syzbot

unknown

map[Benign:false Explanation:The bug report describes a data race in `kernel/printk/printk.c` involving the `con->seq` field of `struct console`. The race is between two tasks executing the printk subsystem's flushing logic.

**Analysis:**
The race occurs in `console_flush_one_record()`:

```c
// kernel/printk/printk.c

static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool *handover,
				     bool *try_again)
{
    // ...
    for_each_console_srcu(con) {
        // ...
        if (flags & CON_NBCON) {
            // ...
        } else {
            // [1] Call console_emit_next_record. 
            // This function may release the console_lock and hand it over to another CPU.
            progress = console_emit_next_record(con, handover, cookie);
            
            // [2] READ access to con->seq.
            // This is the read in the stack trace (Task 12).
            printk_seq = con->seq;
        }

        // [3] Check if handover occurred.
        if (*handover)
            goto fail;
        // ...
    }
    // ...
}
```

And `console_emit_next_record()`:

```c
static bool console_emit_next_record(struct console *con, bool *handover, int cookie)
{
    // ...
    // [4] WRITE access to con->seq.
    // This is the write in the stack trace (Task 15955).
    con->seq = pmsg.seq + 1;
    // ...
    // [5] Handover check and potential lock release.
    *handover = console_lock_spinning_disable_and_check(cookie);
    // ...
}
```

**Scenario:**
1. **Task 12 (Read side):** Calls `console_emit_next_record()` (at [1]). Inside this function, it successfully prints a record (or tries to) and then checks for a waiter. It detects a waiter (Task 15955) and hands over the console lock (at [5]). At this point, Task 12 **no longer holds the lock**.
2. **Task 15955 (Write side):** Wakes up as the new owner of the console lock. It proceeds to `console_flush_one_record()` and then `console_emit_next_record()`. It updates `con->seq` (at [4]).
3. **Task 12 (Read side):** Returns from `console_emit_next_record()` with `*handover = true`. It then executes line [2]: `printk_seq = con->seq;`. This read happens **concurrently** with Task 15955 writing to `con->seq` and **without holding the console lock**.

**Conclusion:**
The race is consistent and **actionable**. The issue is that `console_flush_one_record()` reads `con->seq` *before* checking if the lock was handed over. If a handover occurred, accessing `con->seq` is unsafe because the new lock owner might be modifying it. Although the read value is discarded (since `*handover` is checked at [3] and the function returns early), accessing a shared variable without a lock concurrently with a writer is a data race (undefined behavior) and can lead to torn reads on 32-bit architectures.

The fix is to move the read of `con->seq` to after the `*handover` check.]

unknown

map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/4aeae5d37f9df5ba432cda82ce8d29bd377b8daa]

unknown

map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/1f8ad2d2db1385df6c115ab1f05be6ae51fa9723]

unknown

map[Index:codesearch-index]

unknown

map[Benign:false]

You are an experienced Linux kernel developer tasked with determining if the given kernel bug
report is actionable or not. Actionable means that it contains enough info to root cause
the underlying bug, and that the report is self-consistent and makes sense, rather than
a one-off nonsensical crash induced by a previous memory corruption.

Use the provided tools to confirm any assumptions, what variables/fields being accessed, etc.
In particular, don't make assumptions about the kernel source code,
use codesearch tools to read the actual source code.

The bug report is a data race report from KCSAN tool.
It contains 2 stack traces of the memory accesses that constitute a data race.
The report would be inconsistent, if the stacks point to different subsystems,
or if they access different fields.
The report would be non-actionable, if the underlysing data race is "benign".
That is, the race is on a simple int/bool or similar field, and the accesses
are not supposed to be protected by any mutual exclusion primitives.
Common examples of such "benign" data races are accesses to various flags fields,
statistics counters, and similar.
An actionable race is "harmful", that is can lead to corruption/crash even with
a conservative compiler that compiles memory accesses to primitive types
effectively as atomic. A common example of a "harmful" data races is race on
a complex container (list/hashmap/etc), where accesses are supposed to be protected
by a mutual exclusion primitive.
In the final reply explain why you think the report is consistent and the data race is harmful.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

The bug report is:

netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0
==================================================================
BUG: KCSAN: data-race in console_flush_all / console_flush_all

write to 0xffffffff86a25cd8 of 8 bytes by task 15955 on cpu 1:
 console_emit_next_record kernel/printk/printk.c:3090 [inline]
 console_flush_one_record kernel/printk/printk.c:3215 [inline]
 console_flush_all+0x38a/0x6c0 kernel/printk/printk.c:3289
 __console_flush_and_unlock kernel/printk/printk.c:3319 [inline]
 console_unlock+0x97/0x270 kernel/printk/printk.c:3359
 vprintk_emit+0x39f/0x5c0 kernel/printk/printk.c:2426
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2441
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2451
 isofs_read_inode fs/isofs/inode.c:1383 [inline]
 __isofs_iget+0xfe9/0x1100 fs/isofs/inode.c:1524
 isofs_iget fs/isofs/isofs.h:135 [inline]
 isofs_get_blocks+0x185/0x490 fs/isofs/inode.c:1069
 isofs_get_block fs/isofs/inode.c:1122 [inline]
 isofs_bmap fs/isofs/inode.c:1133 [inline]
 isofs_bread+0x5b/0x100 fs/isofs/inode.c:1141
 isofs_find_entry fs/isofs/namei.c:59 [inline]
 isofs_lookup+0x1a8/0x930 fs/isofs/namei.c:165
 __lookup_slow+0x193/0x250 fs/namei.c:1866
 lookup_slow+0x3c/0x60 fs/namei.c:1883
 walk_component fs/namei.c:2229 [inline]
 lookup_last fs/namei.c:2730 [inline]
 path_lookupat+0x2f7/0x500 fs/namei.c:2754
 filename_lookup+0x147/0x340 fs/namei.c:2783
 kern_path+0x3b/0x130 fs/namei.c:2996
 find_autofs_mount fs/autofs/dev-ioctl.c:196 [inline]
 autofs_dev_ioctl_ismountpoint+0x12d/0x4c0 fs/autofs/dev-ioctl.c:596
 _autofs_dev_ioctl fs/autofs/dev-ioctl.c:746 [inline]
 autofs_dev_ioctl+0x354/0x6a0 fs/autofs/dev-ioctl.c:762
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xca/0x2b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff86a25cd8 of 8 bytes by task 12 on cpu 0:
 console_flush_one_record kernel/printk/printk.c:3216 [inline]
 console_flush_all+0x549/0x6c0 kernel/printk/printk.c:3289
 __console_flush_and_unlock kernel/printk/printk.c:3319 [inline]
 console_unlock+0x97/0x270 kernel/printk/printk.c:3359
 vprintk_emit+0x39f/0x5c0 kernel/printk/printk.c:2426
 dev_vprintk_emit+0x242/0x2a0 drivers/base/core.c:4914
 dev_printk_emit+0x84/0xb0 drivers/base/core.c:4925
 __netdev_printk+0x34b/0x370 net/core/dev.c:12903
 netdev_info+0x9b/0xd0 net/core/dev.c:12958
 nsim_udp_tunnel_set_port+0x135/0x150 drivers/net/netdevsim/udp_tunnels.c:31
 udp_tunnel_nic_device_sync_one net/ipv4/udp_tunnel_nic.c:-1 [inline]
 udp_tunnel_nic_device_sync_by_port net/ipv4/udp_tunnel_nic.c:249 [inline]
 __udp_tunnel_nic_device_sync+0x567/0x9c0 net/ipv4/udp_tunnel_nic.c:292
 udp_tunnel_nic_device_sync_work+0x5d/0x580 net/ipv4/udp_tunnel_nic.c:740
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340
 worker_thread+0x582/0x770 kernel/workqueue.c:3421
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0x0000000000002831 -> 0x0000000000002832

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work
==================================================================
netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0

The bug report describes a data race in `kernel/printk/printk.c` involving the `con->seq` field of `struct console`. The race is between two tasks executing the printk subsystem's flushing logic.

**Analysis:**
The race occurs in `console_flush_one_record()`:

```c
// kernel/printk/printk.c

static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool *handover,
				     bool *try_again)
{
    // ...
    for_each_console_srcu(con) {
        // ...
        if (flags & CON_NBCON) {
            // ...
        } else {
            // [1] Call console_emit_next_record. 
            // This function may release the console_lock and hand it over to another CPU.
            progress = console_emit_next_record(con, handover, cookie);
            
            // [2] READ access to con->seq.
            // This is the read in the stack trace (Task 12).
            printk_seq = con->seq;
        }

        // [3] Check if handover occurred.
        if (*handover)
            goto fail;
        // ...
    }
    // ...
}
```

And `console_emit_next_record()`:

```c
static bool console_emit_next_record(struct console *con, bool *handover, int cookie)
{
    // ...
    // [4] WRITE access to con->seq.
    // This is the write in the stack trace (Task 15955).
    con->seq = pmsg.seq + 1;
    // ...
    // [5] Handover check and potential lock release.
    *handover = console_lock_spinning_disable_and_check(cookie);
    // ...
}
```

**Scenario:**
1. **Task 12 (Read side):** Calls `console_emit_next_record()` (at [1]). Inside this function, it successfully prints a record (or tries to) and then checks for a waiter. It detects a waiter (Task 15955) and hands over the console lock (at [5]). At this point, Task 12 **no longer holds the lock**.
2. **Task 15955 (Write side):** Wakes up as the new owner of the console lock. It proceeds to `console_flush_one_record()` and then `console_emit_next_record()`. It updates `con->seq` (at [4]).
3. **Task 12 (Read side):** Returns from `console_emit_next_record()` with `*handover = true`. It then executes line [2]: `printk_seq = con->seq;`. This read happens **concurrently** with Task 15955 writing to `con->seq` and **without holding the console lock**.

**Conclusion:**
The race is consistent and **actionable**. The issue is that `console_flush_one_record()` reads `con->seq` *before* checking if the lock was handed over. If a handover occurred, accessing `con->seq` is unsafe because the new lock owner might be modifying it. Although the read value is discarded (since `*handover` is checked at [3] and the function returns early), accessing a shared variable without a lock concurrently with a writer is a data race (undefined behavior) and can lead to torn reads on 32-bit architectures.

The fix is to move the read of `con->seq` to after the `*handover` check.

unknown

unknown

map[SourceFile:kernel/printk/printk.c]

