* [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task
@ 2022-06-26 21:33 syzbot
[not found] ` <20220627105336.990-1-hdanton@sina.com>
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: syzbot @ 2022-06-26 21:33 UTC (permalink / raw)
To: aldas60, dave, gregkh, keescook, linux-kernel, linux-staging,
linux-usb, nathan, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 105f3fd2f789 Merge branch 'staging-octeon' of gitolite.ker..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=129a824bf00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a352a56bc8822d0c
dashboard link: https://syzkaller.appspot.com/bug?extid=ce3408364c4a234dd90c
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10a97af8080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1031ec4bf00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:231 [inline]
WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:220 [inline]
WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 check_wait_context kernel/locking/lockdep.c:4727 [inline]
WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 __lock_acquire+0x1356/0x5660 kernel/locking/lockdep.c:5003
Modules linked in:
CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 5.19.0-rc3-syzkaller-00071-g105f3fd2f789 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events hfa384x_usbctlx_completion_task
RIP: 0010:hlock_class kernel/locking/lockdep.c:231 [inline]
RIP: 0010:hlock_class kernel/locking/lockdep.c:220 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4727 [inline]
RIP: 0010:__lock_acquire+0x1356/0x5660 kernel/locking/lockdep.c:5003
Code: 08 84 d2 0f 85 0e 30 00 00 8b 35 7d ec b3 07 85 f6 0f 85 f4 fd ff ff 48 c7 c6 e0 97 47 86 48 c7 c7 20 92 47 86 e8 9a 5b 96 04 <0f> 0b 31 ed e9 aa f0 ff ff e8 fc f1 e8 00 85 c0 0f 84 12 fe ff ff
RSP: 0018:ffffc9000016fa28 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff888109450be0 RCX: 0000000000000000
RDX: ffff888100371c80 RSI: ffffffff812c1d98 RDI: fffff5200002df37
RBP: 0000000000000edc R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000001 R11: 0000000000000001 R12: ffff8881003726c8
R13: ffff888100371c80 R14: 0000000000040000 R15: 00000000000c0edc
FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fb59fac7c0 CR3: 0000000109e53000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
hfa384x_usbctlx_completion_task+0x35/0x510 drivers/staging/wlan-ng/hfa384x_usb.c:2641
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2ef/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 6+ messages in thread[parent not found: <20220627105336.990-1-hdanton@sina.com>]
* Re: [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task
[not found] ` <20220627105336.990-1-hdanton@sina.com>
@ 2022-06-27 11:12 ` syzbot
2022-06-27 11:24 ` Dan Carpenter
1 sibling, 0 replies; 6+ messages in thread
From: syzbot @ 2022-06-27 11:12 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com
Tested on:
commit: 105f3fd2 Merge branch 'staging-octeon' of gitolite.ker..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1415cb88080000
kernel config: https://syzkaller.appspot.com/x/.config?x=a352a56bc8822d0c
dashboard link: https://syzkaller.appspot.com/bug?extid=ce3408364c4a234dd90c
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=107b1ad4080000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task
[not found] ` <20220627105336.990-1-hdanton@sina.com>
2022-06-27 11:12 ` syzbot
@ 2022-06-27 11:24 ` Dan Carpenter
1 sibling, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2022-06-27 11:24 UTC (permalink / raw)
To: Hillf Danton; +Cc: syzbot, linux-kernel, syzkaller-bugs
On Mon, Jun 27, 2022 at 06:53:36PM +0800, Hillf Danton wrote:
> On Sun, 26 Jun 2022 14:33:28 -0700
> > syzbot found the following issue on:
> >
> > HEAD commit: 105f3fd2f789 Merge branch 'staging-octeon' of gitolite.ker..
> > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> > console output: https://syzkaller.appspot.com/x/log.txt?x=129a824bf00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=a352a56bc8822d0c
> > dashboard link: https://syzkaller.appspot.com/bug?extid=ce3408364c4a234dd90c
> > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10a97af8080000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1031ec4bf00000
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com
> >
> > ------------[ cut here ]------------
> > DEBUG_LOCKS_WARN_ON(1)
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:231 [inline]
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:220 [inline]
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 check_wait_context kernel/locking/lockdep.c:4727 [inline]
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 __lock_acquire+0x1356/0x5660 kernel/locking/lockdep.c:5003
> > Modules linked in:
> > CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 5.19.0-rc3-syzkaller-00071-g105f3fd2f789 #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > Workqueue: events hfa384x_usbctlx_completion_task
> > RIP: 0010:hlock_class kernel/locking/lockdep.c:231 [inline]
> > RIP: 0010:hlock_class kernel/locking/lockdep.c:220 [inline]
> > RIP: 0010:check_wait_context kernel/locking/lockdep.c:4727 [inline]
> > RIP: 0010:__lock_acquire+0x1356/0x5660 kernel/locking/lockdep.c:5003
> > Code: 08 84 d2 0f 85 0e 30 00 00 8b 35 7d ec b3 07 85 f6 0f 85 f4 fd ff ff 48 c7 c6 e0 97 47 86 48 c7 c7 20 92 47 86 e8 9a 5b 96 04 <0f> 0b 31 ed e9 aa f0 ff ff e8 fc f1 e8 00 85 c0 0f 84 12 fe ff ff
> > RSP: 0018:ffffc9000016fa28 EFLAGS: 00010082
> > RAX: 0000000000000000 RBX: ffff888109450be0 RCX: 0000000000000000
> > RDX: ffff888100371c80 RSI: ffffffff812c1d98 RDI: fffff5200002df37
> > RBP: 0000000000000edc R08: 0000000000000005 R09: 0000000000000000
> > R10: 0000000080000001 R11: 0000000000000001 R12: ffff8881003726c8
> > R13: ffff888100371c80 R14: 0000000000040000 R15: 00000000000c0edc
> > FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 000055fb59fac7c0 CR3: 0000000109e53000 CR4: 00000000003506e0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> > <TASK>
> > lock_acquire kernel/locking/lockdep.c:5665 [inline]
> > lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
> > __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> > _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
> > hfa384x_usbctlx_completion_task+0x35/0x510 drivers/staging/wlan-ng/hfa384x_usb.c:2641
> > process_one_work+0x996/0x1610 kernel/workqueue.c:2289
> > worker_thread+0x665/0x1080 kernel/workqueue.c:2436
> > kthread+0x2ef/0x3a0 kernel/kthread.c:376
> > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
> > </TASK>
> >
> >
> > ---
> > This report is generated by a bot. It may contain errors.
> > See https://goo.gl/tpsmEJ for more information about syzbot.
> > syzbot engineers can be reached at syzkaller@googlegroups.com.
> >
> > syzbot will keep track of this issue. See:
> > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> > syzbot can test patches for this issue, for details see:
> > https://goo.gl/tpsmEJ#testing-patches
>
> See if it is due to a typo.
>
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 105f3fd2f789
>
> --- y/drivers/staging/wlan-ng/hfa384x_usb.c
> +++ h/drivers/staging/wlan-ng/hfa384x_usb.c
> @@ -2632,7 +2632,7 @@ static void hfa384x_usbctlx_reaper_task(
> */
> static void hfa384x_usbctlx_completion_task(struct work_struct *work)
> {
> - struct hfa384x *hw = container_of(work, struct hfa384x, reaper_bh);
> + struct hfa384x *hw = container_of(work, struct hfa384x, completion_bh);
Looks good. This could easily be detected with static analysis. I will
add it to my todo list.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task
2022-06-26 21:33 [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task syzbot
[not found] ` <20220627105336.990-1-hdanton@sina.com>
@ 2022-06-27 17:08 ` Davidlohr Bueso
2022-06-29 9:06 ` Greg KH
2022-06-29 16:52 ` [PATCH] staging/wlan-ng: get the correct struct hfa384x in work callback Davidlohr Bueso
2 siblings, 1 reply; 6+ messages in thread
From: Davidlohr Bueso @ 2022-06-27 17:08 UTC (permalink / raw)
To: syzbot
Cc: aldas60, gregkh, keescook, linux-kernel, linux-staging,
linux-usb, nathan, syzkaller-bugs
It's nice to see this sort of stuff actually tested :)
On Sun, 26 Jun 2022, syzbot wrote:
>------------[ cut here ]------------
>DEBUG_LOCKS_WARN_ON(1)
>WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:231 [inline]
>WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:220 [inline]
>WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 check_wait_context kernel/locking/lockdep.c:4727 [inline]
>WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 __lock_acquire+0x1356/0x5660 kernel/locking/lockdep.c:5003
>Modules linked in:
>CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 5.19.0-rc3-syzkaller-00071-g105f3fd2f789 #0
>Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
>Workqueue: events hfa384x_usbctlx_completion_task
Sorry about that, the below should fix it. Thanks.
---8<-------------------------------
From: Davidlohr Bueso <dave@stgolabs.net>
Subject: [PATCH] staging/wlan-ng: get the correct struct hfa384x in work callback
hfa384x_usbctlx_completion_task() is bogusly using the reaper BH when
in fact this is the completion_bh. This was reflected when trying
to acquire the hw->ctlxq.lock and getting a failed lockdep class
initialized to it.
Reported-by: syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com
Fixes: 9442e81d7e7 (staging/wlan-ng, prism2usb: replace completion_bh tasklet with work)
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
---
drivers/staging/wlan-ng/hfa384x_usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
index 33844526c797..02fdef7a16c8 100644
--- a/drivers/staging/wlan-ng/hfa384x_usb.c
+++ b/drivers/staging/wlan-ng/hfa384x_usb.c
@@ -2632,7 +2632,7 @@ static void hfa384x_usbctlx_reaper_task(struct work_struct *work)
*/
static void hfa384x_usbctlx_completion_task(struct work_struct *work)
{
- struct hfa384x *hw = container_of(work, struct hfa384x, reaper_bh);
+ struct hfa384x *hw = container_of(work, struct hfa384x, completion_bh);
struct hfa384x_usbctlx *ctlx, *temp;
unsigned long flags;
--
2.36.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task
2022-06-27 17:08 ` Davidlohr Bueso
@ 2022-06-29 9:06 ` Greg KH
0 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2022-06-29 9:06 UTC (permalink / raw)
To: Davidlohr Bueso
Cc: syzbot, aldas60, keescook, linux-kernel, linux-staging,
linux-usb, nathan, syzkaller-bugs
On Mon, Jun 27, 2022 at 10:08:38AM -0700, Davidlohr Bueso wrote:
> It's nice to see this sort of stuff actually tested :)
>
> On Sun, 26 Jun 2022, syzbot wrote:
>
> > ------------[ cut here ]------------
> > DEBUG_LOCKS_WARN_ON(1)
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:231 [inline]
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:220 [inline]
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 check_wait_context kernel/locking/lockdep.c:4727 [inline]
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 __lock_acquire+0x1356/0x5660 kernel/locking/lockdep.c:5003
> > Modules linked in:
> > CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 5.19.0-rc3-syzkaller-00071-g105f3fd2f789 #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > Workqueue: events hfa384x_usbctlx_completion_task
>
> Sorry about that, the below should fix it. Thanks.
>
> ---8<-------------------------------
> From: Davidlohr Bueso <dave@stgolabs.net>
> Subject: [PATCH] staging/wlan-ng: get the correct struct hfa384x in work callback
>
> hfa384x_usbctlx_completion_task() is bogusly using the reaper BH when
> in fact this is the completion_bh. This was reflected when trying
> to acquire the hw->ctlxq.lock and getting a failed lockdep class
> initialized to it.
>
> Reported-by: syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com
> Fixes: 9442e81d7e7 (staging/wlan-ng, prism2usb: replace completion_bh tasklet with work)
> Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
> ---
> drivers/staging/wlan-ng/hfa384x_usb.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Can you submit this properly so that I can accept it?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] staging/wlan-ng: get the correct struct hfa384x in work callback
2022-06-26 21:33 [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task syzbot
[not found] ` <20220627105336.990-1-hdanton@sina.com>
2022-06-27 17:08 ` Davidlohr Bueso
@ 2022-06-29 16:52 ` Davidlohr Bueso
2 siblings, 0 replies; 6+ messages in thread
From: Davidlohr Bueso @ 2022-06-29 16:52 UTC (permalink / raw)
To: syzbot+ce3408364c4a234dd90c
Cc: aldas60, gregkh, keescook, linux-kernel, linux-staging,
linux-usb, nathan, syzkaller-bugs, Davidlohr Bueso
hfa384x_usbctlx_completion_task() is bogusly using the reaper BH when
in fact this is the completion_bh. This was reflected when trying
to acquire the hw->ctlxq.lock and getting a failed lockdep class
initialized to it.
Reported-by: syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com
Fixes: 9442e81d7e7 (staging/wlan-ng, prism2usb: replace completion_bh tasklet with work)
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
---
drivers/staging/wlan-ng/hfa384x_usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
index 33844526c797..02fdef7a16c8 100644
--- a/drivers/staging/wlan-ng/hfa384x_usb.c
+++ b/drivers/staging/wlan-ng/hfa384x_usb.c
@@ -2632,7 +2632,7 @@ static void hfa384x_usbctlx_reaper_task(struct work_struct *work)
*/
static void hfa384x_usbctlx_completion_task(struct work_struct *work)
{
- struct hfa384x *hw = container_of(work, struct hfa384x, reaper_bh);
+ struct hfa384x *hw = container_of(work, struct hfa384x, completion_bh);
struct hfa384x_usbctlx *ctlx, *temp;
unsigned long flags;
--
2.36.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-06-29 23:36 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-26 21:33 [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task syzbot
[not found] ` <20220627105336.990-1-hdanton@sina.com>
2022-06-27 11:12 ` syzbot
2022-06-27 11:24 ` Dan Carpenter
2022-06-27 17:08 ` Davidlohr Bueso
2022-06-29 9:06 ` Greg KH
2022-06-29 16:52 ` [PATCH] staging/wlan-ng: get the correct struct hfa384x in work callback Davidlohr Bueso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.