All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+2f44671e54488d20f0e6@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
	 syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [kernfs?] [usb?] WARNING in kernfs_get (5)
Date: Tue, 14 May 2024 18:09:02 -0700	[thread overview]
Message-ID: <0000000000009a35fa061873c3e8@google.com> (raw)
In-Reply-To: <20240514232319.3252-1-hdanton@sina.com>

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in firmware_uevent

============================================
WARNING: possible recursive locking detected
6.9.0-next-20240514-syzkaller-dirty #0 Not tainted
--------------------------------------------
kworker/0:2/930 is trying to acquire lock:
ffffffff8ec74268 (fw_lock){+.+.}-{3:3}, at: firmware_uevent+0x2f/0x1a0 drivers/base/firmware_loader/sysfs.c:84

but task is already holding lock:
ffffffff8ec74268 (fw_lock){+.+.}-{3:3}, at: fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:123 [inline]
ffffffff8ec74268 (fw_lock){+.+.}-{3:3}, at: fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:164 [inline]
ffffffff8ec74268 (fw_lock){+.+.}-{3:3}, at: firmware_fallback_sysfs+0x755/0x9d0 drivers/base/firmware_loader/fallback.c:240

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(fw_lock);
  lock(fw_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

4 locks held by kworker/0:2/930:
 #0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
 #0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
 #1: ffffc9000441fd00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #1: ffffc9000441fd00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
 #2: ffffffff8e1dd630 (umhelper_sem){++++}-{3:3}, at: usermodehelper_read_lock_wait+0x14e/0x260 kernel/umh.c:247
 #3: ffffffff8ec74268 (fw_lock){+.+.}-{3:3}, at: fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:123 [inline]
 #3: ffffffff8ec74268 (fw_lock){+.+.}-{3:3}, at: fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:164 [inline]
 #3: ffffffff8ec74268 (fw_lock){+.+.}-{3:3}, at: firmware_fallback_sysfs+0x755/0x9d0 drivers/base/firmware_loader/fallback.c:240

stack backtrace:
CPU: 0 PID: 930 Comm: kworker/0:2 Not tainted 6.9.0-next-20240514-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 check_deadlock kernel/locking/lockdep.c:3062 [inline]
 validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856
 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
 firmware_uevent+0x2f/0x1a0 drivers/base/firmware_loader/sysfs.c:84
 dev_uevent+0x4e4/0x900 drivers/base/core.c:2687
 kobject_uevent_env+0x467/0x8e0 lib/kobject_uevent.c:558
 device_del+0x7db/0x9b0 drivers/base/core.c:3928
 fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:125 [inline]
 fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:164 [inline]
 firmware_fallback_sysfs+0x3a8/0x9d0 drivers/base/firmware_loader/fallback.c:240
 _request_firmware+0xcf5/0x12b0 drivers/base/firmware_loader/main.c:914
 request_firmware_work_func+0x12a/0x280 drivers/base/firmware_loader/main.c:1165
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


Tested on:

commit:         26dd54d0 Add linux-next specific files for 20240514
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=157a1c84980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c8af44e051929224
dashboard link: https://syzkaller.appspot.com/bug?extid=2f44671e54488d20f0e6
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10776c68980000


  reply	other threads:[~2024-05-15  1:09 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-05-08 11:07 [syzbot] [kernfs?] WARNING in kernfs_get (5) syzbot
2024-05-14 15:44 ` [syzbot] [kernfs?] [usb?] " syzbot
2024-05-14 23:23   ` Hillf Danton
2024-05-15  1:09     ` syzbot [this message]
2024-05-15 10:33   ` Hillf Danton
2024-05-15 18:09     ` syzbot
2024-05-16 14:27   ` Hillf Danton
2024-05-16 14:52     ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0000000000009a35fa061873c3e8@google.com \
    --to=syzbot+2f44671e54488d20f0e6@syzkaller.appspotmail.com \
    --cc=hdanton@sina.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.