Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1322505
| Path | csiph.com!aioe.org!bofh.it!news.nic.it!robomod |
|---|---|
| From | Dmitry Vyukov <dvyukov@google.com> |
| Newsgroups | linux.kernel |
| Subject | Re: sound: deadlock between snd_pcm_oss_write/snd_pcm_oss_mmap |
| Date | Sat, 30 Jan 2016 21:40:01 +0100 |
| Message-ID | <qWKtj-Mu-5@gated-at.bofh.it> (permalink) |
| References | <qWKjE-IE-5@gated-at.bofh.it> |
| Dkim-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=K1gE5vE4YIYEV9cNCXeOpmuFfePO2SrXFFfuRDJDZ+4=; b=Egdm27QqMHGh+VH9SnJ2AwaxiB2tzx/HYSugVa8yjOUvEztN4sJ0NPRyul/0jF4iJY KeBc7HpCkX7ml9aT7yJYgcQLGv1dP4MTpmQhmakoDUbNF+90FkYtp2b9AA4tYRJScdqp h/BtnDDoMCzn7DLQ6VYsAXjk8pi9XCf7LG7lvr0DXuwZgnX+6M8hBVVLWa3VvgAXHWmt avZMDIun3h+o5f048tLV7TH36k9ASpWlc2KrrTngbNy9p4cl/8hWeYjClPqlns0wNyzn 8d4cnhKkgKD2qnEneUV4qVU8kn55EFiPA4LstjF3UNiJBpcobK7DjxzMdYCiasjvcF6o OXjQ== |
| X-Google-Dkim-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=K1gE5vE4YIYEV9cNCXeOpmuFfePO2SrXFFfuRDJDZ+4=; b=KcjjayE+vCZm1zklSkywOe0E4lUe3KfuM7kAy4DzdeHW5oUj0U2NMzICfs+V3uaJgb wMLT/OoYs7dEKjerCD393qdjh/qT/jNQglYyfz0ziIn/w1AfOyTKzC3+d71m8d6QnPbT QuhuF8NoN67J9vioaUk5Mb0k+qMxLRfrdE6KxzIc1/LGL8CMdfCKHcF97M50MynjtGSV JewxQnTVEez0b1zO8jce77LYfaCq0kJviLRmQTidMHFpllEsuVhM6TvJAxPRK8FFoBoa AMjp1/5ZFYQvs/beSmEEwInZ5XqPpwUjLjwF+1FQcU//fqKGQX9OwzHv1wwzwDPo65VA kutA== |
| X-Gm-Message-State | AG10YORWfb76Kh5zY11jVVEtMBY+Z7rN1p+Xpgd2XU45uO/C6h3x9OUXD2cEbl1l106x/wrlonRZNAi4Z6hNrVtq |
| X-Received | by 10.194.175.198 with SMTP id cc6mr15205340wjc.24.1454185866830; Sat, 30 Jan 2016 12:31:06 -0800 (PST) |
| MIME-Version | 1.0 |
| Content-Type | text/plain; charset=UTF-8 |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 153 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | syzkaller <syzkaller@googlegroups.com>, Kostya Serebryany <kcc@google.com>, Alexander Potapenko <glider@google.com>, Sasha Levin <sasha.levin@oracle.com> |
| X-Original-Date | Sat, 30 Jan 2016 21:30:43 +0100 |
| X-Original-Message-ID | <CACT4Y+YPpoKuc8KrN11aL-1DoNxYLEjv-QnCeu3ZKQjkPdJ7Bg@mail.gmail.com> |
| X-Original-References | <CACT4Y+bVrBKDG0G2_AcUgUQa+X91VKTeS4v+wN7BSHwHtqn3kQ@mail.gmail.com> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | csiph.com linux.kernel:1322505 |
Show key headers only | View raw
On Sat, Jan 30, 2016 at 9:28 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> I've got the following deadlock report while running syzkaller fuzzer:
>
> [ INFO: possible circular locking dependency detected ]
> 4.5.0-rc1+ #305 Not tainted
> -------------------------------------------------------
> syz-executor/14254 is trying to acquire lock:
> (&runtime->oss.params_lock){+.+.+.}, at: [<ffffffff8528a504>]
> snd_pcm_oss_change_params+0xd4/0x3540 sound/core/oss/pcm_oss.c:852
>
> but task is already holding lock:
> (&mm->mmap_sem){++++++}, at: [<ffffffff816b267c>] vm_mmap_pgoff
>
> which lock already depends on the new lock.
>
>
> the existing dependency chain (in reverse order) is:
>
> -> #1 (&mm->mmap_sem){++++++}:
> [<ffffffff8145b9dc>] lock_acquire+0x1dc/0x430
> kernel/locking/lockdep.c:3587
> [<ffffffff816def51>] __might_fault+0x141/0x1d0 mm/memory.c:3802
> [< inline >] copy_from_user ./arch/x86/include/asm/uaccess.h:714
> [< inline >] snd_pcm_oss_write1 sound/core/oss/pcm_oss.c:1376
> [<ffffffff852940f0>] snd_pcm_oss_write+0x250/0x700
> sound/core/oss/pcm_oss.c:2694
> [<ffffffff817b90b3>] __vfs_write+0x113/0x480 fs/read_write.c:528
> [<ffffffff817bab47>] vfs_write+0x167/0x4a0 fs/read_write.c:577
> [< inline >] SYSC_write fs/read_write.c:624
> [<ffffffff817bde31>] SyS_write+0x111/0x220 fs/read_write.c:616
> [<ffffffff866531b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
>
> -> #0 (&runtime->oss.params_lock){+.+.+.}:
> [< inline >] check_prev_add kernel/locking/lockdep.c:1855
> [< inline >] check_prevs_add kernel/locking/lockdep.c:1960
> [< inline >] validate_chain kernel/locking/lockdep.c:2146
> [<ffffffff8145807b>] __lock_acquire+0x31eb/0x4700
> kernel/locking/lockdep.c:3208
> [<ffffffff8145b9dc>] lock_acquire+0x1dc/0x430
> kernel/locking/lockdep.c:3587
> [< inline >] __mutex_lock_common kernel/locking/mutex.c:518
> [<ffffffff8664891c>] mutex_lock_interruptible_nested+0xbc/0xbe0
> kernel/locking/mutex.c:647
> [<ffffffff8528a504>] snd_pcm_oss_change_params+0xd4/0x3540
> sound/core/oss/pcm_oss.c:852
> [<ffffffff8528f01d>] snd_pcm_oss_mmap+0x3dd/0x4c0
> sound/core/oss/pcm_oss.c:2807
> [<ffffffff81705747>] mmap_region+0x897/0x1010 mm/mmap.c:1624
> [<ffffffff81706614>] do_mmap+0x754/0x990 mm/mmap.c:1403
> [< inline >] do_mmap_pgoff include/linux/mm.h:1982
> [<ffffffff816b26af>] vm_mmap_pgoff+0x15f/0x1b0 mm/util.c:328
> [< inline >] SYSC_mmap_pgoff mm/mmap.c:1453
> [<ffffffff816ff85a>] SyS_mmap_pgoff+0x34a/0x580 mm/mmap.c:1411
> [< inline >] SYSC_mmap arch/x86/kernel/sys_x86_64.c:95
> [<ffffffff811aeeb6>] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
> [<ffffffff866531b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
>
> other info that might help us debug this:
>
> Possible unsafe locking scenario:
>
> CPU0 CPU1
> ---- ----
> lock(&mm->mmap_sem);
> lock(&runtime->oss.params_lock);
> lock(&mm->mmap_sem);
> lock(&runtime->oss.params_lock);
>
> *** DEADLOCK ***
>
> 1 lock held by syz-executor/14254:
> #0: (&mm->mmap_sem){++++++}, at: [<ffffffff816b267c>]
> vm_mmap_pgoff+0x12c/0x1b0 mm/util.c:327
>
> stack backtrace:
> CPU: 2 PID: 14254 Comm: syz-executor Not tainted 4.5.0-rc1+ #305
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> 00000000ffffffff ffff88003214f780 ffffffff82be11ad ffffffff8959ac60
> ffffffff8959ac60 ffffffff89573f60 ffff88003214f7d0 ffffffff814512a8
> ffff8800333cdf00 ffff8800333ce742 0000000000000000 ffff8800333ce720
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff82be11ad>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
> [<ffffffff814512a8>] print_circular_bug+0x288/0x340
> kernel/locking/lockdep.c:1228
> [< inline >] check_prev_add kernel/locking/lockdep.c:1855
> [< inline >] check_prevs_add kernel/locking/lockdep.c:1960
> [< inline >] validate_chain kernel/locking/lockdep.c:2146
> [<ffffffff8145807b>] __lock_acquire+0x31eb/0x4700 kernel/locking/lockdep.c:3208
> [<ffffffff8145b9dc>] lock_acquire+0x1dc/0x430 kernel/locking/lockdep.c:3587
> [< inline >] __mutex_lock_common kernel/locking/mutex.c:518
> [<ffffffff8664891c>] mutex_lock_interruptible_nested+0xbc/0xbe0
> kernel/locking/mutex.c:647
> [<ffffffff8528a504>] snd_pcm_oss_change_params+0xd4/0x3540
> sound/core/oss/pcm_oss.c:852
> [<ffffffff8528f01d>] snd_pcm_oss_mmap+0x3dd/0x4c0 sound/core/oss/pcm_oss.c:2807
> [<ffffffff81705747>] mmap_region+0x897/0x1010 mm/mmap.c:1624
> [<ffffffff81706614>] do_mmap+0x754/0x990 mm/mmap.c:1403
> [< inline >] do_mmap_pgoff include/linux/mm.h:1982
> [<ffffffff816b26af>] vm_mmap_pgoff+0x15f/0x1b0 mm/util.c:328
> [< inline >] SYSC_mmap_pgoff mm/mmap.c:1453
> [<ffffffff816ff85a>] SyS_mmap_pgoff+0x34a/0x580 mm/mmap.c:1411
> [< inline >] SYSC_mmap arch/x86/kernel/sys_x86_64.c:95
> [<ffffffff811aeeb6>] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
>
>
> On commit 26cd83670f2f5a3d5b5514a1f7d96567cdb9558b.
Similar for snd_pcm_oss_read:
[ 90.050883] [ INFO: possible circular locking dependency detected ]
[ 90.050883] 4.5.0-rc1+ #305 Not tainted
[ 90.050883] -------------------------------------------------------
[ 90.050883] syz-executor/11689 is trying to acquire lock:
[ 90.050883] (&runtime->oss.params_lock){+.+.+.}, at:
[<ffffffff8528a504>] snd_pcm_oss_change_params+0xd4/0x3540
[ 90.050883]
[ 90.050883] but task is already holding lock:
[ 90.050883] (&mm->mmap_sem){++++++}, at: [<ffffffff816b267c>]
vm_mmap_pgoff+0x12c/0x1b0
[ 90.050883]
[ 90.050883] which lock already depends on the new lock.
[ 90.050883]
[ 90.050883]
[ 90.050883] the existing dependency chain (in reverse order) is:
[ 90.050883]
-> #1 (&mm->mmap_sem){++++++}:
[ 90.050883] [<ffffffff8145b9dc>] lock_acquire+0x1dc/0x430
[ 90.050883] [<ffffffff816def51>] __might_fault+0x141/0x1d0
[ 90.050883] [<ffffffff85295062>] snd_pcm_oss_read+0x262/0x560
[ 90.050883] [<ffffffff817b7183>] __vfs_read+0x113/0x460
[ 90.050883] [<ffffffff817ba7d6>] vfs_read+0x106/0x310
[ 90.050883] [<ffffffff817bdc11>] SyS_read+0x111/0x220
[ 90.050883] [<ffffffff866531b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
[ 90.050883]
-> #0 (&runtime->oss.params_lock){+.+.+.}:
[ 90.050883] [<ffffffff8145807b>] __lock_acquire+0x31eb/0x4700
[ 90.050883] [<ffffffff8145b9dc>] lock_acquire+0x1dc/0x430
[ 90.050883] [<ffffffff8664891c>]
mutex_lock_interruptible_nested+0xbc/0xbe0
[ 90.050883] [<ffffffff8528a504>] snd_pcm_oss_change_params+0xd4/0x3540
[ 90.050883] [<ffffffff8528f01d>] snd_pcm_oss_mmap+0x3dd/0x4c0
[ 90.050883] [<ffffffff81705747>] mmap_region+0x897/0x1010
[ 90.050883] [<ffffffff81706614>] do_mmap+0x754/0x990
[ 90.050883] [<ffffffff816b26af>] vm_mmap_pgoff+0x15f/0x1b0
[ 90.050883] [<ffffffff816ff85a>] SyS_mmap_pgoff+0x34a/0x580
[ 90.050883] [<ffffffff811aeeb6>] SyS_mmap+0x16/0x20
[ 90.050883] [<ffffffff866531b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
sound: deadlock between snd_pcm_oss_write/snd_pcm_oss_mmap Dmitry Vyukov <dvyukov@google.com> - 2016-01-30 21:30 +0100 Re: sound: deadlock between snd_pcm_oss_write/snd_pcm_oss_mmap Dmitry Vyukov <dvyukov@google.com> - 2016-01-30 21:40 +0100 Re: sound: deadlock between snd_pcm_oss_write/snd_pcm_oss_mmap Takashi Iwai <tiwai@suse.de> - 2016-01-31 12:20 +0100
csiph-web