【openEuler 22.03】x86的syzkaller环境上发现possible deadlock in console_lock_spinning_enable问题

【环境信息】
软件信息：
1） OS版本及分支：openEuler 22.03
2） 内核信息：5.10.0
3） 发现问题的组件版本信息：syzkaller
【问题复现步骤】
复现程序：

```
r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TIOCVHANGUP(r0, 0x5437, 0x0)
```

出现概率(是否必现，概率性错误)：概率出现
【预期结果】
问题不出现
【实际结果】
发现possible deadlock in console_lock_spinning_enable问题
【附件信息】

WARNING: possible circular locking dependency detected
5.10.0 #2 Not tainted

syz-executor.0/11922 is trying to acquire lock:
ffffffff8badc2a0 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x2d/0x60 kernel/printk/printk.c:1752

but task is already holding lock:
ffffffff8fe3e078 (&port->lock){-.-.}-{2:2}, at: tty_port_close_start+0x58/0x550 drivers/tty/tty_port.c:567

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (&port->lock){-.-.}-{2:2}:
       lock_acquire+0x114/0x5a0 kernel/locking/lockdep.c:5442
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x73/0xa0 kernel/locking/spinlock.c:159
       tty_port_tty_get+0x21/0xe0 drivers/tty/tty_port.c:288
       tty_port_default_wakeup+0x11/0x40 drivers/tty/tty_port.c:47
       serial8250_tx_chars+0x5ea/0x800 drivers/tty/serial/8250/8250_port.c:1832
       serial8250_handle_irq+0x2fd/0x3e0 drivers/tty/serial/8250/8250_port.c:1919
       serial8250_default_handle_irq+0xaf/0x190 drivers/tty/serial/8250/8250_port.c:1935
       serial8250_interrupt+0xa3/0x1e0 drivers/tty/serial/8250/8250_core.c:126
       __handle_irq_event_percpu+0x1b7/0x620 kernel/irq/handle.c:156
       handle_irq_event_percpu kernel/irq/handle.c:196 [inline]
       handle_irq_event+0xbd/0x280 kernel/irq/handle.c:213
       handle_edge_irq+0x245/0xbe0 kernel/irq/chip.c:819
       asm_call_irq_on_stack+0xf/0x20
       __run_irq_on_irqstack arch/x86/include/asm/irq_stack.h:48 [inline]
       run_irq_on_irqstack_cond arch/x86/include/asm/irq_stack.h:101 [inline]
       handle_irq arch/x86/kernel/irq.c:230 [inline]
       __common_interrupt arch/x86/kernel/irq.c:249 [inline]
       common_interrupt+0x147/0x230 arch/x86/kernel/irq.c:239
       asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:623
       native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
       arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
       default_idle+0xe/0x10 arch/x86/kernel/process.c:688
       default_idle_call+0x89/0xd0 kernel/sched/idle.c:112
       cpuidle_idle_call kernel/sched/idle.c:194 [inline]
       do_idle+0x1bb/0x530 kernel/sched/idle.c:299
       cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:395
       secondary_startup_64_no_verify+0xb0/0xbb

-> #1 (&port_lock_key){-.-.}-{2:2}:
       lock_acquire+0x114/0x5a0 kernel/locking/lockdep.c:5442
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x73/0xa0 kernel/locking/spinlock.c:159
       serial8250_console_write+0x108/0xcc0 drivers/tty/serial/8250/8250_port.c:3292
       call_console_drivers kernel/printk/printk.c:1899 [inline]
       console_unlock+0x960/0xcf0 kernel/printk/printk.c:2517
       vprintk_emit+0x176/0x210 kernel/printk/printk.c:2046
       printk+0x62/0x83 kernel/printk/printk.c:2094
       register_console+0x772/0xa50 kernel/printk/printk.c:2868
       univ8250_console_init+0x41/0x43 drivers/tty/serial/8250/8250_core.c:690
       console_init+0x5d/0xa8 kernel/printk/printk.c:2968
       start_kernel+0x2fc/0x539 init/main.c:990
       secondary_startup_64_no_verify+0xb0/0xbb

