[syzbot] WARNING: locking bug in inet_send_prepare

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a5541c0811a0 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=124dd2a2480000
kernel config: https://syzkaller.appspot.com/x/.config?x=cbd4e584773e9397
dashboard link: https://syzkaller.appspot.com/bug?extid=52866e24647f9a23403f
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d322e0480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1208adc4480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4b7702208fb9/disk-a5541c08.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9ec0153ec051/vmlinux-a5541c08.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6f8725ad290a/Image-a5541c08.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+52866e...@syzkaller.appspotmail.com

------------[ cut here ]------------
Looking for class "l2tp_sock" with key l2tp_socket_class, but found a different class "slock-AF_INET6" with the same key
WARNING: CPU: 0 PID: 24577 at kernel/locking/lockdep.c:940 look_up_lock_class+0x158/0x160
Modules linked in:
CPU: 0 PID: 24577 Comm: syz-executor105 Not tainted 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : look_up_lock_class+0x158/0x160
lr : look_up_lock_class+0x154/0x160 kernel/locking/lockdep.c:937
sp : ffff800014a7b980
x29: ffff800014a7b980 x28: 0000000000000000 x27: 0000000000000000
x26: ffff0000d0864bb0 x25: ffff80000b22ff14 x24: 0000000000000000
x23: ffff80000eec8000 x22: 0000000000000001 x21: ffff80000f1c3018
x20: 0000000000000000 x19: ffff80000dc27c18 x18: 0000000000000000
x17: 6f6620747562202c x16: 7373616c635f7465 x15: 6b636f735f707432
x14: 6c2079656b206874 x13: 205d373735343254 x12: 5b5d313634303832
x11: ff808000081c4d64 x10: 0000000000000000 x9 : ad3022ef6adb7200
x8 : ad3022ef6adb7200 x7 : 545b5d3136343038 x6 : ffff80000c091ebc
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000100000201 x0 : ffff80000dc27c18
Call trace:
look_up_lock_class+0x158/0x160
register_lock_class+0x4c/0x2f8 kernel/locking/lockdep.c:1289
__lock_acquire+0xa8/0x3084 kernel/locking/lockdep.c:4934
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
lock_sock include/net/sock.h:1721 [inline]
inet_autobind net/ipv4/af_inet.c:177 [inline]
inet_send_prepare+0x70/0xf4 net/ipv4/af_inet.c:813
inet6_sendmsg+0x30/0x80 net/ipv6/af_inet6.c:660
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]
__sys_sendto+0x1e4/0x280 net/socket.c:2117
__do_sys_sendto net/socket.c:2129 [inline]
__se_sys_sendto net/socket.c:2125 [inline]
__arm64_sys_sendto+0x30/0x44 net/socket.c:2125
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
irq event stamp: 162
hardirqs last enabled at (161): [<ffff800008038a7c>] local_daif_restore arch/arm64/include/asm/daifflags.h:75 [inline]
hardirqs last enabled at (161): [<ffff800008038a7c>] el0_svc_common+0x40/0x220 arch/arm64/kernel/syscall.c:107
hardirqs last disabled at (160): [<ffff80000c0844f4>] el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
softirqs last enabled at (156): [<ffff80000801c82c>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (162): [<ffff80000b22ff14>] spin_lock_bh include/linux/spinlock.h:355 [inline]
softirqs last disabled at (162): [<ffff80000b22ff14>] lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Tetsuo Handa]

#syz dup: WARNING: locking bug in inet_autobind

[Kuniyuki Iwashima]

From: syzbot <syzbot+52866e...@syzkaller.appspotmail.com>
Date: Mon, 02 Jan 2023 00:11:36 -0800

#syz dup: WARNING: locking bug in inet_autobind

https://lore.kernel.org/netdev/0000000000002a...@google.com/

[Hillf Danton]

On 02 Jan 2023 00:11:36 -0800

> syzbot found the following issue on:
>
> HEAD commit: a5541c0811a0 Merge branch 'for-next/core' into for-kernelci
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1208adc4480000

Update lock key only for newly created sock.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git a5541c0811a0

