[syzbot] possible deadlock in lapb_disconnect_request
15 views
Skip to first unread message
syzbot
Jan 16, 2023, 4:28:50 PM1/16/23
to da...@davemloft.net, edum...@google.com, ku...@kernel.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, m...@dev.tdt.de, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 358a161a6a9e Merge branch 'for-next/fixes' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=150ef54a480000
kernel config: https://syzkaller.appspot.com/x/.config?x=2573056c6a11f00d
dashboard link: https://syzkaller.appspot.com/bug?extid=c9450e09c6b15886782c
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1760c716480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10a8500e480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/99d14e0f4c19/disk-358a161a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/23275b612976/vmlinux-358a161a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ed79195fac61/Image-358a161a.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c9450e...@syzkaller.appspotmail.com
8021q: adding VLAN 0 to HW filter on device bond1475
============================================
WARNING: possible recursive locking detected
6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0 Not tainted
--------------------------------------------
syz-executor129/7388 is trying to acquire lock:
ffff0000fff929c0 (&lapb->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
ffff0000fff929c0 (&lapb->lock){+.-.}-{2:2}, at: lapb_disconnect_request+0xc0/0x1d4 net/lapb/lapb_iface.c:356
but task is already holding lock:
ffff0000fff571c0 (&lapb->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
ffff0000fff571c0 (&lapb->lock){+.-.}-{2:2}, at: lapb_device_event+0x108/0x380 net/lapb/lapb_iface.c:471
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&lapb->lock);
lock(&lapb->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
7 locks held by syz-executor129/7388:
#0: ffff80000da1a2f8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:75 [inline]
#0: ffff80000da1a2f8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x458/0x82c net/core/rtnetlink.c:6138
#1: ffff0000fff571c0 (&lapb->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
#1: ffff0000fff571c0 (&lapb->lock){+.-.}-{2:2}, at: lapb_device_event+0x108/0x380 net/lapb/lapb_iface.c:471
#2: ffff80000d645548 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:324
#3: ffff80000d645520 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:324
#4: ffff80000d645548 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:324
#5: ffff0000ff325ed8 (_xmit_X25#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline]
#5: ffff0000ff325ed8 (_xmit_X25#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4316 [inline]
#5: ffff0000ff325ed8 (_xmit_X25#2){+...}-{2:2}, at: __dev_queue_xmit+0x79c/0xdb8 net/core/dev.c:4245
#6: ffff0000ffd76cc0 (&lapbeth->up_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
#6: ffff0000ffd76cc0 (&lapbeth->up_lock){+...}-{2:2}, at: lapbeth_xmit+0x30/0x2b0 drivers/net/wan/lapbether.c:190
stack backtrace:
CPU: 0 PID: 7388 Comm: syz-executor129 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
__lock_acquire+0x808/0x3084
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lapb_disconnect_request+0xc0/0x1d4 net/lapb/lapb_iface.c:356
lapbeth_xmit+0x8c/0x2b0 drivers/net/wan/lapbether.c:211
__netdev_start_xmit include/linux/netdevice.h:4865 [inline]
netdev_start_xmit include/linux/netdevice.h:4879 [inline]
xmit_one net/core/dev.c:3583 [inline]
dev_hard_start_xmit+0xd4/0x1ec net/core/dev.c:3599
__dev_queue_xmit+0x83c/0xdb8 net/core/dev.c:4249
bond_start_xmit+0x708/0xca0 drivers/net/bonding/bond_main.c:5457
__netdev_start_xmit include/linux/netdevice.h:4865 [inline]
netdev_start_xmit include/linux/netdevice.h:4879 [inline]
xmit_one net/core/dev.c:3583 [inline]
dev_hard_start_xmit+0xd4/0x1ec net/core/dev.c:3599
__dev_queue_xmit+0x83c/0xdb8 net/core/dev.c:4249
dev_queue_xmit include/linux/netdevice.h:3035 [inline]
lapbeth_data_transmit+0xd0/0xe4 drivers/net/wan/lapbether.c:259
lapb_data_transmit+0x3c/0x60 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x154/0x1a0 net/lapb/lapb_out.c:149
lapb_send_control+0x170/0x18c net/lapb/lapb_subr.c:251
