[BUG] sched: WARNING in __clear_task_blocked_on()

[Jeongho Choi]

Hello,

We are seeing a reproducible kernel panic related to the sched code
during probe

This issue occurs as a WARNING in the `WARN_ON_ONCE` code of the
`__clear_task_blocked_on()` function, which immediately triggers a panic
due to the `panic_on_warn` setting.

Environment:

Architecture: arm64
Kernel: Linux 6.18.21
Base: Android Common Kernel (android17-6.18)
Affected area: include/linux/sched.h

The relevant error/panic log is:
[    3.107804] [7:       modprobe:  532] WARNING: CPU: 7 PID: 532 at
include/linux/sched.h:2259 rwsem_mark_wake+0x3d8/0x408

[    3.108951] [7:       modprobe:  532] CPU: 7 UID: 0 PID: 532 Comm:
modprobe Tainted: G           OE
6.18.21-android17-5-ga1a8e8cab9ec-4k #1 PREEMPT
e0006e62dcbab4e76968dae147108b649e8f2b88

[    3.109033] [7:       modprobe:  532] pstate: a34020c5 (NzCv daIF
+PAN -UAO +TCO +DIT -SSBS BTYPE=--)
[    3.109044] [7:       modprobe:  532] pc :
rwsem_mark_wake+0x3d8/0x408
[    3.109048] [7:       modprobe:  532] lr :
rwsem_mark_wake+0x1bc/0x408
[    3.109050] [7:       modprobe:  532] sp : ffffffc096a031d0
[    3.109052] [7:       modprobe:  532] x29: ffffffc096a031f0 x28:
ffffffe95bb97d98 x27: 000000001dd00000
[    3.109072] [7:       modprobe:  532] x26: ffffffc095693a20 x25:
ffffffc096a031d8 x24: ffffffffffffffff
[    3.109076] [7:       modprobe:  532] x23: 0000000000000000 x22:
ffffffc096a031d8 x21: ffffff88021ebd80
[    3.109081] [7:       modprobe:  532] x20: ffffff88001062a8 x19:
ffffffc096a03240 x18: ffffffe95adce240
[    3.109087] [7:       modprobe:  532] x17: 00000000c66b5183 x16:
00000000c66b5183 x15: 0000000000000001
[    3.109091] [7:       modprobe:  532] x14: fffffffffe000000 x13:
ffffff88055beb58 x12: 0000000000000000
[    3.109096] [7:       modprobe:  532] x11: 0000000000000008 x10:
0000000000000001 x9 : 0000000000000003
[    3.109101] [7:       modprobe:  532] x8 : ffffff8800106269 x7 :
7f7f7f7f7f7f7f7f x6 : fefefeff71646b6f
[    3.109105] [7:       modprobe:  532] x5 : 8080808000000000 x4 :
0000000000000020 x3 : 0000000072656c70
[    3.109110] [7:       modprobe:  532] x2 : ffffffc096a031d8 x1 :
0000000000000000 x0 : ffffff88021ec7c0
[    3.109124] [7:       modprobe:  532] Call trace:
[    3.109142] [7:       modprobe:  532]  rwsem_mark_wake+0x3d8/0x408
(P)
[    3.109157] [7:       modprobe:  532]  up_write+0xa8/0x14c
[    3.109165] [7:       modprobe:  532]  kernfs_link_sibling+0xd8/0x16c
[    3.109199] [7:       modprobe:  532]  kernfs_add_one+0x84/0x154
[    3.109223] [7:       modprobe:  532]
kernfs_create_dir_ns+0xc0/0x104
[    3.109227] [7:       modprobe:  532]  sysfs_create_dir_ns+0x80/0xf8
[    3.109231] [7:       modprobe:  532]
kobject_add_internal+0xc0/0x2e0
[    3.109240] [7:       modprobe:  532]  kobject_add+0x90/0x100
[    3.109243] [7:       modprobe:  532]
class_dir_create_and_add+0x7c/0xec
[    3.109270] [7:       modprobe:  532]  get_device_parent+0xb4/0x148
[    3.109274] [7:       modprobe:  532]  device_add+0x74/0x884
[    3.109277] [7:       modprobe:  532]
device_create_groups_vargs+0xd0/0x164
[    3.109352] [7:       modprobe:  532]  device_create+0x58/0x80
[    3.109355] [7:       modprobe:  532]
***_create+0x1f4/0x4d8 
[    3.110504] [7:       modprobe:  532]
***_probe+0x1ac/0x2f8
[    3.110594] [7:       modprobe:  532]
***_module_register_client_module+0xa8/0x118
[    3.111616] [7:       modprobe:  532]
***_driver_register+0x3c/0x50 
[    3.111763] [7:       modprobe:  532]  init_module+0x50/0xf30
[    3.111824] [7:       modprobe:  532]  do_one_initcall+0xdc/0x374
[    3.111861] [7:       modprobe:  532]  do_init_module+0x60/0x4b4
[    3.111889] [7:       modprobe:  532]  load_module+0x2a74/0x2cd0
[    3.111899] [7:       modprobe:  532]
__arm64_sys_finit_module+0x230/0x31c
[    3.111901] [7:       modprobe:  532]  invoke_syscall+0x58/0xe4
[    3.111929] [7:       modprobe:  532]  do_el0_svc+0x48/0xdc
[    3.111937] [7:       modprobe:  532]  el0_svc+0x3c/0x98
[    3.111982] [7:       modprobe:  532]
el0t_64_sync_handler+0x20/0x130
[    3.111985] [7:       modprobe:  532]  el0t_64_sync+0x1c4/0x1c8



The code at the WARN location mentioned in the log above is as follows.

2249 static inline void __clear_task_blocked_on(struct task_struct *p,
 void *m)
2250 {
2251         /* Currently we serialize blocked_on under the
 task::blocked_lock */
2252         lockdep_assert_held_once(&p->blocked_lock);
2253         /*
2254          * There may be cases where we re-clear already
 cleared
2255          * blocked_on relationships, but make sure we are
 not
2256          * clearing the relationship with a different lock.
2257          */
2258         WARN_ON_ONCE(m && p->blocked_on.lock &&
2259                      p->blocked_on.lock != m &&
 p->blocked_on.lock != PROXY_WAKING);


Additionally, I have discovered the following patches in the current 7.2
mainline kernel that have not been applied to the 6.18.21 kernel.
Could these patches be related to the current WARNING issue?


https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/linux/sched.h?h=v7.2-rc2&id=f13beb010e4ab0735c9e46802cbcc820a8bd6467 

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/linux/sched.h?h=v7.2-rc2&id=4c2a20413d7fb3fc3dd7adf233a4f82bb203fb58 

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/linux/sched.h?h=v7.2-rc2&id=1628b25248d0742b2ce9c7cfa59cd183e35f37e1 

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/linux/sched.h?h=v7.2-rc2&id=ec9d4f1c424134bbf30965075df78d02a5d021dc 

2262se review this issue.
Thanks,
Jeongho Choi