queue-4.19/ax25-fix-inconsistent-lock-state-in-ax25_destroy_timer.patch

   1 From foo@baz Wed 19 Jun 2019 02:34:37 PM CEST
   2 From: Eric Dumazet <edumazet@google.com>
   3 Date: Sat, 15 Jun 2019 16:40:52 -0700
   4 Subject: ax25: fix inconsistent lock state in ax25_destroy_timer
   5
   6 From: Eric Dumazet <edumazet@google.com>
   7
   8 [ Upstream commit d4d5d8e83c9616aeef28a2869cea49cc3fb35526 ]
   9
  10 Before thread in process context uses bh_lock_sock()
  11 we must disable bh.
  12
  13 sysbot reported :
  14
  15 WARNING: inconsistent lock state
  16 5.2.0-rc3+ #32 Not tainted
  17
  18 inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
  19 blkid/26581 [HC0[0]:SC1[1]:HE1:SE0] takes:
  20 00000000e0da85ee (slock-AF_AX25){+.?.}, at: spin_lock include/linux/spinlock.h:338 [inline]
  21 00000000e0da85ee (slock-AF_AX25){+.?.}, at: ax25_destroy_timer+0x53/0xc0 net/ax25/af_ax25.c:275
  22 {SOFTIRQ-ON-W} state was registered at:
  23   lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4303
  24   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  25   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
  26   spin_lock include/linux/spinlock.h:338 [inline]
  27   ax25_rt_autobind+0x3ca/0x720 net/ax25/ax25_route.c:429
  28   ax25_connect.cold+0x30/0xa4 net/ax25/af_ax25.c:1221
  29   __sys_connect+0x264/0x330 net/socket.c:1834
  30   __do_sys_connect net/socket.c:1845 [inline]
  31   __se_sys_connect net/socket.c:1842 [inline]
  32   __x64_sys_connect+0x73/0xb0 net/socket.c:1842
  33   do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
  34   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  35 irq event stamp: 2272
  36 hardirqs last  enabled at (2272): [<ffffffff810065f3>] trace_hardirqs_on_thunk+0x1a/0x1c
  37 hardirqs last disabled at (2271): [<ffffffff8100660f>] trace_hardirqs_off_thunk+0x1a/0x1c
  38 softirqs last  enabled at (1522): [<ffffffff87400654>] __do_softirq+0x654/0x94c kernel/softirq.c:320
  39 softirqs last disabled at (2267): [<ffffffff81449010>] invoke_softirq kernel/softirq.c:374 [inline]
  40 softirqs last disabled at (2267): [<ffffffff81449010>] irq_exit+0x180/0x1d0 kernel/softirq.c:414
  41
  42 other info that might help us debug this:
  43  Possible unsafe locking scenario:
  44
  45        CPU0
  46        ----
  47   lock(slock-AF_AX25);
  48   <Interrupt>
  49     lock(slock-AF_AX25);
  50
  51  *** DEADLOCK ***
  52
  53 1 lock held by blkid/26581:
  54  #0: 0000000010fd154d ((&ax25->dtimer)){+.-.}, at: lockdep_copy_map include/linux/lockdep.h:175 [inline]
  55  #0: 0000000010fd154d ((&ax25->dtimer)){+.-.}, at: call_timer_fn+0xe0/0x720 kernel/time/timer.c:1312
  56
  57 stack backtrace:
  58 CPU: 1 PID: 26581 Comm: blkid Not tainted 5.2.0-rc3+ #32
  59 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  60 Call Trace:
  61  <IRQ>
  62  __dump_stack lib/dump_stack.c:77 [inline]
  63  dump_stack+0x172/0x1f0 lib/dump_stack.c:113
  64  print_usage_bug.cold+0x393/0x4a2 kernel/locking/lockdep.c:2935
  65  valid_state kernel/locking/lockdep.c:2948 [inline]
  66  mark_lock_irq kernel/locking/lockdep.c:3138 [inline]
  67  mark_lock+0xd46/0x1370 kernel/locking/lockdep.c:3513
  68  mark_irqflags kernel/locking/lockdep.c:3391 [inline]
  69  __lock_acquire+0x159f/0x5490 kernel/locking/lockdep.c:3745
  70  lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4303
  71  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  72  _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
  73  spin_lock include/linux/spinlock.h:338 [inline]
  74  ax25_destroy_timer+0x53/0xc0 net/ax25/af_ax25.c:275
  75  call_timer_fn+0x193/0x720 kernel/time/timer.c:1322
  76  expire_timers kernel/time/timer.c:1366 [inline]
  77  __run_timers kernel/time/timer.c:1685 [inline]
  78  __run_timers kernel/time/timer.c:1653 [inline]
  79  run_timer_softirq+0x66f/0x1740 kernel/time/timer.c:1698
  80  __do_softirq+0x25c/0x94c kernel/softirq.c:293
  81  invoke_softirq kernel/softirq.c:374 [inline]
  82  irq_exit+0x180/0x1d0 kernel/softirq.c:414
  83  exiting_irq arch/x86/include/asm/apic.h:536 [inline]
  84  smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1068
  85  apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806
  86  </IRQ>
  87 RIP: 0033:0x7f858d5c3232
  88 Code: 8b 61 08 48 8b 84 24 d8 00 00 00 4c 89 44 24 28 48 8b ac 24 d0 00 00 00 4c 8b b4 24 e8 00 00 00 48 89 7c 24 68 48 89 4c 24 78 <48> 89 44 24 58 8b 84 24 e0 00 00 00 89 84 24 84 00 00 00 8b 84 24
  89 RSP: 002b:00007ffcaf0cf5c0 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
  90 RAX: 00007f858d7d27a8 RBX: 00007f858d7d8820 RCX: 00007f858d3940d8
  91 RDX: 00007ffcaf0cf798 RSI: 00000000f5e616f3 RDI: 00007f858d394fee
  92 RBP: 0000000000000000 R08: 00007ffcaf0cf780 R09: 00007f858d7db480
  93 R10: 0000000000000000 R11: 0000000009691a75 R12: 0000000000000005
  94 R13: 00000000f5e616f3 R14: 0000000000000000 R15: 00007ffcaf0cf798
  95
  96 Signed-off-by: Eric Dumazet <edumazet@google.com>
  97 Reported-by: syzbot <syzkaller@googlegroups.com>
  98 Signed-off-by: David S. Miller <davem@davemloft.net>
  99 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 100 ---
 101  net/ax25/ax25_route.c |    2 ++
 102  1 file changed, 2 insertions(+)
 103
 104 --- a/net/ax25/ax25_route.c
 105 +++ b/net/ax25/ax25_route.c
 106 @@ -429,9 +429,11 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25
 107         }
 108
 109         if (ax25->sk != NULL) {
 110 +               local_bh_disable();
 111                 bh_lock_sock(ax25->sk);
 112                 sock_reset_flag(ax25->sk, SOCK_ZAPPED);
 113                 bh_unlock_sock(ax25->sk);
 114 +               local_bh_enable();
 115         }
 116
 117  put: