possible deadlock in sk_clone_lock
12 views
Skip to first unread message
syzbot
Mar 21, 2021, 8:35:20 PM3/21/21
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1064dad6d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=124f4e6b89b71fac
dashboard link: https://syzkaller.appspot.com/bug?extid=c072c80706efe72675eb
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c072c8...@syzkaller.appspotmail.com
EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock
EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock
EXT4-fs: failed to create workqueue
EXT4-fs (loop0): mount failed
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
4.14.226-syzkaller #0 Not tainted
-----------------------------------------------------
syz-executor.5/10503 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire:
(hugetlb_lock){+.+.}, at: [<ffffffff817b902b>] spin_lock include/linux/spinlock.h:317 [inline]
(hugetlb_lock){+.+.}, at: [<ffffffff817b902b>] free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
and this task is already holding:
(slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] spin_lock include/linux/spinlock.h:317 [inline]
(slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234
which would create a new lock dependency:
(slock-AF_INET){+.-.} -> (hugetlb_lock){+.+.}
but this new dependency connects a SOFTIRQ-irq-safe lock:
(slock-AF_INET){+.-.}
... which became SOFTIRQ-irq-safe at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
sk_clone_lock+0x3cf/0x11e0 net/core/sock.c:1666
inet_csk_clone_lock+0x1e/0x3f0 net/ipv4/inet_connection_sock.c:815
tcp_create_openreq_child+0x2c/0x1880 net/ipv4/tcp_minisocks.c:437
tcp_v4_syn_recv_sock+0xa8/0xf80 net/ipv4/tcp_ipv4.c:1358
tcp_check_req+0x4c1/0x1460 net/ipv4/tcp_minisocks.c:764
tcp_v4_rcv+0x1c36/0x3560 net/ipv4/tcp_ipv4.c:1701
ip_local_deliver_finish+0x3f2/0xab0 net/ipv4/ip_input.c:216
NF_HOOK include/linux/netfilter.h:250 [inline]
ip_local_deliver+0x167/0x460 net/ipv4/ip_input.c:257
dst_input include/net/dst.h:476 [inline]
ip_rcv_finish+0x6e3/0x19f0 net/ipv4/ip_input.c:396
NF_HOOK include/linux/netfilter.h:250 [inline]
ip_rcv+0x8a7/0xf10 net/ipv4/ip_input.c:493
__netif_receive_skb_core+0x15ee/0x2a30 net/core/dev.c:4474
__netif_receive_skb+0x27/0x1a0 net/core/dev.c:4512
netif_receive_skb_internal+0xd7/0x580 net/core/dev.c:4585
napi_skb_finish net/core/dev.c:4946 [inline]
napi_gro_receive+0x2e2/0x400 net/core/dev.c:4977
receive_buf+0x5ee/0x49f0 drivers/net/virtio_net.c:852
virtnet_receive drivers/net/virtio_net.c:1098 [inline]
virtnet_poll+0x4b7/0x960 drivers/net/virtio_net.c:1189
napi_poll net/core/dev.c:5596 [inline]
net_rx_action+0x466/0xfd0 net/core/dev.c:5662
__do_softirq+0x24d/0x9ff kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
do_IRQ+0x112/0x1d0 arch/x86/kernel/irq.c:242
ret_from_intr+0x0/0x1e
csd_lock_wait kernel/smp.c:108 [inline]
smp_call_function_single+0x17a/0x370 kernel/smp.c:302
smp_call_function_many+0x60f/0x7a0 kernel/smp.c:434
smp_call_function kernel/smp.c:492 [inline]
on_each_cpu+0x40/0x210 kernel/smp.c:602
text_poke_bp+0xdc/0x110 arch/x86/kernel/alternative.c:814
__jump_label_transform+0x269/0x300 arch/x86/kernel/jump_label.c:102
arch_jump_label_transform+0x26/0x40 arch/x86/kernel/jump_label.c:110
__jump_label_update+0x113/0x170 kernel/jump_label.c:374
jump_label_update kernel/jump_label.c:741 [inline]
jump_label_update+0x140/0x2d0 kernel/jump_label.c:720
__static_key_slow_dec_cpuslocked+0x3d/0xf0 kernel/jump_label.c:204
__static_key_slow_dec kernel/jump_label.c:214 [inline]
static_key_slow_dec+0x53/0x70 kernel/jump_label.c:228
once_deferred+0x58/0x80 lib/once.c:18
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
to a SOFTIRQ-irq-unsafe lock:
(hugetlb_lock){+.+.}
... which became SOFTIRQ-irq-unsafe at:
...
