5.19.8-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 155/155 tty: n_gsm: avoid call of sleeping functions from atomic context
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
commit 902e02ea9385373ce4b142576eef41c642703955 upstream.
Syzkaller reports the following problem:
BUG: sleeping function called from invalid context at kernel/printk/printk.c:2347
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1105, name: syz-executor423
3 locks held by syz-executor423/1105:
#0: ffff8881468b9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x90 drivers/tty/tty_ldisc.c:266 #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: tty_write_lock drivers/tty/tty_io.c:952 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: do_tty_write drivers/tty/tty_io.c:975 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: file_tty_write.constprop.0+0x2a8/0x8e0 drivers/tty/tty_io.c:1118 #2: ffff88801b06c398 (&gsm->tx_lock){....}-{2:2}, at: gsmld_write+0x5e/0x150 drivers/tty/n_gsm.c:2717
irq event stamp: 3482 hardirqs last enabled at (3481): [<ffffffff81d13343>] __get_reqs_available+0x143/0x2f0 fs/aio.c:946 hardirqs last disabled at (3482): [<ffffffff87d39722>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (3482): [<ffffffff87d39722>] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:159 softirqs last enabled at (3408): [<ffffffff87e01002>] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (3401): [<ffffffff87e01002>] asm_call_irq_on_stack+0x12/0x20 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 2 PID: 1105 Comm: syz-executor423 Not tainted 5.10.137-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:118 ___might_sleep.cold+0x1e8/0x22e kernel/sched/core.c:7304 console_lock+0x19/0x80 kernel/printk/printk.c:2347 do_con_write+0x113/0x1de0 drivers/tty/vt/vt.c:2909 con_write+0x22/0xc0 drivers/tty/vt/vt.c:3296 gsmld_write+0xd0/0x150 drivers/tty/n_gsm.c:2720 do_tty_write drivers/tty/tty_io.c:1028 [inline] file_tty_write.constprop.0+0x502/0x8e0 drivers/tty/tty_io.c:1118 call_write_iter include/linux/fs.h:1903 [inline] aio_write+0x355/0x7b0 fs/aio.c:1580 __io_submit_one fs/aio.c:1952 [inline] io_submit_one+0xf45/0x1a90 fs/aio.c:1999 __do_sys_io_submit fs/aio.c:2058 [inline] __se_sys_io_submit fs/aio.c:2028 [inline] __x64_sys_io_submit+0x18c/0x2f0 fs/aio.c:2028 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6
The problem happens in the following control flow:
gsmld_write(...)spin_lock_irqsave(&gsm->tx_lock, flags) // taken a spinlock on TX data
con_write(...)
do_con_write(...)
console_lock()
might_sleep() // -> bug
As far as console_lock() might sleep it should not be called with spinlock held.
The patch replaces tx_lock spinlock with mutex in order to avoid the problem.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/tty/n_gsm.c | 53 +++++++++++++++++++++++----------------------------- 1 file changed, 24 insertions(+), 29 deletions(-)
drivers/tty/n_gsm.c +24 -29
@@ -248,7 +248,7 @@ struct gsm_mux {bool constipated;/* Asked by remote to shut up */ bool has_devices;/* Devices were registered */ -spinlock_t tx_lock; +struct mutex tx_mutex;unsigned int tx_bytes;/* TX data outstanding */ #define TX_THRESH_HI 8192#define TX_THRESH_LO 2048
@@ -680,7 +680,6 @@ static int gsm_send(struct gsm_mux *gsm,struct gsm_msg *msg;u8 *dp;int ocr; -unsigned long flags; msg =gsm_data_alloc (gsm, addr,0 , control);if (!msg)
@@ -702,10 +701,10 @@ static int gsm_send(struct gsm_mux *gsm,gsm_print_packet ("Q->" , addr, cr, control,NULL ,0 ); -spin_lock_irqsave (&gsm->tx_lock, flags); +mutex_lock (&gsm->tx_mutex);list_add_tail (&msg->list, &gsm->tx_ctrl_list); gsm->tx_bytes += msg->len; -spin_unlock_irqrestore (&gsm->tx_lock, flags); +mutex_unlock (&gsm->tx_mutex);gsmld_write_trigger (gsm);return 0 ;
@@ -730,7 +729,7 @@ static void gsm_dlci_clear_queues(structspin_unlock_irqrestore (&dlci->lock, flags);/* Clear data packets in MUX write queue */ -spin_lock_irqsave (&gsm->tx_lock, flags); +mutex_lock (&gsm->tx_mutex);list_for_each_entry_safe (msg, nmsg, &gsm->tx_data_list, list) {if (msg->addr != addr)continue ;
@@ -738,7 +737,7 @@ static void gsm_dlci_clear_queues(structlist_del (&msg->list);kfree (msg); } -spin_unlock_irqrestore (&gsm->tx_lock, flags); +mutex_unlock (&gsm->tx_mutex); }/**
@@ -1024,10 +1023,9 @@ static void __gsm_data_queue(struct gsm_static void gsm_data_queue (struct gsm_dlci *dlci,struct gsm_msg *msg) { -unsigned long flags; -spin_lock_irqsave (&dlci->gsm->tx_lock, flags); +mutex_lock (&dlci->gsm->tx_mutex);__gsm_data_queue (dlci, msg); -spin_unlock_irqrestore (&dlci->gsm->tx_lock, flags); +mutex_unlock (&dlci->gsm->tx_mutex); }/**
@@ -1039,7 +1037,7 @@ static void gsm_data_queue(struct gsm_dl* is data. Keep to the MRU of the mux. This path handles the usual tty * interface which is a byte stream with optional modem data. * -* Caller must hold the tx_lock of the mux. +* Caller must hold the tx_mutex of the mux. */ static int gsm_dlci_data_output (struct gsm_mux *gsm,struct gsm_dlci *dlci)
@@ -1099,7 +1097,7 @@ static int gsm_dlci_data_output(struct g* is data. Keep to the MRU of the mux. This path handles framed data * queued as skbuffs to the DLCI. * -* Caller must hold the tx_lock of the mux. +* Caller must hold the tx_mutex of the mux. */ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
@@ -1115,7 +1113,7 @@ static int gsm_dlci_data_output_framed(sif (dlci->adaption ==4 ) overhead =1 ; -/* dlci->skb is locked by tx_lock */ +/* dlci->skb is locked by tx_mutex */ if (dlci->skb ==NULL ) { dlci->skb =skb_dequeue_tail (&dlci->skb_list);if (dlci->skb ==NULL )
@@ -1169,7 +1167,7 @@ static int gsm_dlci_data_output_framed(s* Push an empty frame in to the transmit queue to update the modem status * bits and to transmit an optional break. * -* Caller must hold the tx_lock of the mux. +* Caller must hold the tx_mutex of the mux. */ static int gsm_dlci_modem_output(struct gsm_mux *gsm, struct gsm_dlci *dlci,
@@ -1283,13 +1281,12 @@ static int gsm_dlci_data_sweep(struct gsstatic void gsm_dlci_data_kick (struct gsm_dlci *dlci) { -unsigned long flags;int sweep;if (dlci->constipated)return ; -spin_lock_irqsave (&dlci->gsm->tx_lock, flags); +mutex_lock (&dlci->gsm->tx_mutex);/* If we have nothing running then we need to fire up */ sweep = (dlci->gsm->tx_bytes <TX_THRESH_LO );if (dlci->gsm->tx_bytes ==0 ) {
@@ -1300,7 +1297,7 @@ static void gsm_dlci_data_kick(struct gs }if (sweep)gsm_dlci_data_sweep (dlci->gsm); -spin_unlock_irqrestore (&dlci->gsm->tx_lock, flags); +mutex_unlock (&dlci->gsm->tx_mutex); }/*
@@ -1994,14 +1991,13 @@ static void gsm_dlci_command(struct gsm_static void gsm_kick_timeout (struct work_struct *work) { struct gsm_mux *gsm = container_of(work, struct gsm_mux, kick_timeout.work); -unsigned long flags;int sent =0 ; -spin_lock_irqsave (&gsm->tx_lock, flags); +mutex_lock (&gsm->tx_mutex);/* If we have nothing running then we need to fire up */ if (gsm->tx_bytes <TX_THRESH_LO ) sent =gsm_dlci_data_sweep (gsm); -spin_unlock_irqrestore (&gsm->tx_lock, flags); +mutex_unlock (&gsm->tx_mutex);if (sent && debug &4 )pr_info ("%s TX queue stalled\n" , __func__);
