【openEuler-1.0-LTS】possible deadlock in console_unlock

【标题描述】syzkaller报告出现了possible deadlock in console_unlock
【环境信息】问题场景为5.10
硬件信息：
NA
软件信息：
openEuler-1.0-LTS
【问题复现步骤】
具体操作步骤
在syzkaller环境运行下列脚本：
test.sh
```shell
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000c9b000/0x3000)=nil, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000180)=<r3=>0x0)
syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0)
io_uring_enter(r1, 0x79f7, 0x0, 0x0, 0x0, 0x0)
ioctl$TIOCVHANGUP(r0, 0x5437, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendmmsg$inet6(r4, &(0x7f0000004040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) (fail_nth: 3)
```
出现概率(是否必现，概率性错误）syzkaller环境低概率
【预期结果】
正常运行无报错
【实际结果】
lockdep检测出潜在的死锁问题
【附件信息】
以下是在5.10上的syzkaller报告
```shell
======================================================
WARNING: possible circular locking dependency detected
5.10.0-04424-ga472e3c833d3 #3 Not tainted
------------------------------------------------------
syz-executor.3/22930 is trying to acquire lock:
fffff5ce01866a60 (console_owner){-.-.}-{0:0}, at: console_unlock+0x2e4/0x9ec kernel/printk/printk.c:2538

but task is already holding lock:
ffff15f7c7688a98 (&sighand->siglock){-.-.}-{2:2}, at: __lock_task_sighand+0xf0/0x370 kernel/signal.c:1396

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #4 (&sighand->siglock){-.-.}-{2:2}:
       validate_chain+0x6dc/0xb0c kernel/locking/lockdep.c:3728
       __lock_acquire+0x498/0x940 kernel/locking/lockdep.c:4954
       lock_acquire+0x228/0x580 kernel/locking/lockdep.c:5564
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xc0/0x15c kernel/locking/spinlock.c:159
       __lock_task_sighand+0xf0/0x370 kernel/signal.c:1396
       lock_task_sighand include/linux/sched/signal.h:699 [inline]
       task_work_add+0x1f8/0x2a0 kernel/task_work.c:58
       io_req_task_work_add+0x98/0x10c fs/io_uring.c:2115
       __io_async_wake+0x338/0x780 fs/io_uring.c:4984
       io_poll_wake+0x40/0x50 fs/io_uring.c:5461
       __wake_up_common+0xcc/0x2a0 kernel/sched/wait.c:93
       __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:123
       __wake_up+0x1c/0x24 kernel/sched/wait.c:142
       tty_ldisc_lock+0x74/0x120 drivers/tty/tty_ldisc.c:335
       tty_ldisc_hangup+0x13c/0x340 drivers/tty/tty_ldisc.c:744
       __tty_hangup.part.0+0x2e0/0x5a0 drivers/tty/tty_io.c:624
       __tty_hangup drivers/tty/tty_io.c:2684 [inline]
       tty_vhangup drivers/tty/tty_io.c:697 [inline]
       tty_ioctl+0xaf0/0x1100 drivers/tty/tty_io.c:2683
       vfs_ioctl fs/ioctl.c:48 [inline]
       __do_sys_ioctl fs/ioctl.c:753 [inline]
       __se_sys_ioctl fs/ioctl.c:739 [inline]
       __arm64_sys_ioctl+0x12c/0x18c fs/ioctl.c:739
       __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
       invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
       el0_svc_common.constprop.0+0xf8/0x420 arch/arm64/kernel/syscall.c:155
       do_el0_svc+0x50/0x120 arch/arm64/kernel/syscall.c:217
       el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
       el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
       el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683

-> #3 (&tty->read_wait){....}-{2:2}:
       validate_chain+0x6dc/0xb0c kernel/locking/lockdep.c:3728
       __lock_acquire+0x498/0x940 kernel/locking/lockdep.c:4954
       lock_acquire+0x228/0x580 kernel/locking/lockdep.c:5564
       __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
       _raw_spin_lock+0xa0/0x120 kernel/locking/spinlock.c:151
       spin_lock include/linux/spinlock.h:354 [inline]
       io_poll_double_wake+0x158/0x30c fs/io_uring.c:5093
       __wake_up_common+0xcc/0x2a0 kernel/sched/wait.c:93
       __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:123
       __wake_up+0x1c/0x24 kernel/sched/wait.c:142
       tty_ldisc_lock+0x88/0x120 drivers/tty/tty_ldisc.c:336
       tty_ldisc_hangup+0x13c/0x340 drivers/tty/tty_ldisc.c:744
       __tty_hangup.part.0+0x2e0/0x5a0 drivers/tty/tty_io.c:624
       __tty_hangup drivers/tty/tty_io.c:2684 [inline]
       tty_vhangup drivers/tty/tty_io.c:697 [inline]
       tty_ioctl+0xaf0/0x1100 drivers/tty/tty_io.c:2683
       vfs_ioctl fs/ioctl.c:48 [inline]
       __do_sys_ioctl fs/ioctl.c:753 [inline]
       __se_sys_ioctl fs/ioctl.c:739 [inline]
       __arm64_sys_ioctl+0x12c/0x18c fs/ioctl.c:739
       __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
       invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
       el0_svc_common.constprop.0+0xf8/0x420 arch/arm64/kernel/syscall.c:155
       do_el0_svc+0x50/0x120 arch/arm64/kernel/syscall.c:217
       el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
       el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
       el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683

-> #2 (&tty->write_wait){....}-{2:2}:
       validate_chain+0x6dc/0xb0c kernel/locking/lockdep.c:3728
       __lock_acquire+0x498/0x940 kernel/locking/lockdep.c:4954
       lock_acquire+0x228/0x580 kernel/locking/lockdep.c:5564
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xc0/0x15c kernel/locking/spinlock.c:159
       __wake_up_common_lock+0xb0/0x130 kernel/sched/wait.c:122
       __wake_up+0x1c/0x24 kernel/sched/wait.c:142
       tty_wakeup+0x54/0xbc drivers/tty/tty_io.c:539
       tty_port_default_wakeup+0x38/0x50 drivers/tty/tty_port.c:50
       tty_port_tty_wakeup+0x3c/0x50 drivers/tty/tty_port.c:388
       uart_write_wakeup+0x38/0x60 drivers/tty/serial/serial_core.c:106
       pl011_tx_chars+0x530/0x5c0 drivers/tty/serial/amba-pl011.c:1418
       pl011_start_tx_pio drivers/tty/serial/amba-pl011.c:1303 [inline]
       pl011_start_tx+0x1b4/0x430 drivers/tty/serial/amba-pl011.c:1315
       __uart_start.isra.0+0xb4/0xcc drivers/tty/serial/serial_core.c:127
       uart_write+0x21c/0x460 drivers/tty/serial/serial_core.c:613
       process_output_block+0x120/0x3ac drivers/tty/n_tty.c:590
       n_tty_write+0x2c8/0x650 drivers/tty/n_tty.c:2383
       do_tty_write drivers/tty/tty_io.c:1028 [inline]
       file_tty_write.constprop.0+0x2d0/0x520 drivers/tty/tty_io.c:1118
       tty_write drivers/tty/tty_io.c:1125 [inline]
       redirected_tty_write+0xe4/0x104 drivers/tty/tty_io.c:1147
       call_write_iter include/linux/fs.h:1960 [inline]
       new_sync_write+0x264/0x37c fs/read_write.c:515
       vfs_write+0x694/0x9d0 fs/read_write.c:602
       ksys_write+0xfc/0x200 fs/read_write.c:655
       __do_sys_write fs/read_write.c:667 [inline]
       __se_sys_write fs/read_write.c:664 [inline]
       __arm64_sys_write+0x50/0x60 fs/read_write.c:664
       __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
       invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
       el0_svc_common.constprop.0+0xf8/0x420 arch/arm64/kernel/syscall.c:155
       do_el0_svc+0x50/0x120 arch/arm64/kernel/syscall.c:217
       el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
       el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
       el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683

-> #1 (&port_lock_key){-.-.}-{2:2}:
       validate_chain+0x6dc/0xb0c kernel/locking/lockdep.c:3728
       __lock_acquire+0x498/0x940 kernel/locking/lockdep.c:4954
       lock_acquire+0x228/0x580 kernel/locking/lockdep.c:5564
       __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
