[Syzkaller] BUG: soft lockup in rtc_timer_do_work

watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [kworker/0:0:11437]
Modules linked in:
CPU: 0 PID: 11437 Comm: kworker/0:0 Not tainted 5.10.0+ #2
Hardware name: linux,dummy-virt (DT)
Workqueue: events rtc_timer_do_work
pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
pc : __asan_store8+0x74/0xc0 mm/kasan/generic.c:253
lr : rb_link_node include/linux/rbtree.h:72 [inline]
lr : timerqueue_add+0x11c/0x160 lib/timerqueue.c:47
sp : ffffff80c0de7a80
x29: ffffff80c0de7a80 x28: ffffff80c129c500 
x27: ffffffd012218000 x26: ffffff80d74cae10 
x25: ffffff80c129c580 x24: ffffff80c129c4f8 
x23: ffffff80c129c560 x22: ffffffd012bdfb48 
x21: ffffff80c129c548 x20: 000000003b9aca00 
x19: 0000000000000000 x18: 0000000000000000 
x17: 0000000000000000 x16: 0000000000000000 
x15: 0000007fe83d67d8 x14: 0000000000000000 
x13: 0000000000000000 x12: ffffffc01825389b 
x11: 1ffffff01825389a x10: ffffffc01825389a 
x9 : ffffffd01126f56c x8 : ffffff80c129c4d0 
x7 : 0000000000000001 x6 : ffffffc01825389a 
x5 : ffffff80c129c4d0 x4 : dfffffd000000000 
x3 : ffffffd010c79ecc x2 : 0000000000000007 
x1 : 0000000000000000 x0 : ffffff80c129c548 
Call trace:
 memory_is_poisoned_1 mm/kasan/generic.c:54 [inline]
 memory_is_poisoned_2_4_8 mm/kasan/generic.c:74 [inline]
 memory_is_poisoned mm/kasan/generic.c:158 [inline]
 check_memory_region_inline mm/kasan/generic.c:184 [inline]
 __asan_store8+0x74/0xc0 mm/kasan/generic.c:253
 rb_link_node include/linux/rbtree.h:72 [inline]
 timerqueue_add+0x11c/0x160 lib/timerqueue.c:47
 rtc_timer_do_work+0x3c0/0x5d4 drivers/rtc/interface.c:932
 process_one_work+0x3ec/0x930 kernel/workqueue.c:2270
 worker_thread+0x108/0x7dc kernel/workqueue.c:2416
 kthread+0x1a0/0x1ec kernel/kthread.c:313
 ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:914

在syz log看到如下日志。
ioctl$RTC_UIE_ON(r0, 0x7003) (async)
ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x1, 0x7f, 0x100})

RTC_UIE_ON会创建一个uie_rtctimer定时器，到期时间是1s，同时周期也是1s。rtc_timer_do_work会执行所有到期定时器的回调函数，并且将周期定时器重新添加到timer队列中。
void rtc_timer_do_work(struct work_struct *work)
{       
    while ((next = timerqueue_getnext(&rtc->timerqueue))) {
        if (next->expires > now)
            break;
    
        /* expire timer */
        timer = container_of(next, struct rtc_timer, node);
        timerqueue_del(&rtc->timerqueue, &timer->node);
        trace_rtc_timer_dequeue(timer);
        timer->enabled = 0;
        if (timer->func)
            timer->func(timer->rtc);

trace_rtc_timer_fired(timer);
        /* Re-add/fwd periodic timers */
        if (ktime_to_ns(timer->period)) {
            timer->node.expires = ktime_add(timer->node.expires,
                            timer->period);
            timer->enabled = 1;
            timerqueue_add(&rtc->timerqueue, &timer->node);
            trace_rtc_timer_enqueue(timer);
        }
    }
	...
}

RTC_SET_TIME又将时间设置为距离现在很遥远的时间，导致uie_rtctimer不断处于 到期-重新入队 的循环，直到定时器的到期时间比rtc时间更晚，这一过程导致watchdog无法得到调度，最终触发softlockup。
**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (3)

GVPopenEuler/kernelClosed

Content Risk Flag