WARNING: locking bug in icmp_send

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: b5372fe5dc84 exec: load_script: Do not exec truncated inte..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=122bf7b0c00000
kernel config: https://syzkaller.appspot.com/x/.config?x=7132344728e7ec3f
dashboard link: https://syzkaller.appspot.com/bug?extid=ba21d65f55b562432c58
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14c90fa7400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ba21d6...@syzkaller.appspotmail.com

yz1> rejected, already enabled
Enabling of bearer <udp:
yz1> rejected, already enabled
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(class_idx > MAX_LOCKDEP_KEYS)
WARNING: CPU: 0 PID: 9 at kernel/locking/lockdep.c:3315
__lock_acquire+0x13bf/0x4700 kernel/locking/lockdep.c:3315
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.0.0-rc7+ #78
Enabling of bearer <udp:
yz1> rejected, already enabled
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
Enabling of bearer <udp:
yz1> rejected, already enabled
panic+0x2cb/0x65c kernel/panic.c:214
Enabling of bearer <udp:
yz1> rejected, already enabled
__warn.cold+0x20/0x45 kernel/panic.c:571
Enabling of bearer <udp:
yz1> rejected, already enabled
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:290
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973
Enabling of bearer <udp:
yz1> rejected, already enabled
RIP: 0010:__lock_acquire+0x13bf/0x4700 kernel/locking/lockdep.c:3315
Code: 8b 1d c9 a6 05 08 45 85 db 0f 85 d6 f4 ff ff 48 c7 c6 e0 a3 6b 87 48
c7 c7 40 78 6b 87 44 89 9c 24 98 00 00 00 e8 ef 29 ec ff <0f> 0b 44 8b 9c
24 98 00 00 00 e9 af f4 ff ff 8b 3d 7c 67 fe 08 85
RSP: 0018:ffff8880a985f320 EFLAGS: 00010086
Enabling of bearer <udp:
yz1> rejected, already enabled
RAX: 0000000000000000 RBX: 000000001ac4c57a RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff815a92c6 RDI: ffffed101530be56
RBP: ffff8880a985f4f0 R08: ffff8880a9846240 R09: fffffbfff1133361
R10: fffffbfff1133360 R11: ffffffff88999b03 R12: ffff8880a9846b28
R13: ffff8880a9846b32 R14: 000000001ac4c57a R15: ffff8880a9846240
Enabling of bearer <udp:
yz1> rejected, already enabled
Enabling of bearer <udp:
yz1> rejected, already enabled
lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3841
__raw_spin_trylock include/linux/spinlock_api_smp.h:90 [inline]
_raw_spin_trylock+0x62/0x80 kernel/locking/spinlock.c:128
Enabling of bearer <udp:
yz1> rejected, already enabled
spin_trylock include/linux/spinlock.h:339 [inline]
icmp_xmit_lock net/ipv4/icmp.c:219 [inline]
icmp_send+0x54c/0x1400 net/ipv4/icmp.c:665
Enabling of bearer <udp:
yz1> rejected, already enabled
Enabling of bearer <udp:
yz1> rejected, already enabled
Enabling of bearer <udp:
yz1> rejected, already enabled
__udp4_lib_rcv+0x1fb2/0x2c50 net/ipv4/udp.c:2321
udp_rcv+0x22/0x30 net/ipv4/udp.c:2480
Enabling of bearer <udp:
yz1> rejected, already enabled
ip_protocol_deliver_rcu+0x60/0x8e0 net/ipv4/ip_input.c:208
Enabling of bearer <udp:
yz1> rejected, already enabled
ip_local_deliver_finish+0x23b/0x390 net/ipv4/ip_input.c:234
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ip_local_deliver+0x1e9/0x520 net/ipv4/ip_input.c:255
dst_input include/net/dst.h:450 [inline]
ip_rcv_finish+0x1db/0x2f0 net/ipv4/ip_input.c:414
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ip_rcv+0xe8/0x3f0 net/ipv4/ip_input.c:524
__netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4973
__netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083
process_backlog+0x206/0x750 net/core/dev.c:5923
napi_poll net/core/dev.c:6346 [inline]
net_rx_action+0x4fa/0x1070 net/core/dev.c:6412
__do_softirq+0x266/0x95a kernel/softirq.c:292
run_ksoftirqd kernel/softirq.c:654 [inline]
run_ksoftirqd+0x8e/0x110 kernel/softirq.c:646
smpboot_thread_fn+0x6ab/0xa10 kernel/smpboot.c:164
kthread+0x357/0x430 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot has bisected this bug to:

commit 52dfae5c85a4c1078e9f1d5e8947d4a25f73dd81
Author: Jon Maloy <jon....@ericsson.com>
Date: Thu Mar 22 19:42:52 2018 +0000

tipc: obtain node identity from interface by default

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11b6dc5d200000
start commit: b5372fe5 exec: load_script: Do not exec truncated interpre..
git tree: upstream
final crash: https://syzkaller.appspot.com/x/report.txt?x=13b6dc5d200000
console output: https://syzkaller.appspot.com/x/log.txt?x=15b6dc5d200000

kernel config: https://syzkaller.appspot.com/x/.config?x=7132344728e7ec3f
dashboard link: https://syzkaller.appspot.com/bug?extid=ba21d65f55b562432c58

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14c90fa7400000

Reported-by: syzbot+ba21d6...@syzkaller.appspotmail.com
Fixes: 52dfae5c85a4 ("tipc: obtain node identity from interface by default")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Jon Maloy]

Yet another duplicate of syzbot+a25307...@syzkaller.appspotmail.com

A fix has been posted.

///jon

[Dmitry Vyukov]

From: Jon Maloy <jon....@ericsson.com>
Date: Mon, Mar 25, 2019 at 5:34 PM
To: syzbot, da...@davemloft.net, kuz...@ms2.inr.ac.ru,
linux-...@vger.kernel.org, net...@vger.kernel.org,
syzkall...@googlegroups.com,
tipc-di...@lists.sourceforge.net, ying...@windriver.com,
yosh...@linux-ipv6.org

> Yet another duplicate of syzbot+a25307...@syzkaller.appspotmail.com
>
> A fix has been posted.
>
> ///jon

Let's close this too:

#syz fix: tipc: change to check tipc_own_id to return in tipc_net_stop

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/BL0PR1501MB20033F21FB21816CC2F50AA49A5E0%40BL0PR1501MB2003.namprd15.prod.outlook.com.
> For more options, visit https://groups.google.com/d/optout.