map[Entities:[map[Kind:function Name:__add_preferred_console] map[Kind:function Name:__check_always_kmsg_dump] map[Kind:function Name:__check_console_no_auto_verbose] map[Kind:function Name:__check_console_suspend] map[Kind:function Name:__check_debug_non_panic_cpus] map[Kind:function Name:__check_ignore_loglevel] map[Kind:function Name:__check_time] map[Kind:function Name:__console_flush_and_unlock] map[Kind:function Name:__console_rewind_all] map[Kind:function Name:__console_unlock] map[Kind:function Name:__control_devkmsg] map[Kind:function Name:__do_sys_syslog] map[Kind:function Name:__do_sys_syslog] map[Kind:function Name:__down_trylock_console_sem] map[Kind:function Name:__ia32_sys_syslog] map[Kind:function Name:__pr_flush] map[Kind:function Name:__pr_flush] map[Kind:function Name:__printk_cpu_sync_put] map[Kind:function Name:__printk_cpu_sync_put] map[Kind:function Name:__printk_cpu_sync_try_get] map[Kind:function Name:__printk_cpu_sync_try_get] map[Kind:function Name:__printk_cpu_sync_wait] map[Kind:function Name:__printk_cpu_sync_wait] map[Kind:function Name:__printk_ratelimit] map[Kind:function Name:__printk_ratelimit] map[Kind:function Name:__printk_recursion_counter] map[Kind:function Name:__se_sys_syslog] map[Kind:function Name:__traceiter_console] map[Kind:function Name:__up_console_sem] map[Kind:function Name:__wake_up_klogd] map[Kind:function Name:__x64_sys_syslog] map[Kind:function Name:_printk] map[Kind:function Name:_printk] map[Kind:function Name:_printk_deferred] map[Kind:function Name:add_preferred_console] map[Kind:function Name:add_to_rb] map[Kind:function Name:append_char] map[Kind:function Name:boot_delay_msec] map[Kind:function Name:check_syslog_permissions] map[Kind:function Name:console_call_setup] map[Kind:function Name:console_conditional_schedule] map[Kind:function Name:console_conditional_schedule] map[Kind:function Name:console_cpu_notify] map[Kind:function Name:console_device] map[Kind:function Name:console_emit_next_record] map[Kind:function Name:console_flush_all] map[Kind:function Name:console_flush_on_panic] map[Kind:function Name:console_flush_one_record] map[Kind:function Name:console_force_preferred_locked] map[Kind:function Name:console_force_preferred_locked] map[Kind:function Name:console_init] map[Kind:function Name:console_list_lock] map[Kind:function Name:console_list_lock] map[Kind:function Name:console_list_unlock] map[Kind:function Name:console_list_unlock] map[Kind:function Name:console_lock] map[Kind:function Name:console_lock] map[Kind:function Name:console_lock_spinning_disable_and_check] map[Kind:function Name:console_lock_spinning_enable] map[Kind:function Name:console_msg_format_setup] map[Kind:function Name:console_prepend_dropped] map[Kind:function Name:console_prepend_message] map[Kind:function Name:console_prepend_replay] map[Kind:function Name:console_resume] map[Kind:function Name:console_resume] map[Kind:function Name:console_resume_all] map[Kind:function Name:console_setup] map[Kind:function Name:console_srcu_read_lock] map[Kind:function Name:console_srcu_read_lock] map[Kind:function Name:console_srcu_read_unlock] map[Kind:function Name:console_srcu_read_unlock] map[Kind:function Name:console_suspend] map[Kind:function Name:console_suspend] map[Kind:function Name:console_suspend_all] map[Kind:function Name:console_suspend_disable] map[Kind:function Name:console_try_replay_all] map[Kind:function Name:console_trylock] map[Kind:function Name:console_trylock] map[Kind:function Name:console_trylock_spinning] map[Kind:function Name:console_unblank] map[Kind:function Name:console_unlock] map[Kind:function Name:console_unlock] map[Kind:function Name:console_verbose] map[Kind:function Name:console_verbose] map[Kind:function Name:control_devkmsg] map[Kind:function Name:debug_non_panic_cpus_setup] map[Kind:function Name:defer_console_output] map[Kind:function Name:devkmsg_emit] map[Kind:function Name:devkmsg_llseek] map[Kind:function Name:devkmsg_open] map[Kind:function Name:devkmsg_poll] map[Kind:function Name:devkmsg_read] map[Kind:function Name:devkmsg_release] map[Kind:function Name:devkmsg_sysctl_set_loglvl] map[Kind:function Name:devkmsg_write] map[Kind:function Name:do_syslog] map[Kind:function Name:early_printk] map[Kind:function Name:find_first_fitting_seq] map[Kind:function Name:get_init_console_seq] map[Kind:function Name:get_record_print_text_size] map[Kind:function Name:ignore_loglevel_setup] map[Kind:function Name:info_print_ext_header] map[Kind:function Name:info_print_prefix] map[Kind:function Name:is_console_locked] map[Kind:function Name:is_console_locked] map[Kind:function Name:is_printk_cpu_sync_owner] map[Kind:function Name:keep_bootcon_setup] map[Kind:function Name:kmsg_dump_desc] map[Kind:function Name:kmsg_dump_get_buffer] map[Kind:function Name:kmsg_dump_get_buffer] map[Kind:function Name:kmsg_dump_get_line] map[Kind:function Name:kmsg_dump_get_line] map[Kind:function Name:kmsg_dump_reason_str] map[Kind:function Name:kmsg_dump_reason_str] map[Kind:function Name:kmsg_dump_register] map[Kind:function Name:kmsg_dump_register] map[Kind:function Name:kmsg_dump_rewind] map[Kind:function Name:kmsg_dump_rewind] map[Kind:function Name:kmsg_dump_unregister] map[Kind:function Name:kmsg_dump_unregister] map[Kind:function Name:latched_seq_read_nolock] map[Kind:function Name:latched_seq_write] map[Kind:function Name:legacy_kthread_create] map[Kind:function Name:legacy_kthread_func] map[Kind:function Name:legacy_kthread_should_wakeup] map[Kind:function Name:log_buf_add_cpu] map[Kind:function Name:log_buf_addr_get] map[Kind:function Name:log_buf_len_get] map[Kind:function Name:log_buf_len_setup] map[Kind:function Name:log_buf_len_update] map[Kind:function Name:log_buf_vmcoreinfo_setup] map[Kind:function Name:match_devname_and_update_preferred_console] map[Kind:function Name:match_devname_and_update_preferred_console] map[Kind:function Name:msg_add_dict_text] map[Kind:function Name:msg_add_ext_text] map[Kind:function Name:msg_print_ext_body] map[Kind:function Name:pr_flush] map[Kind:function Name:print_caller] map[Kind:function Name:print_log_buf_usage_stats] map[Kind:function Name:print_syslog] map[Kind:function Name:print_time] map[Kind:function Name:printk_caller_id] map[Kind:function Name:printk_delay] map[Kind:function Name:printk_get_next_message] map[Kind:function Name:printk_kthreads_check_locked] map[Kind:function Name:printk_kthreads_shutdown] map[Kind:function Name:printk_late_init] map[Kind:function Name:printk_legacy_allow_panic_sync] map[Kind:function Name:printk_legacy_allow_spinlock_enter] map[Kind:function Name:printk_legacy_allow_spinlock_exit] map[Kind:function Name:printk_parse_prefix] map[Kind:function Name:printk_percpu_data_ready] map[Kind:function Name:printk_set_kthreads_ready] map[Kind:function Name:printk_sprint] map[Kind:function Name:printk_timed_ratelimit] map[Kind:function Name:printk_timed_ratelimit] map[Kind:function Name:printk_trigger_flush] map[Kind:function Name:record_print_text] map[Kind:function Name:register_console] map[Kind:function Name:register_console] map[Kind:function Name:set_percpu_data_ready] map[Kind:function Name:set_user_specified] map[Kind:function Name:setup_log_buf] map[Kind:function Name:suppress_message_printing] map[Kind:function Name:syslog_action_restricted] map[Kind:function Name:syslog_clear] map[Kind:function Name:syslog_print] map[Kind:function Name:syslog_print_all] map[Kind:function Name:truncate_msg] map[Kind:function Name:try_enable_default_console] map[Kind:function Name:try_enable_preferred_console] map[Kind:function Name:unregister_console] map[Kind:function Name:unregister_console] map[Kind:function Name:unregister_console_locked] map[Kind:function Name:unregister_console_locked] map[Kind:function Name:unregister_console_locked] map[Kind:function Name:vprintk_default] map[Kind:function Name:vprintk_default] map[Kind:function Name:vprintk_deferred] map[Kind:function Name:vprintk_emit] map[Kind:function Name:vprintk_emit] map[Kind:function Name:vprintk_store] map[Kind:function Name:wake_up_klogd] map[Kind:function Name:wake_up_klogd_work_func]] Missing:false]

unknown

unknown

map[IncludeLines:true Name:console_emit_next_record SourceFile:kernel/printk/printk.c]

map[Missing:false SourceCode:3056:	/*
3057:	 * Print one record for the given console. The record printed is whatever
3058:	 * record is the next available record for the given console.
3059:	 *
3060:	 * @handover will be set to true if a printk waiter has taken over the
3061:	 * console_lock, in which case the caller is no longer holding both the
3062:	 * console_lock and the SRCU read lock. Otherwise it is set to false.
3063:	 *
3064:	 * @cookie is the cookie from the SRCU read lock.
3065:	 *
3066:	 * Returns false if the given console has no next record to print, otherwise
3067:	 * true.
3068:	 *
3069:	 * Requires the console_lock and the SRCU read lock.
3070:	 */
3071:	static bool console_emit_next_record(struct console *con, bool *handover, int cookie)
3072:	{
3073:		bool is_extended = console_srcu_read_flags(con) & CON_EXTENDED;
3074:		char *outbuf = &printk_shared_pbufs.outbuf[0];
3075:		struct printk_message pmsg = {
3076:			.pbufs = &printk_shared_pbufs,
3077:		};
3078:		unsigned long flags;
3079:	
3080:		*handover = false;
3081:	
3082:		if (!printk_get_next_message(&pmsg, con->seq, is_extended, true))
3083:			return false;
3084:	
3085:		con->dropped += pmsg.dropped;
3086:	
3087:		/* Skip messages of formatted length 0. */
3088:		if (pmsg.outbuf_len == 0) {
3089:			con->seq = pmsg.seq + 1;
3090:			goto skip;
3091:		}
3092:	
3093:		if (con->dropped && !is_extended) {
3094:			console_prepend_dropped(&pmsg, con->dropped);
3095:			con->dropped = 0;
3096:		}
3097:	
3098:		/* Write everything out to the hardware. */
3099:	
3100:		if (force_legacy_kthread() && !panic_in_progress()) {
3101:			/*
3102:			 * With forced threading this function is in a task context
3103:			 * (either legacy kthread or get_init_console_seq()). There
3104:			 * is no need for concern about printk reentrance, handovers,
3105:			 * or lockdep complaints.
3106:			 */
3107:	
3108:			con->write(con, outbuf, pmsg.outbuf_len);
3109:			con->seq = pmsg.seq + 1;
3110:		} else {
3111:			/*
3112:			 * While actively printing out messages, if another printk()
3113:			 * were to occur on another CPU, it may wait for this one to
3114:			 * finish. This task can not be preempted if there is a
3115:			 * waiter waiting to take over.
3116:			 *
3117:			 * Interrupts are disabled because the hand over to a waiter
3118:			 * must not be interrupted until the hand over is completed
3119:			 * (@console_waiter is cleared).
3120:			 */
3121:			printk_safe_enter_irqsave(flags);
3122:			console_lock_spinning_enable();
3123:	
3124:			/* Do not trace print latency. */
3125:			stop_critical_timings();
3126:	
3127:			printk_legacy_allow_spinlock_enter();
3128:			con->write(con, outbuf, pmsg.outbuf_len);
3129:			printk_legacy_allow_spinlock_exit();
3130:	
3131:			start_critical_timings();
3132:	
3133:			con->seq = pmsg.seq + 1;
3134:	
3135:			*handover = console_lock_spinning_disable_and_check(cookie);
3136:			printk_safe_exit_irqrestore(flags);
3137:		}
3138:	skip:
3139:		return true;
3140:	}
 SourceFile:kernel/printk/printk.c]

unknown

unknown

map[IncludeLines:true Name:console_flush_one_record SourceFile:kernel/printk/printk.c]

map[Missing:false SourceCode:3155:	/*
3156:	 * Print out one record for each console.
3157:	 *
3158:	 * @do_cond_resched is set by the caller. It can be true only in schedulable
3159:	 * context.
3160:	 *
3161:	 * @next_seq is set to the sequence number after the last available record.
3162:	 * The value is valid only when all usable consoles were flushed. It is
3163:	 * when the function returns true (can do the job) and @try_again parameter
3164:	 * is set to false, see below.
3165:	 *
3166:	 * @handover will be set to true if a printk waiter has taken over the
3167:	 * console_lock, in which case the caller is no longer holding the
3168:	 * console_lock. Otherwise it is set to false.
3169:	 *
3170:	 * @try_again will be set to true when it still makes sense to call this
3171:	 * function again. The function could do the job, see the return value.
3172:	 * And some consoles still make progress.
3173:	 *
3174:	 * Returns true when the function could do the job. Some consoles are usable,
3175:	 * and there was no takeover and no panic_on_other_cpu().
3176:	 *
3177:	 * Requires the console_lock.
3178:	 */
3179:	static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool *handover,
3180:					     bool *try_again)
3181:	{
3182:		struct console_flush_type ft;
3183:		bool any_usable = false;
3184:		struct console *con;
3185:		int cookie;
3186:	
3187:		*try_again = false;
3188:	
3189:		printk_get_console_flush_type(&ft);
3190:	
3191:		cookie = console_srcu_read_lock();
3192:		for_each_console_srcu(con) {
3193:			short flags = console_srcu_read_flags(con);
3194:			u64 printk_seq;
3195:			bool progress;
3196:	
3197:			/*
3198:			 * console_flush_one_record() is only responsible for
3199:			 * nbcon consoles when the nbcon consoles cannot print via
3200:			 * their atomic or threaded flushing.
3201:			 */
3202:			if ((flags & CON_NBCON) && (ft.nbcon_atomic || ft.nbcon_offload))
3203:				continue;
3204:	
3205:			if (!console_is_usable(con, flags, !do_cond_resched))
3206:				continue;
3207:			any_usable = true;
3208:	
3209:			if (flags & CON_NBCON) {
3210:				progress = nbcon_legacy_emit_next_record(con, handover, cookie,
3211:									 !do_cond_resched);
3212:				printk_seq = nbcon_seq_read(con);
3213:			} else {
3214:				progress = console_emit_next_record(con, handover, cookie);
3215:				printk_seq = con->seq;
3216:			}
3217:	
3218:			/*
3219:			 * If a handover has occurred, the SRCU read lock
3220:			 * is already released.
3221:			 */
3222:			if (*handover)
3223:				goto fail;
3224:	
3225:			/* Track the next of the highest seq flushed. */
3226:			if (printk_seq > *next_seq)
3227:				*next_seq = printk_seq;
3228:	
3229:			if (!progress)
3230:				continue;
3231:	
3232:			/*
3233:			 * An usable console made a progress. There might still be
3234:			 * pending messages.
3235:			 */
3236:			*try_again = true;
3237:	
3238:			/* Allow panic_cpu to take over the consoles safely. */
3239:			if (panic_on_other_cpu())
3240:				goto fail_srcu;
3241:	
3242:			if (do_cond_resched)
3243:				cond_resched();
3244:		}
3245:		console_srcu_read_unlock(cookie);
3246:	
3247:		return any_usable;
3248:	
3249:	fail_srcu:
3250:		console_srcu_read_unlock(cookie);
3251:	fail:
3252:		*try_again = false;
3253:		return false;
3254:	}
 SourceFile:kernel/printk/printk.c]

unknown

unknown

map[IncludeLines:true Name:console_flush_all SourceFile:kernel/printk/printk.c]

map[Missing:false SourceCode:3256:	/*
3257:	 * Print out all remaining records to all consoles.
3258:	 *
3259:	 * @do_cond_resched is set by the caller. It can be true only in schedulable
3260:	 * context.
3261:	 *
3262:	 * @next_seq is set to the sequence number after the last available record.
3263:	 * The value is valid only when this function returns true. It means that all
3264:	 * usable consoles are completely flushed.
3265:	 *
3266:	 * @handover will be set to true if a printk waiter has taken over the
3267:	 * console_lock, in which case the caller is no longer holding the
3268:	 * console_lock. Otherwise it is set to false.
3269:	 *
3270:	 * Returns true when there was at least one usable console and all messages
3271:	 * were flushed to all usable consoles. A returned false informs the caller
3272:	 * that everything was not flushed (either there were no usable consoles or
3273:	 * another context has taken over printing or it is a panic situation and this
3274:	 * is not the panic CPU). Regardless the reason, the caller should assume it
3275:	 * is not useful to immediately try again.
3276:	 *
3277:	 * Requires the console_lock.
3278:	 */
3279:	static bool console_flush_all(bool do_cond_resched, u64 *next_seq, bool *handover)
3280:	{
3281:		bool try_again;
3282:		bool ret;
3283:	
3284:		*next_seq = 0;
3285:		*handover = false;
3286:	
3287:		do {
3288:			ret = console_flush_one_record(do_cond_resched, next_seq,
3289:						       handover, &try_again);
3290:		} while (try_again);
3291:	
3292:		return ret;
3293:	}
 SourceFile:kernel/printk/printk.c]

unknown

unknown

map[IncludeLines:true Name:__console_flush_and_unlock SourceFile:kernel/printk/printk.c]

map[Missing:false SourceCode:3295:	static void __console_flush_and_unlock(void)
3296:	{
3297:		bool do_cond_resched;
3298:		bool handover;
3299:		bool flushed;
3300:		u64 next_seq;
3301:	
3302:		/*
3303:		 * Console drivers are called with interrupts disabled, so
3304:		 * @console_may_schedule should be cleared before; however, we may
3305:		 * end up dumping a lot of lines, for example, if called from
3306:		 * console registration path, and should invoke cond_resched()
3307:		 * between lines if allowable.  Not doing so can cause a very long
3308:		 * scheduling stall on a slow console leading to RCU stall and
3309:		 * softlockup warnings which exacerbate the issue with more
3310:		 * messages practically incapacitating the system. Therefore, create
3311:		 * a local to use for the printing loop.
3312:		 */
3313:		do_cond_resched = console_may_schedule;
3314:	
3315:		do {
3316:			console_may_schedule = 0;
3317:	
3318:			flushed = console_flush_all(do_cond_resched, &next_seq, &handover);
3319:			if (!handover)
3320:				__console_unlock();
3321:	
3322:			/*
3323:			 * Abort if there was a failure to flush all messages to all
3324:			 * usable consoles. Either it is not possible to flush (in
3325:			 * which case it would be an infinite loop of retrying) or
3326:			 * another context has taken over printing.
3327:			 */
3328:			if (!flushed)
3329:				break;
3330:	
3331:			/*
3332:			 * Some context may have added new records after
3333:			 * console_flush_all() but before unlocking the console.
3334:			 * Re-check if there is a new record to flush. If the trylock
3335:			 * fails, another context is already handling the printing.
3336:			 */
3337:		} while (prb_read_valid(prb, next_seq, NULL) && console_trylock());
3338:	}
 SourceFile:kernel/printk/printk.c]

unknown

unknown

map[SourceFile:kernel/printk/printk.c]

map[Entities:[map[Kind:function Name:__add_preferred_console] map[Kind:function Name:__check_always_kmsg_dump] map[Kind:function Name:__check_console_no_auto_verbose] map[Kind:function Name:__check_console_suspend] map[Kind:function Name:__check_debug_non_panic_cpus] map[Kind:function Name:__check_ignore_loglevel] map[Kind:function Name:__check_time] map[Kind:function Name:__console_flush_and_unlock] map[Kind:function Name:__console_rewind_all] map[Kind:function Name:__console_unlock] map[Kind:function Name:__control_devkmsg] map[Kind:function Name:__do_sys_syslog] map[Kind:function Name:__do_sys_syslog] map[Kind:function Name:__down_trylock_console_sem] map[Kind:function Name:__ia32_sys_syslog] map[Kind:function Name:__pr_flush] map[Kind:function Name:__pr_flush] map[Kind:function Name:__printk_cpu_sync_put] map[Kind:function Name:__printk_cpu_sync_put] map[Kind:function Name:__printk_cpu_sync_try_get] map[Kind:function Name:__printk_cpu_sync_try_get] map[Kind:function Name:__printk_cpu_sync_wait] map[Kind:function Name:__printk_cpu_sync_wait] map[Kind:function Name:__printk_ratelimit] map[Kind:function Name:__printk_ratelimit] map[Kind:function Name:__printk_recursion_counter] map[Kind:function Name:__se_sys_syslog] map[Kind:function Name:__traceiter_console] map[Kind:function Name:__up_console_sem] map[Kind:function Name:__wake_up_klogd] map[Kind:function Name:__x64_sys_syslog] map[Kind:function Name:_printk] map[Kind:function Name:_printk] map[Kind:function Name:_printk_deferred] map[Kind:function Name:add_preferred_console] map[Kind:function Name:add_to_rb] map[Kind:function Name:append_char] map[Kind:function Name:boot_delay_msec] map[Kind:function Name:check_syslog_permissions] map[Kind:function Name:console_call_setup] map[Kind:function Name:console_conditional_schedule] map[Kind:function Name:console_conditional_schedule] map[Kind:function Name:console_cpu_notify] map[Kind:function Name:console_device] map[Kind:function Name:console_emit_next_record] map[Kind:function Name:console_flush_all] map[Kind:function Name:console_flush_on_panic] map[Kind:function Name:console_flush_one_record] map[Kind:function Name:console_force_preferred_locked] map[Kind:function Name:console_force_preferred_locked] map[Kind:function Name:console_init] map[Kind:function Name:console_list_lock] map[Kind:function Name:console_list_lock] map[Kind:function Name:console_list_unlock] map[Kind:function Name:console_list_unlock] map[Kind:function Name:console_lock] map[Kind:function Name:console_lock] map[Kind:function Name:console_lock_spinning_disable_and_check] map[Kind:function Name:console_lock_spinning_enable] map[Kind:function Name:console_msg_format_setup] map[Kind:function Name:console_prepend_dropped] map[Kind:function Name:console_prepend_message] map[Kind:function Name:console_prepend_replay] map[Kind:function Name:console_resume] map[Kind:function Name:console_resume] map[Kind:function Name:console_resume_all] map[Kind:function Name:console_setup] map[Kind:function Name:console_srcu_read_lock] map[Kind:function Name:console_srcu_read_lock] map[Kind:function Name:console_srcu_read_unlock] map[Kind:function Name:console_srcu_read_unlock] map[Kind:function Name:console_suspend] map[Kind:function Name:console_suspend] map[Kind:function Name:console_suspend_all] map[Kind:function Name:console_suspend_disable] map[Kind:function Name:console_try_replay_all] map[Kind:function Name:console_trylock] map[Kind:function Name:console_trylock] map[Kind:function Name:console_trylock_spinning] map[Kind:function Name:console_unblank] map[Kind:function Name:console_unlock] map[Kind:function Name:console_unlock] map[Kind:function Name:console_verbose] map[Kind:function Name:console_verbose] map[Kind:function Name:control_devkmsg] map[Kind:function Name:debug_non_panic_cpus_setup] map[Kind:function Name:defer_console_output] map[Kind:function Name:devkmsg_emit] map[Kind:function Name:devkmsg_llseek] map[Kind:function Name:devkmsg_open] map[Kind:function Name:devkmsg_poll] map[Kind:function Name:devkmsg_read] map[Kind:function Name:devkmsg_release] map[Kind:function Name:devkmsg_sysctl_set_loglvl] map[Kind:function Name:devkmsg_write] map[Kind:function Name:do_syslog] map[Kind:function Name:early_printk] map[Kind:function Name:find_first_fitting_seq] map[Kind:function Name:get_init_console_seq] map[Kind:function Name:get_record_print_text_size] map[Kind:function Name:ignore_loglevel_setup] map[Kind:function Name:info_print_ext_header] map[Kind:function Name:info_print_prefix] map[Kind:function Name:is_console_locked] map[Kind:function Name:is_console_locked] map[Kind:function Name:is_printk_cpu_sync_owner] map[Kind:function Name:keep_bootcon_setup] map[Kind:function Name:kmsg_dump_desc] map[Kind:function Name:kmsg_dump_get_buffer] map[Kind:function Name:kmsg_dump_get_buffer] map[Kind:function Name:kmsg_dump_get_line] map[Kind:function Name:kmsg_dump_get_line] map[Kind:function Name:kmsg_dump_reason_str] map[Kind:function Name:kmsg_dump_reason_str] map[Kind:function Name:kmsg_dump_register] map[Kind:function Name:kmsg_dump_register] map[Kind:function Name:kmsg_dump_rewind] map[Kind:function Name:kmsg_dump_rewind] map[Kind:function Name:kmsg_dump_unregister] map[Kind:function Name:kmsg_dump_unregister] map[Kind:function Name:latched_seq_read_nolock] map[Kind:function Name:latched_seq_write] map[Kind:function Name:legacy_kthread_create] map[Kind:function Name:legacy_kthread_func] map[Kind:function Name:legacy_kthread_should_wakeup] map[Kind:function Name:log_buf_add_cpu] map[Kind:function Name:log_buf_addr_get] map[Kind:function Name:log_buf_len_get] map[Kind:function Name:log_buf_len_setup] map[Kind:function Name:log_buf_len_update] map[Kind:function Name:log_buf_vmcoreinfo_setup] map[Kind:function Name:match_devname_and_update_preferred_console] map[Kind:function Name:match_devname_and_update_preferred_console] map[Kind:function Name:msg_add_dict_text] map[Kind:function Name:msg_add_ext_text] map[Kind:function Name:msg_print_ext_body] map[Kind:function Name:pr_flush] map[Kind:function Name:print_caller] map[Kind:function Name:print_log_buf_usage_stats] map[Kind:function Name:print_syslog] map[Kind:function Name:print_time] map[Kind:function Name:printk_caller_id] map[Kind:function Name:printk_delay] map[Kind:function Name:printk_get_next_message] map[Kind:function Name:printk_kthreads_check_locked] map[Kind:function Name:printk_kthreads_shutdown] map[Kind:function Name:printk_late_init] map[Kind:function Name:printk_legacy_allow_panic_sync] map[Kind:function Name:printk_legacy_allow_spinlock_enter] map[Kind:function Name:printk_legacy_allow_spinlock_exit] map[Kind:function Name:printk_parse_prefix] map[Kind:function Name:printk_percpu_data_ready] map[Kind:function Name:printk_set_kthreads_ready] map[Kind:function Name:printk_sprint] map[Kind:function Name:printk_timed_ratelimit] map[Kind:function Name:printk_timed_ratelimit] map[Kind:function Name:printk_trigger_flush] map[Kind:function Name:record_print_text] map[Kind:function Name:register_console] map[Kind:function Name:register_console] map[Kind:function Name:set_percpu_data_ready] map[Kind:function Name:set_user_specified] map[Kind:function Name:setup_log_buf] map[Kind:function Name:suppress_message_printing] map[Kind:function Name:syslog_action_restricted] map[Kind:function Name:syslog_clear] map[Kind:function Name:syslog_print] map[Kind:function Name:syslog_print_all] map[Kind:function Name:truncate_msg] map[Kind:function Name:try_enable_default_console] map[Kind:function Name:try_enable_preferred_console] map[Kind:function Name:unregister_console] map[Kind:function Name:unregister_console] map[Kind:function Name:unregister_console_locked] map[Kind:function Name:unregister_console_locked] map[Kind:function Name:unregister_console_locked] map[Kind:function Name:vprintk_default] map[Kind:function Name:vprintk_default] map[Kind:function Name:vprintk_deferred] map[Kind:function Name:vprintk_emit] map[Kind:function Name:vprintk_emit] map[Kind:function Name:vprintk_store] map[Kind:function Name:wake_up_klogd] map[Kind:function Name:wake_up_klogd_work_func]] Missing:false]

unknown

unknown

map[IncludeLines:true Name:console_trylock SourceFile:kernel/printk/printk.c]

map[Missing:false SourceCode:2848:	/**
2849:	 * console_trylock - try to block the console subsystem from printing
2850:	 *
2851:	 * Try to acquire a lock which guarantees that no consoles will
2852:	 * be in or enter their write() callback.
2853:	 *
2854:	 * returns 1 on success, and 0 on failure to acquire the lock.
2855:	 */
2856:	int console_trylock(void)
2857:	{
2858:		/* On panic, the console_lock must be left to the panic cpu. */
2859:		if (panic_on_other_cpu())
2860:			return 0;
2861:		if (down_trylock_console_sem())
2862:			return 0;
2863:		console_locked = 1;
2864:		console_may_schedule = 0;
2865:		return 1;
2866:	}
 SourceFile:kernel/printk/printk.c]

unknown

unknown

map[IncludeLines:true Name:vprintk_emit SourceFile:kernel/printk/printk.c]

map[Missing:false SourceCode:2369:	asmlinkage int vprintk_emit(int facility, int level,
2370:				    const struct dev_printk_info *dev_info,
2371:				    const char *fmt, va_list args)
2372:	{
2373:		struct console_flush_type ft;
2374:		int printed_len;
2375:	
2376:		/* Suppress unimportant messages after panic happens */
2377:		if (unlikely(suppress_printk))
2378:			return 0;
2379:	
2380:		/*
2381:		 * The messages on the panic CPU are the most important. If
2382:		 * non-panic CPUs are generating any messages, they will be
2383:		 * silently dropped.
2384:		 */
2385:		if (panic_on_other_cpu() &&
2386:		    !debug_non_panic_cpus &&
2387:		    !panic_triggering_all_cpu_backtrace)
2388:			return 0;
2389:	
2390:		printk_get_console_flush_type(&ft);
2391:	
2392:		/* If called from the scheduler, we can not call up(). */
2393:		if (level == LOGLEVEL_SCHED) {
2394:			level = LOGLEVEL_DEFAULT;
2395:			ft.legacy_offload |= ft.legacy_direct && !console_irqwork_blocked;
2396:			ft.legacy_direct = false;
2397:		}
2398:	
2399:		printk_delay(level);
2400:	
2401:		printed_len = vprintk_store(facility, level, dev_info, fmt, args);
2402:	
2403:		if (ft.nbcon_atomic)
2404:			nbcon_atomic_flush_pending();
2405:	
2406:		if (ft.nbcon_offload)
2407:			nbcon_kthreads_wake();
2408:	
2409:		if (ft.legacy_direct) {
2410:			/*
2411:			 * The caller may be holding system-critical or
2412:			 * timing-sensitive locks. Disable preemption during
2413:			 * printing of all remaining records to all consoles so that
2414:			 * this context can return as soon as possible. Hopefully
2415:			 * another printk() caller will take over the printing.
2416:			 */
2417:			preempt_disable();
2418:			/*
2419:			 * Try to acquire and then immediately release the console
2420:			 * semaphore. The release will print out buffers. With the
2421:			 * spinning variant, this context tries to take over the
2422:			 * printing from another printing context.
2423:			 */
2424:			if (console_trylock_spinning())
2425:				console_unlock();
2426:			preempt_enable();
2427:		}
2428:	
2429:		if (ft.legacy_offload)
2430:			defer_console_output();
2431:		else if (!console_irqwork_blocked)
2432:			wake_up_klogd();
2433:	
2434:		return printed_len;
2435:	}
 SourceFile:kernel/printk/printk.c]

unknown

unknown

map[IncludeLines:true Name:console_trylock_spinning SourceFile:kernel/printk/printk.c]

map[Missing:false SourceCode:1967:	/**
1968:	 * console_trylock_spinning - try to get console_lock by busy waiting
1969:	 *
1970:	 * This allows to busy wait for the console_lock when the current
1971:	 * owner is running in specially marked sections. It means that
1972:	 * the current owner is running and cannot reschedule until it
1973:	 * is ready to lose the lock.
1974:	 *
1975:	 * Return: 1 if we got the lock, 0 othrewise
1976:	 */
1977:	static int console_trylock_spinning(void)
1978:	{
1979:		struct task_struct *owner = NULL;
1980:		bool waiter;
1981:		bool spin = false;
1982:		unsigned long flags;
1983:	
1984:		if (console_trylock())
1985:			return 1;
1986:	
1987:		/*
1988:		 * It's unsafe to spin once a panic has begun. If we are the
1989:		 * panic CPU, we may have already halted the owner of the
1990:		 * console_sem. If we are not the panic CPU, then we should
1991:		 * avoid taking console_sem, so the panic CPU has a better
1992:		 * chance of cleanly acquiring it later.
1993:		 */
1994:		if (panic_in_progress())
1995:			return 0;
1996:	
1997:		printk_safe_enter_irqsave(flags);
1998:	
1999:		raw_spin_lock(&console_owner_lock);
2000:		owner = READ_ONCE(console_owner);
2001:		waiter = READ_ONCE(console_waiter);
2002:		if (!waiter && owner && owner != current) {
2003:			WRITE_ONCE(console_waiter, true);
2004:			spin = true;
2005:		}
2006:		raw_spin_unlock(&console_owner_lock);
2007:	
2008:		/*
2009:		 * If there is an active printk() writing to the
2010:		 * consoles, instead of having it write our data too,
2011:		 * see if we can offload that load from the active
2012:		 * printer, and do some printing ourselves.
2013:		 * Go into a spin only if there isn't already a waiter
2014:		 * spinning, and there is an active printer, and
2015:		 * that active printer isn't us (recursive printk?).
2016:		 */
2017:		if (!spin) {
2018:			printk_safe_exit_irqrestore(flags);
2019:			return 0;
2020:		}
2021:	
2022:		/* We spin waiting for the owner to release us */
2023:		spin_acquire(&console_owner_dep_map, 0, 0, _THIS_IP_);
2024:		/* Owner will clear console_waiter on hand off */
2025:		while (READ_ONCE(console_waiter))
2026:			cpu_relax();
2027:		spin_release(&console_owner_dep_map, _THIS_IP_);
2028:	
2029:		printk_safe_exit_irqrestore(flags);
2030:		/*
2031:		 * The owner passed the console lock to us.
2032:		 * Since we did not spin on console lock, annotate
2033:		 * this as a trylock. Otherwise lockdep will
2034:		 * complain.
2035:		 */
2036:		mutex_acquire(&console_lock_dep_map, 0, 1, _THIS_IP_);
2037:	
2038:		/*
2039:		 * Update @console_may_schedule for trylock because the previous
2040:		 * owner may have been schedulable.
2041:		 */
2042:		console_may_schedule = 0;
2043:	
2044:		return 1;
2045:	}
 SourceFile:kernel/printk/printk.c]

unknown

unknown

map[Benign:false]

map[Benign:false]

unknown