On 1/4/22 11:49, kvartet wrote:
> Hello,
> 
> When using Syzkaller to fuzz the latest Linux kernel, the following
> crash was triggered.
> 
> HEAD commit: a7904a538933 Linux 5.16-rc6
> git tree: upstream
> console output: https://paste.ubuntu.com/p/Bfpr8Gxtd4/plain/
> kernel config: https://paste.ubuntu.com/p/FDDNHDxtwz/plain/
> 
> Sorry, I don't have a reproducer for this crash, hope the symbolized
> report can help.
> If you fix this issue, please add the following tag to the commit:
> Reported-by: Yiru Xu <xyru1999@gmail.com>
> 
> 
> INFO: trying to register non-static key.
> The code is fine but needs lockdep annotation, or maybe
> you didn't initialize this object before use?
> turning off the locking correctness validator.
> CPU: 2 PID: 18524 Comm: syz-executor.5 Not tainted 5.16.0-rc6 #9
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
>   <IRQ>
>   __dump_stack lib/dump_stack.c:88 [inline]
>   dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
>   assign_lock_key kernel/locking/lockdep.c:951 [inline]
>   register_lock_class+0x148d/0x1950 kernel/locking/lockdep.c:1263
>   __lock_acquire+0x106/0x57e0 kernel/locking/lockdep.c:4906
>   lock_acquire kernel/locking/lockdep.c:5637 [inline]
>   lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5602
>   percpu_down_read_trylock include/linux/percpu-rwsem.h:92 [inline]
>   hci_uart_tx_wakeup+0x12e/0x490 drivers/bluetooth/hci_ldisc.c:124
>   h5_timed_event+0x32f/0x6a0 drivers/bluetooth/hci_h5.c:188
>   call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421

hci_uart_proto.open() functions register timer, which may call 
hci_uart_tx_wakeup(), so we need to initalize rwsem before calling
hci_uart_proto.open()

Just for thoughts


With regards,
Pavel Skripkin