net/rfkill: WARNING in rfkill_fop_read

[Dmitry Vyukov]

Hello,

The following program triggers WARNING message in rfkill_fop_read:

------------[ cut here ]------------
WARNING: CPU: 2 PID: 6975 at kernel/sched/core.c:7663
__might_sleep+0x138/0x1a0()
do not call blocking ops when !TASK_RUNNING; state=1 set at
[<ffffffff81436e01>] prepare_to_wait_event+0x141/0x410
kernel/sched/wait.c:210
Modules linked in:
CPU: 2 PID: 6975 Comm: a.out Not tainted 4.5.0-rc1+ #283
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 00000000ffffffff ffff88003369f908 ffffffff8299a06d ffff88003369f978
 ffff8800338e0000 ffffffff864453c0 ffff88003369f948 ffffffff8134fcf9
 ffffffff813c9cf8 ffffed00066d3f2b ffffffff864453c0 0000000000001def
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff8299a06d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
 [<ffffffff8134fcf9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
 [<ffffffff8134fe09>] warn_slowpath_fmt+0xa9/0xd0 kernel/panic.c:494
 [<ffffffff813c9cf8>] __might_sleep+0x138/0x1a0 kernel/sched/core.c:7658
 [<ffffffff8634f934>] mutex_lock_nested+0x74/0xa50 kernel/locking/mutex.c:617
 [<     inline     >] rfkill_readable net/rfkill/core.c:1102
 [<ffffffff8613403d>] rfkill_fop_read+0x23d/0x3e0 net/rfkill/core.c:1125
 [<ffffffff817a9831>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719
 [<ffffffff817ad698>] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849
 [<ffffffff817ad803>] vfs_readv+0x83/0xb0 fs/read_write.c:873
 [<     inline     >] SYSC_readv fs/read_write.c:899
 [<ffffffff817b0771>] SyS_readv+0x111/0x2b0 fs/read_write.c:891
 [<ffffffff86359636>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
---[ end trace 8fc3336c73e4219c ]---


// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <pthread.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/wait.h>
#include <stdlib.h>

long r[8];

void* thr(void* arg)
{
  switch ((long)arg) {
  case 0:
    r[0] = syscall(SYS_mmap, 0x20000000ul, 0x50000ul, 0x3ul, 0x32ul,
                   0xfffffffffffffffful, 0x0ul);
    break;
  case 1:
    r[2] = open("/dev/rfkill", O_RDWR);
    break;
  case 2:
    *(uint64_t*)0x20042fe0 = (uint64_t)0x20042ff9;
    *(uint64_t*)0x20042fe8 = (uint64_t)0x7;
    *(uint64_t*)0x20042ff0 = (uint64_t)0x20032fa1;
    *(uint64_t*)0x20042ff8 = (uint64_t)0xf4;
    r[7] = syscall(SYS_readv, r[2], 0x20042fe0ul, 0x2ul, 0, 0, 0);
    break;
  }
  return 0;
}

void worker()
{
  long i;
  pthread_t th[3];

  memset(r, -1, sizeof(r));
  for (i = 0; i < 3; i++) {
    pthread_create(&th[i], 0, thr, (void*)i);
    usleep(10000);
  }
  for (i = 0; i < 3; i++) {
    pthread_create(&th[i], 0, thr, (void*)i);
    if (i % 2 == 0)
      usleep(10000);
  }
  usleep(100000);
}

int main()
{
  int i, status, pids[16];

  for (;;) {
    for (i = 0; i < 16; i++) {
      if ((pids[i] = fork()) == 0) {
        worker();
        exit(0);
      }
    }
    for (i = 0; i < 16; i++) {
      while (waitpid(pids[i], &status, __WALL) != pids[i]) {
      }
    }
  }
  return 0;
}

On commit 92e963f50fc74041b5e9e744c330dca48e04f08d (Jan 24).