-> #0 (console_owner){-.-.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:2868 [inline]
       check_prevs_add+0x351/0x51f0 kernel/locking/lockdep.c:2993
       validate_chain kernel/locking/lockdep.c:3608 [inline]
       __lock_acquire+0x425f/0x5ed0 kernel/locking/lockdep.c:4832
       lock_acquire+0x114/0x5a0 kernel/locking/lockdep.c:5442
       console_lock_spinning_enable+0x52/0x60 kernel/printk/printk.c:1755
       console_unlock+0x69e/0xcf0 kernel/printk/printk.c:2514
       vprintk_emit+0x176/0x210 kernel/printk/printk.c:2046
       printk+0x62/0x83 kernel/printk/printk.c:2094
       tty_port_close_start+0x3c8/0x550 drivers/tty/tty_port.c:569
       tty_port_close+0x26/0x140 drivers/tty/tty_port.c:634
       tty_release+0x30c/0xef0 drivers/tty/tty_io.c:1692
       __fput+0x34c/0x7a0 fs/file_table.c:281
       task_work_run+0x137/0x1c0 kernel/task_work.c:151
       tracehook_notify_resume include/linux/tracehook.h:188 [inline]
       exit_to_user_mode_loop kernel/entry/common.c:164 [inline]
       exit_to_user_mode_prepare+0xe4/0x170 kernel/entry/common.c:191
       syscall_exit_to_user_mode+0x4a/0x170 kernel/entry/common.c:266
       entry_SYSCALL_64_after_hwframe+0x44/0xa9

other info that might help us debug this:

Chain exists of:
  console_owner --> &port_lock_key --> &port->lock

Possible unsafe locking scenario:

CPU0                    CPU1
       ----                    ----
  lock(&port->lock);
                               lock(&port_lock_key);
                               lock(&port->lock);
  lock(console_owner);

*** DEADLOCK ***

3 locks held by syz-executor.0/11922:
 #0: ffff8881358321c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_release+0xac/0xef0 drivers/tty/tty_io.c:1674
 #1: ffffffff8fe3e078 (&port->lock){-.-.}-{2:2}, at: tty_port_close_start+0x58/0x550 drivers/tty/tty_port.c:567
 #2: ffffffff8b9c3fe0 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x15d/0x210 kernel/printk/printk.c:2045

stack backtrace:
CPU: 3 PID: 11922 Comm: syz-executor.0 Not tainted 5.10.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x137/0x1be lib/dump_stack.c:118
 print_circular_bug+0xadb/0xd80 kernel/locking/lockdep.c:1996
 check_noncircular+0x21f/0x2d0 kernel/locking/lockdep.c:2117
 check_prev_add kernel/locking/lockdep.c:2868 [inline]
 check_prevs_add+0x351/0x51f0 kernel/locking/lockdep.c:2993
 validate_chain kernel/locking/lockdep.c:3608 [inline]
 __lock_acquire+0x425f/0x5ed0 kernel/locking/lockdep.c:4832
 lock_acquire+0x114/0x5a0 kernel/locking/lockdep.c:5442
 console_lock_spinning_enable+0x52/0x60 kernel/printk/printk.c:1755
 console_unlock+0x69e/0xcf0 kernel/printk/printk.c:2514
 vprintk_emit+0x176/0x210 kernel/printk/printk.c:2046
 printk+0x62/0x83 kernel/printk/printk.c:2094
 tty_port_close_start+0x3c8/0x550 drivers/tty/tty_port.c:569
 tty_port_close+0x26/0x140 drivers/tty/tty_port.c:634
 tty_release+0x30c/0xef0 drivers/tty/tty_io.c:1692
 __fput+0x34c/0x7a0 fs/file_table.c:281
 task_work_run+0x137/0x1c0 kernel/task_work.c:151
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:164 [inline]
 exit_to_user_mode_prepare+0xe4/0x170 kernel/entry/common.c:191
 syscall_exit_to_user_mode+0x4a/0x170 kernel/entry/common.c:266
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x418331
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 1a 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffec68ecec0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000418331
RDX: 0000000000000000 RSI: ffffffff817b53db RDI: 0000000000000003
RBP: 0000000000000001 R08: 0000001b33420000 R09: 00000000000010d3
R10: 00000000c7c310d7 R11: 0000000000000293 R12: 00000000000003e8
R13: 0000000000202bb8 R14: ffffffffffffffff R15: 000000000119bfac

GVP openEuler/kernel

内容风险标识

评论 (2)

GVPopenEuler/kernel

内容风险标识