Message-ID: <b2962bcd-c35f-26dd-cb4e-8bc7e2807ca2@redhat.com>
Date:   Tue, 24 Jan 2023 12:58:03 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: Re: WARNING: locking bug in pgd_free
Content-Language: en-US
To:     Sanan Hasanov <sanan.hasanov@Knights.ucf.edu>,
        "peterz@infradead.org" <peterz@infradead.org>,
        "mingo@redhat.com" <mingo@redhat.com>,
        "will@kernel.org" <will@kernel.org>,
        "boqun.feng@gmail.com" <boqun.feng@gmail.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc:     "contact@pgazz.com" <contact@pgazz.com>,
        "syzkaller@googlegroups.com" <syzkaller@googlegroups.com>
References: <IA1PR07MB98304A14BD26596C87A8C581ABC99@IA1PR07MB9830.namprd07.prod.outlook.com>
From:   Waiman Long <longman@redhat.com>
In-Reply-To: <IA1PR07MB98304A14BD26596C87A8C581ABC99@IA1PR07MB9830.namprd07.prod.outlook.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk


On 1/24/23 11:22, Sanan Hasanov wrote:
> Good day, dear maintainers,
>
> We found a bug using a modified kernel configuration file used by syzbot.
>
> We enhanced the coverage of the configuration file using our tool, klocalizer.
>
> Kernel Branch: 6.2.0-rc3-next-20230112
> Kernel config: https://drive.google.com/file/d/1Zg-NZ5s04wPVdO8cfpvQjatI-0VAVjZV/view?usp=sharing
>
> Unfortunately, we do not have a reproducer yet.
>
> Thank you!
>
> Best regards,
> Sanan Hasanov
>
> ------------[ cut here ]------------
> DEBUG_LOCKS_WARN_ON(1)
> WARNING: CPU: 5 PID: 7278 at kernel/locking/lockdep.c:232 hlock_class kernel/locking/lockdep.c:232 [inline]
> WARNING: CPU: 5 PID: 7278 at kernel/locking/lockdep.c:232 hlock_class kernel/locking/lockdep.c:221 [inline]
> WARNING: CPU: 5 PID: 7278 at kernel/locking/lockdep.c:232 check_deadlock kernel/locking/lockdep.c:3017 [inline]
> WARNING: CPU: 5 PID: 7278 at kernel/locking/lockdep.c:232 validate_chain kernel/locking/lockdep.c:3819 [inline]
> WARNING: CPU: 5 PID: 7278 at kernel/locking/lockdep.c:232 __lock_acquire+0x24b8/0x5170 kernel/locking/lockdep.c:5056
> Modules linked in:
> CPU: 5 PID: 7278 Comm: systemd-udevd Not tainted 6.2.0-rc3-next-20230112 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:hlock_class kernel/locking/lockdep.c:232 [inline]
> RIP: 0010:hlock_class kernel/locking/lockdep.c:221 [inline]
> RIP: 0010:check_deadlock kernel/locking/lockdep.c:3017 [inline]
> RIP: 0010:validate_chain kernel/locking/lockdep.c:3819 [inline]
> RIP: 0010:__lock_acquire+0x24b8/0x5170 kernel/locking/lockdep.c:5056

This error only happens when the lock class used has been freed 
(zapped). A lock class can be freed by either lockdep_unregister_key() 
or by lockdep_reset_lock(). The lock in question is a static pgd_lock 
defined in arch/x86/mm/fault.c. lockdep_unregister_key() is for 
dynamically allocated key which is not the case for pgd_lock. 
lockdep_reset_lock() is used by locking_selftest.c only. Does your 
config include CONFIG_DEBUG_LOCKING_API_SELFTESTS?

Cheers,
Longman