| # Note: 191-194 have the same root cause. |
| TITLE: possible deadlock in perf_trace_init |
| |
| [ 49.707025] ====================================================== |
| [ 49.713322] WARNING: possible circular locking dependency detected |
| [ 49.719607] 4.15.0-rc2+ #122 Not tainted |
| [ 49.723630] ------------------------------------------------------ |
| [ 49.729910] syz-executor6/4896 is trying to acquire lock: |
| [ 49.735409] (event_mutex){+.+.}, at: [<000000009b3a8cd5>] perf_trace_init+0x58/0xab0 |
| [ 49.743358] |
| [ 49.743358] but task is already holding lock: |
| [ 49.749293] (&ctx->mutex){+.+.}, at: [<00000000935cf968>] perf_event_init_task+0x25b/0x890 |
| [ 49.757751] |
| [ 49.757751] which lock already depends on the new lock. |
| [ 49.757751] |
| [ 49.766030] |
| [ 49.766030] the existing dependency chain (in reverse order) is: |
| [ 49.773612] |
| [ 49.773612] -> #8 (&ctx->mutex){+.+.}: |
| [ 49.778947] lock_acquire+0x1d5/0x580 |
| [ 49.783234] __mutex_lock+0x16f/0x1a80 |
| [ 49.787609] mutex_lock_nested+0x16/0x20 |
| [ 49.792155] perf_event_ctx_lock_nested+0x21b/0x450 |
| [ 49.797654] perf_read+0xb9/0x970 |
| [ 49.801594] do_iter_read+0x3db/0x5b0 |
| [ 49.805878] vfs_readv+0x121/0x1c0 |
| [ 49.809903] default_file_splice_read+0x508/0xae0 |
| [ 49.815231] do_splice_to+0x110/0x170 |
| [ 49.819516] SyS_splice+0x11a8/0x1630 |
| [ 49.823803] do_fast_syscall_32+0x3ee/0xf9d |
| [ 49.828612] entry_SYSENTER_compat+0x51/0x60 |
| [ 49.833503] |
| [ 49.833503] -> #7 (&pipe->mutex/1){+.+.}: |
| [ 49.839105] lock_acquire+0x1d5/0x580 |
| [ 49.843391] __mutex_lock+0x16f/0x1a80 |
| [ 49.847763] mutex_lock_nested+0x16/0x20 |
| [ 49.852308] pipe_lock+0x56/0x70 |
| [ 49.856160] iter_file_splice_write+0x264/0xf30 |
| [ 49.861317] SyS_splice+0x7d5/0x1630 |
| [ 49.865516] do_fast_syscall_32+0x3ee/0xf9d |
| [ 49.870326] entry_SYSENTER_compat+0x51/0x60 |
| [ 49.875215] |
| [ 49.875215] -> #6 (sb_writers){.+.+}: |
| [ 49.880465] fs_reclaim_acquire+0x14/0x20 |
| [ 49.885100] kmem_cache_alloc+0x29/0x760 |
| [ 49.889648] __d_alloc+0xb3/0xbe0 |
| [ 49.893586] d_alloc+0x8e/0x340 |
| [ 49.897353] __lookup_hash+0x58/0x190 |
| [ 49.901635] |
| [ 49.901635] -> #5 ((completion)&req.done){+.+.}: |
| [ 49.907839] lock_acquire+0x1d5/0x580 |
| [ 49.912128] wait_for_completion+0xcb/0x7b0 |
| [ 49.916937] devtmpfs_create_node+0x32b/0x4a0 |
| [ 49.921916] device_add+0x120f/0x1640 |
| [ 49.926203] device_create_groups_vargs+0x1f3/0x250 |
| [ 49.931704] device_create+0xda/0x110 |
| [ 49.935991] msr_device_create+0x26/0x40 |
| [ 49.940540] cpuhp_invoke_callback+0x2ea/0x1d20 |
| [ 49.945693] cpuhp_thread_fun+0x48e/0x7e0 |
| [ 49.950330] smpboot_thread_fn+0x450/0x7c0 |
| [ 49.955048] kthread+0x37a/0x440 |
| [ 49.958898] ret_from_fork+0x24/0x30 |
| [ 49.963093] |
| [ 49.963093] -> #4 (cpuhp_state-up){+.+.}: |
| [ 49.968687] lock_acquire+0x1d5/0x580 |
| [ 49.972974] cpuhp_issue_call+0x1e5/0x520 |
| [ 49.977611] __cpuhp_setup_state_cpuslocked+0x282/0x600 |
| [ 49.983458] __cpuhp_setup_state+0xb0/0x140 |
| [ 49.988266] page_writeback_init+0x4d/0x71 |
| [ 49.992987] pagecache_init+0x48/0x4f |
| [ 49.997276] start_kernel+0x6bc/0x74f |
| [ 50.001564] x86_64_start_reservations+0x2a/0x2c |
| [ 50.006804] x86_64_start_kernel+0x77/0x7a |
| [ 50.011526] secondary_startup_64+0xa5/0xb0 |
| [ 50.016329] |
| [ 50.016329] -> #3 (cpuhp_state_mutex){+.+.}: |
| [ 50.022186] lock_acquire+0x1d5/0x580 |
| [ 50.026470] __mutex_lock+0x16f/0x1a80 |
| [ 50.030841] mutex_lock_nested+0x16/0x20 |
| [ 50.035386] __cpuhp_setup_state_cpuslocked+0x5b/0x600 |
| [ 50.041146] __cpuhp_setup_state+0xb0/0x140 |
| [ 50.045951] kvm_guest_init+0x1f3/0x20f |
| [ 50.050409] setup_arch+0x17e8/0x1a02 |
| [ 50.054695] start_kernel+0xa5/0x74f |
| [ 50.058896] x86_64_start_reservations+0x2a/0x2c |
| [ 50.064136] x86_64_start_kernel+0x77/0x7a |
| [ 50.068855] secondary_startup_64+0xa5/0xb0 |
| [ 50.073659] |
| [ 50.073659] -> #2 (cpu_hotplug_lock.rw_sem){++++}: |
| [ 50.080037] lock_acquire+0x1d5/0x580 |
| [ 50.084323] cpus_read_lock+0x42/0x90 |
| [ 50.088611] static_key_slow_inc+0x9d/0x3c0 |
| [ 50.093420] tracepoint_probe_register_prio+0x80d/0x9a0 |
| [ 50.099270] tracepoint_probe_register+0x2a/0x40 |
| [ 50.104511] trace_event_reg+0x167/0x320 |
| [ 50.109059] perf_trace_init+0x4ef/0xab0 |
| [ 50.113607] perf_tp_event_init+0x7d/0xf0 |
| [ 50.118241] perf_try_init_event+0xc9/0x1f0 |
| [ 50.123057] perf_event_alloc+0x1cc6/0x2b00 |
| [ 50.127868] SYSC_perf_event_open+0x842/0x2f10 |
| [ 50.132937] SyS_perf_event_open+0x39/0x50 |
| [ 50.137657] do_fast_syscall_32+0x3ee/0xf9d |
| [ 50.142464] entry_SYSENTER_compat+0x51/0x60 |
| [ 50.147353] |
| [ 50.147353] -> #1 (tracepoints_mutex){+.+.}: |
| [ 50.153211] lock_acquire+0x1d5/0x580 |
| [ 50.157495] __mutex_lock+0x16f/0x1a80 |
| [ 50.161869] mutex_lock_nested+0x16/0x20 |
| [ 50.166415] tracepoint_probe_register_prio+0xa0/0x9a0 |
| [ 50.172176] tracepoint_probe_register+0x2a/0x40 |
| [ 50.177415] trace_event_reg+0x167/0x320 |
| [ 50.181960] perf_trace_init+0x4ef/0xab0 |
| [ 50.186507] perf_tp_event_init+0x7d/0xf0 |
| [ 50.191139] perf_try_init_event+0xc9/0x1f0 |
| [ 50.195945] perf_event_alloc+0x1cc6/0x2b00 |
| [ 50.200752] SYSC_perf_event_open+0x842/0x2f10 |
| [ 50.205821] SyS_perf_event_open+0x39/0x50 |
| [ 50.210540] do_fast_syscall_32+0x3ee/0xf9d |
| [ 50.215349] entry_SYSENTER_compat+0x51/0x60 |
| [ 50.220237] |
| [ 50.220237] -> #0 (event_mutex){+.+.}: |
| [ 50.225571] __lock_acquire+0x3498/0x47f0 |
| [ 50.230203] lock_acquire+0x1d5/0x580 |
| [ 50.234488] __mutex_lock+0x16f/0x1a80 |
| [ 50.238862] mutex_lock_nested+0x16/0x20 |
| [ 50.243408] perf_trace_init+0x58/0xab0 |
| [ 50.247866] perf_tp_event_init+0x7d/0xf0 |
| [ 50.252498] perf_try_init_event+0xc9/0x1f0 |
| [ 50.257306] perf_event_alloc+0x1005/0x2b00 |
| [ 50.262112] inherit_event.isra.92+0x15b/0x920 |
| [ 50.267182] inherit_task_group.isra.94.part.95+0x73/0x240 |
| [ 50.273291] perf_event_init_task+0x348/0x890 |
| [ 50.278275] copy_process.part.36+0x173b/0x4ae0 |
| [ 50.283428] _do_fork+0x1ef/0xff0 |
| [ 50.287366] SyS_clone+0x37/0x50 |
| [ 50.291221] do_fast_syscall_32+0x3ee/0xf9d |
| [ 50.296028] entry_SYSENTER_compat+0x51/0x60 |
| [ 50.300916] |
| [ 50.300916] other info that might help us debug this: |
| [ 50.300916] |
| [ 50.309021] Chain exists of: |
| [ 50.309021] event_mutex --> &pipe->mutex/1 --> &ctx->mutex |
| [ 50.309021] |
| [ 50.319134] Possible unsafe locking scenario: |
| [ 50.319134] |
| [ 50.325156] CPU0 CPU1 |
| [ 50.329785] ---- ---- |
| [ 50.334413] lock(&ctx->mutex); |
| [ 50.337742] lock(&pipe->mutex/1); |
| [ 50.343853] lock(&ctx->mutex); |
| [ 50.349699] lock(event_mutex); |
| [ 50.353031] |
| [ 50.353031] *** DEADLOCK *** |
| [ 50.353031] |
| [ 50.359059] 2 locks held by syz-executor6/4896: |
| [ 50.363687] #0: (&ctx->mutex){+.+.}, at: [<00000000935cf968>] perf_event_init_task+0x25b/0x890 |
| [ 50.372583] #1: (&pmus_srcu){....}, at: [<00000000389c2fa4>] perf_event_alloc+0xf55/0x2b00 |
| [ 50.381128] |
| [ 50.381128] stack backtrace: |
| [ 50.385592] CPU: 0 PID: 4896 Comm: syz-executor6 Not tainted 4.15.0-rc2+ #122 |
| [ 50.392826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 50.402143] Call Trace: |
| [ 50.404698] dump_stack+0x194/0x257 |
| [ 50.408290] ? arch_local_irq_restore+0x53/0x53 |
| [ 50.412927] print_circular_bug+0x42d/0x610 |
| [ 50.417213] ? save_stack_trace+0x1a/0x20 |
| [ 50.421329] check_prev_add+0x666/0x15f0 |
| [ 50.425356] ? copy_trace+0x150/0x150 |
| [ 50.429123] ? check_usage+0xb60/0xb60 |
| [ 50.432981] __lock_acquire+0x3498/0x47f0 |
| [ 50.437094] ? __lock_acquire+0x3498/0x47f0 |
| [ 50.441383] ? perf_trace_run_bpf_submit+0x206/0x330 |
| [ 50.446457] ? debug_check_no_locks_freed+0x3d0/0x3d0 |
| [ 50.451621] ? perf_tp_event+0xae0/0xae0 |
| [ 50.455651] ? perf_tp_event+0x7f4/0xae0 |
| [ 50.459680] ? memset+0x31/0x40 |
| [ 50.462930] ? perf_trace_lock_acquire+0x532/0x980 |
| [ 50.467829] ? perf_trace_lock+0x900/0x900 |
| [ 50.472027] ? perf_tp_event+0xae0/0xae0 |
| [ 50.476061] ? perf_trace_lock+0x4d6/0x900 |
| [ 50.480268] lock_acquire+0x1d5/0x580 |
| [ 50.484034] ? perf_trace_init+0x58/0xab0 |
| [ 50.488150] ? lock_release+0xda0/0xda0 |
| [ 50.492094] ? rcu_note_context_switch+0x710/0x710 |
| [ 50.496990] ? __might_sleep+0x95/0x190 |
| [ 50.500931] ? perf_trace_init+0x58/0xab0 |
| [ 50.505051] __mutex_lock+0x16f/0x1a80 |
| [ 50.508902] ? perf_trace_init+0x58/0xab0 |
| [ 50.513018] ? __lock_acquire+0x6e9/0x47f0 |
| [ 50.517219] ? lock_downgrade+0x980/0x980 |
| [ 50.521332] ? perf_trace_init+0x58/0xab0 |
| [ 50.525447] ? mutex_lock_io_nested+0x1900/0x1900 |
| [ 50.530254] ? debug_check_no_locks_freed+0x3d0/0x3d0 |
| [ 50.535411] ? perf_tp_event+0xae0/0xae0 |
| [ 50.539437] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 50.544420] ? trace_hardirqs_on+0xd/0x10 |
| [ 50.548537] ? perf_trace_lock_acquire+0x532/0x980 |
| [ 50.553435] ? save_stack+0xa3/0xd0 |
| [ 50.557028] ? perf_trace_lock+0x900/0x900 |
| [ 50.561232] ? print_usage_bug+0x3f0/0x3f0 |
| [ 50.565430] ? find_held_lock+0x39/0x1d0 |
| [ 50.569458] ? print_usage_bug+0x3f0/0x3f0 |
| [ 50.573657] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 50.578637] ? __lockdep_init_map+0xe4/0x650 |
| [ 50.583015] ? lockdep_init_map+0x3d/0x70 |
| [ 50.587131] ? module_unload_free+0x5b0/0x5b0 |
| [ 50.591593] ? perf_event_alloc+0xf55/0x2b00 |
| [ 50.595968] mutex_lock_nested+0x16/0x20 |
| [ 50.599993] ? mutex_lock_nested+0x16/0x20 |
| [ 50.604197] perf_trace_init+0x58/0xab0 |
| [ 50.608137] ? refcount_inc_not_zero+0xfe/0x180 |
| [ 50.612770] ? refcount_add+0x60/0x60 |
| [ 50.616533] ? __lockdep_init_map+0xe4/0x650 |
| [ 50.620906] perf_tp_event_init+0x7d/0xf0 |
| [ 50.625023] perf_try_init_event+0xc9/0x1f0 |
| [ 50.629314] perf_event_alloc+0x1005/0x2b00 |
| [ 50.633598] ? find_held_lock+0x39/0x1d0 |
| [ 50.637626] ? __perf_install_in_context+0x2d0/0x2d0 |
| [ 50.642695] ? find_held_lock+0x39/0x1d0 |
| [ 50.646721] ? print_usage_bug+0x3f0/0x3f0 |
| [ 50.650923] ? print_usage_bug+0x3f0/0x3f0 |
| [ 50.655123] ? depot_save_stack+0x1c2/0x490 |
| [ 50.659411] ? lock_release+0xda0/0xda0 |
| [ 50.663351] ? mark_held_locks+0xb2/0x100 |
| [ 50.667467] ? mark_held_locks+0xb2/0x100 |
| [ 50.671579] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 50.676561] ? debug_mutex_init+0x1c/0x60 |
| [ 50.680673] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 50.685655] ? lockdep_init_map+0x3d/0x70 |
| [ 50.689769] ? debug_mutex_init+0x2d/0x60 |
| [ 50.693883] ? __mutex_init+0x1c7/0x2a0 |
| [ 50.697822] ? alloc_perf_context+0x4c/0xe0 |
| [ 50.702110] ? inherit_task_group.isra.94.part.95+0x1a2/0x240 |
| [ 50.707958] ? SyS_membarrier+0x600/0x600 |
| [ 50.712072] ? mark_held_locks+0xb2/0x100 |
| [ 50.716188] ? __raw_spin_lock_init+0x1c/0x100 |
| [ 50.720737] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 50.725718] ? __lockdep_init_map+0xe4/0x650 |
| [ 50.730094] ? lockdep_init_map+0x3d/0x70 |
| [ 50.734208] ? __perf_event_init_context+0xde/0x3b0 |
| [ 50.739190] ? perf_event_mux_interval_ms_store+0x4c0/0x4c0 |
| [ 50.744869] inherit_event.isra.92+0x15b/0x920 |
| [ 50.749418] ? perf_event_create_kernel_counter+0x290/0x290 |
| [ 50.755098] ? rcu_read_lock_sched_held+0x108/0x120 |
| [ 50.760083] ? kmem_cache_alloc_trace+0x459/0x750 |
| [ 50.764892] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 50.769874] ? trace_hardirqs_on+0xd/0x10 |
| [ 50.773990] inherit_task_group.isra.94.part.95+0x73/0x240 |
| [ 50.779585] perf_event_init_task+0x348/0x890 |
| [ 50.784046] ? sched_fork+0x45b/0xc00 |
| [ 50.787815] ? perf_event_attrs+0x40/0x40 |
| [ 50.791931] ? kmem_cache_alloc_trace+0x459/0x750 |
| [ 50.796739] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 50.801720] ? __lockdep_init_map+0xe4/0x650 |
| [ 50.806100] copy_process.part.36+0x173b/0x4ae0 |
| [ 50.810738] ? __cleanup_sighand+0x40/0x40 |
| [ 50.814938] ? __might_sleep+0x95/0x190 |
| [ 50.818879] ? _cond_resched+0x14/0x30 |
| [ 50.822746] ? futex_wait_queue_me+0x527/0x7e0 |
| [ 50.827295] ? refill_pi_state_cache.part.6+0x2f0/0x2f0 |
| [ 50.832627] ? print_usage_bug+0x3f0/0x3f0 |
| [ 50.836828] ? get_futex_value_locked+0xc3/0xf0 |
| [ 50.841465] ? futex_wait_setup+0x22e/0x3d0 |
| [ 50.845753] ? futex_wake+0x680/0x680 |
| [ 50.849526] ? drop_futex_key_refs.isra.13+0x63/0xb0 |
| [ 50.854595] ? futex_wait+0x69e/0x990 |
| [ 50.858360] ? memset+0x31/0x40 |
| [ 50.861606] ? perf_tp_event+0xae0/0xae0 |
| [ 50.865635] ? futex_wait_setup+0x3d0/0x3d0 |
| [ 50.869924] ? debug_check_no_locks_freed+0x3d0/0x3d0 |
| [ 50.875081] ? perf_tp_event+0xae0/0xae0 |
| [ 50.879106] ? hash_futex+0x15/0x210 |
| [ 50.882786] ? drop_futex_key_refs.isra.13+0x63/0xb0 |
| [ 50.887855] ? perf_trace_lock+0x4d6/0x900 |
| [ 50.892058] ? get_futex_key+0x1d50/0x1d50 |
| [ 50.896259] ? trace_event_raw_event_lock+0x340/0x340 |
| [ 50.901420] ? do_futex+0x85b/0x2280 |
| [ 50.905101] ? check_noncircular+0x20/0x20 |
| [ 50.909307] ? exit_robust_list+0x240/0x240 |
| [ 50.913596] ? lock_downgrade+0x980/0x980 |
| [ 50.917710] ? __fget+0xbb/0x580 |
| [ 50.921042] ? find_held_lock+0x39/0x1d0 |
| [ 50.925070] ? lock_release+0xda0/0xda0 |
| [ 50.929017] ? __lock_is_held+0xbc/0x140 |
| [ 50.933049] _do_fork+0x1ef/0xff0 |
| [ 50.936469] ? fork_idle+0x2d0/0x2d0 |
| [ 50.940160] ? iterate_fd+0x3f0/0x3f0 |
| [ 50.943926] ? rcu_pm_notify+0xc0/0xc0 |
| [ 50.947777] ? __fget_light+0x29d/0x390 |
| [ 50.951717] ? fget_raw+0x20/0x20 |
| [ 50.955136] ? rcu_read_lock_sched_held+0x108/0x120 |
| [ 50.960118] ? kmem_cache_free+0x249/0x280 |
| [ 50.964323] ? compat_SyS_futex+0x288/0x380 |
| [ 50.968610] ? compat_SyS_get_robust_list+0x300/0x300 |
| [ 50.973765] ? __fdget+0x18/0x20 |
| [ 50.977098] ? compat_SyS_ioctl+0x77/0x2a30 |
| [ 50.981385] SyS_clone+0x37/0x50 |
| [ 50.984721] ? entry_INT80_compat+0x40/0x40 |
| [ 50.989015] do_fast_syscall_32+0x3ee/0xf9d |
| [ 50.993305] ? do_int80_syscall_32+0x9d0/0x9d0 |
| [ 50.997853] ? lockdep_sys_exit+0x47/0xf0 |
| [ 51.001964] ? syscall_return_slowpath+0x2ad/0x550 |
| [ 51.006858] ? sysret32_from_system_call+0x5/0x3b |
| [ 51.011665] ? trace_hardirqs_off_thunk+0x1a/0x1c |
| [ 51.016473] entry_SYSENTER_compat+0x51/0x60 |
| [ 51.020846] RIP: 0023:0xf7fc8c79 |
| [ 51.024176] RSP: 002b:00000000f77c408c EFLAGS: 00000296 ORIG_RAX: 0000000000000078 |
| [ 51.031848] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000020de9000 |
| [ 51.039085] RDX: 000000002019bffc RSI: 00000000208be000 RDI: 00000000208b4ffc |
| [ 51.046319] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 |
| [ 51.053553] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 |
| [ 51.060790] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 |
