[Syzkaller] BUG: soft lockup in rtc_timer_do_work

watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [kworker/0:0:11437]
Modules linked in:
CPU: 0 PID: 11437 Comm: kworker/0:0 Not tainted 5.10.0+ #2
Hardware name: linux,dummy-virt (DT)
Workqueue: events rtc_timer_do_work
pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
pc : __asan_store8+0x74/0xc0 mm/kasan/generic.c:253
lr : rb_link_node include/linux/rbtree.h:72 [inline]
lr : timerqueue_add+0x11c/0x160 lib/timerqueue.c:47
sp : ffffff80c0de7a80
x29: ffffff80c0de7a80 x28: ffffff80c129c500
x27: ffffffd012218000 x26: ffffff80d74cae10
x25: ffffff80c129c580 x24: ffffff80c129c4f8
x23: ffffff80c129c560 x22: ffffffd012bdfb48
x21: ffffff80c129c548 x20: 000000003b9aca00
x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000007fe83d67d8 x14: 0000000000000000
x13: 0000000000000000 x12: ffffffc01825389b
x11: 1ffffff01825389a x10: ffffffc01825389a
x9 : ffffffd01126f56c x8 : ffffff80c129c4d0
x7 : 0000000000000001 x6 : ffffffc01825389a
x5 : ffffff80c129c4d0 x4 : dfffffd000000000
x3 : ffffffd010c79ecc x2 : 0000000000000007
x1 : 0000000000000000 x0 : ffffff80c129c548
Call trace:
memory_is_poisoned_1 mm/kasan/generic.c:54 [inline]
memory_is_poisoned_2_4_8 mm/kasan/generic.c:74 [inline]
memory_is_poisoned mm/kasan/generic.c:158 [inline]
check_memory_region_inline mm/kasan/generic.c:184 [inline]
__asan_store8+0x74/0xc0 mm/kasan/generic.c:253
rb_link_node include/linux/rbtree.h:72 [inline]
timerqueue_add+0x11c/0x160 lib/timerqueue.c:47
rtc_timer_do_work+0x3c0/0x5d4 drivers/rtc/interface.c:932
process_one_work+0x3ec/0x930 kernel/workqueue.c:2270
worker_thread+0x108/0x7dc kernel/workqueue.c:2416
kthread+0x1a0/0x1ec kernel/kthread.c:313
ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:914

在syz log看到如下日志。
ioctlRTCUIEON(r0,0x7003)(async)ioctl
RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x1, 0x7f, 0x100})

RTC_UIE_ON会创建一个uie_rtctimer定时器，到期时间是1s，同时周期也是1s。rtc_timer_do_work会执行所有到期定时器的回调函数，并且将周期定时器重新添加到timer队列中。
void rtc_timer_do_work(struct work_struct *work)
{
while ((next = timerqueue_getnext(&rtc->timerqueue))) {
if (next->expires > now)
break;

/* expire timer */
    timer = container_of(next, struct rtc_timer, node);
    timerqueue_del(&rtc->timerqueue, &timer->node);
    trace_rtc_timer_dequeue(timer);
    timer->enabled = 0;
    if (timer->func)
        timer->func(timer->rtc);

trace_rtc_timer_fired(timer);
    /* Re-add/fwd periodic timers */
    if (ktime_to_ns(timer->period)) {
        timer->node.expires = ktime_add(timer->node.expires,
                        timer->period);
        timer->enabled = 1;
        timerqueue_add(&rtc->timerqueue, &timer->node);
        trace_rtc_timer_enqueue(timer);
    }
}
...
}

RTC_SET_TIME又将时间设置为距离现在很遥远的时间，导致uie_rtctimer不断处于 到期-重新入队 的循环，直到定时器的到期时间比rtc时间更晚，这一过程导致watchdog无法得到调度，最终触发softlockup。

src-openEuler/kernel

内容风险标识

评论 (2)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识