possible deadlock in bond_get_stats

34 views

Skip to first unread message

syzbot

unread,

Jan 19, 2020, 11:38:10 PM1/19/20

to syzkaller...@googlegroups.com

Hello,

syzbot found the following crash on:

HEAD commit: c1141b3a Linux 4.14.166
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12682cc9e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a99b4b74c4c01851
dashboard link: https://syzkaller.appspot.com/bug?extid=cc4595b28900b14a3fb5
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+cc4595...@syzkaller.appspotmail.com

8021q: adding VLAN 0 to HW filter on device bond1
Invalid argument reading file caps for ./bus
bond0: Enslaving bond1 as an active interface with an up link
============================================
WARNING: possible recursive locking detected
4.14.166-syzkaller #0 Not tainted
--------------------------------------------
syz-executor.2/16876 is trying to acquire lock:
(&(&bond->stats_lock)->rlock#2/2){+.+.}, at: [<ffffffff83e7a5c2>] bond_get_stats+0xd2/0x4b0 drivers/net/bonding/bond_main.c:3416

but task is already holding lock:
Invalid argument reading file caps for ./bus
(&(&bond->stats_lock)->rlock#2/2){+.+.}, at: [<ffffffff83e7a5c2>] bond_get_stats+0xd2/0x4b0 drivers/net/bonding/bond_main.c:3416

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&(&bond->stats_lock)->rlock#2/2);
lock(&(&bond->stats_lock)->rlock#2/2);

*** DEADLOCK ***

May be due to missing lock nesting notation

3 locks held by syz-executor.2/16876:
#0: (rtnl_mutex){+.+.}, at: [<ffffffff85239119>] rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: (rtnl_mutex){+.+.}, at: [<ffffffff85239119>] rtnetlink_rcv_msg+0x339/0xb70 net/core/rtnetlink.c:4301
#1: (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: [<ffffffff83e7a5c2>] bond_get_stats+0xd2/0x4b0 drivers/net/bonding/bond_main.c:3416
#2: (rcu_read_lock){....}, at: [<ffffffff83e7a5a1>] bond_get_nest_level drivers/net/bonding/bond_main.c:3405 [inline]
#2: (rcu_read_lock){....}, at: [<ffffffff83e7a5a1>] bond_get_stats+0xb1/0x4b0 drivers/net/bonding/bond_main.c:3416

stack backtrace:
CPU: 1 PID: 16876 Comm: syz-executor.2 Not tainted 4.14.166-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
print_deadlock_bug kernel/locking/lockdep.c:1796 [inline]
check_deadlock kernel/locking/lockdep.c:1843 [inline]
validate_chain kernel/locking/lockdep.c:2444 [inline]
__lock_acquire.cold+0x2bf/0x8dc kernel/locking/lockdep.c:3487
lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3994
_raw_spin_lock_nested+0x35/0x50 kernel/locking/spinlock.c:362
bond_get_stats+0xd2/0x4b0 drivers/net/bonding/bond_main.c:3416
dev_get_stats+0x8e/0x250 net/core/dev.c:7994
bond_get_stats+0x20f/0x4b0 drivers/net/bonding/bond_main.c:3422
dev_get_stats+0x8e/0x250 net/core/dev.c:7994
rtnl_fill_stats+0x4d/0xac0 net/core/rtnetlink.c:1079
rtnl_fill_ifinfo+0xe45/0x32c0 net/core/rtnetlink.c:1385
rtmsg_ifinfo_build_skb+0x9b/0x140 net/core/rtnetlink.c:2903
rtmsg_ifinfo_event.part.0+0x35/0xc0 net/core/rtnetlink.c:2933
rtmsg_ifinfo_event net/core/rtnetlink.c:4357 [inline]
rtnetlink_event+0xf4/0x120 net/core/rtnetlink.c:4350
notifier_call_chain+0x111/0x1b0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x56/0x70 net/core/dev.c:1671
call_netdevice_notifiers net/core/dev.c:1687 [inline]
netdev_features_change net/core/dev.c:1300 [inline]
netdev_change_features+0x66/0x80 net/core/dev.c:7458
bond_compute_features.isra.0+0x484/0x8d0 drivers/net/bonding/bond_main.c:1122
bond_slave_netdev_event drivers/net/bonding/bond_main.c:3150 [inline]
bond_netdev_event+0x493/0x8e0 drivers/net/bonding/bond_main.c:3191
notifier_call_chain+0x111/0x1b0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x56/0x70 net/core/dev.c:1671
call_netdevice_notifiers net/core/dev.c:1687 [inline]
netdev_features_change net/core/dev.c:1300 [inline]
netdev_change_features+0x66/0x80 net/core/dev.c:7458
bond_compute_features.isra.0+0x484/0x8d0 drivers/net/bonding/bond_main.c:1122
bond_enslave+0x15ef/0x4c70 drivers/net/bonding/bond_main.c:1731
do_set_master net/core/rtnetlink.c:1961 [inline]
do_set_master+0x19f/0x200 net/core/rtnetlink.c:1936
rtnl_newlink+0x12ed/0x1700 net/core/rtnetlink.c:2747
rtnetlink_rcv_msg+0x3da/0xb70 net/core/rtnetlink.c:4306
netlink_rcv_skb+0x14f/0x3c0 net/netlink/af_netlink.c:2432
rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4318
netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
netlink_unicast+0x44d/0x650 net/netlink/af_netlink.c:1312
netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x70a/0x840 net/socket.c:2062
__sys_sendmsg+0xb9/0x140 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2103
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45b349
RSP: 002b:00007fb6e14cec78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fb6e14cf6d4 RCX: 000000000045b349
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 000000000000099e R14: 00000000004cb152 R15: 000000000075bf2c
bond1: Enslaving veth3 as a backup interface with a down link
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
audit: type=1400 audit(2000000105.850:48): avc: denied { relabelto } for pid=16921 comm="syz-executor.2" name="bus" dev="sda1" ino=17442 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1
audit: type=1400 audit(2000000105.890:49): avc: denied { setattr } for pid=16921 comm="syz-executor.2" name="bus" dev="sda1" ino=17442 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1
Invalid argument reading file caps for ./bus
audit: type=1400 audit(2000000105.890:50): avc: denied { relabelfrom } for pid=16921 comm="syz-executor.2" name="bus" dev="sda1" ino=17442 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1
audit: type=1400 audit(2000000105.890:51): avc: denied { getattr } for pid=7354 comm="syz-executor.2" path="/root/syzkaller-testdir057695883/syzkaller.Kce7dp/323/bus" dev="sda1" ino=17442 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1
audit: type=1400 audit(2000000105.890:52): avc: denied { unlink } for pid=7354 comm="syz-executor.2" name="bus" dev="sda1" ino=17442 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Unknown ioctl 8841
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
selinux_nlmsg_perm: 1344 callbacks suppressed
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17165 comm=syz-executor.3
Invalid argument reading file caps for ./bus
CUSE: info not properly terminated
Invalid argument reading file caps for ./bus
audit: type=1400 audit(2000000110.390:53): avc: denied { setopt } for pid=17220 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
netlink: 52 bytes leftover after parsing attributes in process `syz-executor.3'.
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
batadv_slave_0: Invalid MTU 5 requested, hw min 68
ucma_write: process 1137 (syz-executor.5) changed security contexts after opening file descriptor, this is not allowed.
Invalid argument reading file caps for ./bus
batadv_slave_0: Invalid MTU 5 requested, hw min 68
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
selinux_nlmsg_perm: 1434 callbacks suppressed
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17541 comm=syz-executor.0
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus
Invalid argument reading file caps for ./bus

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Jan 20, 2020, 12:19:09 AM1/20/20

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following crash on:

HEAD commit: c1141b3a Linux 4.14.166
git tree: linux-4.14.y

console output: https://syzkaller.appspot.com/x/log.txt?x=128eb166e00000

kernel config: https://syzkaller.appspot.com/x/.config?x=a99b4b74c4c01851
dashboard link: https://syzkaller.appspot.com/bug?extid=cc4595b28900b14a3fb5
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111d60f1e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10ab8faee00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+cc4595...@syzkaller.appspotmail.com

bond1: cannot enslave bond to itself.
bond3: Enslaving veth3 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond5
bond1: Enslaving bond5 as a backup interface with a down link

============================================
WARNING: possible recursive locking detected
4.14.166-syzkaller #0 Not tainted
--------------------------------------------

syz-executor577/7191 is trying to acquire lock:

(&(&bond->stats_lock)->rlock#2/2){+.+.}, at: [<ffffffff83e7a5c2>] bond_get_stats+0xd2/0x4b0 drivers/net/bonding/bond_main.c:3416

but task is already holding lock:

(&(&bond->stats_lock)->rlock#2/2){+.+.}, at: [<ffffffff83e7a5c2>] bond_get_stats+0xd2/0x4b0 drivers/net/bonding/bond_main.c:3416

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&(&bond->stats_lock)->rlock#2/2);
lock(&(&bond->stats_lock)->rlock#2/2);

*** DEADLOCK ***

May be due to missing lock nesting notation

3 locks held by syz-executor577/7191:

#0: (rtnl_mutex){+.+.}, at: [<ffffffff85239119>] rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: (rtnl_mutex){+.+.}, at: [<ffffffff85239119>] rtnetlink_rcv_msg+0x339/0xb70 net/core/rtnetlink.c:4301
#1: (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: [<ffffffff83e7a5c2>] bond_get_stats+0xd2/0x4b0 drivers/net/bonding/bond_main.c:3416
#2: (rcu_read_lock){....}, at: [<ffffffff83e7a5a1>] bond_get_nest_level drivers/net/bonding/bond_main.c:3405 [inline]
#2: (rcu_read_lock){....}, at: [<ffffffff83e7a5a1>] bond_get_stats+0xb1/0x4b0 drivers/net/bonding/bond_main.c:3416

stack backtrace:

CPU: 1 PID: 7191 Comm: syz-executor577 Not tainted 4.14.166-syzkaller #0

RIP: 0033:0x4495e9
RSP: 002b:00007f4e804d7ce8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006e5a38 RCX: 00000000004495e9

RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003

RBP: 00000000006e5a30 R08: 0000000000000008 R09: 0000000000000000
R10: 000000000000000a R11: 0000000000000246 R12: 00000000006e5a3c
R13: 00007ffd3ac120df R14: 00007f4e804d89c0 R15: 20c49ba5e353f7cf
bond5: Enslaving veth5 as a backup interface with a down link
syz-executor577 (7191) used greatest stack depth: 23368 bytes left
8021q: adding VLAN 0 to HW filter on device bond6
bond1: Enslaving bond6 as a backup interface with a down link
bond6: Enslaving veth7 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond8
bond1: Enslaving bond8 as a backup interface with a down link
bond12: Enslaving veth15 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond12
bond1: Enslaving bond12 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond13
bond1: Enslaving bond13 as a backup interface with a down link
bond13: Enslaving veth17 as a backup interface with a down link
bond14: Enslaving veth19 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond14
bond1: Enslaving bond14 as a backup interface with a down link
bond15: Enslaving veth21 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond15
bond1: Enslaving bond15 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond16
bond1: Enslaving bond16 as a backup interface with a down link
bond16: Enslaving veth23 as a backup interface with a down link
bond17: Enslaving veth25 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond17
bond1: Enslaving bond17 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond18
bond1: Enslaving bond18 as a backup interface with a down link
bond20: Enslaving veth29 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond20
bond1: Enslaving bond20 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond21
bond1: Enslaving bond21 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond24
bond1: Enslaving bond24 as a backup interface with a down link
bond24: Enslaving veth35 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond25
bond1: Enslaving bond25 as a backup interface with a down link
bond25: Enslaving veth37 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond26
bond1: Enslaving bond26 as a backup interface with a down link
bond28: Enslaving veth41 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond28
bond1: Enslaving bond28 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond31
bond1: Enslaving bond31 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond33
bond1: Enslaving bond33 as a backup interface with a down link
bond35: Enslaving veth53 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond35
bond1: Enslaving bond35 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond36
bond1: Enslaving bond36 as a backup interface with a down link
bond36: Enslaving veth55 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond37
bond1: Enslaving bond37 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond40
bond1: Enslaving bond40 as a backup interface with a down link
bond40: Enslaving veth61 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond41
bond1: Enslaving bond41 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond43
bond1: Enslaving bond43 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond45
bond1: Enslaving bond45 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond47
bond1: Enslaving bond47 as a backup interface with a down link
bond47: Enslaving veth69 as a backup interface with a down link
bond50: Enslaving veth73 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond51
bond1: Enslaving bond51 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond53
bond1: Enslaving bond53 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond57
bond1: Enslaving bond57 as a backup interface with a down link
bond59: Enslaving veth85 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond59
bond1: Enslaving bond59 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond60
bond1: Enslaving bond60 as a backup interface with a down link
bond60: Enslaving veth87 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond61
bond1: Enslaving bond61 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond63
bond1: Enslaving bond63 as a backup interface with a down link
bond63: Enslaving veth91 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond65
bond1: Enslaving bond65 as a backup interface with a down link
bond65: Enslaving veth95 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond68
bond1: Enslaving bond68 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond70
bond1: Enslaving bond70 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond72
bond1: Enslaving bond72 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond74
bond1: Enslaving bond74 as a backup interface with a down link
bond74: Enslaving veth105 as a backup interface with a down link
bond75: Enslaving veth107 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond75
bond1: Enslaving bond75 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond76
bond1: Enslaving bond76 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond78
bond1: Enslaving bond78 as a backup interface with a down link
bond78: Enslaving veth113 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond79
bond1: Enslaving bond79 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond81
bond1: Enslaving bond81 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond84
bond1: Enslaving bond84 as a backup interface with a down link
bond84: Enslaving veth121 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond85
bond1: Enslaving bond85 as a backup interface with a down link
bond85: Enslaving veth123 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond86
bond1: Enslaving bond86 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond88
bond1: Enslaving bond88 as a backup interface with a down link
bond90: Enslaving veth129 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond90
bond1: Enslaving bond90 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond91
bond1: Enslaving bond91 as a backup interface with a down link
bond93: Enslaving veth133 as a backup interface with a down link
bond94: Enslaving veth135 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond94
bond1: Enslaving bond94 as a backup interface with a down link
bond95: Enslaving veth137 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond95
bond1: Enslaving bond95 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond96
bond1: Enslaving bond96 as a backup interface with a down link
bond96: Enslaving veth139 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond97
bond1: Enslaving bond97 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond99
bond1: Enslaving bond99 as a backup interface with a down link
bond99: Enslaving veth143 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond100
bond1: Enslaving bond100 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond102
bond1: Enslaving bond102 as a backup interface with a down link
bond102: Enslaving veth147 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond104
bond1: Enslaving bond104 as a backup interface with a down link
bond104: Enslaving veth151 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond105
bond1: Enslaving bond105 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond107
bond1: Enslaving bond107 as a backup interface with a down link
bond110: Enslaving veth159 as a backup interface with a down link
bond111: Enslaving veth161 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond112
bond1: Enslaving bond112 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond114
bond1: Enslaving bond114 as a backup interface with a down link
bond114: Enslaving veth165 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond115
bond1: Enslaving bond115 as a backup interface with a down link
bond115: Enslaving veth167 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond116
bond1: Enslaving bond116 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond121
bond1: Enslaving bond121 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond123
bond1: Enslaving bond123 as a backup interface with a down link
bond123: Enslaving veth177 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond124
bond1: Enslaving bond124 as a backup interface with a down link
bond124: Enslaving veth179 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond125
bond1: Enslaving bond125 as a backup interface with a down link
bond125: Enslaving veth181 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond126
bond1: Enslaving bond126 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond128
bond1: Enslaving bond128 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond130
bond1: Enslaving bond130 as a backup interface with a down link
bond130: Enslaving veth187 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond131
bond1: Enslaving bond131 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond133
bond1: Enslaving bond133 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond135
bond1: Enslaving bond135 as a backup interface with a down link
bond135: Enslaving veth193 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond136
bond1: Enslaving bond136 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond138
bond1: Enslaving bond138 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond140
bond1: Enslaving bond140 as a backup interface with a down link
8021q: adding VLAN 0 to HW filter on device bond142
bond1: Enslaving bond142 as a backup interface with a down link

syzbot

unread,

Jan 24, 2020, 12:20:08 AM1/24/20

to syzkaller...@googlegroups.com

Hello,

syzbot found the following crash on:

HEAD commit: d183c8e2 Linux 4.19.98
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=118ee335e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=270360e13b071d92
dashboard link: https://syzkaller.appspot.com/bug?extid=c5a41cbfa28bf4b97526

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+c5a41c...@syzkaller.appspotmail.com

loop5: rw=12288, want=8200, limit=20
bond1: Enslaving bond888 as a backup interface with a down link
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20

============================================
WARNING: possible recursive locking detected

4.19.98-syzkaller #0 Not tainted
--------------------------------------------
syz-executor.3/31073 is trying to acquire lock:
00000000c18ca6a9 (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0xe1/0x560 drivers/net/bonding/bond_main.c:3450

but task is already holding lock:

00000000ea691994 (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0xe1/0x560 drivers/net/bonding/bond_main.c:3450

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&(&bond->stats_lock)->rlock#2/2);
lock(&(&bond->stats_lock)->rlock#2/2);

*** DEADLOCK ***

May be due to missing lock nesting notation

3 locks held by syz-executor.3/31073:
#0: 00000000a0d11fb8 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline]
#0: 00000000a0d11fb8 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x40a/0xb00 net/core/rtnetlink.c:4765
#1: 00000000ea691994 (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0xe1/0x560 drivers/net/bonding/bond_main.c:3450
#2: 0000000057fcdce9 (rcu_read_lock){....}, at: bond_get_nest_level drivers/net/bonding/bond_main.c:3439 [inline]
#2: 0000000057fcdce9 (rcu_read_lock){....}, at: bond_get_stats+0xc0/0x560 drivers/net/bonding/bond_main.c:3450

stack backtrace:
CPU: 0 PID: 31073 Comm: syz-executor.3 Not tainted 4.19.98-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_deadlock_bug kernel/locking/lockdep.c:1759 [inline]
check_deadlock kernel/locking/lockdep.c:1803 [inline]
validate_chain kernel/locking/lockdep.c:2399 [inline]
__lock_acquire.cold+0x20f/0x4a7 kernel/locking/lockdep.c:3411
lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3903
_raw_spin_lock_nested+0x35/0x50 kernel/locking/spinlock.c:354
bond_get_stats+0xe1/0x560 drivers/net/bonding/bond_main.c:3450
dev_get_stats+0x8e/0x280 net/core/dev.c:9049
bond_get_stats+0x23e/0x560 drivers/net/bonding/bond_main.c:3456
dev_get_stats+0x8e/0x280 net/core/dev.c:9049
rtnl_fill_stats+0x4d/0xac0 net/core/rtnetlink.c:1176
rtnl_fill_ifinfo+0x1101/0x3660 net/core/rtnetlink.c:1663
rtmsg_ifinfo_build_skb+0xcd/0x1a0 net/core/rtnetlink.c:3347
rtmsg_ifinfo_event.part.0+0x43/0xe0 net/core/rtnetlink.c:3379
rtmsg_ifinfo_event net/core/rtnetlink.c:4826 [inline]
rtnetlink_event+0x12c/0x150 net/core/rtnetlink.c:4819
notifier_call_chain+0xc2/0x230 kernel/notifier.c:93

__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401

call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1748
call_netdevice_notifiers net/core/dev.c:1766 [inline]
netdev_features_change net/core/dev.c:1334 [inline]
netdev_change_features+0x7e/0xb0 net/core/dev.c:8487
bond_compute_features.isra.0+0x4de/0x950 drivers/net/bonding/bond_main.c:1116
bond_enslave+0x1740/0x5310 drivers/net/bonding/bond_main.c:1754
do_set_master net/core/rtnetlink.c:2321 [inline]
do_set_master+0x1ca/0x230 net/core/rtnetlink.c:2295
rtnl_newlink+0x12a7/0x1600 net/core/rtnetlink.c:3160
rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:4768
netlink_rcv_skb+0x17d/0x460 net/netlink/af_netlink.c:2454
rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4786
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x53a/0x730 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:632
___sys_sendmsg+0x803/0x920 net/socket.c:2115
__sys_sendmsg+0x105/0x1d0 net/socket.c:2153
__do_sys_sendmsg net/socket.c:2162 [inline]
__se_sys_sendmsg net/socket.c:2160 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2160
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b349
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f19fac27c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f19fac286d4 RCX: 000000000045b349
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000005
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff

R13: 000000000000099e R14: 00000000004cb152 R15: 000000000075bfd4
bond888: Warning: No 802.3ad response from the link partner for any adapters in the bond
bond888: Enslaving gretap723 as a backup interface with an up link
bond888: Warning: No 802.3ad response from the link partner for any adapters in the bond
bond902: Enslaving gretap720 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
bond889: Enslaving gretap724 as a backup interface with an up link
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond903: Enslaving gretap721 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
validate_nla: 13 callbacks suppressed
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
bond890: Enslaving gretap725 as a backup interface with an up link
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond904: Enslaving gretap722 as a backup interface with an up link
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond905: Enslaving gretap723 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond891: Enslaving gretap726 as a backup interface with an up link
bond891: Warning: No 802.3ad response from the link partner for any adapters in the bond
8021q: adding VLAN 0 to HW filter on device bond891
bond0: Enslaving bond891 as an active interface with an up link
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
bond891: Warning: No 802.3ad response from the link partner for any adapters in the bond
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
f2fs_msg: 70 callbacks suppressed
F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0)
bond906: Enslaving gretap724 as a backup interface with an up link
nla_parse: 23 callbacks suppressed
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
attempt to access beyond end of device
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
F2FS-fs (loop5): Failed to get valid F2FS checkpoint
F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0)
F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock
bond892: Enslaving gretap727 as a backup interface with an up link
bond892: Warning: No 802.3ad response from the link partner for any adapters in the bond
attempt to access beyond end of device
8021q: adding VLAN 0 to HW filter on device bond892
loop5: rw=12288, want=8200, limit=20
bond0: Enslaving bond892 as an active interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
F2FS-fs (loop5): Failed to get valid F2FS checkpoint
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
bond892: Warning: No 802.3ad response from the link partner for any adapters in the bond
F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0)
F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
F2FS-fs (loop5): Failed to get valid F2FS checkpoint
F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0)
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond907: Enslaving gretap725 as a backup interface with an up link
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
bond893: Enslaving gretap728 as a backup interface with an up link
8021q: adding VLAN 0 to HW filter on device bond893
bond893: Warning: No 802.3ad response from the link partner for any adapters in the bond
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
bond0: Enslaving bond893 as an active interface with an up link
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
loop5: rw=12288, want=12296, limit=20
bond893: Warning: No 802.3ad response from the link partner for any adapters in the bond
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond908: Enslaving gretap726 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
bond894: Enslaving gretap729 as a backup interface with an up link
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
8021q: adding VLAN 0 to HW filter on device bond894
bond894: Warning: No 802.3ad response from the link partner for any adapters in the bond
bond0: Enslaving bond894 as an active interface with an up link
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
bond894: Warning: No 802.3ad response from the link partner for any adapters in the bond
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond909: Enslaving gretap727 as a backup interface with an up link
attempt to access beyond end of device
bond895: Enslaving gretap730 as a backup interface with an up link
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond895: Warning: No 802.3ad response from the link partner for any adapters in the bond
attempt to access beyond end of device
8021q: adding VLAN 0 to HW filter on device bond895
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond0: Enslaving bond895 as an active interface with an up link
attempt to access beyond end of device
bond895: Warning: No 802.3ad response from the link partner for any adapters in the bond
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond896: Enslaving gretap731 as a backup interface with an up link
attempt to access beyond end of device
bond910: Enslaving gretap728 as a backup interface with an up link
loop5: rw=12288, want=8200, limit=20
bond896: Warning: No 802.3ad response from the link partner for any adapters in the bond
8021q: adding VLAN 0 to HW filter on device bond896
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond0: Enslaving bond896 as an active interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond911: Enslaving gretap729 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
bond897: Enslaving gretap732 as a backup interface with an up link
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond912: Enslaving gretap730 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
bond898: Enslaving gretap733 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=103 sclass=netlink_route_socket pig=31505 comm=syz-executor.2
attempt to access beyond end of device
validate_nla: 24 callbacks suppressed
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
loop5: rw=12288, want=12296, limit=20
bond899: Enslaving gretap734 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond913: Enslaving gretap731 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
8021q: adding VLAN 0 to HW filter on device bond899
loop5: rw=12288, want=12296, limit=20
bond0: Enslaving bond899 as an active interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
bond900: Enslaving gretap735 as a backup interface with an up link
attempt to access beyond end of device
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
f2fs_msg: 91 callbacks suppressed
F2FS-fs (loop5): Failed to get valid F2FS checkpoint
8021q: adding VLAN 0 to HW filter on device bond900
net_ratelimit: 3 callbacks suppressed
bond900: Warning: No 802.3ad response from the link partner for any adapters in the bond
bond0: Enslaving bond900 as an active interface with an up link
bond914: Enslaving gretap732 as a backup interface with an up link
nla_parse: 26 callbacks suppressed
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0)
netlink: 'syz-executor.3': attribute type 1 has an invalid length.
F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock
attempt to access beyond end of device
bond900: Warning: No 802.3ad response from the link partner for any adapters in the bond
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
loop5: rw=12288, want=8200, limit=20
netlink: 'syz-executor.4': attribute type 1 has an invalid length.
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
F2FS-fs (loop5): Failed to get valid F2FS checkpoint
F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0)
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
F2FS-fs (loop5): Failed to get valid F2FS checkpoint
bond901: Enslaving gretap736 as a backup interface with an up link
F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0)
F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock
bond915: Enslaving gretap733 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
F2FS-fs (loop5): Failed to get valid F2FS checkpoint
8021q: adding VLAN 0 to HW filter on device bond901
attempt to access beyond end of device
bond901: Warning: No 802.3ad response from the link partner for any adapters in the bond
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond0: Enslaving bond901 as an active interface with an up link
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
bond901: Warning: No 802.3ad response from the link partner for any adapters in the bond
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond902: Enslaving gretap737 as a backup interface with an up link
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
attempt to access beyond end of device
bond916: Enslaving gretap734 as a backup interface with an up link
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
batman_adv: Cannot find parent device
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond903: Enslaving gretap738 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20
bond917: Enslaving gretap735 as a backup interface with an up link
attempt to access beyond end of device
loop5: rw=12288, want=8200, limit=20
attempt to access beyond end of device
loop5: rw=12288, want=12296, limit=20

syzbot

unread,

Jan 26, 2020, 9:32:09 AM1/26/20

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following crash on:

HEAD commit: d183c8e2 Linux 4.19.98
git tree: linux-4.19.y

console output: https://syzkaller.appspot.com/x/log.txt?x=15481d85e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=2ec5d533b79bf93

dashboard link: https://syzkaller.appspot.com/bug?extid=c5a41cbfa28bf4b97526
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=154b3335e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13481d85e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c5a41c...@syzkaller.appspotmail.com

bond3: making interface gretap4 the new active one
bond3: Enslaving gretap4 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond4
bond3: Enslaving bond4 as an active interface with a down link

============================================
WARNING: possible recursive locking detected
4.19.98-syzkaller #0 Not tainted
--------------------------------------------

syz-executor231/8208 is trying to acquire lock:
0000000028391afe (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0xe1/0x560 drivers/net/bonding/bond_main.c:3450

but task is already holding lock:

00000000ac6c7c64 (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0xe1/0x560 drivers/net/bonding/bond_main.c:3450

3 locks held by syz-executor231/8208:
#0: 0000000022c7fac6 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline]
#0: 0000000022c7fac6 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x40a/0xb00 net/core/rtnetlink.c:4765
#1: 00000000ac6c7c64 (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0xe1/0x560 drivers/net/bonding/bond_main.c:3450
#2: 0000000055226510 (rcu_read_lock){....}, at: bond_get_nest_level drivers/net/bonding/bond_main.c:3439 [inline]
#2: 0000000055226510 (rcu_read_lock){....}, at: bond_get_stats+0xc0/0x560 drivers/net/bonding/bond_main.c:3450

stack backtrace:
CPU: 1 PID: 8208 Comm: syz-executor231 Not tainted 4.19.98-syzkaller #0

RIP: 0033:0x442019
Code: e8 8c 07 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffdb57acf98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442019
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffdbb1414ac R09: 00007ffdbb1414ac
R10: 00007ffdbb1414ac R11: 0000000000000246 R12: 00000000000105f9
R13: 0000000000402dc0 R14: 0000000000000000 R15: 0000000000000000
bond4: making interface gretap5 the new active one
bond4: Enslaving gretap5 as an active interface with an up link
syz-executor231 (8208) used greatest stack depth: 21648 bytes left
8021q: adding VLAN 0 to HW filter on device bond5
bond3: Enslaving bond5 as an active interface with a down link
bond5: making interface gretap6 the new active one
bond5: Enslaving gretap6 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond6
bond3: Enslaving bond6 as an active interface with a down link
bond6: making interface gretap7 the new active one
bond6: Enslaving gretap7 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond7
bond3: Enslaving bond7 as an active interface with a down link
bond7: making interface gretap8 the new active one
bond7: Enslaving gretap8 as an active interface with an up link

8021q: adding VLAN 0 to HW filter on device bond8

bond3: Enslaving bond8 as an active interface with a down link
bond8: making interface gretap9 the new active one
bond8: Enslaving gretap9 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond9
bond3: Enslaving bond9 as an active interface with a down link
bond9: making interface gretap10 the new active one
bond9: Enslaving gretap10 as an active interface with an up link
bond0: Releasing active interface gretap1
bond3: Enslaving gretap1 as an active interface with an up link
bond1: Releasing active interface gretap2
bond3: Enslaving gretap2 as an active interface with an up link
bond2: Releasing active interface gretap3
bond3: Enslaving gretap3 as an active interface with an up link
bond4: Releasing active interface gretap5
bond3: Enslaving gretap5 as an active interface with an up link
bond5: Releasing active interface gretap6
bond3: Enslaving gretap6 as an active interface with an up link
bond6: Releasing active interface gretap7
bond3: Enslaving gretap7 as an active interface with an up link
bond7: Releasing active interface gretap8
bond3: Enslaving gretap8 as an active interface with an up link
bond8: Releasing active interface gretap9
bond3: Enslaving gretap9 as an active interface with an up link
bond9: Releasing active interface gretap10
bond3: Enslaving gretap10 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond10
bond3: Enslaving bond10 as an active interface with a down link
bond10: making interface gretap11 the new active one
bond10: Enslaving gretap11 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond11
bond3: Enslaving bond11 as an active interface with a down link
bond11: making interface gretap12 the new active one
bond11: Enslaving gretap12 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond12
bond3: Enslaving bond12 as an active interface with a down link
bond12: making interface gretap13 the new active one
bond12: Enslaving gretap13 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond13
bond3: Enslaving bond13 as an active interface with a down link
bond13: making interface gretap14 the new active one
bond13: Enslaving gretap14 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond14
bond3: Enslaving bond14 as an active interface with a down link
bond14: making interface gretap15 the new active one
bond14: Enslaving gretap15 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond15
bond3: Enslaving bond15 as an active interface with a down link
bond15: making interface gretap16 the new active one
bond15: Enslaving gretap16 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond16
bond3: Enslaving bond16 as an active interface with a down link
bond16: making interface gretap17 the new active one
bond16: Enslaving gretap17 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond17
bond3: Enslaving bond17 as an active interface with a down link
bond17: making interface gretap18 the new active one
bond17: Enslaving gretap18 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond18
bond3: Enslaving bond18 as an active interface with a down link
bond18: making interface gretap19 the new active one
bond18: Enslaving gretap19 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond19
bond3: Enslaving bond19 as an active interface with a down link
bond19: making interface gretap20 the new active one
bond19: Enslaving gretap20 as an active interface with an up link
bond10: Releasing active interface gretap11
bond3: Enslaving gretap11 as an active interface with an up link
bond11: Releasing active interface gretap12
bond3: Enslaving gretap12 as an active interface with an up link
validate_nla: 32 callbacks suppressed
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond12: Releasing active interface gretap13
bond3: Enslaving gretap13 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond13: Releasing active interface gretap14
bond3: Enslaving gretap14 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond14: Releasing active interface gretap15
bond3: Enslaving gretap15 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond15: Releasing active interface gretap16
bond3: Enslaving gretap16 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond16: Releasing active interface gretap17
bond3: Enslaving gretap17 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond17: Releasing active interface gretap18
bond3: Enslaving gretap18 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond18: Releasing active interface gretap19
bond3: Enslaving gretap19 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond19: Releasing active interface gretap20
bond3: Enslaving gretap20 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
8021q: adding VLAN 0 to HW filter on device bond20
bond3: Enslaving bond20 as an active interface with a down link
bond20: making interface gretap21 the new active one
bond20: Enslaving gretap21 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
8021q: adding VLAN 0 to HW filter on device bond21
bond3: Enslaving bond21 as an active interface with a down link
bond21: making interface gretap22 the new active one
bond21: Enslaving gretap22 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond22
bond3: Enslaving bond22 as an active interface with a down link
bond22: making interface gretap23 the new active one
bond22: Enslaving gretap23 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond23
bond3: Enslaving bond23 as an active interface with a down link
bond23: making interface gretap24 the new active one
bond23: Enslaving gretap24 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond24
bond3: Enslaving bond24 as an active interface with a down link
bond24: making interface gretap25 the new active one
bond24: Enslaving gretap25 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond25
bond3: Enslaving bond25 as an active interface with a down link
bond25: making interface gretap26 the new active one
bond25: Enslaving gretap26 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond26
bond3: Enslaving bond26 as an active interface with a down link
bond26: making interface gretap27 the new active one
bond26: Enslaving gretap27 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond27
bond3: Enslaving bond27 as an active interface with a down link
bond27: making interface gretap28 the new active one
bond27: Enslaving gretap28 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond28
bond3: Enslaving bond28 as an active interface with a down link
bond28: making interface gretap29 the new active one
bond28: Enslaving gretap29 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond29
bond3: Enslaving bond29 as an active interface with a down link
bond29: making interface gretap30 the new active one
bond29: Enslaving gretap30 as an active interface with an up link
bond20: Releasing active interface gretap21
bond3: Enslaving gretap21 as an active interface with an up link
bond21: Releasing active interface gretap22
bond3: Enslaving gretap22 as an active interface with an up link
bond22: Releasing active interface gretap23
bond3: Enslaving gretap23 as an active interface with an up link
bond23: Releasing active interface gretap24
bond3: Enslaving gretap24 as an active interface with an up link
bond24: Releasing active interface gretap25
bond3: Enslaving gretap25 as an active interface with an up link
bond25: Releasing active interface gretap26
bond3: Enslaving gretap26 as an active interface with an up link
bond26: Releasing active interface gretap27
bond3: Enslaving gretap27 as an active interface with an up link
bond27: Releasing active interface gretap28
bond3: Enslaving gretap28 as an active interface with an up link
bond28: Releasing active interface gretap29
bond3: Enslaving gretap29 as an active interface with an up link
bond29: Releasing active interface gretap30
bond3: Enslaving gretap30 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond30
bond3: Enslaving bond30 as an active interface with a down link
bond30: making interface gretap31 the new active one
bond30: Enslaving gretap31 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond31
bond3: Enslaving bond31 as an active interface with a down link
bond31: making interface gretap32 the new active one
bond31: Enslaving gretap32 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond32
bond3: Enslaving bond32 as an active interface with a down link
bond32: making interface gretap33 the new active one
bond32: Enslaving gretap33 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond33
bond3: Enslaving bond33 as an active interface with a down link
bond33: making interface gretap34 the new active one
bond33: Enslaving gretap34 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond34
bond3: Enslaving bond34 as an active interface with a down link
bond34: making interface gretap35 the new active one
bond34: Enslaving gretap35 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond35
bond3: Enslaving bond35 as an active interface with a down link
bond35: making interface gretap36 the new active one
bond35: Enslaving gretap36 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond36
bond3: Enslaving bond36 as an active interface with a down link
bond36: making interface gretap37 the new active one
bond36: Enslaving gretap37 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond37
bond3: Enslaving bond37 as an active interface with a down link
bond37: making interface gretap38 the new active one
bond37: Enslaving gretap38 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond38
bond3: Enslaving bond38 as an active interface with a down link
bond38: making interface gretap39 the new active one
bond38: Enslaving gretap39 as an active interface with an up link
8021q: adding VLAN 0 to HW filter on device bond39
bond3: Enslaving bond39 as an active interface with a down link
bond39: making interface gretap40 the new active one
bond39: Enslaving gretap40 as an active interface with an up link
bond30: Releasing active interface gretap31
bond3: Enslaving gretap31 as an active interface with an up link
bond31: Releasing active interface gretap32
bond3: Enslaving gretap32 as an active interface with an up link
bond32: Releasing active interface gretap33
bond3: Enslaving gretap33 as an active interface with an up link
bond33: Releasing active interface gretap34
bond3: Enslaving gretap34 as an active interface with an up link
validate_nla: 32 callbacks suppressed
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond34: Releasing active interface gretap35
bond3: Enslaving gretap35 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond35: Releasing active interface gretap36
bond3: Enslaving gretap36 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond36: Releasing active interface gretap37
bond3: Enslaving gretap37 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond37: Releasing active interface gretap38
bond3: Enslaving gretap38 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond38: Releasing active interface gretap39
bond3: Enslaving gretap39 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
bond39: Releasing active interface gretap40
bond3: Enslaving gretap40 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
8021q: adding VLAN 0 to HW filter on device bond40
bond3: Enslaving bond40 as an active interface with a down link
bond40: making interface gretap41 the new active one
bond40: Enslaving gretap41 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
8021q: adding VLAN 0 to HW filter on device bond41
bond3: Enslaving bond41 as an active interface with a down link
bond41: making interface gretap42 the new active one
bond41: Enslaving gretap42 as an active interface with an up link
netlink: 'syz-executor231': attribute type 1 has an invalid length.
8021q: adding VLAN 0 to HW filter on device bond42
bond3: Enslaving bond42 as an active interface with a down link
bond42: making interface gretap43 the new active one
bond42: Enslaving gretap43 as an active interface with an up link

Reply all

Reply to author

Forward

0 new messages