdep.c:2935 | |
65 | valid_state kernel/locking/lockdep.c:2948 [inline] | |
66 | mark_lock_irq kernel/locking/lockdep.c:3138 [inline] | |
67 | mark_lock+0xd46/0x1370 kernel/locking/lockdep.c:3513 | |
68 | mark_irqflags kernel/locking/lockdep.c:3391 [inline] | |
69 | __lock_acquire+0x159f/0x5490 kernel/locking/lockdep.c:3745 | |
70 | lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4303 | |
71 | __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] | |
72 | _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151 | |
73 | spin_lock include/linux/spinlock.h:338 [inline] | |
74 | ax25_destroy_timer+0x53/0xc0 net/ax25/af_ax25.c:275 | |
75 | call_timer_fn+0x193/0x720 kernel/time/timer.c:1322 | |
76 | expire_timers kernel/time/timer.c:1366 [inline] | |
77 | __run_timers kernel/time/timer.c:1685 [inline] | |
78 | __run_timers kernel/time/timer.c:1653 [inline] | |
79 | run_timer_softirq+0x66f/0x1740 kernel/time/timer.c:1698 | |
80 | __do_softirq+0x25c/0x94c kernel/softirq.c:293 | |
81 | invoke_softirq kernel/softirq.c:374 [inline] | |
82 | irq_exit+0x180/0x1d0 kernel/softirq.c:414 | |
83 | exiting_irq arch/x86/include/asm/apic.h:536 [inline] | |
84 | smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1068 | |
85 | apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806 | |
86 | </IRQ> | |
87 | RIP: 0033:0x7f858d5c3232 | |
88 | Code: 8b 61 08 48 8b 84 24 d8 00 00 00 4c 89 44 24 28 48 8b ac 24 d0 00 00 00 4c 8b b4 24 e8 00 00 00 48 89 7c 24 68 48 89 4c 24 78 <48> 89 44 24 58 8b 84 24 e0 00 00 00 89 84 24 84 00 00 00 8b 84 24 | |
89 | RSP: 002b:00007ffcaf0cf5c0 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 | |
90 | RAX: 00007f858d7d27a8 RBX: 00007f858d7d8820 RCX: 00007f858d3940d8 | |
91 | RDX: 00007ffcaf0cf798 RSI: 00000000f5e616f3 RDI: 00007f858d394fee | |
92 | RBP: 0000000000000000 R08: 00007ffcaf0cf780 R09: 00007f858d7db480 | |
93 | R10: 0000000000000000 R11: 0000000009691a75 R12: 0000000000000005 | |
94 | R13: 00000000f5e616f3 R14: 0000000000000000 R15: 00007ffcaf0cf798 | |
95 | ||
96 | Signed-off-by: Eric Dumazet <edumazet@google.com> | |
97 | Reported-by: syzbot <syzkaller@googlegroups.com> | |
98 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
99 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
100 | --- | |
101 | net/ax25/ax25_route.c | 2 ++ | |
102 | 1 file changed, 2 insertions(+) | |
103 | ||
104 | --- a/net/ax25/ax25_route.c | |
105 | +++ b/net/ax25/ax25_route.c | |
106 | @@ -429,9 +429,11 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25 | |
107 | } | |
108 | ||
109 | if (ax25->sk != NULL) { | |
110 | + local_bh_disable(); | |
111 | bh_lock_sock(ax25->sk); | |
112 | sock_reset_flag(ax25->sk, SOCK_ZAPPED); | |
113 | bh_unlock_sock(ax25->sk); | |
114 | + local_bh_enable(); | |
115 | } | |
116 | ||
117 | put: |