[v1] Input: serio - don't sleep on serio_mutex from drvctl_store()

[PATCH] Input: serio - don't sleep on serio_mutex from drvctl_store()

Posted by Nguyen Ngoc Thang 5 days, 9 hours ago

Writing to the drvctl attribute takes serio_mutex while holding the
attribute's kernfs active reference. serio_unregister_port() does the
opposite: it holds serio_mutex and device_del() then waits for active
references to drain in kernfs_drain(). If a drvctl write is in flight
when the port is unregistered, the writer waits for serio_mutex and the
unregistering task waits for the writer, and neither makes progress.
Interruptibility of the lock does not help, as nothing signals the writer.

lockdep reports it as:

  WARNING: possible circular locking dependency detected
  repro/4908 is trying to acquire lock:
   (kn->active){++++}-{0:0}, at: __kernfs_remove+0x34c/0xb90
  but task is already holding lock:
   (serio_mutex){+.+.}-{4:4}, at: serio_unregister_port+0x1b/0x40
   drvctl_store
   sysfs_kf_write
   ...
   kernfs_drain
   device_del
   serio_destroy_port
   serio_unregister_port
   userio_char_release

Use mutex_trylock() and restart the syscall when the mutex is busy, so
the active reference is dropped before waiting. Once the port is being
removed the retried write fails with -ENODEV.

Reported-by: syzbot+1075f6dc93f398c1857e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1075f6dc93f398c1857e
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
Root cause: drvctl_store() runs with the attribute's kernfs active reference
held and then takes serio_mutex. serio_unregister_port() takes serio_mutex and
then device_del() -> kernfs_drain() waits for all active references to drop.
A drvctl write that is in flight when the port is unregistered therefore waits
for serio_mutex while the unregistering task waits for that writer: a real
AB-BA deadlock, not just a lockdep false positive. mutex_lock_interruptible()
does not help as nobody signals the writer.

Reproduced in QEMU (x86_64, syzbot config, lockdep): a small program creates
and closes /dev/userio ports in a loop while 4 threads write "psmouse" to the
new port's drvctl. Unpatched kernel: the same circular-dependency splat as the
syzbot report (kn->active <-> serio_mutex, drvctl_store vs
serio_unregister_port/userio_char_release). An earlier, cruder run also left
the unregistering task blocked for >143s (hung task). Patched kernel: 20
create/close rounds complete, no lockdep report, no hang.

Fix: take serio_mutex with mutex_trylock() and restart_syscall() if busy, so
the active reference is dropped before waiting; once removal has begun the
retried write fails with -ENODEV. The only former failure, -EINTR on a signal,
is now covered by the normal syscall restart path.

The Fixes tag points at the original import: the lock order predates git
history (serio_sem) and I could not find a narrower commit.

 drivers/input/serio/serio.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 54dd26249b02..811e65fd4eb3 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -357,7 +357,8 @@ static ssize_t drvctl_store(struct device *dev, struct device_attribute *attr, c
 	struct device_driver *drv;
 	int error;
 
-	scoped_cond_guard(mutex_intr, return -EINTR, &serio_mutex) {
+	/* Port removal holds serio_mutex and drains us: don't wait for it. */
+	scoped_cond_guard(mutex_try, return restart_syscall(), &serio_mutex) {
 		if (!strncmp(buf, "none", count)) {
 			serio_disconnect_port(serio);
 		} else if (!strncmp(buf, "reconnect", count)) {
-- 
2.43.0

Re: [PATCH] Input: serio - don't sleep on serio_mutex from drvctl_store()

Posted by kernel test robot 17 hours ago

Hi Nguyen,

kernel test robot noticed the following build errors:

[auto build test ERROR on dtor-input/next]
[also build test ERROR on dtor-input/for-linus linus/master v7.3-rc4 next-20260922]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Nguyen-Ngoc-Thang/Input-serio-don-t-sleep-on-serio_mutex-from-drvctl_store/20260919-194604
base:   https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git next
patch link:    https://lore.kernel.org/r/20260919124604.210505-1-ngocthang2710.1999%40gmail.com
patch subject: [PATCH] Input: serio - don't sleep on serio_mutex from drvctl_store()
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20260924/202609241230.lUW53GKL-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260924/202609241230.lUW53GKL-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609241230.lUW53GKL-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from include/linux/jump_label.h:78,
                    from include/linux/dynamic_debug.h:6,
                    from include/linux/printk.h:620,
                    from include/asm-generic/bug.h:31,
                    from arch/x86/include/asm/bug.h:195,
                    from arch/x86/include/asm/alternative.h:9,
                    from arch/x86/include/asm/barrier.h:5,
                    from include/linux/list.h:11,
                    from include/linux/module.h:12,
                    from drivers/input/serio/serio.c:14:
   drivers/input/serio/serio.c: In function 'drvctl_store':
>> drivers/input/serio/serio.c:361:45: error: implicit declaration of function 'restart_syscall'; did you mean 'do_no_restart_syscall'? [-Wimplicit-function-declaration]
     361 |         scoped_cond_guard(mutex_try, return restart_syscall(), &serio_mutex) {
         |                                             ^~~~~~~~~~~~~~~
   include/linux/cleanup.h:457:25: note: in definition of macro '__scoped_cond_guard'
     457 |                         _fail;                                          \
         |                         ^~~~~
   drivers/input/serio/serio.c:361:9: note: in expansion of macro 'scoped_cond_guard'
     361 |         scoped_cond_guard(mutex_try, return restart_syscall(), &serio_mutex) {
         |         ^~~~~~~~~~~~~~~~~


vim +361 drivers/input/serio/serio.c

   353	
   354	static ssize_t drvctl_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
   355	{
   356		struct serio *serio = to_serio_port(dev);
   357		struct device_driver *drv;
   358		int error;
   359	
   360		/* Port removal holds serio_mutex and drains us: don't wait for it. */
 > 361		scoped_cond_guard(mutex_try, return restart_syscall(), &serio_mutex) {
   362			if (!strncmp(buf, "none", count)) {
   363				serio_disconnect_port(serio);
   364			} else if (!strncmp(buf, "reconnect", count)) {
   365				serio_reconnect_subtree(serio);
   366			} else if (!strncmp(buf, "rescan", count)) {
   367				serio_disconnect_port(serio);
   368				serio_find_driver(serio);
   369				serio_remove_duplicate_events(serio, SERIO_RESCAN_PORT);
   370			} else if ((drv = driver_find(buf, &serio_bus)) != NULL) {
   371				serio_disconnect_port(serio);
   372				error = serio_bind_driver(serio, to_serio_driver(drv));
   373				serio_remove_duplicate_events(serio, SERIO_RESCAN_PORT);
   374				if (error)
   375					return error;
   376			} else {
   377				return -EINVAL;
   378			}
   379		}
   380	
   381		return count;
   382	}
   383	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] Input: serio - don't sleep on serio_mutex from drvctl_store()

Posted by kernel test robot 22 hours ago

Hi Nguyen,

kernel test robot noticed the following build errors:

[auto build test ERROR on dtor-input/next]
[also build test ERROR on dtor-input/for-linus linus/master v7.3-rc4 next-20260922]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Nguyen-Ngoc-Thang/Input-serio-don-t-sleep-on-serio_mutex-from-drvctl_store/20260919-194604
base:   https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git next
patch link:    https://lore.kernel.org/r/20260919124604.210505-1-ngocthang2710.1999%40gmail.com
patch subject: [PATCH] Input: serio - don't sleep on serio_mutex from drvctl_store()
config: x86_64-kexec (https://download.01.org/0day-ci/archive/20260924/202609240622.tn7TrVy2-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260924/202609240622.tn7TrVy2-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609240622.tn7TrVy2-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/input/serio/serio.c:361:38: error: call to undeclared function 'restart_syscall'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
     361 |         scoped_cond_guard(mutex_try, return restart_syscall(), &serio_mutex) {
         |                                             ^
   1 error generated.


vim +/restart_syscall +361 drivers/input/serio/serio.c

   353	
   354	static ssize_t drvctl_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
   355	{
   356		struct serio *serio = to_serio_port(dev);
   357		struct device_driver *drv;
   358		int error;
   359	
   360		/* Port removal holds serio_mutex and drains us: don't wait for it. */
 > 361		scoped_cond_guard(mutex_try, return restart_syscall(), &serio_mutex) {
   362			if (!strncmp(buf, "none", count)) {
   363				serio_disconnect_port(serio);
   364			} else if (!strncmp(buf, "reconnect", count)) {
   365				serio_reconnect_subtree(serio);
   366			} else if (!strncmp(buf, "rescan", count)) {
   367				serio_disconnect_port(serio);
   368				serio_find_driver(serio);
   369				serio_remove_duplicate_events(serio, SERIO_RESCAN_PORT);
   370			} else if ((drv = driver_find(buf, &serio_bus)) != NULL) {
   371				serio_disconnect_port(serio);
   372				error = serio_bind_driver(serio, to_serio_driver(drv));
   373				serio_remove_duplicate_events(serio, SERIO_RESCAN_PORT);
   374				if (error)
   375					return error;
   376			} else {
   377				return -EINVAL;
   378			}
   379		}
   380	
   381		return count;
   382	}
   383	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki