Content-Type: multipart/mixed; boundary="------------Abq1EaETT00qTeX0ojmvcZWG"
Message-ID: <e907527f-c071-c5f1-e83a-3786c750cd45@gmail.com>
Date:   Tue, 4 Jan 2022 17:06:38 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.4.1
Subject: Re: INFO: trying to register non-static key in hci_uart_tx_wakeup
Content-Language: en-US
To:     kvartet <xyru1999@gmail.com>, marcel@holtmann.org,
        johan.hedberg@gmail.com, luiz.dentz@gmail.com,
        linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
Cc:     sunhao.th@gmail.com
References: <CAFkrUsjA1qai+1ysWS_LEUYcMGo+ZRF3v743q6k9e4roF6PWZw@mail.gmail.com>
From:   Pavel Skripkin <paskripkin@gmail.com>
In-Reply-To: <CAFkrUsjA1qai+1ysWS_LEUYcMGo+ZRF3v743q6k9e4roF6PWZw@mail.gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------Abq1EaETT00qTeX0ojmvcZWG
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 1/4/22 11:49, kvartet wrote:
> Hello,
> 
> When using Syzkaller to fuzz the latest Linux kernel, the following
> crash was triggered.
> 
> HEAD commit: a7904a538933 Linux 5.16-rc6
> git tree: upstream
> console output: https://paste.ubuntu.com/p/Bfpr8Gxtd4/plain/
> kernel config: https://paste.ubuntu.com/p/FDDNHDxtwz/plain/
> 
> Sorry, I don't have a reproducer for this crash, hope the symbolized
> report can help.
> If you fix this issue, please add the following tag to the commit:
> Reported-by: Yiru Xu <xyru1999@gmail.com>
> 
> 
> INFO: trying to register non-static key.
> The code is fine but needs lockdep annotation, or maybe
> you didn't initialize this object before use?
> turning off the locking correctness validator.
> CPU: 2 PID: 18524 Comm: syz-executor.5 Not tainted 5.16.0-rc6 #9
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
>   <IRQ>
>   __dump_stack lib/dump_stack.c:88 [inline]
>   dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
>   assign_lock_key kernel/locking/lockdep.c:951 [inline]
>   register_lock_class+0x148d/0x1950 kernel/locking/lockdep.c:1263
>   __lock_acquire+0x106/0x57e0 kernel/locking/lockdep.c:4906
>   lock_acquire kernel/locking/lockdep.c:5637 [inline]
>   lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5602
>   percpu_down_read_trylock include/linux/percpu-rwsem.h:92 [inline]
>   hci_uart_tx_wakeup+0x12e/0x490 drivers/bluetooth/hci_ldisc.c:124
>   h5_timed_event+0x32f/0x6a0 drivers/bluetooth/hci_h5.c:188
>   call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421

hci_uart_proto.open() functions register timer, which may call 
hci_uart_tx_wakeup(), so we need to initalize rwsem before calling
hci_uart_proto.open()

Just for thoughts


With regards,
Pavel Skripkin

--------------Abq1EaETT00qTeX0ojmvcZWG
Content-Type: text/plain; charset=UTF-8; name="ph"
Content-Disposition: attachment; filename="ph"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL2RyaXZlcnMvYmx1ZXRvb3RoL2hjaV9zZXJkZXYuYyBiL2RyaXZlcnMv
Ymx1ZXRvb3RoL2hjaV9zZXJkZXYuYwppbmRleCAzYjAwZDgyZDM2Y2YuLjRjZGE4OTBjZTY0
NyAxMDA2NDQKLS0tIGEvZHJpdmVycy9ibHVldG9vdGgvaGNpX3NlcmRldi5jCisrKyBiL2Ry
aXZlcnMvYmx1ZXRvb3RoL2hjaV9zZXJkZXYuYwpAQCAtMzA1LDYgKzMwNSw4IEBAIGludCBo
Y2lfdWFydF9yZWdpc3Rlcl9kZXZpY2Uoc3RydWN0IGhjaV91YXJ0ICpodSwKIAlpZiAoZXJy
KQogCQlyZXR1cm4gZXJyOwogCisJcGVyY3B1X2luaXRfcndzZW0oJmh1LT5wcm90b19sb2Nr
KTsKKwogCWVyciA9IHAtPm9wZW4oaHUpOwogCWlmIChlcnIpCiAJCWdvdG8gZXJyX29wZW47
CkBAIC0zMjcsNyArMzI5LDYgQEAgaW50IGhjaV91YXJ0X3JlZ2lzdGVyX2RldmljZShzdHJ1
Y3QgaGNpX3VhcnQgKmh1LAogCiAJSU5JVF9XT1JLKCZodS0+aW5pdF9yZWFkeSwgaGNpX3Vh
cnRfaW5pdF93b3JrKTsKIAlJTklUX1dPUksoJmh1LT53cml0ZV93b3JrLCBoY2lfdWFydF93
cml0ZV93b3JrKTsKLQlwZXJjcHVfaW5pdF9yd3NlbSgmaHUtPnByb3RvX2xvY2spOwogCiAJ
LyogT25seSB3aGVuIHZlbmRvciBzcGVjaWZpYyBzZXR1cCBjYWxsYmFjayBpcyBwcm92aWRl
ZCwgY29uc2lkZXIKIAkgKiB0aGUgbWFudWZhY3R1cmVyIGluZm9ybWF0aW9uIHZhbGlkLiBU
aGlzIGF2b2lkcyBmaWxsaW5nIGluIHRoZQo=

--------------Abq1EaETT00qTeX0ojmvcZWG--