[syzbot] [afs?] [ntfs3?] BUG: sleeping function called from invalid context in ovl_cache_entry_new
9 views
Skip to first unread message
syzbot
Mar 27, 2025, 12:27:27 PM3/27/25
to almaz.ale...@paragon-software.com, dhow...@redhat.com, linu...@lists.infradead.org, linux-...@vger.kernel.org, marc....@auristor.com, nt...@lists.linux.dev, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 2df0c02dab82 x86 boot build: make git ignore stale 'tools'..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=138f0a4c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5f1762820c18874b
dashboard link: https://syzkaller.appspot.com/bug?extid=54e6c2176ba76c56217e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=178f0a4c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14182bb0580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fe089500003/disk-2df0c02d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d8df5abbd7c5/vmlinux-2df0c02d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09d23e93d3a8/bzImage-2df0c02d.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/586c05b92249/mount_0.gz
The issue was bisected to:
commit 1d0b929fc070b4115403a0a6206a0c6a62dd61f5
Author: David Howells <dhow...@redhat.com>
Date: Mon Feb 24 09:52:58 2025 +0000
afs: Change dynroot to create contents on demand
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1747aa4c580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=14c7aa4c580000
console output: https://syzkaller.appspot.com/x/log.txt?x=10c7aa4c580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54e6c2...@syzkaller.appspotmail.com
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5821, name: syz-executor365
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by syz-executor365/5821:
#0: ffff888032b155f8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x310 fs/file.c:1213
#1: ffff888077c90cf8 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: wrap_directory_iterator+0x5a/0xd0 fs/readdir.c:54
#2: ffff88807d2c0148 (&type->i_mutex_dir_key#6){++++}-{4:4}, at: iterate_dir+0x4a6/0x760 fs/readdir.c:101
#3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: afs_dynroot_readdir+0x466/0xbe0 fs/afs/dynroot.c:351
CPU: 0 UID: 0 PID: 5821 Comm: syz-executor365 Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
__might_resched+0x558/0x6c0 kernel/sched/core.c:8798
might_alloc include/linux/sched/mm.h:321 [inline]
slab_pre_alloc_hook mm/slub.c:4089 [inline]
slab_alloc_node mm/slub.c:4167 [inline]
__do_kmalloc_node mm/slub.c:4317 [inline]
__kmalloc_noprof+0xd0/0x4d0 mm/slub.c:4330
kmalloc_noprof include/linux/slab.h:906 [inline]
ovl_cache_entry_new+0x39/0x7b0 fs/overlayfs/readdir.c:152
ovl_cache_entry_add_rb fs/overlayfs/readdir.c:188 [inline]
ovl_fill_merge+0x416/0x830 fs/overlayfs/readdir.c:266
dir_emit include/linux/fs.h:3853 [inline]
afs_dynroot_readdir_cells fs/afs/dynroot.c:310 [inline]
afs_dynroot_readdir+0x814/0xbe0 fs/afs/dynroot.c:352
iterate_dir+0x5a9/0x760 fs/readdir.c:108
ovl_dir_read+0xfe/0x570 fs/overlayfs/readdir.c:313
ovl_dir_read_merged+0x315/0x5e0 fs/overlayfs/readdir.c:369
ovl_cache_get fs/overlayfs/readdir.c:422 [inline]
ovl_iterate+0x1196/0x21c0 fs/overlayfs/readdir.c:783
wrap_directory_iterator+0x91/0xd0 fs/readdir.c:65
iterate_dir+0x5a9/0x760 fs/readdir.c:108
__do_sys_getdents fs/readdir.c:322 [inline]
__se_sys_getdents+0x1ff/0x4e0 fs/readdir.c:308
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7c82f020f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff5a9e9b58 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007fff5a9e9c20 RCX: 00007f7c82f020f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 2df0c02dab82 x86 boot build: make git ignore stale 'tools'..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=138f0a4c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5f1762820c18874b
dashboard link: https://syzkaller.appspot.com/bug?extid=54e6c2176ba76c56217e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=178f0a4c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14182bb0580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fe089500003/disk-2df0c02d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d8df5abbd7c5/vmlinux-2df0c02d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09d23e93d3a8/bzImage-2df0c02d.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/586c05b92249/mount_0.gz
The issue was bisected to:
commit 1d0b929fc070b4115403a0a6206a0c6a62dd61f5
Author: David Howells <dhow...@redhat.com>
Date: Mon Feb 24 09:52:58 2025 +0000
afs: Change dynroot to create contents on demand
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1747aa4c580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=14c7aa4c580000
console output: https://syzkaller.appspot.com/x/log.txt?x=10c7aa4c580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54e6c2...@syzkaller.appspotmail.com
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5821, name: syz-executor365
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by syz-executor365/5821:
#0: ffff888032b155f8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x310 fs/file.c:1213
#1: ffff888077c90cf8 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: wrap_directory_iterator+0x5a/0xd0 fs/readdir.c:54
#2: ffff88807d2c0148 (&type->i_mutex_dir_key#6){++++}-{4:4}, at: iterate_dir+0x4a6/0x760 fs/readdir.c:101
#3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: afs_dynroot_readdir+0x466/0xbe0 fs/afs/dynroot.c:351
CPU: 0 UID: 0 PID: 5821 Comm: syz-executor365 Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
__might_resched+0x558/0x6c0 kernel/sched/core.c:8798
might_alloc include/linux/sched/mm.h:321 [inline]
slab_pre_alloc_hook mm/slub.c:4089 [inline]
slab_alloc_node mm/slub.c:4167 [inline]
__do_kmalloc_node mm/slub.c:4317 [inline]
__kmalloc_noprof+0xd0/0x4d0 mm/slub.c:4330
kmalloc_noprof include/linux/slab.h:906 [inline]
ovl_cache_entry_new+0x39/0x7b0 fs/overlayfs/readdir.c:152
ovl_cache_entry_add_rb fs/overlayfs/readdir.c:188 [inline]
ovl_fill_merge+0x416/0x830 fs/overlayfs/readdir.c:266
dir_emit include/linux/fs.h:3853 [inline]
afs_dynroot_readdir_cells fs/afs/dynroot.c:310 [inline]
afs_dynroot_readdir+0x814/0xbe0 fs/afs/dynroot.c:352
iterate_dir+0x5a9/0x760 fs/readdir.c:108
ovl_dir_read+0xfe/0x570 fs/overlayfs/readdir.c:313
ovl_dir_read_merged+0x315/0x5e0 fs/overlayfs/readdir.c:369
ovl_cache_get fs/overlayfs/readdir.c:422 [inline]
ovl_iterate+0x1196/0x21c0 fs/overlayfs/readdir.c:783
wrap_directory_iterator+0x91/0xd0 fs/readdir.c:65
iterate_dir+0x5a9/0x760 fs/readdir.c:108
__do_sys_getdents fs/readdir.c:322 [inline]
__se_sys_getdents+0x1ff/0x4e0 fs/readdir.c:308
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7c82f020f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff5a9e9b58 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007fff5a9e9c20 RCX: 00007f7c82f020f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
David Howells
Mar 28, 2025, 1:46:32 PM3/28/25
to syzbot, dhow...@redhat.com, almaz.ale...@paragon-software.com, linu...@lists.infradead.org, linux-...@vger.kernel.org, marc....@auristor.com, nt...@lists.linux.dev, syzkall...@googlegroups.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
commit f34068283e8650ecd7a2f57b0b55aa91e498a470
Author: David Howells <dhow...@redhat.com>
Date: Fri Mar 28 16:46:58 2025 +0000
afs: Fix afs_dynroot_readdir() to not use the RCU read lock
afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
emitting cell automount entries - but dir_emit() may write to a userspace
buffer, thereby causing a fault to occur and waits to happen.