lapb_establish_data_link+0x50/0x70
lapb_device_event+0x2ac/0x380
notifier_call_chain kernel/notifier.c:87 [inline]
raw_notifier_call_chain+0x7c/0x108 kernel/notifier.c:455
call_netdevice_notifiers_info net/core/dev.c:1944 [inline]
call_netdevice_notifiers_extack net/core/dev.c:1982 [inline]
call_netdevice_notifiers net/core/dev.c:1996 [inline]
dev_open+0xec/0x168 net/core/dev.c:1458
bond_enslave+0x7cc/0x1824 drivers/net/bonding/bond_main.c:1963
do_set_master net/core/rtnetlink.c:2617 [inline]
do_setlink+0x564/0x17a4 net/core/rtnetlink.c:2820
__rtnl_newlink net/core/rtnetlink.c:3590 [inline]
rtnl_newlink+0x98c/0xa08 net/core/rtnetlink.c:3637
rtnetlink_rcv_msg+0x484/0x82c net/core/rtnetlink.c:6141
netlink_rcv_skb+0xfc/0x1e8 net/netlink/af_netlink.c:2564
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6159
netlink_unicast_kernel+0xfc/0x1dc net/netlink/af_netlink.c:1330
netlink_unicast+0x164/0x248 net/netlink/af_netlink.c:1356
netlink_sendmsg+0x484/0x584 net/netlink/af_netlink.c:1932
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]
____sys_sendmsg+0x2f8/0x440 net/socket.c:2476
___sys_sendmsg net/socket.c:2530 [inline]
__sys_sendmsg+0x1ac/0x228 net/socket.c:2559
__do_sys_sendmsg net/socket.c:2568 [inline]
__se_sys_sendmsg net/socket.c:2566 [inline]
__arm64_sys_sendmsg+0x2c/0x3c net/socket.c:2566
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
bond1475: (slave lapb2942): Enslaving as an active interface with an up link
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: 358a161a6a9e Merge branch 'for-next/fixes' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=150ef54a480000
kernel config: https://syzkaller.appspot.com/x/.config?x=2573056c6a11f00d
dashboard link: https://syzkaller.appspot.com/bug?extid=c9450e09c6b15886782c
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1760c716480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10a8500e480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/99d14e0f4c19/disk-358a161a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/23275b612976/vmlinux-358a161a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ed79195fac61/Image-358a161a.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c9450e...@syzkaller.appspotmail.com
8021q: adding VLAN 0 to HW filter on device bond1475
============================================
WARNING: possible recursive locking detected
6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0 Not tainted
--------------------------------------------
syz-executor129/7388 is trying to acquire lock:
ffff0000fff929c0 (&lapb->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
ffff0000fff929c0 (&lapb->lock){+.-.}-{2:2}, at: lapb_disconnect_request+0xc0/0x1d4 net/lapb/lapb_iface.c:356
but task is already holding lock:
ffff0000fff571c0 (&lapb->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
ffff0000fff571c0 (&lapb->lock){+.-.}-{2:2}, at: lapb_device_event+0x108/0x380 net/lapb/lapb_iface.c:471
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&lapb->lock);
lock(&lapb->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
7 locks held by syz-executor129/7388:
#0: ffff80000da1a2f8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:75 [inline]
#0: ffff80000da1a2f8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x458/0x82c net/core/rtnetlink.c:6138
#1: ffff0000fff571c0 (&lapb->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
#1: ffff0000fff571c0 (&lapb->lock){+.-.}-{2:2}, at: lapb_device_event+0x108/0x380 net/lapb/lapb_iface.c:471
#2: ffff80000d645548 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:324
#3: ffff80000d645520 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:324
#4: ffff80000d645548 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:324
#5: ffff0000ff325ed8 (_xmit_X25#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline]
#5: ffff0000ff325ed8 (_xmit_X25#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4316 [inline]
#5: ffff0000ff325ed8 (_xmit_X25#2){+...}-{2:2}, at: __dev_queue_xmit+0x79c/0xdb8 net/core/dev.c:4245
#6: ffff0000ffd76cc0 (&lapbeth->up_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
