All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Hillf Danton <hdanton@sina.com>
Cc: syzbot <syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com>,
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task
Date: Mon, 27 Jun 2022 14:24:41 +0300	[thread overview]
Message-ID: <20220627112441.GV16517@kadam> (raw)
In-Reply-To: <20220627105336.990-1-hdanton@sina.com>

On Mon, Jun 27, 2022 at 06:53:36PM +0800, Hillf Danton wrote:
> On Sun, 26 Jun 2022 14:33:28 -0700
> > syzbot found the following issue on:
> > 
> > HEAD commit:    105f3fd2f789 Merge branch 'staging-octeon' of gitolite.ker..
> > git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> > console output: https://syzkaller.appspot.com/x/log.txt?x=129a824bf00000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=a352a56bc8822d0c
> > dashboard link: https://syzkaller.appspot.com/bug?extid=ce3408364c4a234dd90c
> > compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10a97af8080000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1031ec4bf00000
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com
> > 
> > ------------[ cut here ]------------
> > DEBUG_LOCKS_WARN_ON(1)
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:231 [inline]
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 hlock_class kernel/locking/lockdep.c:220 [inline]
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 check_wait_context kernel/locking/lockdep.c:4727 [inline]
> > WARNING: CPU: 1 PID: 21 at kernel/locking/lockdep.c:231 __lock_acquire+0x1356/0x5660 kernel/locking/lockdep.c:5003
> > Modules linked in:
> > CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 5.19.0-rc3-syzkaller-00071-g105f3fd2f789 #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > Workqueue: events hfa384x_usbctlx_completion_task
> > RIP: 0010:hlock_class kernel/locking/lockdep.c:231 [inline]
> > RIP: 0010:hlock_class kernel/locking/lockdep.c:220 [inline]
> > RIP: 0010:check_wait_context kernel/locking/lockdep.c:4727 [inline]
> > RIP: 0010:__lock_acquire+0x1356/0x5660 kernel/locking/lockdep.c:5003
> > Code: 08 84 d2 0f 85 0e 30 00 00 8b 35 7d ec b3 07 85 f6 0f 85 f4 fd ff ff 48 c7 c6 e0 97 47 86 48 c7 c7 20 92 47 86 e8 9a 5b 96 04 <0f> 0b 31 ed e9 aa f0 ff ff e8 fc f1 e8 00 85 c0 0f 84 12 fe ff ff
> > RSP: 0018:ffffc9000016fa28 EFLAGS: 00010082
> > RAX: 0000000000000000 RBX: ffff888109450be0 RCX: 0000000000000000
> > RDX: ffff888100371c80 RSI: ffffffff812c1d98 RDI: fffff5200002df37
> > RBP: 0000000000000edc R08: 0000000000000005 R09: 0000000000000000
> > R10: 0000000080000001 R11: 0000000000000001 R12: ffff8881003726c8
> > R13: ffff888100371c80 R14: 0000000000040000 R15: 00000000000c0edc
> > FS:  0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 000055fb59fac7c0 CR3: 0000000109e53000 CR4: 00000000003506e0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> >  <TASK>
> >  lock_acquire kernel/locking/lockdep.c:5665 [inline]
> >  lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
> >  __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> >  _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
> >  hfa384x_usbctlx_completion_task+0x35/0x510 drivers/staging/wlan-ng/hfa384x_usb.c:2641
> >  process_one_work+0x996/0x1610 kernel/workqueue.c:2289
> >  worker_thread+0x665/0x1080 kernel/workqueue.c:2436
> >  kthread+0x2ef/0x3a0 kernel/kthread.c:376
> >  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
> >  </TASK>
> > 
> > 
> > ---
> > This report is generated by a bot. It may contain errors.
> > See https://goo.gl/tpsmEJ for more information about syzbot.
> > syzbot engineers can be reached at syzkaller@googlegroups.com.
> > 
> > syzbot will keep track of this issue. See:
> > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> > syzbot can test patches for this issue, for details see:
> > https://goo.gl/tpsmEJ#testing-patches
> 
> See if it is due to a typo.
> 
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git  105f3fd2f789
> 
> --- y/drivers/staging/wlan-ng/hfa384x_usb.c
> +++ h/drivers/staging/wlan-ng/hfa384x_usb.c
> @@ -2632,7 +2632,7 @@ static void hfa384x_usbctlx_reaper_task(
>   */
>  static void hfa384x_usbctlx_completion_task(struct work_struct *work)
>  {
> -	struct hfa384x *hw = container_of(work, struct hfa384x, reaper_bh);
> +	struct hfa384x *hw = container_of(work, struct hfa384x, completion_bh);

Looks good.  This could easily be detected with static analysis.  I will
add it to my todo list.

regards,
dan carpenter


  parent reply	other threads:[~2022-06-27 11:26 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-26 21:33 [syzbot] WARNING: locking bug in hfa384x_usbctlx_completion_task syzbot
     [not found] ` <20220627105336.990-1-hdanton@sina.com>
2022-06-27 11:12   ` syzbot
2022-06-27 11:24   ` Dan Carpenter [this message]
2022-06-27 17:08 ` Davidlohr Bueso
2022-06-29  9:06   ` Greg KH
2022-06-29 16:52 ` [PATCH] staging/wlan-ng: get the correct struct hfa384x in work callback Davidlohr Bueso

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220627112441.GV16517@kadam \
    --to=dan.carpenter@oracle.com \
    --cc=hdanton@sina.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.