Fix afs_dynroot_readdir() to get a shared lock on i_rwsem instead.
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
Reported-by: syzbot+3b6c5c...@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhow...@redhat.com>
cc: Marc Dionne <marc....@auristor.com>
cc: linu...@lists.infradead.org
cc: linux-...@vger.kernel.org
diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 691e0ae607a1..61bc8c81c5ca 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -348,9 +348,9 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
}
if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
- rcu_read_lock();
+ down_read(&file_inode(file)->i_rwsem);
ret = afs_dynroot_readdir_cells(net, ctx);
- rcu_read_unlock();
+ up_read(&file_inode(file)->i_rwsem);
}
return ret;
}
commit f34068283e8650ecd7a2f57b0b55aa91e498a470
Author: David Howells <dhow...@redhat.com>
Date: Fri Mar 28 16:46:58 2025 +0000
afs: Fix afs_dynroot_readdir() to not use the RCU read lock
afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
emitting cell automount entries - but dir_emit() may write to a userspace
buffer, thereby causing a fault to occur and waits to happen.
Fix afs_dynroot_readdir() to get a shared lock on i_rwsem instead.
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
Signed-off-by: David Howells <dhow...@redhat.com>
cc: Marc Dionne <marc....@auristor.com>
cc: linu...@lists.infradead.org
cc: linux-...@vger.kernel.org
diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 691e0ae607a1..61bc8c81c5ca 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -348,9 +348,9 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
}
if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
- rcu_read_lock();
+ down_read(&file_inode(file)->i_rwsem);
ret = afs_dynroot_readdir_cells(net, ctx);
- rcu_read_unlock();
+ up_read(&file_inode(file)->i_rwsem);
}
return ret;
}
syzbot
Mar 28, 2025, 2:28:03 PM3/28/25
to almaz.ale...@paragon-software.com, dhow...@redhat.com, linu...@lists.infradead.org, linux-...@vger.kernel.org, marc....@auristor.com, nt...@lists.linux.dev, syzkall...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
[ 67.301492][ T5869] veth1_macvtap: entered promiscuous mode
[ 67.319170][ T5869] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 67.333396][ T5869] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 67.346831][ T5869] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.356212][ T5869] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.365100][ T5869] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.373953][ T5869] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.472722][ T5869] syz-executor (5869) used greatest stack depth: 19488 bytes left
[ 67.501901][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 67.576996][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 67.661465][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 67.748009][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 67.949932][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 67.958916][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 67.967344][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 67.976923][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 67.985260][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/03/28 18:27:39 executed programs: 0
[ 69.164026][ T5141] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 69.173295][ T5141] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 69.181734][ T5141] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 69.190184][ T5141] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 69.199442][ T5141] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 69.295244][ T5935] chnl_net:caif_netlink_parms(): no params data found
[ 69.338972][ T5935] bridge0: port 1(bridge_slave_0) entered blocking state
[ 69.346368][ T5935] bridge0: port 1(bridge_slave_0) entered disabled state
[ 69.353702][ T5935] bridge_slave_0: entered allmulticast mode
[ 69.360993][ T5935] bridge_slave_0: entered promiscuous mode
[ 69.368827][ T5935] bridge0: port 2(bridge_slave_1) entered blocking state
[ 69.376982][ T5935] bridge0: port 2(bridge_slave_1) entered disabled state
[ 69.384211][ T5935] bridge_slave_1: entered allmulticast mode
[ 69.391737][ T5935] bridge_slave_1: entered promiscuous mode
[ 69.416181][ T5935] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 69.427861][ T5935] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 69.452906][ T5935] team0: Port device team_slave_0 added
[ 69.460371][ T5935] team0: Port device team_slave_1 added
[ 69.481917][ T5935] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 69.489067][ T5935] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 69.515903][ T5935] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 69.529007][ T5935] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 69.536113][ T5935] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 69.562895][ T5935] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 69.592286][ T5935] hsr_slave_0: entered promiscuous mode
[ 69.599283][ T5935] hsr_slave_1: entered promiscuous mode
[ 69.605412][ T5935] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 69.613545][ T5935] Cannot create hsr debugfs directory
[ 70.333954][ T12] bridge_slave_1: left allmulticast mode
[ 70.340653][ T12] bridge_slave_1: left promiscuous mode
[ 70.349079][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 70.361384][ T12] bridge_slave_0: left allmulticast mode
[ 70.373776][ T12] bridge_slave_0: left promiscuous mode
[ 70.380530][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 70.680418][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 70.691520][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 70.702701][ T12] bond0 (unregistering): Released all slaves
[ 70.723743][ T5494]
[ 70.726126][ T5494] ============================================
[ 70.732393][ T5494] WARNING: possible recursive locking detected
[ 70.738574][ T5494] 6.14.0-syzkaller-07422-gacb4f33713b9-dirty #0 Not tainted
[ 70.745870][ T5494] --------------------------------------------
[ 70.752151][ T5494] dhcpcd/5494 is trying to acquire lock:
[ 70.758584][ T5494] ffff888031928d28 (&dev->lock){+.+.}-{4:4}, at: lapbeth_device_event+0x766/0xa20
[ 70.767850][ T5494]
[ 70.767850][ T5494] but task is already holding lock:
[ 70.775239][ T5494] ffff888029048d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[ 70.784310][ T5494]
[ 70.784310][ T5494] other info that might help us debug this:
[ 70.792558][ T5494] Possible unsafe locking scenario:
[ 70.792558][ T5494]
[ 70.800017][ T5494] CPU0
[ 70.803327][ T5494] ----
[ 70.806654][ T5494] lock(&dev->lock);
[ 70.810660][ T5494] lock(&dev->lock);
[ 70.814779][ T5494]
[ 70.814779][ T5494] *** DEADLOCK ***
[ 70.814779][ T5494]
[ 70.822942][ T5494] May be due to missing lock nesting notation
[ 70.822942][ T5494]
[ 70.831273][ T5494] 2 locks held by dhcpcd/5494:
[ 70.836134][ T5494] #0: ffffffff900cf5c8 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x34e/0x1d80