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hugetlb_lock);
local_irq_disable();
lock(slock-AF_INET);
lock(hugetlb_lock);
<Interrupt>
lock(slock-AF_INET);
*** DEADLOCK ***
3 locks held by syz-executor.5/10503:
#0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [<ffffffff85ba52c6>] inode_lock include/linux/fs.h:719 [inline]
#0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [<ffffffff85ba52c6>] __sock_release+0x86/0x2b0 net/socket.c:601
#1: (sk_lock-AF_INET){+.+.}, at: [<ffffffff860f3f35>] lock_sock include/net/sock.h:1471 [inline]
#1: (sk_lock-AF_INET){+.+.}, at: [<ffffffff860f3f35>] tcp_close+0x25/0xed0 net/ipv4/tcp.c:2144
#2: (slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] spin_lock include/linux/spinlock.h:317 [inline]
#2: (slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234
the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
-> (slock-AF_INET){+.-.} ops: 787287 {
HARDIRQ-ON-W at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:176
spin_lock_bh include/linux/spinlock.h:322 [inline]
lock_sock_nested+0x39/0x100 net/core/sock.c:2788
lock_sock include/net/sock.h:1471 [inline]
inet_autobind+0x1a/0x180 net/ipv4/af_inet.c:178
inet_dgram_connect+0x134/0x1f0 net/ipv4/af_inet.c:538
SYSC_connect net/socket.c:1655 [inline]
SyS_connect+0x1f4/0x240 net/socket.c:1636
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
IN-SOFTIRQ-W at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
sk_clone_lock+0x3cf/0x11e0 net/core/sock.c:1666
inet_csk_clone_lock+0x1e/0x3f0 net/ipv4/inet_connection_sock.c:815
tcp_create_openreq_child+0x2c/0x1880 net/ipv4/tcp_minisocks.c:437
tcp_v4_syn_recv_sock+0xa8/0xf80 net/ipv4/tcp_ipv4.c:1358
tcp_check_req+0x4c1/0x1460 net/ipv4/tcp_minisocks.c:764
tcp_v4_rcv+0x1c36/0x3560 net/ipv4/tcp_ipv4.c:1701
ip_local_deliver_finish+0x3f2/0xab0 net/ipv4/ip_input.c:216
NF_HOOK include/linux/netfilter.h:250 [inline]
ip_local_deliver+0x167/0x460 net/ipv4/ip_input.c:257
dst_input include/net/dst.h:476 [inline]
ip_rcv_finish+0x6e3/0x19f0 net/ipv4/ip_input.c:396
NF_HOOK include/linux/netfilter.h:250 [inline]
ip_rcv+0x8a7/0xf10 net/ipv4/ip_input.c:493
__netif_receive_skb_core+0x15ee/0x2a30 net/core/dev.c:4474
__netif_receive_skb+0x27/0x1a0 net/core/dev.c:4512
netif_receive_skb_internal+0xd7/0x580 net/core/dev.c:4585
napi_skb_finish net/core/dev.c:4946 [inline]
napi_gro_receive+0x2e2/0x400 net/core/dev.c:4977
receive_buf+0x5ee/0x49f0 drivers/net/virtio_net.c:852
virtnet_receive drivers/net/virtio_net.c:1098 [inline]
virtnet_poll+0x4b7/0x960 drivers/net/virtio_net.c:1189
napi_poll net/core/dev.c:5596 [inline]
net_rx_action+0x466/0xfd0 net/core/dev.c:5662
__do_softirq+0x24d/0x9ff kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
do_IRQ+0x112/0x1d0 arch/x86/kernel/irq.c:242
ret_from_intr+0x0/0x1e
csd_lock_wait kernel/smp.c:108 [inline]
smp_call_function_single+0x17a/0x370 kernel/smp.c:302
smp_call_function_many+0x60f/0x7a0 kernel/smp.c:434
smp_call_function kernel/smp.c:492 [inline]
on_each_cpu+0x40/0x210 kernel/smp.c:602
text_poke_bp+0xdc/0x110 arch/x86/kernel/alternative.c:814
__jump_label_transform+0x269/0x300 arch/x86/kernel/jump_label.c:102
arch_jump_label_transform+0x26/0x40 arch/x86/kernel/jump_label.c:110
__jump_label_update+0x113/0x170 kernel/jump_label.c:374
jump_label_update kernel/jump_label.c:741 [inline]
jump_label_update+0x140/0x2d0 kernel/jump_label.c:720
__static_key_slow_dec_cpuslocked+0x3d/0xf0 kernel/jump_label.c:204
__static_key_slow_dec kernel/jump_label.c:214 [inline]
static_key_slow_dec+0x53/0x70 kernel/jump_label.c:228
once_deferred+0x58/0x80 lib/once.c:18
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
INITIAL USE at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:176
spin_lock_bh include/linux/spinlock.h:322 [inline]
lock_sock_nested+0x39/0x100 net/core/sock.c:2788
lock_sock include/net/sock.h:1471 [inline]
inet_autobind+0x1a/0x180 net/ipv4/af_inet.c:178
inet_dgram_connect+0x134/0x1f0 net/ipv4/af_inet.c:538
SYSC_connect net/socket.c:1655 [inline]
SyS_connect+0x1f4/0x240 net/socket.c:1636
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
}
... key at: [<ffffffff8c982ab0>] af_family_slock_keys+0x10/0x180
... acquired at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
__put_page+0xb9/0x2f0 mm/swap.c:111
put_page include/linux/mm.h:875 [inline]
__skb_frag_unref include/linux/skbuff.h:2829 [inline]
skb_release_data+0x25a/0x820 net/core/skbuff.c:577
skb_release_all net/core/skbuff.c:640 [inline]
__kfree_skb+0x46/0x60 net/core/skbuff.c:654
sk_wmem_free_skb include/net/sock.h:1425 [inline]
tcp_write_queue_purge include/net/tcp.h:1631 [inline]
tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904
inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866
tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298
inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
get_signal+0x18a3/0x1ca0 kernel/signal.c:2234
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:814
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
the dependencies between the lock to be acquired
and SOFTIRQ-irq-unsafe lock:
-> (hugetlb_lock){+.+.} ops: 74 {
HARDIRQ-ON-W at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
SOFTIRQ-ON-W at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
INITIAL USE at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
}
... key at: [<ffffffff89000cf8>] hugetlb_lock+0x18/0x15e0
... acquired at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
__put_page+0xb9/0x2f0 mm/swap.c:111
put_page include/linux/mm.h:875 [inline]
__skb_frag_unref include/linux/skbuff.h:2829 [inline]
skb_release_data+0x25a/0x820 net/core/skbuff.c:577
skb_release_all net/core/skbuff.c:640 [inline]
__kfree_skb+0x46/0x60 net/core/skbuff.c:654
sk_wmem_free_skb include/net/sock.h:1425 [inline]
tcp_write_queue_purge include/net/tcp.h:1631 [inline]
tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904
inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866
tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298
inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
get_signal+0x18a3/0x1ca0 kernel/signal.c:2234
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:814
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
stack backtrace:
CPU: 1 PID: 10503 Comm: syz-executor.5 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
print_bad_irq_dependency kernel/locking/lockdep.c:1609 [inline]
check_usage.cold+0x806/0xbe6 kernel/locking/lockdep.c:1641
check_irq_usage kernel/locking/lockdep.c:1697 [inline]
check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline]
check_prev_add kernel/locking/lockdep.c:1910 [inline]
check_prevs_add kernel/locking/lockdep.c:2022 [inline]
validate_chain kernel/locking/lockdep.c:2464 [inline]
__lock_acquire+0x1cfc/0x3f20 kernel/locking/lockdep.c:3491
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
__put_page+0xb9/0x2f0 mm/swap.c:111
put_page include/linux/mm.h:875 [inline]
__skb_frag_unref include/linux/skbuff.h:2829 [inline]
skb_release_data+0x25a/0x820 net/core/skbuff.c:577
skb_release_all net/core/skbuff.c:640 [inline]
__kfree_skb+0x46/0x60 net/core/skbuff.c:654
sk_wmem_free_skb include/net/sock.h:1425 [inline]
tcp_write_queue_purge include/net/tcp.h:1631 [inline]
tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904
inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866
tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298
inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
get_signal+0x18a3/0x1ca0 kernel/signal.c:2234
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:814
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007f88aa5f8188 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: 00000000004807b8 RBX: 000000000056bf60 RCX: 0000000000466459
RDX: ffffffffffffffd0 RSI: 0000000020000140 RDI: 0000000000000005
RBP: 00000000004bf9fb R08: 0000000000000000 R09: ffffffffffffff36
R10: 000000000401c005 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007fff876d9cff R14: 00007f88aa5f8300 R15: 0000000000022000
print_req_error: I/O error, dev loop0, sector 0
hfsplus: unable to parse mount options
nla_parse: 6 callbacks suppressed
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
overlayfs: unrecognized mount option "upperdwr=./file0" or missing value
XFS (nullb0): unknown mount option [workdir].
overlayfs: unrecognized mount option "upperdwr=./file0" or missing value
XFS (nullb0): unknown mount option [workdir].
overlayfs: unrecognized mount option "upperdwr=./file0" or missing value
tmpfs: No value for mount option 'dont_hash'
XFS (nullb0): unknown mount option [workdir].
tmpfs: No value for mount option 'dont_hash'
overlayfs: unrecognized mount option "upperdwr=./file0" or missing value
XFS (nullb0): unknown mount option [workdir].
tmpfs: No value for mount option 'dont_hash'
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
tmpfs: No value for mount option 'dont_hash'
tmpfs: No value for mount option 'dont_hash'
tmpfs: No value for mount option 'dont_hash'
tmpfs: No value for mount option 'dont_hash'
tmpfs: No value for mount option 'dont_hash'
EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
QAT: Device 0 not found
kauditd_printk_skb: 1 callbacks suppressed
audit: type=1800 audit(1616373273.769:13): pid=11081 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.5" name="bus" dev="sda1" ino=14067 res=0
QAT: Device 0 not found
QAT: Device 0 not found
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 1 PID: 11119 Comm: syz-executor.1 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc_node mm/slab.c:3297 [inline]
kmem_cache_alloc_node+0x263/0x410 mm/slab.c:3640
__alloc_skb+0x5c/0x510 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:980 [inline]
netlink_alloc_large_skb net/netlink/af_netlink.c:1159 [inline]
netlink_sendmsg+0x901/0xb80 net/netlink/af_netlink.c:1853
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007fdaff4aa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000005
RBP: 00007fdaff4aa1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff491cf8ff R14: 00007fdaff4aa300 R15: 0000000000022000
audit: type=1800 audit(1616373274.509:14): pid=11136 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="" name="bus" dev="sda1" ino=14067 res=0
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 11149 Comm: syz-executor.1 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc_node mm/slab.c:3297 [inline]
kmem_cache_alloc_node_trace+0x25a/0x400 mm/slab.c:3659
__do_kmalloc_node mm/slab.c:3681 [inline]
__kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696
__kmalloc_reserve net/core/skbuff.c:137 [inline]
__alloc_skb+0x96/0x510 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:980 [inline]
netlink_alloc_large_skb net/netlink/af_netlink.c:1159 [inline]
netlink_sendmsg+0x901/0xb80 net/netlink/af_netlink.c:1853
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007fdaff4aa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000005
RBP: 00007fdaff4aa1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff491cf8ff R14: 00007fdaff4aa300 R15: 0000000000022000
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 11181 Comm: syz-executor.1 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc_node mm/slab.c:3297 [inline]
kmem_cache_alloc_node+0x263/0x410 mm/slab.c:3640
__alloc_skb+0x5c/0x510 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:980 [inline]
nlmsg_new include/net/netlink.h:511 [inline]
netlink_ack+0x216/0x9a0 net/netlink/af_netlink.c:2360
netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2439
genl_rcv+0x24/0x40 net/netlink/genetlink.c:636
netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007fdaff4aa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000005
RBP: 00007fdaff4aa1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff491cf8ff R14: 00007fdaff4aa300 R15: 0000000000022000
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 11249 Comm: syz-executor.1 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc_node mm/slab.c:3297 [inline]
kmem_cache_alloc_node_trace+0x25a/0x400 mm/slab.c:3659
__do_kmalloc_node mm/slab.c:3681 [inline]
__kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696
__kmalloc_reserve net/core/skbuff.c:137 [inline]
__alloc_skb+0x96/0x510 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:980 [inline]
nlmsg_new include/net/netlink.h:511 [inline]
netlink_ack+0x216/0x9a0 net/netlink/af_netlink.c:2360
netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2439
genl_rcv+0x24/0x40 net/netlink/genetlink.c:636
netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007fdaff4aa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000005
RBP: 00007fdaff4aa1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff491cf8ff R14: 00007fdaff4aa300 R15: 0000000000022000
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1064dad6d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=124f4e6b89b71fac
dashboard link: https://syzkaller.appspot.com/bug?extid=c072c80706efe72675eb
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c072c8...@syzkaller.appspotmail.com
EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock
EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock
EXT4-fs: failed to create workqueue
EXT4-fs (loop0): mount failed
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
4.14.226-syzkaller #0 Not tainted
-----------------------------------------------------
syz-executor.5/10503 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire:
(hugetlb_lock){+.+.}, at: [<ffffffff817b902b>] spin_lock include/linux/spinlock.h:317 [inline]
(hugetlb_lock){+.+.}, at: [<ffffffff817b902b>] free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
and this task is already holding:
(slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] spin_lock include/linux/spinlock.h:317 [inline]
(slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234
which would create a new lock dependency:
(slock-AF_INET){+.-.} -> (hugetlb_lock){+.+.}
but this new dependency connects a SOFTIRQ-irq-safe lock:
(slock-AF_INET){+.-.}
... which became SOFTIRQ-irq-safe at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
sk_clone_lock+0x3cf/0x11e0 net/core/sock.c:1666
inet_csk_clone_lock+0x1e/0x3f0 net/ipv4/inet_connection_sock.c:815
tcp_create_openreq_child+0x2c/0x1880 net/ipv4/tcp_minisocks.c:437
tcp_v4_syn_recv_sock+0xa8/0xf80 net/ipv4/tcp_ipv4.c:1358
tcp_check_req+0x4c1/0x1460 net/ipv4/tcp_minisocks.c:764
tcp_v4_rcv+0x1c36/0x3560 net/ipv4/tcp_ipv4.c:1701
ip_local_deliver_finish+0x3f2/0xab0 net/ipv4/ip_input.c:216
NF_HOOK include/linux/netfilter.h:250 [inline]
ip_local_deliver+0x167/0x460 net/ipv4/ip_input.c:257
dst_input include/net/dst.h:476 [inline]
ip_rcv_finish+0x6e3/0x19f0 net/ipv4/ip_input.c:396
NF_HOOK include/linux/netfilter.h:250 [inline]
ip_rcv+0x8a7/0xf10 net/ipv4/ip_input.c:493
__netif_receive_skb_core+0x15ee/0x2a30 net/core/dev.c:4474
__netif_receive_skb+0x27/0x1a0 net/core/dev.c:4512
netif_receive_skb_internal+0xd7/0x580 net/core/dev.c:4585
napi_skb_finish net/core/dev.c:4946 [inline]
napi_gro_receive+0x2e2/0x400 net/core/dev.c:4977
receive_buf+0x5ee/0x49f0 drivers/net/virtio_net.c:852
virtnet_receive drivers/net/virtio_net.c:1098 [inline]
virtnet_poll+0x4b7/0x960 drivers/net/virtio_net.c:1189
napi_poll net/core/dev.c:5596 [inline]
net_rx_action+0x466/0xfd0 net/core/dev.c:5662
__do_softirq+0x24d/0x9ff kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
do_IRQ+0x112/0x1d0 arch/x86/kernel/irq.c:242
ret_from_intr+0x0/0x1e
csd_lock_wait kernel/smp.c:108 [inline]
smp_call_function_single+0x17a/0x370 kernel/smp.c:302
smp_call_function_many+0x60f/0x7a0 kernel/smp.c:434
smp_call_function kernel/smp.c:492 [inline]
on_each_cpu+0x40/0x210 kernel/smp.c:602
text_poke_bp+0xdc/0x110 arch/x86/kernel/alternative.c:814
__jump_label_transform+0x269/0x300 arch/x86/kernel/jump_label.c:102
arch_jump_label_transform+0x26/0x40 arch/x86/kernel/jump_label.c:110
__jump_label_update+0x113/0x170 kernel/jump_label.c:374
jump_label_update kernel/jump_label.c:741 [inline]
jump_label_update+0x140/0x2d0 kernel/jump_label.c:720
__static_key_slow_dec_cpuslocked+0x3d/0xf0 kernel/jump_label.c:204
__static_key_slow_dec kernel/jump_label.c:214 [inline]
static_key_slow_dec+0x53/0x70 kernel/jump_label.c:228
once_deferred+0x58/0x80 lib/once.c:18
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
to a SOFTIRQ-irq-unsafe lock:
(hugetlb_lock){+.+.}
... which became SOFTIRQ-irq-unsafe at:
...
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hugetlb_lock);
local_irq_disable();
lock(slock-AF_INET);
lock(hugetlb_lock);
<Interrupt>
lock(slock-AF_INET);
*** DEADLOCK ***
3 locks held by syz-executor.5/10503:
#0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [<ffffffff85ba52c6>] inode_lock include/linux/fs.h:719 [inline]
#0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [<ffffffff85ba52c6>] __sock_release+0x86/0x2b0 net/socket.c:601
#1: (sk_lock-AF_INET){+.+.}, at: [<ffffffff860f3f35>] lock_sock include/net/sock.h:1471 [inline]
#1: (sk_lock-AF_INET){+.+.}, at: [<ffffffff860f3f35>] tcp_close+0x25/0xed0 net/ipv4/tcp.c:2144
#2: (slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] spin_lock include/linux/spinlock.h:317 [inline]
#2: (slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234
the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
-> (slock-AF_INET){+.-.} ops: 787287 {
HARDIRQ-ON-W at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:176
spin_lock_bh include/linux/spinlock.h:322 [inline]
lock_sock_nested+0x39/0x100 net/core/sock.c:2788
lock_sock include/net/sock.h:1471 [inline]
inet_autobind+0x1a/0x180 net/ipv4/af_inet.c:178
inet_dgram_connect+0x134/0x1f0 net/ipv4/af_inet.c:538
SYSC_connect net/socket.c:1655 [inline]
SyS_connect+0x1f4/0x240 net/socket.c:1636
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
IN-SOFTIRQ-W at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
sk_clone_lock+0x3cf/0x11e0 net/core/sock.c:1666
inet_csk_clone_lock+0x1e/0x3f0 net/ipv4/inet_connection_sock.c:815
tcp_create_openreq_child+0x2c/0x1880 net/ipv4/tcp_minisocks.c:437
tcp_v4_syn_recv_sock+0xa8/0xf80 net/ipv4/tcp_ipv4.c:1358
tcp_check_req+0x4c1/0x1460 net/ipv4/tcp_minisocks.c:764
tcp_v4_rcv+0x1c36/0x3560 net/ipv4/tcp_ipv4.c:1701
ip_local_deliver_finish+0x3f2/0xab0 net/ipv4/ip_input.c:216
NF_HOOK include/linux/netfilter.h:250 [inline]
ip_local_deliver+0x167/0x460 net/ipv4/ip_input.c:257
dst_input include/net/dst.h:476 [inline]
ip_rcv_finish+0x6e3/0x19f0 net/ipv4/ip_input.c:396
NF_HOOK include/linux/netfilter.h:250 [inline]
ip_rcv+0x8a7/0xf10 net/ipv4/ip_input.c:493
__netif_receive_skb_core+0x15ee/0x2a30 net/core/dev.c:4474
__netif_receive_skb+0x27/0x1a0 net/core/dev.c:4512
netif_receive_skb_internal+0xd7/0x580 net/core/dev.c:4585
napi_skb_finish net/core/dev.c:4946 [inline]
napi_gro_receive+0x2e2/0x400 net/core/dev.c:4977
receive_buf+0x5ee/0x49f0 drivers/net/virtio_net.c:852
virtnet_receive drivers/net/virtio_net.c:1098 [inline]
virtnet_poll+0x4b7/0x960 drivers/net/virtio_net.c:1189
napi_poll net/core/dev.c:5596 [inline]
net_rx_action+0x466/0xfd0 net/core/dev.c:5662
__do_softirq+0x24d/0x9ff kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
do_IRQ+0x112/0x1d0 arch/x86/kernel/irq.c:242
ret_from_intr+0x0/0x1e
csd_lock_wait kernel/smp.c:108 [inline]
smp_call_function_single+0x17a/0x370 kernel/smp.c:302
smp_call_function_many+0x60f/0x7a0 kernel/smp.c:434
smp_call_function kernel/smp.c:492 [inline]
on_each_cpu+0x40/0x210 kernel/smp.c:602
text_poke_bp+0xdc/0x110 arch/x86/kernel/alternative.c:814
__jump_label_transform+0x269/0x300 arch/x86/kernel/jump_label.c:102
arch_jump_label_transform+0x26/0x40 arch/x86/kernel/jump_label.c:110
__jump_label_update+0x113/0x170 kernel/jump_label.c:374
jump_label_update kernel/jump_label.c:741 [inline]
jump_label_update+0x140/0x2d0 kernel/jump_label.c:720
__static_key_slow_dec_cpuslocked+0x3d/0xf0 kernel/jump_label.c:204
__static_key_slow_dec kernel/jump_label.c:214 [inline]
static_key_slow_dec+0x53/0x70 kernel/jump_label.c:228
once_deferred+0x58/0x80 lib/once.c:18
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
INITIAL USE at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:176
spin_lock_bh include/linux/spinlock.h:322 [inline]
lock_sock_nested+0x39/0x100 net/core/sock.c:2788
lock_sock include/net/sock.h:1471 [inline]
inet_autobind+0x1a/0x180 net/ipv4/af_inet.c:178
inet_dgram_connect+0x134/0x1f0 net/ipv4/af_inet.c:538
SYSC_connect net/socket.c:1655 [inline]
SyS_connect+0x1f4/0x240 net/socket.c:1636
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
}
... key at: [<ffffffff8c982ab0>] af_family_slock_keys+0x10/0x180
... acquired at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
__put_page+0xb9/0x2f0 mm/swap.c:111
put_page include/linux/mm.h:875 [inline]
__skb_frag_unref include/linux/skbuff.h:2829 [inline]
skb_release_data+0x25a/0x820 net/core/skbuff.c:577
skb_release_all net/core/skbuff.c:640 [inline]
__kfree_skb+0x46/0x60 net/core/skbuff.c:654
sk_wmem_free_skb include/net/sock.h:1425 [inline]
tcp_write_queue_purge include/net/tcp.h:1631 [inline]
tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904
inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866
tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298
inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
get_signal+0x18a3/0x1ca0 kernel/signal.c:2234
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:814
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
the dependencies between the lock to be acquired
and SOFTIRQ-irq-unsafe lock:
-> (hugetlb_lock){+.+.} ops: 74 {
HARDIRQ-ON-W at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
SOFTIRQ-ON-W at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
INITIAL USE at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
}
... key at: [<ffffffff89000cf8>] hugetlb_lock+0x18/0x15e0
... acquired at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
__put_page+0xb9/0x2f0 mm/swap.c:111
put_page include/linux/mm.h:875 [inline]
__skb_frag_unref include/linux/skbuff.h:2829 [inline]
skb_release_data+0x25a/0x820 net/core/skbuff.c:577
skb_release_all net/core/skbuff.c:640 [inline]
__kfree_skb+0x46/0x60 net/core/skbuff.c:654
sk_wmem_free_skb include/net/sock.h:1425 [inline]
tcp_write_queue_purge include/net/tcp.h:1631 [inline]
tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904
inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866
tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298
inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
get_signal+0x18a3/0x1ca0 kernel/signal.c:2234
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:814
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
stack backtrace:
CPU: 1 PID: 10503 Comm: syz-executor.5 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
print_bad_irq_dependency kernel/locking/lockdep.c:1609 [inline]
check_usage.cold+0x806/0xbe6 kernel/locking/lockdep.c:1641
check_irq_usage kernel/locking/lockdep.c:1697 [inline]
check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline]
check_prev_add kernel/locking/lockdep.c:1910 [inline]
check_prevs_add kernel/locking/lockdep.c:2022 [inline]
validate_chain kernel/locking/lockdep.c:2464 [inline]
__lock_acquire+0x1cfc/0x3f20 kernel/locking/lockdep.c:3491
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
__put_page+0xb9/0x2f0 mm/swap.c:111
put_page include/linux/mm.h:875 [inline]
__skb_frag_unref include/linux/skbuff.h:2829 [inline]
skb_release_data+0x25a/0x820 net/core/skbuff.c:577
skb_release_all net/core/skbuff.c:640 [inline]
__kfree_skb+0x46/0x60 net/core/skbuff.c:654
sk_wmem_free_skb include/net/sock.h:1425 [inline]
tcp_write_queue_purge include/net/tcp.h:1631 [inline]
tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904
inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866
tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298
inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
get_signal+0x18a3/0x1ca0 kernel/signal.c:2234
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:814
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007f88aa5f8188 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: 00000000004807b8 RBX: 000000000056bf60 RCX: 0000000000466459
RDX: ffffffffffffffd0 RSI: 0000000020000140 RDI: 0000000000000005
RBP: 00000000004bf9fb R08: 0000000000000000 R09: ffffffffffffff36
R10: 000000000401c005 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007fff876d9cff R14: 00007f88aa5f8300 R15: 0000000000022000
print_req_error: I/O error, dev loop0, sector 0
hfsplus: unable to parse mount options
nla_parse: 6 callbacks suppressed
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
overlayfs: unrecognized mount option "upperdwr=./file0" or missing value
XFS (nullb0): unknown mount option [workdir].
overlayfs: unrecognized mount option "upperdwr=./file0" or missing value
XFS (nullb0): unknown mount option [workdir].
overlayfs: unrecognized mount option "upperdwr=./file0" or missing value
tmpfs: No value for mount option 'dont_hash'
XFS (nullb0): unknown mount option [workdir].
tmpfs: No value for mount option 'dont_hash'
overlayfs: unrecognized mount option "upperdwr=./file0" or missing value
XFS (nullb0): unknown mount option [workdir].
tmpfs: No value for mount option 'dont_hash'
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
tmpfs: No value for mount option 'dont_hash'
tmpfs: No value for mount option 'dont_hash'
tmpfs: No value for mount option 'dont_hash'
tmpfs: No value for mount option 'dont_hash'
tmpfs: No value for mount option 'dont_hash'
EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
QAT: Device 0 not found
kauditd_printk_skb: 1 callbacks suppressed
audit: type=1800 audit(1616373273.769:13): pid=11081 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.5" name="bus" dev="sda1" ino=14067 res=0
QAT: Device 0 not found
QAT: Device 0 not found
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 1 PID: 11119 Comm: syz-executor.1 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc_node mm/slab.c:3297 [inline]
kmem_cache_alloc_node+0x263/0x410 mm/slab.c:3640
__alloc_skb+0x5c/0x510 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:980 [inline]
netlink_alloc_large_skb net/netlink/af_netlink.c:1159 [inline]
netlink_sendmsg+0x901/0xb80 net/netlink/af_netlink.c:1853
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007fdaff4aa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000005
RBP: 00007fdaff4aa1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff491cf8ff R14: 00007fdaff4aa300 R15: 0000000000022000
audit: type=1800 audit(1616373274.509:14): pid=11136 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="" name="bus" dev="sda1" ino=14067 res=0
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 11149 Comm: syz-executor.1 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc_node mm/slab.c:3297 [inline]
kmem_cache_alloc_node_trace+0x25a/0x400 mm/slab.c:3659
__do_kmalloc_node mm/slab.c:3681 [inline]
__kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696
__kmalloc_reserve net/core/skbuff.c:137 [inline]
__alloc_skb+0x96/0x510 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:980 [inline]
netlink_alloc_large_skb net/netlink/af_netlink.c:1159 [inline]
netlink_sendmsg+0x901/0xb80 net/netlink/af_netlink.c:1853
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007fdaff4aa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000005
RBP: 00007fdaff4aa1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff491cf8ff R14: 00007fdaff4aa300 R15: 0000000000022000
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 11181 Comm: syz-executor.1 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc_node mm/slab.c:3297 [inline]
kmem_cache_alloc_node+0x263/0x410 mm/slab.c:3640
__alloc_skb+0x5c/0x510 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:980 [inline]
nlmsg_new include/net/netlink.h:511 [inline]
netlink_ack+0x216/0x9a0 net/netlink/af_netlink.c:2360
netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2439
genl_rcv+0x24/0x40 net/netlink/genetlink.c:636
netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007fdaff4aa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000005
RBP: 00007fdaff4aa1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff491cf8ff R14: 00007fdaff4aa300 R15: 0000000000022000
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 11249 Comm: syz-executor.1 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x149 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc_node mm/slab.c:3297 [inline]
kmem_cache_alloc_node_trace+0x25a/0x400 mm/slab.c:3659
__do_kmalloc_node mm/slab.c:3681 [inline]
__kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696
__kmalloc_reserve net/core/skbuff.c:137 [inline]
__alloc_skb+0x96/0x510 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:980 [inline]
nlmsg_new include/net/netlink.h:511 [inline]
netlink_ack+0x216/0x9a0 net/netlink/af_netlink.c:2360
netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2439
genl_rcv+0x24/0x40 net/netlink/genetlink.c:636
netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x466459
RSP: 002b:00007fdaff4aa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000005
RBP: 00007fdaff4aa1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff491cf8ff R14: 00007fdaff4aa300 R15: 0000000000022000
netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'.
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Mar 21, 2021, 8:55:17 PM3/21/21
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15081026d00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=132c497cd00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c072c8...@syzkaller.appspotmail.com
arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
lock_acquire+0x1ec/0x3f0 kernel/locking/lockdep.c:4001
down_read+0x36/0x80 kernel/locking/rwsem.c:24
anon_vma_lock_read include/linux/rmap.h:130 [inline]
validate_mm+0xd3/0x580 mm/mmap.c:359
__vma_adjust+0x967/0x1770 mm/mmap.c:960
vma_adjust include/linux/mm.h:2112 [inline]
__split_vma+0x3aa/0x6c0 mm/mmap.c:2615
split_vma+0x85/0xc0 mm/mmap.c:2644
mprotect_fixup+0x6e3/0x8c0 mm/mprotect.c:437
do_mprotect_pkey+0x44a/0x7e0 mm/mprotect.c:575
SYSC_mprotect mm/mprotect.c:600 [inline]
SyS_mprotect+0x26/0x30 mm/mprotect.c:597
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
3 locks held by syz-executor423/7964:
arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
lock_acquire+0x1ec/0x3f0 kernel/locking/lockdep.c:4001
down_read+0x36/0x80 kernel/locking/rwsem.c:24
anon_vma_lock_read include/linux/rmap.h:130 [inline]
validate_mm+0xd3/0x580 mm/mmap.c:359
__vma_adjust+0x967/0x1770 mm/mmap.c:960
vma_adjust include/linux/mm.h:2112 [inline]
__split_vma+0x3aa/0x6c0 mm/mmap.c:2615
split_vma+0x85/0xc0 mm/mmap.c:2644
mprotect_fixup+0x6e3/0x8c0 mm/mprotect.c:437
do_mprotect_pkey+0x44a/0x7e0 mm/mprotect.c:575
SYSC_mprotect mm/mprotect.c:600 [inline]
SyS_mprotect+0x26/0x30 mm/mprotect.c:597
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
SYSC_exit_group kernel/exit.c:976 [inline]
SyS_exit_group+0x19/0x20 kernel/exit.c:974
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
SYSC_exit_group kernel/exit.c:976 [inline]
SyS_exit_group+0x19/0x20 kernel/exit.c:974
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
stack backtrace:
CPU: 0 PID: 7964 Comm: syz-executor423 Not tainted 4.14.226-syzkaller #0
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
SYSC_exit_group kernel/exit.c:976 [inline]
SyS_exit_group+0x19/0x20 kernel/exit.c:974
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x44b709
RSP: 002b:00007ffda82acbf8 EFLAGS: 00000246 ORIG_RAX: 00000000
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=124f4e6b89b71fac
dashboard link: https://syzkaller.appspot.com/bug?extid=c072c80706efe72675eb
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=102647aed00000
dashboard link: https://syzkaller.appspot.com/bug?extid=c072c80706efe72675eb
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=132c497cd00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c072c8...@syzkaller.appspotmail.com
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
4.14.226-syzkaller #0 Not tainted
-----------------------------------------------------
syz-executor423/7964 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire:
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
4.14.226-syzkaller #0 Not tainted
-----------------------------------------------------
lock_acquire+0x1ec/0x3f0 kernel/locking/lockdep.c:4001
down_read+0x36/0x80 kernel/locking/rwsem.c:24
anon_vma_lock_read include/linux/rmap.h:130 [inline]
validate_mm+0xd3/0x580 mm/mmap.c:359
__vma_adjust+0x967/0x1770 mm/mmap.c:960
vma_adjust include/linux/mm.h:2112 [inline]
__split_vma+0x3aa/0x6c0 mm/mmap.c:2615
split_vma+0x85/0xc0 mm/mmap.c:2644
mprotect_fixup+0x6e3/0x8c0 mm/mprotect.c:437
do_mprotect_pkey+0x44a/0x7e0 mm/mprotect.c:575
SYSC_mprotect mm/mprotect.c:600 [inline]
SyS_mprotect+0x26/0x30 mm/mprotect.c:597
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
#0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [<ffffffff85ba52c6>] inode_lock include/linux/fs.h:719 [inline]
#0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [<ffffffff85ba52c6>] __sock_release+0x86/0x2b0 net/socket.c:601
#1: (sk_lock-AF_INET){+.+.}, at: [<ffffffff860f3f35>] lock_sock include/net/sock.h:1471 [inline]
#1: (sk_lock-AF_INET){+.+.}, at: [<ffffffff860f3f35>] tcp_close+0x25/0xed0 net/ipv4/tcp.c:2144
#2: (slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] spin_lock include/linux/spinlock.h:317 [inline]
#2: (slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234
the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
-> (slock-AF_INET){+.-.} ops: 6069 {
#0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [<ffffffff85ba52c6>] __sock_release+0x86/0x2b0 net/socket.c:601
#1: (sk_lock-AF_INET){+.+.}, at: [<ffffffff860f3f35>] lock_sock include/net/sock.h:1471 [inline]
#1: (sk_lock-AF_INET){+.+.}, at: [<ffffffff860f3f35>] tcp_close+0x25/0xed0 net/ipv4/tcp.c:2144
#2: (slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] spin_lock include/linux/spinlock.h:317 [inline]
#2: (slock-AF_INET){+.-.}, at: [<ffffffff860f4450>] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234
the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
lock_acquire+0x1ec/0x3f0 kernel/locking/lockdep.c:4001
down_read+0x36/0x80 kernel/locking/rwsem.c:24
anon_vma_lock_read include/linux/rmap.h:130 [inline]
validate_mm+0xd3/0x580 mm/mmap.c:359
__vma_adjust+0x967/0x1770 mm/mmap.c:960
vma_adjust include/linux/mm.h:2112 [inline]
__split_vma+0x3aa/0x6c0 mm/mmap.c:2615
split_vma+0x85/0xc0 mm/mmap.c:2644
mprotect_fixup+0x6e3/0x8c0 mm/mprotect.c:437
do_mprotect_pkey+0x44a/0x7e0 mm/mprotect.c:575
SYSC_mprotect mm/mprotect.c:600 [inline]
SyS_mprotect+0x26/0x30 mm/mprotect.c:597
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
INITIAL USE at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
entry_SYSCALL_64_after_hwframe+0x46/0xbb
INITIAL USE at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
SYSC_exit_group kernel/exit.c:976 [inline]
SyS_exit_group+0x19/0x20 kernel/exit.c:974
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
the dependencies between the lock to be acquired
and SOFTIRQ-irq-unsafe lock:
-> (hugetlb_lock){+.+.} ops: 32 {
the dependencies between the lock to be acquired
and SOFTIRQ-irq-unsafe lock:
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
SYSC_exit_group kernel/exit.c:976 [inline]
SyS_exit_group+0x19/0x20 kernel/exit.c:974
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
stack backtrace:
CPU: 0 PID: 7964 Comm: syz-executor423 Not tainted 4.14.226-syzkaller #0
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
SYSC_exit_group kernel/exit.c:976 [inline]
SyS_exit_group+0x19/0x20 kernel/exit.c:974
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x44b709
RSP: 002b:00007ffda82acbf8 EFLAGS: 00000246 ORIG_RAX: 00000000
Reply all
Reply to author
Forward
0 new messages