       _raw_spin_lock+0xa0/0x120 kernel/locking/spinlock.c:151
       spin_lock include/linux/spinlock.h:354 [inline]
       pl011_console_write+0x2f0/0x410 drivers/tty/serial/amba-pl011.c:2263
       call_console_drivers.constprop.0+0x1f8/0x3b0 kernel/printk/printk.c:1932
       console_unlock+0x36c/0x9ec kernel/printk/printk.c:2553
       vprintk_emit+0x40c/0x4b0 kernel/printk/printk.c:2075
       vprintk_default+0x48/0x54 kernel/printk/printk.c:2092
       vprintk_func+0x1f0/0x40c kernel/printk/printk_safe.c:404
       printk+0xbc/0xf0 kernel/printk/printk.c:2123
       register_console+0x580/0x790 kernel/printk/printk.c:2905
       uart_configure_port.constprop.0+0x4a0/0x4e0 drivers/tty/serial/serial_core.c:2431
       uart_add_one_port+0x378/0x550 drivers/tty/serial/serial_core.c:2944
       pl011_register_port+0xb4/0x210 drivers/tty/serial/amba-pl011.c:2686
       pl011_probe+0x334/0x3ec drivers/tty/serial/amba-pl011.c:2736
       amba_probe+0x14c/0x2f0 drivers/amba/bus.c:283
       really_probe+0x210/0xa5c drivers/base/dd.c:562
       driver_probe_device+0x1c8/0x280 drivers/base/dd.c:747
       __device_attach_driver+0x18c/0x260 drivers/base/dd.c:853
       bus_for_each_drv+0x120/0x1a0 drivers/base/bus.c:431
       __device_attach+0x16c/0x3b4 drivers/base/dd.c:922
       device_initial_probe+0x28/0x34 drivers/base/dd.c:971
       bus_probe_device+0x124/0x13c drivers/base/bus.c:491
       fw_devlink_resume+0x164/0x270 drivers/base/core.c:1601
       of_platform_default_populate_init+0xf4/0x114 drivers/of/platform.c:543
       do_one_initcall+0x11c/0x770 init/main.c:1217
       do_initcall_level+0x364/0x388 init/main.c:1290
       do_initcalls+0x90/0xc0 init/main.c:1306
       do_basic_setup init/main.c:1326 [inline]
       kernel_init_freeable+0x57c/0x63c init/main.c:1529
       kernel_init+0x1c/0x20c init/main.c:1417
       ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1034

-> #0 (console_owner){-.-.}-{0:0}:
       check_prev_add+0xe0/0x105c kernel/locking/lockdep.c:2988
       check_prevs_add+0x1c8/0x3d4 kernel/locking/lockdep.c:3113
       validate_chain+0x6dc/0xb0c kernel/locking/lockdep.c:3728
       __lock_acquire+0x498/0x940 kernel/locking/lockdep.c:4954
       lock_acquire+0x228/0x580 kernel/locking/lockdep.c:5564
       console_lock_spinning_enable kernel/printk/printk.c:1784 [inline]
       console_unlock+0x360/0x9ec kernel/printk/printk.c:2550
       vprintk_emit+0x40c/0x4b0 kernel/printk/printk.c:2075
       vprintk_default+0x48/0x54 kernel/printk/printk.c:2092
       vprintk_func+0x1f0/0x40c kernel/printk/printk_safe.c:404
       printk+0xbc/0xf0 kernel/printk/printk.c:2123
       fail_dump lib/fault-inject.c:45 [inline]
       should_fail+0x2a0/0x370 lib/fault-inject.c:146
       __should_failslab+0x8c/0xe0 mm/failslab.c:33
       should_failslab+0x14/0x2c mm/slab_common.c:1181
       slab_pre_alloc_hook mm/slab.h:495 [inline]
       slab_alloc_node mm/slub.c:2842 [inline]
       slab_alloc mm/slub.c:2931 [inline]
       kmem_cache_alloc+0x8c/0xe64 mm/slub.c:2936
       __sigqueue_alloc+0x224/0x5a4 kernel/signal.c:437
       __send_signal+0x7e4/0xeac kernel/signal.c:1121
       send_signal+0x348/0x6a0 kernel/signal.c:1247
       do_send_sig_info kernel/signal.c:1296 [inline]
       send_sig_info kernel/signal.c:1611 [inline]
       send_sig+0xd8/0x150 kernel/signal.c:1621
       wait_for_space fs/splice.c:988 [inline]
       wait_for_space+0x124/0x1c0 fs/splice.c:984
       do_splice+0x59c/0xbd0 fs/splice.c:1085
       __do_splice+0x2b0/0x630 fs/splice.c:1137
       __do_sys_splice fs/splice.c:1343 [inline]
       __se_sys_splice fs/splice.c:1325 [inline]
       __arm64_sys_splice+0x10c/0x1d4 fs/splice.c:1325
       __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
       invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
       el0_svc_common.constprop.0+0xf8/0x420 arch/arm64/kernel/syscall.c:155
       do_el0_svc+0x50/0x120 arch/arm64/kernel/syscall.c:217
       el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
       el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
       el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683

other info that might help us debug this:

Chain exists of:
  console_owner --> &tty->read_wait --> &sighand->siglock

Possible unsafe locking scenario:

CPU0                    CPU1
       ----                    ----
  lock(&sighand->siglock);
                               lock(&tty->read_wait);
                               lock(&sighand->siglock);
  lock(console_owner);

*** DEADLOCK ***

3 locks held by syz-executor.3/22930:
 #0: ffff15f7e1d4ca68 (&pipe->mutex/1){+.+.}-{3:3}, at: pipe_lock_nested fs/pipe.c:81 [inline]
 #0: ffff15f7e1d4ca68 (&pipe->mutex/1){+.+.}-{3:3}, at: pipe_lock+0x58/0x70 fs/pipe.c:89
 #1: ffff15f7c7688a98 (&sighand->siglock){-.-.}-{2:2}, at: __lock_task_sighand+0xf0/0x370 kernel/signal.c:1396
 #2: fffff5ce018663c0 (console_lock){+.+.}-{0:0}, at: console_trylock_spinning+0x1c/0x2e0 kernel/printk/printk.c:1846

stack backtrace:
CPU: 0 PID: 22930 Comm: syz-executor.3 Not tainted 5.10.0-04424-ga472e3c833d3 #3
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x41c arch/arm64/kernel/stacktrace.c:132
 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2c0 lib/dump_stack.c:118
 print_circular_bug+0x1ec/0x284 kernel/locking/lockdep.c:2002
 check_noncircular+0x1cc/0x1ec kernel/locking/lockdep.c:2123
 check_prev_add+0xe0/0x105c kernel/locking/lockdep.c:2988
 check_prevs_add+0x1c8/0x3d4 kernel/locking/lockdep.c:3113
 validate_chain+0x6dc/0xb0c kernel/locking/lockdep.c:3728
 __lock_acquire+0x498/0x940 kernel/locking/lockdep.c:4954
 lock_acquire+0x228/0x580 kernel/locking/lockdep.c:5564
 console_lock_spinning_enable kernel/printk/printk.c:1784 [inline]
 console_unlock+0x360/0x9ec kernel/printk/printk.c:2550
 vprintk_emit+0x40c/0x4b0 kernel/printk/printk.c:2075
 vprintk_default+0x48/0x54 kernel/printk/printk.c:2092
 vprintk_func+0x1f0/0x40c kernel/printk/printk_safe.c:404
 printk+0xbc/0xf0 kernel/printk/printk.c:2123
 fail_dump lib/fault-inject.c:45 [inline]
 should_fail+0x2a0/0x370 lib/fault-inject.c:146
 __should_failslab+0x8c/0xe0 mm/failslab.c:33
 should_failslab+0x14/0x2c mm/slab_common.c:1181
 slab_pre_alloc_hook mm/slab.h:495 [inline]
 slab_alloc_node mm/slub.c:2842 [inline]
 slab_alloc mm/slub.c:2931 [inline]
 kmem_cache_alloc+0x8c/0xe64 mm/slub.c:2936
 __sigqueue_alloc+0x224/0x5a4 kernel/signal.c:437
 __send_signal+0x7e4/0xeac kernel/signal.c:1121
 send_signal+0x348/0x6a0 kernel/signal.c:1247
 do_send_sig_info kernel/signal.c:1296 [inline]
 send_sig_info kernel/signal.c:1611 [inline]
 send_sig+0xd8/0x150 kernel/signal.c:1621
 wait_for_space fs/splice.c:988 [inline]
 wait_for_space+0x124/0x1c0 fs/splice.c:984
 do_splice+0x59c/0xbd0 fs/splice.c:1085
 __do_splice+0x2b0/0x630 fs/splice.c:1137
 __do_sys_splice fs/splice.c:1343 [inline]
 __se_sys_splice fs/splice.c:1325 [inline]
 __arm64_sys_splice+0x10c/0x1d4 fs/splice.c:1325
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common.constprop.0+0xf8/0x420 arch/arm64/kernel/syscall.c:155
 do_el0_svc+0x50/0x120 arch/arm64/kernel/syscall.c:217
 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683
```

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识