#6: ffff0000ffd76cc0 (&lapbeth->up_lock){+...}-{2:2}, at: lapbeth_xmit+0x30/0x2b0 drivers/net/wan/lapbether.c:190
stack backtrace:
CPU: 0 PID: 7388 Comm: syz-executor129 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
__lock_acquire+0x808/0x3084
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lapb_disconnect_request+0xc0/0x1d4 net/lapb/lapb_iface.c:356
lapbeth_xmit+0x8c/0x2b0 drivers/net/wan/lapbether.c:211
__netdev_start_xmit include/linux/netdevice.h:4865 [inline]
netdev_start_xmit include/linux/netdevice.h:4879 [inline]
xmit_one net/core/dev.c:3583 [inline]
dev_hard_start_xmit+0xd4/0x1ec net/core/dev.c:3599
__dev_queue_xmit+0x83c/0xdb8 net/core/dev.c:4249
bond_start_xmit+0x708/0xca0 drivers/net/bonding/bond_main.c:5457
__netdev_start_xmit include/linux/netdevice.h:4865 [inline]
netdev_start_xmit include/linux/netdevice.h:4879 [inline]
xmit_one net/core/dev.c:3583 [inline]
dev_hard_start_xmit+0xd4/0x1ec net/core/dev.c:3599
__dev_queue_xmit+0x83c/0xdb8 net/core/dev.c:4249
dev_queue_xmit include/linux/netdevice.h:3035 [inline]
lapbeth_data_transmit+0xd0/0xe4 drivers/net/wan/lapbether.c:259
lapb_data_transmit+0x3c/0x60 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x154/0x1a0 net/lapb/lapb_out.c:149
lapb_send_control+0x170/0x18c net/lapb/lapb_subr.c:251
lapb_establish_data_link+0x50/0x70
lapb_device_event+0x2ac/0x380
notifier_call_chain kernel/notifier.c:87 [inline]
raw_notifier_call_chain+0x7c/0x108 kernel/notifier.c:455
call_netdevice_notifiers_info net/core/dev.c:1944 [inline]
call_netdevice_notifiers_extack net/core/dev.c:1982 [inline]
call_netdevice_notifiers net/core/dev.c:1996 [inline]
dev_open+0xec/0x168 net/core/dev.c:1458
bond_enslave+0x7cc/0x1824 drivers/net/bonding/bond_main.c:1963
do_set_master net/core/rtnetlink.c:2617 [inline]
do_setlink+0x564/0x17a4 net/core/rtnetlink.c:2820
__rtnl_newlink net/core/rtnetlink.c:3590 [inline]
rtnl_newlink+0x98c/0xa08 net/core/rtnetlink.c:3637
rtnetlink_rcv_msg+0x484/0x82c net/core/rtnetlink.c:6141
netlink_rcv_skb+0xfc/0x1e8 net/netlink/af_netlink.c:2564
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6159
netlink_unicast_kernel+0xfc/0x1dc net/netlink/af_netlink.c:1330
netlink_unicast+0x164/0x248 net/netlink/af_netlink.c:1356
netlink_sendmsg+0x484/0x584 net/netlink/af_netlink.c:1932
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]
____sys_sendmsg+0x2f8/0x440 net/socket.c:2476
___sys_sendmsg net/socket.c:2530 [inline]
__sys_sendmsg+0x1ac/0x228 net/socket.c:2559
__do_sys_sendmsg net/socket.c:2568 [inline]
__se_sys_sendmsg net/socket.c:2566 [inline]
__arm64_sys_sendmsg+0x2c/0x3c net/socket.c:2566
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
bond1475: (slave lapb2942): Enslaving as an active interface with an up link
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
Hillf Danton
Jan 16, 2023, 7:43:51 PM1/16/23
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Date: Mon, 16 Jan 2023 13:28:49 -0800
Establish data link without lapb->lock held.
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git 358a161a6a9e
--- x/net/lapb/lapb_iface.c
+++ y/net/lapb/lapb_iface.c
@@ -457,6 +457,7 @@ static int lapb_device_event(struct noti
{
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct lapb_cb *lapb;
+ int estab = 0;
if (!net_eq(dev_net(dev), &init_net))
return NOTIFY_DONE;
@@ -482,7 +483,7 @@ static int lapb_device_event(struct noti
} else {
if (lapb->state == LAPB_STATE_0) {
lapb->state = LAPB_STATE_1;
- lapb_establish_data_link(lapb);
+ estab = 1;
}
}
}
@@ -509,7 +510,7 @@ static int lapb_device_event(struct noti
} else {
if (lapb->state == LAPB_STATE_0) {
lapb->state = LAPB_STATE_1;
- lapb_establish_data_link(lapb);
+ estab = 1;
}
}
} else {
@@ -525,6 +526,8 @@ static int lapb_device_event(struct noti
}
spin_unlock_bh(&lapb->lock);
+ if (estab)
+ lapb_establish_data_link(lapb);
lapb_put(lapb);
return NOTIFY_DONE;
}
--
> syzbot found the following issue on:
>
> HEAD commit: 358a161a6a9e Merge branch 'for-next/fixes' into for-kernelci
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10a8500e480000
>
> HEAD commit: 358a161a6a9e Merge branch 'for-next/fixes' into for-kernelci
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
Establish data link without lapb->lock held.
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git 358a161a6a9e
--- x/net/lapb/lapb_iface.c
+++ y/net/lapb/lapb_iface.c
@@ -457,6 +457,7 @@ static int lapb_device_event(struct noti
{
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct lapb_cb *lapb;
+ int estab = 0;
if (!net_eq(dev_net(dev), &init_net))
return NOTIFY_DONE;
@@ -482,7 +483,7 @@ static int lapb_device_event(struct noti
} else {
if (lapb->state == LAPB_STATE_0) {
lapb->state = LAPB_STATE_1;
- lapb_establish_data_link(lapb);
+ estab = 1;
}
}
}
@@ -509,7 +510,7 @@ static int lapb_device_event(struct noti
} else {
if (lapb->state == LAPB_STATE_0) {
lapb->state = LAPB_STATE_1;
- lapb_establish_data_link(lapb);
+ estab = 1;
}
}
} else {
@@ -525,6 +526,8 @@ static int lapb_device_event(struct noti
}
spin_unlock_bh(&lapb->lock);
+ if (estab)
+ lapb_establish_data_link(lapb);
lapb_put(lapb);
return NOTIFY_DONE;
}
--
syzbot
Jan 16, 2023, 9:25:17 PM1/16/23
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: MAX_LOCKDEP_CHAINS too low!
BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 0 PID: 5160 Comm: kworker/u4:6 Not tainted 6.2.0-rc3-syzkaller-00017-g358a161a6a9e-dirty #0
validate_chain kernel/locking/lockdep.c:3799 [inline]
__lock_acquire+0xf2c/0x3084 kernel/locking/lockdep.c:5055
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
debug_object_activate+0x6c/0x30c lib/debugobjects.c:665
debug_timer_activate kernel/time/timer.c:782 [inline]
__mod_timer+0x534/0x700 kernel/time/timer.c:1119
add_timer+0x34/0x50 kernel/time/timer.c:1244
__queue_delayed_work kernel/workqueue.c:1676 [inline]
queue_delayed_work_on+0x130/0x240 kernel/workqueue.c:1701
queue_delayed_work include/linux/workqueue.h:518 [inline]
bond_netdev_notify_work+0xc8/0xf4 drivers/net/bonding/bond_main.c:1743
process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
worker_thread+0x340/0x610 kernel/workqueue.c:2436
kthread+0x12c/0x158 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
Tested on:
commit: 358a161a Merge branch 'for-next/fixes' into for-kernelci
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17830e7e480000
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: MAX_LOCKDEP_CHAINS too low!
BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 0 PID: 5160 Comm: kworker/u4:6 Not tainted 6.2.0-rc3-syzkaller-00017-g358a161a6a9e-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: bond594 bond_netdev_notify_work
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
lookup_chain_cache_add kernel/locking/lockdep.c:3778 [inline]
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
validate_chain kernel/locking/lockdep.c:3799 [inline]
__lock_acquire+0xf2c/0x3084 kernel/locking/lockdep.c:5055
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
debug_object_activate+0x6c/0x30c lib/debugobjects.c:665
debug_timer_activate kernel/time/timer.c:782 [inline]
__mod_timer+0x534/0x700 kernel/time/timer.c:1119
add_timer+0x34/0x50 kernel/time/timer.c:1244
__queue_delayed_work kernel/workqueue.c:1676 [inline]
queue_delayed_work_on+0x130/0x240 kernel/workqueue.c:1701
queue_delayed_work include/linux/workqueue.h:518 [inline]
bond_netdev_notify_work+0xc8/0xf4 drivers/net/bonding/bond_main.c:1743
process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
worker_thread+0x340/0x610 kernel/workqueue.c:2436
kthread+0x12c/0x158 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
Tested on:
commit: 358a161a Merge branch 'for-next/fixes' into for-kernelci
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17830e7e480000
kernel config: https://syzkaller.appspot.com/x/.config?x=2573056c6a11f00d
dashboard link: https://syzkaller.appspot.com/bug?extid=c9450e09c6b15886782c
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=161144da480000
dashboard link: https://syzkaller.appspot.com/bug?extid=c9450e09c6b15886782c
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syzbot
Nov 19, 2023, 12:00:16 PM11/19/23
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages