Hello, The following program triggers WARNING message in rfkill_fop_read: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 6975 at kernel/sched/core.c:7663 __might_sleep+0x138/0x1a0() do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff81436e01>] prepare_to_wait_event+0x141/0x410 kernel/sched/wait.c:210 Modules linked in: CPU: 2 PID: 6975 Comm: a.out Not tainted 4.5.0-rc1+ #283 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 00000000ffffffff ffff88003369f908 ffffffff8299a06d ffff88003369f978 ffff8800338e0000 ffffffff864453c0 ffff88003369f948 ffffffff8134fcf9 ffffffff813c9cf8 ffffed00066d3f2b ffffffff864453c0 0000000000001def Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff8299a06d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 [<ffffffff8134fcf9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 [<ffffffff8134fe09>] warn_slowpath_fmt+0xa9/0xd0 kernel/panic.c:494 [<ffffffff813c9cf8>] __might_sleep+0x138/0x1a0 kernel/sched/core.c:7658 [<ffffffff8634f934>] mutex_lock_nested+0x74/0xa50 kernel/locking/mutex.c:617 [< inline >] rfkill_readable net/rfkill/core.c:1102 [<ffffffff8613403d>] rfkill_fop_read+0x23d/0x3e0 net/rfkill/core.c:1125 [<ffffffff817a9831>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719 [<ffffffff817ad698>] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849 [<ffffffff817ad803>] vfs_readv+0x83/0xb0 fs/read_write.c:873 [< inline >] SYSC_readv fs/read_write.c:899 [<ffffffff817b0771>] SyS_readv+0x111/0x2b0 fs/read_write.c:891 [<ffffffff86359636>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 ---[ end trace 8fc3336c73e4219c ]--- // autogenerated by syzkaller (http://github.com/google/syzkaller) #include <pthread.h> #include <stdint.h> #include <string.h> #include <sys/syscall.h> #include <unistd.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/wait.h> #include <stdlib.h> long r[8]; void* thr(void* arg) { switch ((long)arg) { case 0: r[0] = syscall(SYS_mmap, 0x20000000ul, 0x50000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); break; case 1: r[2] = open("/dev/rfkill", O_RDWR); break; case 2: *(uint64_t*)0x20042fe0 = (uint64_t)0x20042ff9; *(uint64_t*)0x20042fe8 = (uint64_t)0x7; *(uint64_t*)0x20042ff0 = (uint64_t)0x20032fa1; *(uint64_t*)0x20042ff8 = (uint64_t)0xf4; r[7] = syscall(SYS_readv, r[2], 0x20042fe0ul, 0x2ul, 0, 0, 0); break; } return 0; } void worker() { long i; pthread_t th[3]; memset(r, -1, sizeof(r)); for (i = 0; i < 3; i++) { pthread_create(&th[i], 0, thr, (void*)i); usleep(10000); } for (i = 0; i < 3; i++) { pthread_create(&th[i], 0, thr, (void*)i); if (i % 2 == 0) usleep(10000); } usleep(100000); } int main() { int i, status, pids[16]; for (;;) { for (i = 0; i < 16; i++) { if ((pids[i] = fork()) == 0) { worker(); exit(0); } } for (i = 0; i < 16; i++) { while (waitpid(pids[i], &status, __WALL) != pids[i]) { } } } return 0; } On commit 92e963f50fc74041b5e9e744c330dca48e04f08d (Jan 24). -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