@@ -2531,6 +2527,7 @@ static void gsm_free_mux(struct gsm_muxbreak ; } } +mutex_destroy (&gsm->tx_mutex);mutex_destroy (&gsm->mutex);kfree (gsm->txframe);kfree (gsm->buf);
@@ -2602,6 +2599,7 @@ static struct gsm_mux *gsm_alloc_mux(voi }spin_lock_init (&gsm->lock);mutex_init (&gsm->mutex); +mutex_init (&gsm->tx_mutex);kref_init (&gsm->ref);INIT_LIST_HEAD (&gsm->tx_ctrl_list);INIT_LIST_HEAD (&gsm->tx_data_list);
@@ -2610,7 +2608,6 @@ static struct gsm_mux *gsm_alloc_mux(voiINIT_WORK (&gsm->tx_work, gsmld_write_task);init_waitqueue_head (&gsm->event);spin_lock_init (&gsm->control_lock); -spin_lock_init (&gsm->tx_lock); gsm->t1 =T1 ; gsm->t2 =T2 ;
@@ -2635,6 +2632,7 @@ static struct gsm_mux *gsm_alloc_mux(voi }spin_unlock (&gsm_mux_lock);if (i ==MAX_MUX ) { +mutex_destroy (&gsm->tx_mutex);mutex_destroy (&gsm->mutex);kfree (gsm->txframe);kfree (gsm->buf);
@@ -2790,17 +2788,16 @@ static void gsmld_write_trigger(struct gstatic void gsmld_write_task (struct work_struct *work) { struct gsm_mux *gsm = container_of(work, struct gsm_mux, tx_work); -unsigned long flags;int i, ret;/* All outstanding control channel and control messages and one data * frame is sent. */ ret = -ENODEV ; -spin_lock_irqsave (&gsm->tx_lock, flags); +mutex_lock (&gsm->tx_mutex);if (gsm->tty) ret =gsm_data_kick (gsm); -spin_unlock_irqrestore (&gsm->tx_lock, flags); +mutex_unlock (&gsm->tx_mutex);if (ret >=0 )for (i =0 ; i <NUM_DLCI ; i++)
@@ -3008,7 +3005,6 @@ static ssize_t gsmld_write(struct tty_st const unsigned char *buf, size_t nr) {struct gsm_mux *gsm = tty->disc_data; -unsigned long flags;int space;int ret;
@@ -3016,13 +3012,13 @@ static ssize_t gsmld_write(struct tty_streturn -ENODEV ; ret = -ENOBUFS ; -spin_lock_irqsave (&gsm->tx_lock, flags); +mutex_lock (&gsm->tx_mutex); space =tty_write_room (tty);if (space >= nr) ret = tty->ops->write (tty, buf, nr);else set_bit (TTY_DO_WRITE_WAKEUP , &tty->flags); -spin_unlock_irqrestore (&gsm->tx_lock, flags); +mutex_unlock (&gsm->tx_mutex);return ret; }
@@ -3319,14 +3315,13 @@ static struct tty_ldisc_ops tty_ldisc_pastatic void gsm_modem_upd_via_data (struct gsm_dlci *dlci,u8 brk) {struct gsm_mux *gsm = dlci->gsm; -unsigned long flags;if (dlci->state !=DLCI_OPEN || dlci->adaption !=2 )return ; -spin_lock_irqsave (&gsm->tx_lock, flags); +mutex_lock (&gsm->tx_mutex);gsm_dlci_modem_output (gsm, dlci, brk); -spin_unlock_irqrestore (&gsm->tx_lock, flags); +mutex_unlock (&gsm->tx_mutex); }/**
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 08 Sep 2022 13:27:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.19.8-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.19.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.19.8-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.19.y
* git commit: c0790038d4859e77589313023c61b0d7104e2d14
* git describe: v5.19.4-390-gc0790038d485
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.19.y/build/v5.19.4-390-gc0790038d485
## No test Regressions (compared to v5.19.4-234-gdd6b2254d7a7)
## No metric Regressions (compared to v5.19.4-234-gdd6b2254d7a7)
## No test Fixes (compared to v5.19.4-234-gdd6b2254d7a7)
## No metric Fixes (compared to v5.19.4-234-gdd6b2254d7a7)
## Test result summary
total: 103723, pass: 93459, fail: 693, skip: 9312, xfail: 259
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 333 total, 333 passed, 0 failed
* arm64: 65 total, 63 passed, 2 failed
* i386: 55 total, 53 passed, 2 failed
* mips: 56 total, 56 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 69 total, 63 passed, 6 failed
* riscv: 27 total, 22 passed, 5 failed