[ 70.845571][ T5494] #1: ffff888029048d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[ 70.854909][ T5494]
[ 70.854909][ T5494] stack backtrace:
[ 70.861028][ T5494] CPU: 0 UID: 0 PID: 5494 Comm: dhcpcd Not tainted 6.14.0-syzkaller-07422-gacb4f33713b9-dirty #0 PREEMPT(full)
[ 70.861048][ T5494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 70.861060][ T5494] Call Trace:
[ 70.861068][ T5494] <TASK>
[ 70.861075][ T5494] dump_stack_lvl+0x241/0x360
[ 70.861096][ T5494] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.861111][ T5494] ? __pfx__printk+0x10/0x10
[ 70.861124][ T5494] ? print_lock+0x171/0x1a0
[ 70.861137][ T5494] print_deadlock_bug+0x2be/0x2d0
[ 70.861149][ T5494] validate_chain+0x928/0x24e0
[ 70.861161][ T5494] ? stack_depot_save_flags+0x3a/0x970
[ 70.861177][ T5494] ? look_up_lock_class+0x7b/0x170
[ 70.861193][ T5494] ? register_lock_class+0x54/0x330
[ 70.861210][ T5494] __lock_acquire+0xad5/0xd80
[ 70.861228][ T5494] lock_acquire+0x116/0x2f0
[ 70.861244][ T5494] ? lapbeth_device_event+0x766/0xa20
[ 70.861273][ T5494] __mutex_lock+0x1a5/0x10c0
[ 70.861290][ T5494] ? lapbeth_device_event+0x766/0xa20
[ 70.861308][ T5494] ? ref_tracker_alloc+0x316/0x4c0
[ 70.861322][ T5494] ? lapbeth_device_event+0x766/0xa20
[ 70.861337][ T5494] ? rcu_is_watching+0x15/0xb0
[ 70.861349][ T5494] ? __pfx___mutex_lock+0x10/0x10
[ 70.861367][ T5494] ? __raw_spin_lock_init+0x45/0x100
[ 70.861381][ T5494] lapbeth_device_event+0x766/0xa20
[ 70.861399][ T5494] notifier_call_chain+0x1a5/0x3f0
[ 70.861413][ T5494] __dev_notify_flags+0x209/0x410
[ 70.861426][ T5494] ? __pfx___dev_notify_flags+0x10/0x10
[ 70.861437][ T5494] ? __dev_change_flags+0x517/0x700
[ 70.861448][ T5494] ? __pfx___mutex_lock+0x10/0x10
[ 70.861463][ T5494] ? __pfx___dev_change_flags+0x10/0x10
[ 70.861474][ T5494] ? __pfx___mutex_lock+0x10/0x10
[ 70.861490][ T5494] netif_change_flags+0xf0/0x1a0
[ 70.861502][ T5494] dev_change_flags+0x146/0x270
[ 70.861520][ T5494] devinet_ioctl+0xea4/0x1d80
[ 70.861541][ T5494] ? __pfx_devinet_ioctl+0x10/0x10
[ 70.861558][ T5494] ? get_user_ifreq+0x1bb/0x200
[ 70.861572][ T5494] inet_ioctl+0x3d9/0x4f0
[ 70.861585][ T5494] ? __pfx_inet_ioctl+0x10/0x10
[ 70.861597][ T5494] ? lockdep_hardirqs_on+0x9d/0x150
[ 70.861616][ T5494] ? tomoyo_path_number_perm+0x215/0x790
[ 70.861629][ T5494] sock_do_ioctl+0x15a/0x490
[ 70.861646][ T5494] ? __pfx_sock_do_ioctl+0x10/0x10
[ 70.861661][ T5494] ? fd_install+0x9c/0x4c0
[ 70.861675][ T5494] ? __asan_memset+0x23/0x50
[ 70.861690][ T5494] ? smack_file_ioctl+0x2a7/0x3b0
[ 70.861709][ T5494] sock_ioctl+0x644/0x900
[ 70.861723][ T5494] ? __pfx_sock_ioctl+0x10/0x10
[ 70.861737][ T5494] ? __sys_socket+0x209/0x3c0
[ 70.861756][ T5494] ? __pfx_sock_ioctl+0x10/0x10
[ 70.861770][ T5494] __se_sys_ioctl+0xf1/0x160
[ 70.861787][ T5494] do_syscall_64+0xf3/0x230
[ 70.861803][ T5494] ? clear_bhb_loop+0x45/0xa0
[ 70.861817][ T5494] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.861834][ T5494] RIP: 0033:0x7fd9c5fd0d49
[ 70.861847][ T5494] Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8
[ 70.861857][ T5494] RSP: 002b:00007ffdb24aded8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 70.861871][ T5494] RAX: ffffffffffffffda RBX: 00007fd9c5f026c0 RCX: 00007fd9c5fd0d49
[ 70.861880][ T5494] RDX: 00007ffdb24be0c8 RSI: 0000000000008914 RDI: 000000000000000e
[ 70.861888][ T5494] RBP: 00007ffdb24ce288 R08: 00007ffdb24be088 R09: 00007ffdb24be038
[ 70.861896][ T5494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 70.861903][ T5494] R13: 00007ffdb24be0c8 R14: 0000000000000028 R15: 0000000000008914
[ 70.861915][ T5494] </TASK>
[ 71.236309][ T54] Bluetooth: hci0: command tx timeout
[ 71.275432][ T12] hsr_slave_0: left promiscuous mode
[ 71.281546][ T12] hsr_slave_1: left promiscuous mode
[ 71.287764][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 71.295331][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 71.304070][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 71.313996][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 71.326049][ T12] veth1_macvtap: left promiscuous mode
[ 71.332010][ T12] veth0_macvtap: left promiscuous mode
[ 71.338664][ T12] veth1_vlan: left promiscuous mode
[ 71.344086][ T12] veth0_vlan: left promiscuous mode
[ 71.499375][ T12] team0 (unregistering): Port device team_slave_1 removed
[ 71.518998][ T12] team0 (unregistering): Port device team_slave_0 removed
[ 71.768553][ T5935] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 71.782330][ T5935] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 71.800415][ T5935] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 71.807733][ T1299] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.814222][ T1299] ieee802154 phy1 wpan1: encryption failed: -22
[ 71.827908][ T5935] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 71.908849][ T5935] 8021q: adding VLAN 0 to HW filter on device bond0
[ 71.927794][ T5935] 8021q: adding VLAN 0 to HW filter on device team0
[ 71.939414][ T52] bridge0: port 1(bridge_slave_0) entered blocking state
[ 71.946587][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 71.960586][ T52] bridge0: port 2(bridge_slave_1) entered blocking state
[ 71.967847][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 72.100315][ T5935] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 72.135076][ T5935] veth0_vlan: entered promiscuous mode
[ 72.150064][ T5935] veth1_vlan: entered promiscuous mode
[ 72.174924][ T5935] veth0_macvtap: entered promiscuous mode
[ 72.185557][ T5935] veth1_macvtap: entered promiscuous mode
[ 72.204865][ T5935] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 72.221827][ T5935] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 72.233244][ T5935] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.243419][ T5935] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.254138][ T5935] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.265046][ T5935] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.303411][ T5935] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[ 72.328013][ T3439] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.329376][ T5935] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht'
[ 72.350429][ T3439] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 72.373018][ T52] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.382317][ T52] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/tool...@v0.0.1-go1.23.6.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/tool...@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3336433996=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at 89d30d7360d
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=89d30d7360d4a366f8fdf00d6ac56cced7a45b0b -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250325-195331'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"89d30d7360d4a366f8fdf00d6ac56cced7a45b0b\"
/usr/bin/ld: /tmp/cc58UvIY.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=13d22a4c580000
Tested on:
commit: acb4f337 Merge tag 'm68knommu-for-v6.15' of git://git...
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=982413b40f90fdf8
syzbot tried to test the proposed patch but the build/boot failed:
[ 67.301492][ T5869] veth1_macvtap: entered promiscuous mode
[ 67.319170][ T5869] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 67.333396][ T5869] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 67.346831][ T5869] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.356212][ T5869] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.365100][ T5869] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.373953][ T5869] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.472722][ T5869] syz-executor (5869) used greatest stack depth: 19488 bytes left
[ 67.501901][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 67.576996][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 67.661465][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 67.748009][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 67.949932][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 67.958916][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 67.967344][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 67.976923][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 67.985260][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/03/28 18:27:39 executed programs: 0
[ 69.164026][ T5141] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 69.173295][ T5141] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 69.181734][ T5141] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 69.190184][ T5141] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 69.199442][ T5141] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 69.295244][ T5935] chnl_net:caif_netlink_parms(): no params data found
[ 69.338972][ T5935] bridge0: port 1(bridge_slave_0) entered blocking state
[ 69.346368][ T5935] bridge0: port 1(bridge_slave_0) entered disabled state
[ 69.353702][ T5935] bridge_slave_0: entered allmulticast mode
[ 69.360993][ T5935] bridge_slave_0: entered promiscuous mode
[ 69.368827][ T5935] bridge0: port 2(bridge_slave_1) entered blocking state
[ 69.376982][ T5935] bridge0: port 2(bridge_slave_1) entered disabled state
[ 69.384211][ T5935] bridge_slave_1: entered allmulticast mode
[ 69.391737][ T5935] bridge_slave_1: entered promiscuous mode
[ 69.416181][ T5935] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 69.427861][ T5935] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 69.452906][ T5935] team0: Port device team_slave_0 added
[ 69.460371][ T5935] team0: Port device team_slave_1 added
[ 69.481917][ T5935] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 69.489067][ T5935] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 69.515903][ T5935] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 69.529007][ T5935] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 69.536113][ T5935] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 69.562895][ T5935] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 69.592286][ T5935] hsr_slave_0: entered promiscuous mode
[ 69.599283][ T5935] hsr_slave_1: entered promiscuous mode
[ 69.605412][ T5935] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 69.613545][ T5935] Cannot create hsr debugfs directory
[ 70.333954][ T12] bridge_slave_1: left allmulticast mode
[ 70.340653][ T12] bridge_slave_1: left promiscuous mode
[ 70.349079][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 70.361384][ T12] bridge_slave_0: left allmulticast mode
[ 70.373776][ T12] bridge_slave_0: left promiscuous mode
[ 70.380530][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 70.680418][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 70.691520][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 70.702701][ T12] bond0 (unregistering): Released all slaves
[ 70.723743][ T5494]
[ 70.726126][ T5494] ============================================
[ 70.732393][ T5494] WARNING: possible recursive locking detected
[ 70.738574][ T5494] 6.14.0-syzkaller-07422-gacb4f33713b9-dirty #0 Not tainted
[ 70.745870][ T5494] --------------------------------------------
[ 70.752151][ T5494] dhcpcd/5494 is trying to acquire lock:
[ 70.758584][ T5494] ffff888031928d28 (&dev->lock){+.+.}-{4:4}, at: lapbeth_device_event+0x766/0xa20
[ 70.767850][ T5494]
[ 70.767850][ T5494] but task is already holding lock:
[ 70.775239][ T5494] ffff888029048d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[ 70.784310][ T5494]
[ 70.784310][ T5494] other info that might help us debug this:
[ 70.792558][ T5494] Possible unsafe locking scenario:
[ 70.792558][ T5494]
[ 70.800017][ T5494] CPU0
[ 70.803327][ T5494] ----
[ 70.806654][ T5494] lock(&dev->lock);
[ 70.810660][ T5494] lock(&dev->lock);
[ 70.814779][ T5494]
[ 70.814779][ T5494] *** DEADLOCK ***
[ 70.814779][ T5494]
[ 70.822942][ T5494] May be due to missing lock nesting notation
[ 70.822942][ T5494]
[ 70.831273][ T5494] 2 locks held by dhcpcd/5494:
[ 70.836134][ T5494] #0: ffffffff900cf5c8 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x34e/0x1d80
[ 70.845571][ T5494] #1: ffff888029048d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[ 70.854909][ T5494]
[ 70.854909][ T5494] stack backtrace:
[ 70.861028][ T5494] CPU: 0 UID: 0 PID: 5494 Comm: dhcpcd Not tainted 6.14.0-syzkaller-07422-gacb4f33713b9-dirty #0 PREEMPT(full)
[ 70.861048][ T5494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 70.861060][ T5494] Call Trace:
[ 70.861068][ T5494] <TASK>
[ 70.861075][ T5494] dump_stack_lvl+0x241/0x360
[ 70.861096][ T5494] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.861111][ T5494] ? __pfx__printk+0x10/0x10
[ 70.861124][ T5494] ? print_lock+0x171/0x1a0
[ 70.861137][ T5494] print_deadlock_bug+0x2be/0x2d0
[ 70.861149][ T5494] validate_chain+0x928/0x24e0
[ 70.861161][ T5494] ? stack_depot_save_flags+0x3a/0x970
[ 70.861177][ T5494] ? look_up_lock_class+0x7b/0x170
[ 70.861193][ T5494] ? register_lock_class+0x54/0x330
[ 70.861210][ T5494] __lock_acquire+0xad5/0xd80
[ 70.861228][ T5494] lock_acquire+0x116/0x2f0
[ 70.861244][ T5494] ? lapbeth_device_event+0x766/0xa20
[ 70.861273][ T5494] __mutex_lock+0x1a5/0x10c0
[ 70.861290][ T5494] ? lapbeth_device_event+0x766/0xa20
[ 70.861308][ T5494] ? ref_tracker_alloc+0x316/0x4c0
[ 70.861322][ T5494] ? lapbeth_device_event+0x766/0xa20
[ 70.861337][ T5494] ? rcu_is_watching+0x15/0xb0
[ 70.861349][ T5494] ? __pfx___mutex_lock+0x10/0x10
[ 70.861367][ T5494] ? __raw_spin_lock_init+0x45/0x100
[ 70.861381][ T5494] lapbeth_device_event+0x766/0xa20
[ 70.861399][ T5494] notifier_call_chain+0x1a5/0x3f0
[ 70.861413][ T5494] __dev_notify_flags+0x209/0x410
[ 70.861426][ T5494] ? __pfx___dev_notify_flags+0x10/0x10
[ 70.861437][ T5494] ? __dev_change_flags+0x517/0x700
[ 70.861448][ T5494] ? __pfx___mutex_lock+0x10/0x10
[ 70.861463][ T5494] ? __pfx___dev_change_flags+0x10/0x10
[ 70.861474][ T5494] ? __pfx___mutex_lock+0x10/0x10
[ 70.861490][ T5494] netif_change_flags+0xf0/0x1a0
[ 70.861502][ T5494] dev_change_flags+0x146/0x270
[ 70.861520][ T5494] devinet_ioctl+0xea4/0x1d80
[ 70.861541][ T5494] ? __pfx_devinet_ioctl+0x10/0x10
[ 70.861558][ T5494] ? get_user_ifreq+0x1bb/0x200
[ 70.861572][ T5494] inet_ioctl+0x3d9/0x4f0
[ 70.861585][ T5494] ? __pfx_inet_ioctl+0x10/0x10
[ 70.861597][ T5494] ? lockdep_hardirqs_on+0x9d/0x150
[ 70.861616][ T5494] ? tomoyo_path_number_perm+0x215/0x790
[ 70.861629][ T5494] sock_do_ioctl+0x15a/0x490
[ 70.861646][ T5494] ? __pfx_sock_do_ioctl+0x10/0x10
[ 70.861661][ T5494] ? fd_install+0x9c/0x4c0
[ 70.861675][ T5494] ? __asan_memset+0x23/0x50
[ 70.861690][ T5494] ? smack_file_ioctl+0x2a7/0x3b0
[ 70.861709][ T5494] sock_ioctl+0x644/0x900
[ 70.861723][ T5494] ? __pfx_sock_ioctl+0x10/0x10
[ 70.861737][ T5494] ? __sys_socket+0x209/0x3c0
[ 70.861756][ T5494] ? __pfx_sock_ioctl+0x10/0x10
[ 70.861770][ T5494] __se_sys_ioctl+0xf1/0x160
[ 70.861787][ T5494] do_syscall_64+0xf3/0x230
[ 70.861803][ T5494] ? clear_bhb_loop+0x45/0xa0
[ 70.861817][ T5494] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.861834][ T5494] RIP: 0033:0x7fd9c5fd0d49
[ 70.861847][ T5494] Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8
[ 70.861857][ T5494] RSP: 002b:00007ffdb24aded8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 70.861871][ T5494] RAX: ffffffffffffffda RBX: 00007fd9c5f026c0 RCX: 00007fd9c5fd0d49
[ 70.861880][ T5494] RDX: 00007ffdb24be0c8 RSI: 0000000000008914 RDI: 000000000000000e
[ 70.861888][ T5494] RBP: 00007ffdb24ce288 R08: 00007ffdb24be088 R09: 00007ffdb24be038
[ 70.861896][ T5494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 70.861903][ T5494] R13: 00007ffdb24be0c8 R14: 0000000000000028 R15: 0000000000008914
[ 70.861915][ T5494] </TASK>
[ 71.236309][ T54] Bluetooth: hci0: command tx timeout
[ 71.275432][ T12] hsr_slave_0: left promiscuous mode
[ 71.281546][ T12] hsr_slave_1: left promiscuous mode
[ 71.287764][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 71.295331][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 71.304070][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 71.313996][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 71.326049][ T12] veth1_macvtap: left promiscuous mode
[ 71.332010][ T12] veth0_macvtap: left promiscuous mode
[ 71.338664][ T12] veth1_vlan: left promiscuous mode
[ 71.344086][ T12] veth0_vlan: left promiscuous mode
[ 71.499375][ T12] team0 (unregistering): Port device team_slave_1 removed
[ 71.518998][ T12] team0 (unregistering): Port device team_slave_0 removed
[ 71.768553][ T5935] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 71.782330][ T5935] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 71.800415][ T5935] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 71.807733][ T1299] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.814222][ T1299] ieee802154 phy1 wpan1: encryption failed: -22
[ 71.827908][ T5935] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 71.908849][ T5935] 8021q: adding VLAN 0 to HW filter on device bond0
[ 71.927794][ T5935] 8021q: adding VLAN 0 to HW filter on device team0
[ 71.939414][ T52] bridge0: port 1(bridge_slave_0) entered blocking state
[ 71.946587][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 71.960586][ T52] bridge0: port 2(bridge_slave_1) entered blocking state
[ 71.967847][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 72.100315][ T5935] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 72.135076][ T5935] veth0_vlan: entered promiscuous mode
[ 72.150064][ T5935] veth1_vlan: entered promiscuous mode
[ 72.174924][ T5935] veth0_macvtap: entered promiscuous mode
[ 72.185557][ T5935] veth1_macvtap: entered promiscuous mode
[ 72.204865][ T5935] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 72.221827][ T5935] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 72.233244][ T5935] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.243419][ T5935] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.254138][ T5935] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.265046][ T5935] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.303411][ T5935] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[ 72.328013][ T3439] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.329376][ T5935] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht'
[ 72.350429][ T3439] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 72.373018][ T52] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.382317][ T52] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/tool...@v0.0.1-go1.23.6.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/tool...@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3336433996=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at 89d30d7360d
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=89d30d7360d4a366f8fdf00d6ac56cced7a45b0b -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250325-195331'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"89d30d7360d4a366f8fdf00d6ac56cced7a45b0b\"
/usr/bin/ld: /tmp/cc58UvIY.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=13d22a4c580000
Tested on:
commit: acb4f337 Merge tag 'm68knommu-for-v6.15' of git://git...
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=982413b40f90fdf8
dashboard link: https://syzkaller.appspot.com/bug?extid=54e6c2176ba76c56217e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13de743f980000
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Edward Adam Davis
Mar 28, 2025, 10:53:49 PM3/28/25
to syzbot+54e6c2...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
#syz test
diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 691e0ae607a1..829188ef5435 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -287,12 +287,16 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
_enter("%llu", ctx->pos);
+ rcu_read_lock();
for (;;) {
unsigned int ix = ctx->pos >> 1;
+ u8 name_len;
+ char *name;
+ unsigned int dynroot_ino;
cell = idr_get_next(&net->cells_dyn_ino, &ix);
if (!cell)
- return 0;
+ goto unlock;
if (READ_ONCE(cell->state) == AFS_CELL_REMOVING ||
READ_ONCE(cell->state) == AFS_CELL_DEAD) {
ctx->pos += 2;
@@ -306,19 +310,28 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
_debug("pos %llu -> cell %u", ctx->pos, cell->dynroot_ino);
+ name_len = cell->name_len;
+ name = cell->name;
+ dynroot_ino = cell->dynroot_ino;
if ((ctx->pos & 1) == 0) {
- if (!dir_emit(ctx, cell->name, cell->name_len,
- cell->dynroot_ino, DT_DIR))
- return 0;
+ rcu_read_unlock();
+ if (!dir_emit(ctx, name, name_len, dynroot_ino, DT_DIR))
+ goto out;
+ rcu_read_lock();
ctx->pos++;
}
if ((ctx->pos & 1) == 1) {
- if (!dir_emit(ctx, cell->name - 1, cell->name_len + 1,
- cell->dynroot_ino + 1, DT_DIR))
- return 0;
+ rcu_read_unlock();
+ if (!dir_emit(ctx, name - 1, name_len + 1,
+ dynroot_ino + 1, DT_DIR))
+ goto out;
+ rcu_read_lock();
ctx->pos++;
}
}
+unlock:
+ rcu_read_unlock();
+out:
return 0;
}
@@ -348,9 +361,7 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
}
diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 691e0ae607a1..829188ef5435 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -287,12 +287,16 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
_enter("%llu", ctx->pos);
+ rcu_read_lock();
for (;;) {
unsigned int ix = ctx->pos >> 1;
+ u8 name_len;
+ char *name;
+ unsigned int dynroot_ino;
cell = idr_get_next(&net->cells_dyn_ino, &ix);
if (!cell)
- return 0;
+ goto unlock;
if (READ_ONCE(cell->state) == AFS_CELL_REMOVING ||
READ_ONCE(cell->state) == AFS_CELL_DEAD) {
ctx->pos += 2;
@@ -306,19 +310,28 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
_debug("pos %llu -> cell %u", ctx->pos, cell->dynroot_ino);
+ name_len = cell->name_len;
+ name = cell->name;
+ dynroot_ino = cell->dynroot_ino;
if ((ctx->pos & 1) == 0) {
- if (!dir_emit(ctx, cell->name, cell->name_len,
- cell->dynroot_ino, DT_DIR))
- return 0;
+ rcu_read_unlock();
+ if (!dir_emit(ctx, name, name_len, dynroot_ino, DT_DIR))
+ goto out;
+ rcu_read_lock();
ctx->pos++;
}
if ((ctx->pos & 1) == 1) {
- if (!dir_emit(ctx, cell->name - 1, cell->name_len + 1,
- cell->dynroot_ino + 1, DT_DIR))
- return 0;
+ rcu_read_unlock();
+ if (!dir_emit(ctx, name - 1, name_len + 1,
+ dynroot_ino + 1, DT_DIR))
+ goto out;
+ rcu_read_lock();
ctx->pos++;
}
}
+unlock:
+ rcu_read_unlock();
+out:
return 0;
}
@@ -348,9 +361,7 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
}
if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
- rcu_read_lock();
if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
- rcu_read_lock();
ret = afs_dynroot_readdir_cells(net, ctx);
- rcu_read_unlock();
}
return ret;
- rcu_read_unlock();
}
}
syzbot
Mar 29, 2025, 2:02:05 AM3/29/25
to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
T5845] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
syzbot tried to test the proposed patch but the build/boot failed:
[ 67.873741][ T5845] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.882828][ T5845] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 67.892838][ T5845] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 68.022968][ T739] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 68.099904][ T739] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 68.169446][ T739] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 68.241769][ T739] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 69.209247][ T5910] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 69.221468][ T5910] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 69.230175][ T5910] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 69.239192][ T5910] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 69.246743][ T5910] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 69.725106][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 69.741653][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 69.766123][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 69.774200][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/03/29 06:01:08 executed programs: 0
[ 70.225341][ T5910] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 70.234939][ T5910] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 70.243559][ T5910] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 70.252434][ T5910] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 70.260174][ T5910] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 70.347265][ T5933] chnl_net:caif_netlink_parms(): no params data found
[ 70.389979][ T5933] bridge0: port 1(bridge_slave_0) entered blocking state
[ 70.397116][ T5933] bridge0: port 1(bridge_slave_0) entered disabled state
[ 70.404567][ T5933] bridge_slave_0: entered allmulticast mode
[ 70.411635][ T5933] bridge_slave_0: entered promiscuous mode
[ 70.419405][ T5933] bridge0: port 2(bridge_slave_1) entered blocking state
[ 70.426553][ T5933] bridge0: port 2(bridge_slave_1) entered disabled state
[ 70.434133][ T5933] bridge_slave_1: entered allmulticast mode
[ 70.440770][ T5933] bridge_slave_1: entered promiscuous mode
[ 70.459538][ T5933] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 70.470995][ T5933] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 70.493596][ T5933] team0: Port device team_slave_0 added
[ 70.501395][ T5933] team0: Port device team_slave_1 added
[ 70.519008][ T5933] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 70.526072][ T5933] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 70.552861][ T5933] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 70.565006][ T5933] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 70.572298][ T5933] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 70.598637][ T5933] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 70.627155][ T5933] hsr_slave_0: entered promiscuous mode
[ 70.633381][ T5933] hsr_slave_1: entered promiscuous mode
[ 70.639645][ T5933] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 70.647370][ T5933] Cannot create hsr debugfs directory
[ 70.812486][ T739] bridge_slave_1: left allmulticast mode
[ 70.819194][ T739] bridge_slave_1: left promiscuous mode
[ 70.825833][ T739] bridge0: port 2(bridge_slave_1) entered disabled state
[ 70.842235][ T739] bridge_slave_0: left allmulticast mode
[ 70.847996][ T739] bridge_slave_0: left promiscuous mode
[ 70.853757][ T739] bridge0: port 1(bridge_slave_0) entered disabled state
[ 71.122739][ T739] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 71.133922][ T739] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 71.144058][ T739] bond0 (unregistering): Released all slaves
[ 71.164249][ T5492]
[ 71.166627][ T5492] ============================================
[ 71.172866][ T5492] WARNING: possible recursive locking detected
[ 71.179026][ T5492] 6.14.0-syzkaller-09584-g7d06015d936c-dirty #0 Not tainted
[ 71.186417][ T5492] --------------------------------------------
[ 71.192576][ T5492] dhcpcd/5492 is trying to acquire lock:
[ 71.198194][ T5492] ffff888030ed0d28 (&dev->lock){+.+.}-{4:4}, at: lapbeth_device_event+0x766/0xa20
[ 71.207517][ T5492]
[ 71.207517][ T5492] but task is already holding lock:
[ 71.214971][ T5492] ffff88805c068d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[ 71.223915][ T5492]
[ 71.223915][ T5492] other info that might help us debug this:
[ 71.231970][ T5492] Possible unsafe locking scenario:
[ 71.231970][ T5492]
[ 71.239412][ T5492] CPU0
[ 71.242679][ T5492] ----
[ 71.245961][ T5492] lock(&dev->lock);
[ 71.249953][ T5492] lock(&dev->lock);
[ 71.253947][ T5492]
[ 71.253947][ T5492] *** DEADLOCK ***
[ 71.253947][ T5492]
[ 71.262112][ T5492] May be due to missing lock nesting notation
[ 71.262112][ T5492]
[ 71.270417][ T5492] 2 locks held by dhcpcd/5492:
[ 71.275342][ T5492] #0: ffffffff900d3988 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x34e/0x1d80
[ 71.284475][ T5492] #1: ffff88805c068d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[ 71.293780][ T5492]
[ 71.293780][ T5492] stack backtrace:
[ 71.299673][ T5492] CPU: 1 UID: 0 PID: 5492 Comm: dhcpcd Not tainted 6.14.0-syzkaller-09584-g7d06015d936c-dirty #0 PREEMPT(full)
[ 71.299689][ T5492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 71.299700][ T5492] Call Trace:
[ 71.299706][ T5492] <TASK>
[ 71.299712][ T5492] dump_stack_lvl+0x241/0x360
[ 71.299731][ T5492] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.299745][ T5492] ? __pfx__printk+0x10/0x10
[ 71.299758][ T5492] ? print_lock+0x171/0x1a0
[ 71.299770][ T5492] print_deadlock_bug+0x2be/0x2d0
[ 71.299783][ T5492] validate_chain+0x928/0x24e0
[ 71.299795][ T5492] ? stack_depot_save_flags+0x3a/0x970
[ 71.299813][ T5492] ? look_up_lock_class+0x7b/0x170
[ 71.299825][ T5492] ? register_lock_class+0x54/0x330
[ 71.299841][ T5492] __lock_acquire+0xad5/0xd80
[ 71.299859][ T5492] lock_acquire+0x116/0x2f0
[ 71.299873][ T5492] ? lapbeth_device_event+0x766/0xa20
[ 71.299888][ T5492] __mutex_lock+0x1a5/0x10c0
[ 71.299900][ T5492] ? lapbeth_device_event+0x766/0xa20
[ 71.299913][ T5492] ? ref_tracker_alloc+0x316/0x4c0
[ 71.299930][ T5492] ? lapbeth_device_event+0x766/0xa20
[ 71.299941][ T5492] ? rcu_is_watching+0x15/0xb0
[ 71.299953][ T5492] ? __pfx___mutex_lock+0x10/0x10
[ 71.299967][ T5492] ? __raw_spin_lock_init+0x45/0x100
[ 71.299981][ T5492] lapbeth_device_event+0x766/0xa20
[ 71.299994][ T5492] notifier_call_chain+0x1a5/0x3f0
[ 71.300009][ T5492] __dev_notify_flags+0x209/0x410
[ 71.300024][ T5492] ? __pfx___dev_notify_flags+0x10/0x10
[ 71.300037][ T5492] ? __dev_change_flags+0x517/0x700
[ 71.300052][ T5492] ? __pfx___mutex_lock+0x10/0x10
[ 71.300063][ T5492] ? __pfx___dev_change_flags+0x10/0x10
[ 71.300077][ T5492] ? __pfx___mutex_lock+0x10/0x10
[ 71.300088][ T5492] netif_change_flags+0xf0/0x1a0
[ 71.300103][ T5492] dev_change_flags+0x146/0x270
[ 71.300117][ T5492] devinet_ioctl+0xea4/0x1d80
[ 71.300132][ T5492] ? __pfx_devinet_ioctl+0x10/0x10
[ 71.300145][ T5492] ? get_user_ifreq+0x1bb/0x200
[ 71.300161][ T5492] inet_ioctl+0x3d9/0x4f0
[ 71.300176][ T5492] ? __pfx_inet_ioctl+0x10/0x10
[ 71.300190][ T5492] ? lockdep_hardirqs_on+0x9d/0x150
[ 71.300211][ T5492] ? tomoyo_path_number_perm+0x215/0x790
[ 71.300226][ T5492] sock_do_ioctl+0x15a/0x490
[ 71.300238][ T5492] ? __pfx_sock_do_ioctl+0x10/0x10
[ 71.300250][ T5492] ? fd_install+0x9c/0x4c0
[ 71.300263][ T5492] ? __asan_memset+0x23/0x50
[ 71.300278][ T5492] ? smack_file_ioctl+0x2a7/0x3b0
[ 71.300295][ T5492] sock_ioctl+0x644/0x900
[ 71.300312][ T5492] ? __pfx_sock_ioctl+0x10/0x10
[ 71.300328][ T5492] ? __sys_socket+0x209/0x3c0
[ 71.300341][ T5492] ? __pfx_sock_ioctl+0x10/0x10
[ 71.300357][ T5492] __se_sys_ioctl+0xf1/0x160
[ 71.300374][ T5492] do_syscall_64+0xf3/0x230
[ 71.300386][ T5492] ? clear_bhb_loop+0x45/0xa0
[ 71.300399][ T5492] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.300413][ T5492] RIP: 0033:0x7fa55dcd4d49
[ 71.300429][ T5492] Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8
[ 71.300439][ T5492] RSP: 002b:00007fffa292ae78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 71.300453][ T5492] RAX: ffffffffffffffda RBX: 00007fa55dc066c0 RCX: 00007fa55dcd4d49
[ 71.300462][ T5492] RDX: 00007fffa293b068 RSI: 0000000000008914 RDI: 0000000000000010
[ 71.300470][ T5492] RBP: 00007fffa294b228 R08: 00007fffa293b028 R09: 00007fffa293afd8
[ 71.300478][ T5492] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 71.300486][ T5492] R13: 00007fffa293b068 R14: 0000000000000028 R15: 0000000000008914
[ 71.300498][ T5492] </TASK>
[ 71.649519][ T1300] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.655830][ T1300] ieee802154 phy1 wpan1: encryption failed: -22
[ 71.712528][ T739] hsr_slave_0: left promiscuous mode
[ 71.718615][ T739] hsr_slave_1: left promiscuous mode
[ 71.724266][ T739] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 71.732057][ T739] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 71.740909][ T739] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 71.748958][ T739] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 71.758568][ T739] veth1_macvtap: left promiscuous mode
[ 71.764195][ T739] veth0_macvtap: left promiscuous mode
[ 71.770138][ T739] veth1_vlan: left promiscuous mode
[ 71.775453][ T739] veth0_vlan: left promiscuous mode
[ 71.927279][ T739] team0 (unregistering): Port device team_slave_1 removed
[ 71.945557][ T739] team0 (unregistering): Port device team_slave_0 removed
[ 72.266794][ T5933] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 72.277112][ T5933] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 72.294262][ T5933] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 72.309749][ T5933] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 72.321044][ T5910] Bluetooth: hci0: command tx timeout
[ 72.379040][ T5933] 8021q: adding VLAN 0 to HW filter on device bond0
[ 72.396416][ T5933] 8021q: adding VLAN 0 to HW filter on device team0
[ 72.410829][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.418091][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 72.436046][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.443239][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 72.563767][ T5933] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 72.597276][ T5933] veth0_vlan: entered promiscuous mode
[ 72.611239][ T5933] veth1_vlan: entered promiscuous mode
[ 72.635744][ T5933] veth0_macvtap: entered promiscuous mode
[ 72.645289][ T5933] veth1_macvtap: entered promiscuous mode
[ 72.662044][ T5933] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 72.675270][ T5933] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 72.687034][ T5933] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.699053][ T5933] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.709642][ T5933] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.719441][ T5933] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.752137][ T5933] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[ 72.780028][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.792389][ T5933] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht'
[ 72.793485][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 72.821218][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.831461][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs/linux/gopath/pkg/mod/golang.org/tool...@v0.0.1-go1.23.6.linux-amd64'
GOTOOLDIR='/syzkaller/jobs/linux/gopath/pkg/mod/golang.org/tool...@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2577909696=/tmp/go-build -gno-record-gcc-switches'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 89d30d7360d
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=89d30d7360d4a366f8fdf00d6ac56cced7a45b0b -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250325-195331'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"89d30d7360d4a366f8fdf00d6ac56cced7a45b0b\"
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1170aa4c580000
Error text is too large and was truncated, full error text is at:
Tested on:
commit: 7d06015d Merge tag 'pci-v6.15-changes' of git://git.ke..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=6f5a67fe881fabe4
dashboard link: https://syzkaller.appspot.com/bug?extid=54e6c2176ba76c56217e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=101dc678580000
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
David Howells
Mar 31, 2025, 4:06:18 AM3/31/25
to syzbot, dhow...@redhat.com, almaz.ale...@paragon-software.com, linu...@lists.infradead.org, linux-...@vger.kernel.org, marc....@auristor.com, nt...@lists.linux.dev, syzkall...@googlegroups.com
commit db7a516159869b19f237c73bd75599bbe0bfcc4d
Author: David Howells <dhow...@redhat.com>
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
index 691e0ae607a1..8c6130789fde 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -348,9 +348,9 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
}
return ret;
}
Author: David Howells <dhow...@redhat.com>
Date: Fri Mar 28 16:46:58 2025 +0000
afs: Fix afs_dynroot_readdir() to not use the RCU read lock
afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
emitting cell automount entries - but dir_emit() may write to a userspace
buffer, thereby causing a fault to occur and waits to happen.
Fix afs_dynroot_readdir() to get a shared lock on net->cells_lock instead.
afs: Fix afs_dynroot_readdir() to not use the RCU read lock
afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
emitting cell automount entries - but dir_emit() may write to a userspace
buffer, thereby causing a fault to occur and waits to happen.
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
Reported-by: syzbot+3b6c5c...@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhow...@redhat.com>
cc: Marc Dionne <marc....@auristor.com>
cc: linu...@lists.infradead.org
cc: linux-...@vger.kernel.org
diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
Signed-off-by: David Howells <dhow...@redhat.com>
cc: Marc Dionne <marc....@auristor.com>
cc: linu...@lists.infradead.org
cc: linux-...@vger.kernel.org
index 691e0ae607a1..8c6130789fde 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -348,9 +348,9 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
}
if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
- rcu_read_lock();
+ down_read(&net->cells_lock);
if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
- rcu_read_lock();
ret = afs_dynroot_readdir_cells(net, ctx);
- rcu_read_unlock();
+ up_read(&net->cells_lock);
- rcu_read_unlock();
}
return ret;
}
syzbot
Mar 31, 2025, 4:38:07 AM3/31/25
to almaz.ale...@paragon-software.com, dhow...@redhat.com, linu...@lists.infradead.org, linux-...@vger.kernel.org, marc....@auristor.com, nt...@lists.linux.dev, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
unregister_netdevice: waiting for DEV to become free
unregister_netdevice: waiting for batadv0 to become free. Usage count = 3
Tested on:
commit: 4e82c870 Merge tag 'rust-6.15' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1045c404580000
kernel config: https://syzkaller.appspot.com/x/.config?x=56c806e1bbb36dee
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
unregister_netdevice: waiting for DEV to become free
unregister_netdevice: waiting for batadv0 to become free. Usage count = 3
Tested on:
commit: 4e82c870 Merge tag 'rust-6.15' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1045c404580000
kernel config: https://syzkaller.appspot.com/x/.config?x=56c806e1bbb36dee
dashboard link: https://syzkaller.appspot.com/bug?extid=54e6c2176ba76c56217e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1569c404580000
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
David Howells
Mar 31, 2025, 7:07:27 AM3/31/25
to syzbot, dhow...@redhat.com, almaz.ale...@paragon-software.com, linu...@lists.infradead.org, linux-...@vger.kernel.org, marc....@auristor.com, nt...@lists.linux.dev, syzkall...@googlegroups.com
Reply all
Reply to author
Forward
0 new messages