--- x/net/l2tp/l2tp_core.c
+++ y/net/l2tp/l2tp_core.c
@@ -1460,6 +1460,7 @@ int l2tp_tunnel_register(struct l2tp_tun
struct socket *sock;
struct sock *sk;
int ret;
+ int lookup = 0;

if (tunnel->fd < 0) {
ret = l2tp_tunnel_sock_create(net, tunnel->tunnel_id,
@@ -1471,6 +1472,7 @@ int l2tp_tunnel_register(struct l2tp_tun
sock = sockfd_lookup(tunnel->fd, &ret);
if (!sock)
goto err;
+ lookup = 1;
}

sk = sock->sk;
@@ -1512,8 +1514,8 @@ int l2tp_tunnel_register(struct l2tp_tun

tunnel->old_sk_destruct = sk->sk_destruct;
sk->sk_destruct = &l2tp_tunnel_destruct;
- lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class,
- "l2tp_sock");
+ if (!lookup)
+ lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
sk->sk_allocation = GFP_ATOMIC;

trace_register_tunnel(tunnel);
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: rcu detected stall in corrupted

rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { P3558 } 2645 jiffies s: 2069 root: 0x0/T
rcu: blocking rcu_node structures (internal RCU debug):


Tested on:

commit: a5541c08 Merge branch 'for-next/core' into for-kernelci
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1642be24480000

kernel config: https://syzkaller.appspot.com/x/.config?x=cbd4e584773e9397
dashboard link: https://syzkaller.appspot.com/bug?extid=52866e24647f9a23403f
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

patch: https://syzkaller.appspot.com/x/patch.diff?x=1799310a480000

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: rcu detected stall in corrupted

rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { P4865 } 2629 jiffies s: 1857 root: 0x0/T

rcu: blocking rcu_node structures (internal RCU debug):


Tested on:

commit: 8ebb40bc l2tp: fix a lockdep warning
git tree: https://github.com/congwang/linux.git net
console output: https://syzkaller.appspot.com/x/log.txt?x=150ac884480000
kernel config: https://syzkaller.appspot.com/x/.config?x=7ed5a2ece88e420c

dashboard link: https://syzkaller.appspot.com/bug?extid=52866e24647f9a23403f
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Note: no patches were applied.

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

WARNING: locking bug in sock_i_uid

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 1 PID: 5088 at kernel/locking/lockdep.c:231 check_wait_context kernel/locking/lockdep.c:4729 [inline]
WARNING: CPU: 1 PID: 5088 at kernel/locking/lockdep.c:231 __lock_acquire+0x2b0/0x3084 kernel/locking/lockdep.c:5005
Modules linked in:
CPU: 1 PID: 5088 Comm: syz-executor.3 Not tainted 6.1.0-syzkaller-12901-g3628ca9b8dba #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : check_wait_context kernel/locking/lockdep.c:4729 [inline]
pc : __lock_acquire+0x2b0/0x3084 kernel/locking/lockdep.c:5005
lr : hlock_class kernel/locking/lockdep.c:231 [inline]
lr : check_wait_context kernel/locking/lockdep.c:4729 [inline]
lr : __lock_acquire+0x298/0x3084 kernel/locking/lockdep.c:5005
sp : ffff800012fb38c0
x29: ffff800012fb39a0 x28: 0000000000000002 x27: ffff0000d3784e50
x26: ffff0000cb1612b8 x25: ffff0000d3785840 x24: 0000000000000000
x23: 0000000000000000 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000002 x19: aaaaaa0000fc5233 x18: 0000000000000287
x17: 0000000000000000 x16: ffff80000dd86118 x15: ffff0000d3784e00
x14: 0000000000000000 x13: 0000000000000012 x12: ffff80000dadb9a0
x11: ff808000081cc3c8 x10: ffff80000df48158 x9 : 62f873844a52aa00
x8 : 0000000000000000 x7 : 4e5241575f534b43 x6 : ffff80000c11a934

x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000

x2 : 0000000000000000 x1 : 0000000100000402 x0 : 0000000000000016
Call trace:
check_wait_context kernel/locking/lockdep.c:4729 [inline]
__lock_acquire+0x2b0/0x3084 kernel/locking/lockdep.c:5005
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
_raw_read_lock_bh+0x64/0x7c kernel/locking/spinlock.c:252
sock_i_uid+0x24/0x58 net/core/sock.c:2564
udp_lib_lport_inuse+0x44/0x268 net/ipv4/udp.c:145
udp_lib_get_port+0x1c8/0x934 net/ipv4/udp.c:265
udp_v6_get_port+0x60/0x74 net/ipv6/udp.c:105
inet_autobind net/ipv4/af_inet.c:180 [inline]
inet_send_prepare+0xa4/0xf4 net/ipv4/af_inet.c:813
inet6_sendmsg+0x30/0x80 net/ipv6/af_inet6.c:655

sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]

__sys_sendto+0x1e4/0x280 net/socket.c:2120
__do_sys_sendto net/socket.c:2132 [inline]
__se_sys_sendto net/socket.c:2128 [inline]
__arm64_sys_sendto+0x30/0x44 net/socket.c:2128

__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584

irq event stamp: 138
hardirqs last enabled at (137): [<ffff800009972d58>] get_random_u32+0x20c/0x294 drivers/char/random.c:532
hardirqs last disabled at (136): [<ffff800009972c38>] get_random_u32+0xec/0x294 drivers/char/random.c:532
softirqs last enabled at (132): [<ffff80000b29c2a0>] spin_unlock_bh include/linux/spinlock.h:395 [inline]
softirqs last enabled at (132): [<ffff80000b29c2a0>] lock_sock_nested+0xc0/0xd8 net/core/sock.c:3488
softirqs last disabled at (138): [<ffff80000b6ebecc>] spin_lock_bh include/linux/spinlock.h:355 [inline]
softirqs last disabled at (138): [<ffff80000b6ebecc>] udp_lib_get_port+0x1a4/0x934 net/ipv4/udp.c:264

---[ end trace 0000000000000000 ]---

Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000114506000
[00000000000000b8] pgd=08000001144e2003, p4d=08000001144e2003, pud=08000001143b6003, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 5088 Comm: syz-executor.3 Tainted: G W 6.1.0-syzkaller-12901-g3628ca9b8dba #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : check_wait_context kernel/locking/lockdep.c:4729 [inline]
pc : __lock_acquire+0x2d0/0x3084 kernel/locking/lockdep.c:5005
lr : hlock_class kernel/locking/lockdep.c:231 [inline]
lr : check_wait_context kernel/locking/lockdep.c:4729 [inline]
lr : __lock_acquire+0x298/0x3084 kernel/locking/lockdep.c:5005
sp : ffff800012fb38c0
x29: ffff800012fb39a0 x28: 0000000000000002 x27: ffff0000d3784e50
x26: ffff0000cb1612b8 x25: ffff0000d3785840 x24: 0000000000000000
x23: 0000000000000000 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000002 x19: aaaaaa0000fc5233 x18: 0000000000000287
x17: 0000000000000000 x16: ffff80000dd86118 x15: ffff0000d3784e00
x14: 0000000000000000 x13: 0000000000000012 x12: ffff80000dadb9a0
x11: ff808000081cc3c8 x10: ffff80000df48158 x9 : 0000000000061233
x8 : 0000000000000000 x7 : 4e5241575f534b43 x6 : ffff80000c11a934

x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000

x2 : 0000000000000000 x1 : 0000000100000402 x0 : 0000000000000016
Call trace:
hlock_class kernel/locking/lockdep.c:222 [inline]
check_wait_context kernel/locking/lockdep.c:4730 [inline]
__lock_acquire+0x2d0/0x3084 kernel/locking/lockdep.c:5005
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
_raw_read_lock_bh+0x64/0x7c kernel/locking/spinlock.c:252
sock_i_uid+0x24/0x58 net/core/sock.c:2564
udp_lib_lport_inuse+0x44/0x268 net/ipv4/udp.c:145
udp_lib_get_port+0x1c8/0x934 net/ipv4/udp.c:265
udp_v6_get_port+0x60/0x74 net/ipv6/udp.c:105
inet_autobind net/ipv4/af_inet.c:180 [inline]
inet_send_prepare+0xa4/0xf4 net/ipv4/af_inet.c:813
inet6_sendmsg+0x30/0x80 net/ipv6/af_inet6.c:655

sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]

__sys_sendto+0x1e4/0x280 net/socket.c:2120
__do_sys_sendto net/socket.c:2132 [inline]
__se_sys_sendto net/socket.c:2128 [inline]
__arm64_sys_sendto+0x30/0x44 net/socket.c:2128

__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584

Code: f002ed0a 91046210 9105614a b9400329 (3942e114)

---[ end trace 0000000000000000 ]---

----------------
Code disassembly (best guess):
0: f002ed0a adrp x10, 0x5da3000
4: 91046210 add x16, x16, #0x118
8: 9105614a add x10, x10, #0x158
c: b9400329 ldr w9, [x25]
* 10: 3942e114 ldrb w20, [x8, #184] <-- trapping instruction


Tested on:

commit: 3628ca9b bpf: Always use maximal size for copy_array()

git tree: https://github.com/congwang/linux.git net

console output: https://syzkaller.appspot.com/x/log.txt?x=11617cdc480000

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

INFO: rcu detected stall in corrupted

rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { P4874 } 2683 jiffies s: 2025 root: 0x0/T

rcu: blocking rcu_node structures (internal RCU debug):


Tested on:

commit: bb026ca9 l2tp: close all race conditions in l2tp_tunne..

git tree: https://github.com/congwang/linux.git net

console output: https://syzkaller.appspot.com/x/log.txt?x=10afe36c480000