[syzbot] BUG: sleeping function called from invalid context in __ipv6_dev_mc_dec

24 views
Skip to first unread message

syzbot

unread,
May 3, 2021, 1:11:43ā€ÆPM5/3/21
to and...@kernel.org, ap42...@gmail.com, a...@kernel.org, ava...@gmail.com, b...@vger.kernel.org, cong...@bytedance.com, dan...@iogearbox.net, da...@davemloft.net, dsa...@kernel.org, ha...@kernel.org, john.fa...@gmail.com, ka...@fb.com, kps...@kernel.org, ku...@kernel.org, linux-...@vger.kernel.org, net...@vger.kernel.org, ro...@cumulusnetworks.com, songliu...@fb.com, syzkall...@googlegroups.com, y...@fb.com, yosh...@linux-ipv6.org
Hello,

syzbot found the following issue on:

HEAD commit: 95aafe91 net: ethernet: ixp4xx: Support device tree probing
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14fad3e1d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=7668018815a66138
dashboard link: https://syzkaller.appspot.com/bug?extid=7d941e89dd48bcf42573
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=103edf15d00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1592b9d5d00000

The issue was bisected to:

commit f185de28d9ae6c978135993769352e523ee8df06
Author: Taehee Yoo <ap42...@gmail.com>
Date: Thu Mar 25 16:16:56 2021 +0000

mld: add new workqueues for process mld events

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=145ba3f5d00000
final oops: https://syzkaller.appspot.com/x/report.txt?x=165ba3f5d00000
console output: https://syzkaller.appspot.com/x/log.txt?x=125ba3f5d00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7d941e...@syzkaller.appspotmail.com
Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:928
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 9825, name: syz-executor943
2 locks held by syz-executor943/9825:
#0: ffffffff8d6730a8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d6730a8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5559
#1: ffffffff8bf74520 (rcu_read_lock){....}-{1:2}, at: nla_ok include/net/netlink.h:1159 [inline]
#1: ffffffff8bf74520 (rcu_read_lock){....}-{1:2}, at: do_setlink+0x27d0/0x3af0 net/core/rtnetlink.c:2868
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 0 PID: 9825 Comm: syz-executor943 Not tainted 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
___might_sleep.cold+0x1f1/0x237 kernel/sched/core.c:8328
__mutex_lock_common kernel/locking/mutex.c:928 [inline]
__mutex_lock+0xa9/0x1120 kernel/locking/mutex.c:1096
__ipv6_dev_mc_dec+0x5f/0x340 net/ipv6/mcast.c:965
addrconf_leave_solict net/ipv6/addrconf.c:2182 [inline]
addrconf_leave_solict net/ipv6/addrconf.c:2174 [inline]
__ipv6_ifa_notify+0x5b6/0xa90 net/ipv6/addrconf.c:6099
ipv6_ifa_notify net/ipv6/addrconf.c:6122 [inline]
ipv6_del_addr+0x463/0xae0 net/ipv6/addrconf.c:1294
addrconf_verify_rtnl+0xdbc/0x1220 net/ipv6/addrconf.c:4489
inet6_set_iftoken net/ipv6/addrconf.c:5757 [inline]
inet6_set_link_af+0x53c/0xc40 net/ipv6/addrconf.c:5833
do_setlink+0x290d/0x3af0 net/core/rtnetlink.c:2875
__rtnl_newlink+0xdcf/0x1710 net/core/rtnetlink.c:3385
rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3500
rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5562
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
sock_sendmsg_nosec net/socket.c:654 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:674
____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
___sys_sendmsg+0xf3/0x170 net/socket.c:2404
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x443869
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc4ce9e848 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffc4ce9e870 RCX: 0000000000443869
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d
R10: 000000000000000d R11: 0000000000000246 R12: 00007ffc4ce9e860
R13: 00000000000f4240 R14: 0000000000014fb2 R15: 00007ffc4ce9e854

=============================
[ BUG: Invalid wait context ]
5.12.0-rc7-syzkaller #0 Tainted: G W
-----------------------------
syz-executor943/9825 is trying to lock:
ffff8880188a3530 (&idev->mc_lock){+.+.}-{3:3}, at: __ipv6_dev_mc_dec+0x5f/0x340 net/ipv6/mcast.c:965
other info that might help us debug this:
context-{4:4}
2 locks held by syz-executor943/9825:
#0: ffffffff8d6730a8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d6730a8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5559
#1: ffffffff8bf74520 (rcu_read_lock){....}-{1:2}, at: nla_ok include/net/netlink.h:1159 [inline]
#1: ffffffff8bf74520 (rcu_read_lock){....}-{1:2}, at: do_setlink+0x27d0/0x3af0 net/core/rtnetlink.c:2868
stack backtrace:
CPU: 0 PID: 9825 Comm: syz-executor943 Tainted: G W 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4552 [inline]
check_wait_context kernel/locking/lockdep.c:4613 [inline]
__lock_acquire.cold+0x219/0x3b4 kernel/locking/lockdep.c:4851
lock_acquire kernel/locking/lockdep.c:5511 [inline]
lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5476
__mutex_lock_common kernel/locking/mutex.c:949 [inline]
__mutex_lock+0x139/0x1120 kernel/locking/mutex.c:1096
__ipv6_dev_mc_dec+0x5f/0x340 net/ipv6/mcast.c:965
addrconf_leave_solict net/ipv6/addrconf.c:2182 [inline]
addrconf_leave_solict net/ipv6/addrconf.c:2174 [inline]
__ipv6_ifa_notify+0x5b6/0xa90 net/ipv6/addrconf.c:6099
ipv6_ifa_notify net/ipv6/addrconf.c:6122 [inline]
ipv6_del_addr+0x463/0xae0 net/ipv6/addrconf.c:1294
addrconf_verify_rtnl+0xdbc/0x1220 net/ipv6/addrconf.c:4489
inet6_set_iftoken net/ipv6/addrconf.c:5757 [inline]
inet6_set_link_af+0x53c/0xc40 net/ipv6/addrconf.c:5833
do_setlink+0x290d/0x3af0 net/core/rtnetlink.c:2875
__rtnl_newlink+0xdcf/0x1710 net/core/rtnetlink.c:3385
rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3500
rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5562
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
sock_sendmsg_nosec net/socket.c:654 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:674
____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
___sys_sendmsg+0xf3/0x170 net/socket.c:2404
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x443869
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc4ce9e848 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffc4ce9e870 RCX: 0000000000443869
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d
R10: 000000000000000d R11: 0000000000000246 R12: 00007ffc4ce9e860
R13: 00000000000f4240 R14: 0000000000014fb2 R15: 00007ffc4ce9e854
BUG: sleeping function called from invalid context at include/linux/sched/mm.h:197
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 9825, name: syz-executor943
INFO: lockdep is turned off.
Preemption disabled at:
[<ffffffff87026ff3>] local_bh_disable include/linux/bottom_half.h:19 [inline]
[<ffffffff87026ff3>] netif_addr_lock_bh include/linux/netdevice.h:4549 [inline]
[<ffffffff87026ff3>] __dev_mc_del net/core/dev_addr_lists.c:814 [inline]
[<ffffffff87026ff3>] dev_mc_del+0x63/0x110 net/core/dev_addr_lists.c:833
CPU: 0 PID: 9825 Comm: syz-executor943 Tainted: G W 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
___might_sleep.cold+0x1f1/0x237 kernel/sched/core.c:8328
might_alloc include/linux/sched/mm.h:197 [inline]
slab_pre_alloc_hook mm/slab.h:497 [inline]
slab_alloc_node mm/slub.c:2826 [inline]
slab_alloc mm/slub.c:2915 [inline]
kmem_cache_alloc_trace+0x263/0x2a0 mm/slub.c:2932
kmalloc include/linux/slab.h:554 [inline]
kzalloc include/linux/slab.h:684 [inline]
mld_add_delrec net/ipv6/mcast.c:737 [inline]
igmp6_leave_group net/ipv6/mcast.c:2629 [inline]
igmp6_group_dropped+0x4f7/0xe90 net/ipv6/mcast.c:717
__ipv6_dev_mc_dec+0x25d/0x340 net/ipv6/mcast.c:973
addrconf_leave_solict net/ipv6/addrconf.c:2182 [inline]
addrconf_leave_solict net/ipv6/addrconf.c:2174 [inline]
__ipv6_ifa_notify+0x5b6/0xa90 net/ipv6/addrconf.c:6099
ipv6_ifa_notify net/ipv6/addrconf.c:6122 [inline]
ipv6_del_addr+0x463/0xae0 net/ipv6/addrconf.c:1294
addrconf_verify_rtnl+0xdbc/0x1220 net/ipv6/addrconf.c:4489
inet6_set_iftoken net/ipv6/addrconf.c:5757 [inline]
inet6_set_link_af+0x53c/0xc40 net/ipv6/addrconf.c:5833
do_setlink+0x290d/0x3af0 net/core/rtnetlink.c:2875
__rtnl_newlink+0xdcf/0x1710 net/core/rtnetlink.c:3385
rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3500
rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5562
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
sock_sendmsg_nosec net/socket.c:654 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:674
____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
___sys_sendmsg+0xf3/0x170 net/socket.c:2404
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x443869
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc4ce9e848 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffc4ce9e870 RCX: 0000000000443869
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d
R10: 000000000000000d R11: 0000000000000246 R12: 00007ffc4ce9e860
R13: 00000000000f4240 R14: 0000000000014fb2 R15: 00007ffc4ce9e854
__nla_validate_parse: 52 callbacks suppressed
netlink: 4 bytes leftover after parsing attributes in process `syz-executor943'.


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

syzbot

unread,
May 5, 2021, 4:16:06ā€ÆPM5/5/21
to syzkall...@googlegroups.com, xiyou.w...@gmail.com
Hello,

syzbot tried to test the proposed patch but the build/boot failed:

WARNING in __nf_unregister_net_hook

------------[ cut here ]------------
hook not found, pf 3 num 0
WARNING: CPU: 1 PID: 280 at net/netfilter/core.c:480 __nf_unregister_net_hook+0x1eb/0x610 net/netfilter/core.c:480
Modules linked in:
CPU: 1 PID: 280 Comm: kworker/u4:5 Not tainted 5.12.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:__nf_unregister_net_hook+0x1eb/0x610 net/netfilter/core.c:480
Code: 0f b6 14 02 48 89 c8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 11 04 00 00 8b 53 1c 89 ee 48 c7 c7 40 79 6d 8a e8 f0 59 8a 01 <0f> 0b e9 e5 00 00 00 e8 19 64 30 fa 44 8b 3c 24 4c 89 f8 48 c1 e0
RSP: 0018:ffffc90001ccfbc0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8880204ff400 RCX: 0000000000000000
RDX: ffff888011b63880 RSI: ffffffff815c8ba5 RDI: fffff52000399f6a
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815c2a0e R11: 0000000000000000 R12: ffff888025388f20
R13: 0000000000000000 R14: ffff888020496300 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f84191eb010 CR3: 0000000016456000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
nf_unregister_net_hook net/netfilter/core.c:502 [inline]
nf_unregister_net_hooks+0x117/0x160 net/netfilter/core.c:576
arpt_unregister_table_pre_exit+0x67/0x80 net/ipv4/netfilter/arp_tables.c:1565
ops_pre_exit_list net/core/net_namespace.c:165 [inline]
cleanup_net+0x451/0xb10 net/core/net_namespace.c:583
process_one_work+0x98d/0x1600 kernel/workqueue.c:2275
worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
kthread+0x3b1/0x4a0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294


[ [0;32m OK [0m] Reached target Login Prompts.
[ [0;32m OK [0m] Reached target Multi-User System.
[ [0;32m OK [0m] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
[ [0;32m OK [0m] Started Update UTMP about System Runlevel Changes.

Debian GNU/Linux 9 syzkaller ttyS0

Warning: Permanently added '10.128.10.9' (ECDSA) to the list of known hosts.
2021/05/05 20:15:32 fuzzer started
2021/05/05 20:15:32 connecting to host at 10.128.0.169:42359
2021/05/05 20:15:32 checking machine...
2021/05/05 20:15:32 checking revisions...
2021/05/05 20:15:32 testing simple program...
syzkaller login: [ 74.030762][ T8426] chnl_net:caif_netlink_parms(): no params data found
[ 74.083621][ T8426] bridge0: port 1(bridge_slave_0) entered blocking state
[ 74.093040][ T8426] bridge0: port 1(bridge_slave_0) entered disabled state
[ 74.103661][ T8426] device bridge_slave_0 entered promiscuous mode
[ 74.115909][ T8426] bridge0: port 2(bridge_slave_1) entered blocking state
[ 74.125597][ T8426] bridge0: port 2(bridge_slave_1) entered disabled state
[ 74.135246][ T8426] device bridge_slave_1 entered promiscuous mode
[ 74.156744][ T8426] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 74.169764][ T8426] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 74.193334][ T8426] team0: Port device team_slave_0 added
[ 74.203141][ T8426] team0: Port device team_slave_1 added
[ 74.222638][ T8426] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 74.231288][ T8426] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 74.264736][ T8426] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 74.281430][ T8426] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 74.291355][ T8426] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 74.322131][ T8426] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 74.351095][ T8426] device hsr_slave_0 entered promiscuous mode
[ 74.359496][ T8426] device hsr_slave_1 entered promiscuous mode
[ 74.467792][ T8426] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 74.479431][ T8426] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 74.492011][ T8426] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 74.502929][ T8426] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 74.533075][ T8426] bridge0: port 2(bridge_slave_1) entered blocking state
[ 74.541302][ T8426] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 74.550547][ T8426] bridge0: port 1(bridge_slave_0) entered blocking state
[ 74.558699][ T8426] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 74.609023][ T8426] 8021q: adding VLAN 0 to HW filter on device bond0
[ 74.623045][ T3146] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 74.637869][ T3146] bridge0: port 1(bridge_slave_0) entered disabled state
[ 74.646877][ T3146] bridge0: port 2(bridge_slave_1) entered disabled state
[ 74.658250][ T3146] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 74.678763][ T8426] 8021q: adding VLAN 0 to HW filter on device team0
[ 74.692247][ T3146] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 74.703666][ T3146] bridge0: port 1(bridge_slave_0) entered blocking state
[ 74.712277][ T3146] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 74.738804][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 74.749324][ T5] bridge0: port 2(bridge_slave_1) entered blocking state
[ 74.756680][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 74.766695][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 74.790994][ T8649] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 74.800312][ T8649] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 74.810898][ T8649] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 74.820289][ T8649] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 74.830762][ T8426] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 74.851676][ T8649] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 74.860148][ T8649] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 74.875204][ T8426] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 74.898653][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 74.926877][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 74.937105][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 74.946363][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 74.961463][ T8426] device veth0_vlan entered promiscuous mode
[ 74.981866][ T8426] device veth1_vlan entered promiscuous mode
[ 75.012179][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 75.024383][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 75.036700][ T8426] device veth0_macvtap entered promiscuous mode
[ 75.050089][ T8426] device veth1_macvtap entered promiscuous mode
[ 75.070632][ T8426] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 75.080589][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 75.093325][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 75.105667][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 75.115551][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 75.128286][ T8426] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 75.145078][ T8646] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 75.156297][ T8646] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 75.168838][ T8426] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 75.180698][ T8426] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 75.191819][ T8426] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 75.202860][ T8426] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
executing program
[ 75.296727][ T220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 75.329887][ T220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 75.343567][ T8649] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 75.361399][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 75.382237][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 75.393675][ T8649] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2021/05/05 20:15:35 building call list...
[ 76.043858][ T280] ------------[ cut here ]------------
[ 76.051782][ T280] hook not found, pf 3 num 0
[ 76.052411][ T280] WARNING: CPU: 1 PID: 280 at net/netfilter/core.c:480 __nf_unregister_net_hook+0x1eb/0x610
[ 76.083726][ T280] Modules linked in:
[ 76.092402][ T280] CPU: 1 PID: 280 Comm: kworker/u4:5 Not tainted 5.12.0-syzkaller #0
[ 76.108903][ T280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 76.127771][ T280] Workqueue: netns cleanup_net
[ 76.142108][ T280] RIP: 0010:__nf_unregister_net_hook+0x1eb/0x610
[ 76.160644][ T280] Code: 0f b6 14 02 48 89 c8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 11 04 00 00 8b 53 1c 89 ee 48 c7 c7 40 79 6d 8a e8 f0 59 8a 01 <0f> 0b e9 e5 00 00 00 e8 19 64 30 fa 44 8b 3c 24 4c 89 f8 48 c1 e0
[ 76.201710][ T280] RSP: 0018:ffffc90001ccfbc0 EFLAGS: 00010286
[ 76.210520][ T280] RAX: 0000000000000000 RBX: ffff8880204ff400 RCX: 0000000000000000
[ 76.228084][ T280] RDX: ffff888011b63880 RSI: ffffffff815c8ba5 RDI: fffff52000399f6a
[ 76.243156][ T280] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[ 76.256427][ T280] R10: ffffffff815c2a0e R11: 0000000000000000 R12: ffff888025388f20
[ 76.269665][ T280] R13: 0000000000000000 R14: ffff888020496300 R15: 0000000000000001
[ 76.284119][ T280] FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
[ 76.299346][ T280] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 76.318096][ T280] CR2: 00007f84191eb010 CR3: 0000000016456000 CR4: 00000000001506e0
[ 76.329730][ T280] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 76.341380][ T280] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 76.359275][ T280] Call Trace:
[ 76.367320][ T280] nf_unregister_net_hooks+0x117/0x160
[ 76.376773][ T280] arpt_unregister_table_pre_exit+0x67/0x80
[ 76.383577][ T280] ? arptable_filter_net_exit+0x20/0x20
[ 76.392303][ T280] cleanup_net+0x451/0xb10
[ 76.399307][ T280] ? ops_free_list.part.0+0x3d0/0x3d0
[ 76.407012][ T280] process_one_work+0x98d/0x1600
[ 76.412481][ T280] ? pwq_dec_nr_in_flight+0x320/0x320
[ 76.419995][ T280] ? rwlock_bug.part.0+0x90/0x90
[ 76.427434][ T280] ? _raw_spin_lock_irq+0x41/0x50
[ 76.436214][ T280] worker_thread+0x64c/0x1120
[ 76.442721][ T280] ? process_one_work+0x1600/0x1600
[ 76.448430][ T280] kthread+0x3b1/0x4a0
[ 76.453543][ T280] ? __kthread_bind_mask+0xc0/0xc0
[ 76.461494][ T280] ret_from_fork+0x1f/0x30
[ 76.469653][ T280] Kernel panic - not syncing: panic_on_warn set ...
[ 76.477153][ T280] CPU: 1 PID: 280 Comm: kworker/u4:5 Not tainted 5.12.0-syzkaller #0
[ 76.486235][ T280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 76.496495][ T280] Workqueue: netns cleanup_net
[ 76.502009][ T280] Call Trace:
[ 76.506034][ T280] dump_stack+0x141/0x1d7
[ 76.510554][ T280] panic+0x306/0x73d
[ 76.515507][ T280] ? __warn_printk+0xf3/0xf3
[ 76.520541][ T280] ? __warn.cold+0x1a/0x44
[ 76.525142][ T280] ? __nf_unregister_net_hook+0x1eb/0x610
[ 76.531234][ T280] __warn.cold+0x35/0x44
[ 76.535664][ T280] ? __nf_unregister_net_hook+0x1eb/0x610
[ 76.541813][ T280] report_bug+0x1bd/0x210
[ 76.546532][ T280] handle_bug+0x3c/0x60
[ 76.550880][ T280] exc_invalid_op+0x14/0x40
[ 76.555729][ T280] asm_exc_invalid_op+0x12/0x20
[ 76.560749][ T280] RIP: 0010:__nf_unregister_net_hook+0x1eb/0x610
[ 76.567496][ T280] Code: 0f b6 14 02 48 89 c8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 11 04 00 00 8b 53 1c 89 ee 48 c7 c7 40 79 6d 8a e8 f0 59 8a 01 <0f> 0b e9 e5 00 00 00 e8 19 64 30 fa 44 8b 3c 24 4c 89 f8 48 c1 e0
[ 76.588510][ T280] RSP: 0018:ffffc90001ccfbc0 EFLAGS: 00010286
[ 76.594584][ T280] RAX: 0000000000000000 RBX: ffff8880204ff400 RCX: 0000000000000000
[ 76.603366][ T280] RDX: ffff888011b63880 RSI: ffffffff815c8ba5 RDI: fffff52000399f6a
[ 76.612418][ T280] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[ 76.620572][ T280] R10: ffffffff815c2a0e R11: 0000000000000000 R12: ffff888025388f20
[ 76.628853][ T280] R13: 0000000000000000 R14: ffff888020496300 R15: 0000000000000001
[ 76.637098][ T280] ? wake_up_klogd.part.0+0x8e/0xd0
[ 76.642305][ T280] ? vprintk+0x95/0x260
[ 76.646469][ T280] nf_unregister_net_hooks+0x117/0x160
[ 76.652120][ T280] arpt_unregister_table_pre_exit+0x67/0x80
[ 76.658304][ T280] ? arptable_filter_net_exit+0x20/0x20
[ 76.664023][ T280] cleanup_net+0x451/0xb10
[ 76.669007][ T280] ? ops_free_list.part.0+0x3d0/0x3d0
[ 76.674578][ T280] process_one_work+0x98d/0x1600
[ 76.679533][ T280] ? pwq_dec_nr_in_flight+0x320/0x320
[ 76.684914][ T280] ? rwlock_bug.part.0+0x90/0x90
[ 76.689856][ T280] ? _raw_spin_lock_irq+0x41/0x50
[ 76.694880][ T280] worker_thread+0x64c/0x1120
[ 76.699660][ T280] ? process_one_work+0x1600/0x1600
[ 76.704856][ T280] kthread+0x3b1/0x4a0
[ 76.708920][ T280] ? __kthread_bind_mask+0xc0/0xc0
[ 76.714219][ T280] ret_from_fork+0x1f/0x30
[ 76.720247][ T280] Kernel Offset: disabled
[ 76.724987][ T280] Rebooting in 86400 seconds..



Tested on:

commit: 4a4e3b44 rtnetlink: use rwsem to protect rtnl_af_ops list
git tree: https://github.com/congwang/linux.git net
kernel config: https://syzkaller.appspot.com/x/.config?x=ce3ddc6b9fd60c48
dashboard link: https://syzkaller.appspot.com/bug?extid=7d941e89dd48bcf42573
compiler:

syzbot

unread,
May 5, 2021, 4:51:07ā€ÆPM5/5/21
to syzkall...@googlegroups.com, xiyou.w...@gmail.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+7d941e...@syzkaller.appspotmail.com

Tested on:

commit: be8f6621 netfilter: arptables: use pernet ops struct durin..
Note: testing is done by a robot and is best-effort only.

syzbot

unread,
May 5, 2021, 6:27:08ā€ÆPM5/5/21
to syzkall...@googlegroups.com, xiyou.w...@gmail.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+7d941e...@syzkaller.appspotmail.com

Tested on:

commit: fc69eb8d rtnetlink: use rwsem to protect rtnl_af_ops list

Cong Wang

unread,
May 6, 2021, 3:41:28ā€ÆPM5/6/21
to syzbot, syzkaller-bugs

syzbot

unread,
May 6, 2021, 5:18:10ā€ÆPM5/6/21
to syzkall...@googlegroups.com, xiyou.w...@gmail.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+7d941e...@syzkaller.appspotmail.com

Tested on:

commit: 2e5a93cb rtnetlink: avoid RCU read lock when holding RTNL
Reply all
Reply to author
Forward
0 new messages