UIO: mutex used in interrupt handler causes crash

[Tom Brezinski]

Running:
Bionic Beaver
Ubuntu 4.15.0-62.69-generic 4.15.18

Problem since: Ubuntu-4.15.0-59.66

In commit 725bbc87 on 2/13/2019 in uio.c a mutex_lock was added to uio_interrupt. This results in a "scheduling while atomic" error if someone else owns the mutex at the time it is invoked.

The following commit in the kernel mainline appears to fix this issue:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3d27c4de8d4fb2d4099ff324671792aa2578c6f9

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1843487

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

apport information

[Tom Brezinski (tbrezinski)]

The following commit in the kernel mainline fixes this issue:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3d27c4de8d4fb2d4099ff324671792aa2578c6f9

[Kamal Mostafa (kamalmostafa)]

@Tom- Thanks for reporting this and isolating the cause and the fix. Here's a test kernel which includes a backport of the fix commit. Could you please verify that it resolves the problem?:

https://kernel.ubuntu.com/~kamal/lp1843487/

[Tom Brezinski (tbrezinski)]

@Kamal thanks for the quick response. I tried the files you sent over but it looks like I need some additional packages in order to rebuild my kernel module for that kernel. I tried to tell modprobe to force load my module built against 4.15.0-66 and it would not load it.

[Kamal Mostafa (kamalmostafa)]

@Tom- Ah yes, you'll need the headers packages too, in order to build your own modules. OK, I've now added the two "linux-headers-*" packages to https://kernel.ubuntu.com/~kamal/lp1843487/ ... I believe you'll have to install the pair together.

[Tom Brezinski (tbrezinski)]

@Kamal yes this seems to fix it. I was able to run my device stress test for over 15 minutes. With the bug I was lucky if I could make it 15 seconds.

[Kamal Mostafa (kamalmostafa)]

@Tom Sounds like a winner to me! I've submitted the patch to our process pipeline:
https://lists.ubuntu.com/archives/kernel-team/2019-October/105155.html

A post will appear here once it lands in a production Bionic kernel (most likely in our next three-week cycle, around 18-Nov).

Thanks again for doing the leg-work on this!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Tom Brezinski (tbrezinski)]

Verified fix in proposed 4.15.0-71-generic.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.15.0-72.81

---------------
linux (4.15.0-72.81) bionic; urgency=medium

  * bionic/linux: 4.15.0-72.81 -proposed tracker (LP: #1854027)

  * [Regression] Bionic kernel 4.15.0-71.80 can not boot on ThunderX
    (LP: #1853326)
    - Revert "arm64: Use firmware to detect CPUs that are not affected by
      Spectre-v2"
    - Revert "arm64: Get rid of __smccc_workaround_1_hvc_*"

  * [Regression] Bionic kernel 4.15.0-71.80 can not boot on ThunderX2 and
    Kunpeng920 (LP: #1852723)
    - SAUCE: arm64: capabilities: Move setup_boot_cpu_capabilities() call to
      correct place

linux (4.15.0-71.80) bionic; urgency=medium

  * bionic/linux: 4.15.0-71.80 -proposed tracker (LP: #1852289)

  * Bionic update: upstream stable patchset 2019-10-29 (LP: #1850541)
    - panic: ensure preemption is disabled during panic()
    - f2fs: use EINVAL for superblock with invalid magic
    - [Config] updateconfigs for USB_RIO500
    - USB: rio500: Remove Rio 500 kernel driver
    - USB: yurex: Don't retry on unexpected errors
    - USB: yurex: fix NULL-derefs on disconnect
    - USB: usb-skeleton: fix runtime PM after driver unbind
    - USB: usb-skeleton: fix NULL-deref on disconnect
    - xhci: Fix false warning message about wrong bounce buffer write length
    - xhci: Prevent device initiated U1/U2 link pm if exit latency is too long
    - xhci: Check all endpoints for LPM timeout
    - usb: xhci: wait for CNR controller not ready bit in xhci resume
    - USB: adutux: fix use-after-free on disconnect
    - USB: adutux: fix NULL-derefs on disconnect
    - USB: adutux: fix use-after-free on release
    - USB: iowarrior: fix use-after-free on disconnect
    - USB: iowarrior: fix use-after-free on release
    - USB: iowarrior: fix use-after-free after driver unbind
    - USB: usblp: fix runtime PM after driver unbind
    - USB: chaoskey: fix use-after-free on release
    - USB: ldusb: fix NULL-derefs on driver unbind
    - serial: uartlite: fix exit path null pointer
    - USB: serial: keyspan: fix NULL-derefs on open() and write()
    - USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20
    - USB: serial: option: add Telit FN980 compositions
    - USB: serial: option: add support for Cinterion CLS8 devices
    - USB: serial: fix runtime PM after driver unbind
    - USB: usblcd: fix I/O after disconnect
    - USB: microtek: fix info-leak at probe
    - USB: dummy-hcd: fix power budget for SuperSpeed mode
    - usb: renesas_usbhs: gadget: Do not discard queues in
      usb_ep_set_{halt,wedge}()
    - usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior
    - USB: legousbtower: fix slab info leak at probe
    - USB: legousbtower: fix deadlock on disconnect
    - USB: legousbtower: fix potential NULL-deref on disconnect
    - USB: legousbtower: fix open after failed reset request
    - USB: legousbtower: fix use-after-free on release
    - staging: vt6655: Fix memory leak in vt6655_probe
    - iio: adc: ad799x: fix probe error handling
    - iio: adc: axp288: Override TS pin bias current for some models
    - iio: light: opt3001: fix mutex unlock race
    - efivar/ssdt: Don't iterate over EFI va...