* s390: 21 total, 21 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x86_64: 58 total, 56 passed, 2 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-open-posix-tests
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* packetdrill
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 08 Sep 2022 13:27:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.19.8-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.19.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 08 Sep 2022 13:27:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.19.8-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.19.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 08 Sep 2022 13:27:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.19.8-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.19.y
and the diffstat can be found below.thanks,
greg k-h
Hi Greg,
Compiled and booted on my test system Lenovo P50s: Intel Core i7 No emergency and critical messages in the dmesg
./perf bench sched all
# Running sched/messaging benchmark...
# 20 sender and receiver processes per group
# 10 groups == 400 processes run
Total time: 0.808 [sec]
# Running sched/pipe benchmark...
# Executed 1000000 pipe operations between two processes
Total time: 9.461 [sec]
9.461262 usecs/op
105694 ops/secThanks
-Zan
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 08 Sep 2022 13:27:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.19.8-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.19.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 08 Sep 2022 13:27:58 +0000. Anything received after that time might be too late.
Build results:
total: 150 pass: 150 fail: 0 Qemu test results: total: 490 pass: 490 fail: 0
Guenter
Hey Greg,
Ran tests and boot tested on my system, no regressions found
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 08 Sep 2022 13:27:58 +0000. Anything received after that time might be too late.
Build test (gcc version 12.2.1 20220819):
mips: 59 configs -> no failure
arm: 99 configs -> no failure
arm64: 3 configs -> no failurex86_64: 4 configs -> no failure
alpha allmodconfig -> no failure
csky allmodconfig -> no failure
powerpc allmodconfig -> no failure
riscv allmodconfig -> no failure
s390 allmodconfig -> no failure
xtensa allmodconfig -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
mips: Booted on ci20 board. No regression. [3]
[1]. https://openqa.qa.codethink.co.uk/tests/1781
[2]. https://openqa.qa.codethink.co.uk/tests/1786
[3]. https://openqa.qa.codethink.co.uk/tests/1788
--
Regards
Sudip
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully cross-compiled for arm64 (bcm2711_defconfig, GCC 10.2.0) and powerpc (ps3_defconfig, GCC 12.1.0).
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Thu, 08 Sep 2022 13:27:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.19.8-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.19.y
and the diffstat can be found below.
openSUSE configs¹⁾ all green.
¹⁾ armv6hl armv7hl arm64 i386 ppc64 ppc64le riscv64 s390x x86_64
Signature · 3 lines
-- js suse labs
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.19.8 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 08 Sep 2022 13:27:58 +0000. Anything received after that time might be too late.
Hi Greg,
5.19.8-rc1 tested.
Run tested on:
- Intel Tiger Lake x86_64 (nuc11 i7-1165G7)
In addition - build tested for:
- Allwinner A64
- Allwinner H3
- Allwinner H5
- Allwinner H6
- NXP iMX6
- NXP iMX8
- Qualcomm Dragonboard
- Rockchip RK3288
- Rockchip RK3328
- Rockchip RK3399pro
- Samsung Exynos5422
--
Rudi