[v5.15] possible deadlock in ib_register_device
0 views
Skip to first unread message
syzbot
Jul 27, 2026, 6:32:37 AMJul 27
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 674f684f7c61 Linux 5.15.212
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=149bbfde580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=d1d4eec0908ddb161a41
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f55be2937b89/disk-674f684f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a19fb0ffc049/vmlinux-674f684f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/365d4529a007/bzImage-674f684f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d1d4ee...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.2.121/5005 is trying to acquire lock:
ffffffff8d232ad0 (devices_rwsem){++++}-{3:3}, at: assign_name drivers/infiniband/core/device.c:1216 [inline]
ffffffff8d232ad0 (devices_rwsem){++++}-{3:3}, at: ib_register_device+0xcb/0x12e0 drivers/infiniband/core/device.c:1380
but task is already holding lock:
ffffffff8c1d4a08 (param_lock){+.+.}-{3:3}, at: kernel_param_lock kernel/params.c:598 [inline]
ffffffff8c1d4a08 (param_lock){+.+.}-{3:3}, at: param_attr_store+0xcb/0x300 kernel/params.c:583
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #5 (param_lock){+.+.}-{3:3}:
__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
ieee80211_rate_control_ops_get net/mac80211/rate.c:192 [inline]
rate_control_alloc net/mac80211/rate.c:239 [inline]
ieee80211_init_rate_ctrl_alg+0x171/0x5e0 net/mac80211/rate.c:983
ieee80211_register_hw+0x23c6/0x3a60 net/mac80211/main.c:1252
mac80211_hwsim_new_radio+0x209d/0x4050 drivers/net/wireless/mac80211_hwsim.c:3373
init_mac80211_hwsim+0x581/0x720 drivers/net/wireless/mac80211_hwsim.c:4606
do_one_initcall+0x272/0x730 init/main.c:1315
do_initcall_level+0x13d/0x1f0 init/main.c:1388
do_initcalls+0x4b/0x90 init/main.c:1404
kernel_init_freeable+0x3d5/0x560 init/main.c:1628
kernel_init+0x19/0x1b0 init/main.c:1519
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
-> #4 (rtnl_mutex){+.+.}-{3:3}:
__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
ib_get_eth_speed+0x16b/0x500 drivers/infiniband/core/verbs.c:1905
rxe_query_port+0x58/0x190 drivers/infiniband/sw/rxe/rxe_verbs.c:41
__ib_query_port drivers/infiniband/core/device.c:2081 [inline]
ib_query_port+0x15e/0x7e0 drivers/infiniband/core/device.c:2113
rxe_port_immutable+0xe0/0x240 drivers/infiniband/sw/rxe/rxe_verbs.c:132
setup_port_data drivers/infiniband/core/device.c:857 [inline]
setup_device drivers/infiniband/core/device.c:1253 [inline]
ib_register_device+0xd42/0x12e0 drivers/infiniband/core/device.c:1392
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_newlink+0x66/0x100 drivers/infiniband/sw/rxe/rxe.c:272
nldev_newlink+0x524/0x580 drivers/infiniband/core/nldev.c:1711
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6d8/0xa00 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #3 (&rxe->usdev_lock){+.+.}-{3:3}:
__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
rxe_query_port+0x46/0x190 drivers/infiniband/sw/rxe/rxe_verbs.c:40
__ib_query_port drivers/infiniband/core/device.c:2081 [inline]
ib_query_port+0x15e/0x7e0 drivers/infiniband/core/device.c:2113
ib_setup_port_attrs+0x27b/0x2140 drivers/infiniband/core/sysfs.c:1422
add_one_compat_dev+0x3da/0x5c0 drivers/infiniband/core/device.c:978
add_compat_devs drivers/infiniband/core/device.c:1036 [inline]
enable_device_and_get+0x2ac/0x3d0 drivers/infiniband/core/device.c:1347
ib_register_device+0x1039/0x12e0 drivers/infiniband/core/device.c:1429
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_newlink+0x66/0x100 drivers/infiniband/sw/rxe/rxe.c:272
nldev_newlink+0x524/0x580 drivers/infiniband/core/nldev.c:1711
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6d8/0xa00 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #2 (&device->compat_devs_mutex){+.+.}-{3:3}:
__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
add_one_compat_dev+0xee/0x5c0 drivers/infiniband/core/device.c:952
add_compat_devs drivers/infiniband/core/device.c:1036 [inline]
enable_device_and_get+0x2ac/0x3d0 drivers/infiniband/core/device.c:1347
ib_register_device+0x1039/0x12e0 drivers/infiniband/core/device.c:1429
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_newlink+0x66/0x100 drivers/infiniband/sw/rxe/rxe.c:272
nldev_newlink+0x524/0x580 drivers/infiniband/core/nldev.c:1711
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6d8/0xa00 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #1 (rdma_nets_rwsem){++++}-{3:3}:
down_read+0x44/0x2e0 kernel/locking/rwsem.c:1498
add_compat_devs drivers/infiniband/core/device.c:1034 [inline]
enable_device_and_get+0x275/0x3d0 drivers/infiniband/core/device.c:1347
ib_register_device+0x1039/0x12e0 drivers/infiniband/core/device.c:1429
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_newlink+0x66/0x100 drivers/infiniband/sw/rxe/rxe.c:272
nldev_newlink+0x524/0x580 drivers/infiniband/core/nldev.c:1711
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6d8/0xa00 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #0 (devices_rwsem){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c66/0x7b50 kernel/locking/lockdep.c:5012
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
down_write+0x38/0x60 kernel/locking/rwsem.c:1551
assign_name drivers/infiniband/core/device.c:1216 [inline]
ib_register_device+0xcb/0x12e0 drivers/infiniband/core/device.c:1380
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_param_set_add+0x395/0x590 drivers/infiniband/sw/rxe/rxe_sysfs.c:68
param_attr_store+0x20a/0x300 kernel/params.c:585
module_attr_store+0x5b/0x80 kernel/params.c:905
kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2173 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x748/0xd70 fs/read_write.c:594
ksys_write+0x153/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
other info that might help us debug this:
Chain exists of:
devices_rwsem --> rtnl_mutex --> param_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(param_lock);
lock(rtnl_mutex);
lock(param_lock);
lock(devices_rwsem);
*** DEADLOCK ***
5 locks held by syz.2.121/5005:
#0: ffff88807770c870 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
#1: ffff88807f6f8460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
#2: ffff888025519c88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
#3: ffff888142b95578 (kn->active){++++}-{0:0}, at: kernfs_fop_write_iter+0x1fd/0x500 fs/kernfs/file.c:288
#4: ffffffff8c1d4a08 (param_lock){+.+.}-{3:3}, at: kernel_param_lock kernel/params.c:598 [inline]
#4: ffffffff8c1d4a08 (param_lock){+.+.}-{3:3}, at: param_attr_store+0xcb/0x300 kernel/params.c:583
stack backtrace:
CPU: 1 PID: 5005 Comm: syz.2.121 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
check_noncircular+0x296/0x330 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c66/0x7b50 kernel/locking/lockdep.c:5012
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
down_write+0x38/0x60 kernel/locking/rwsem.c:1551
assign_name drivers/infiniband/core/device.c:1216 [inline]
ib_register_device+0xcb/0x12e0 drivers/infiniband/core/device.c:1380
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_param_set_add+0x395/0x590 drivers/infiniband/sw/rxe/rxe_sysfs.c:68
param_attr_store+0x20a/0x300 kernel/params.c:585
module_attr_store+0x5b/0x80 kernel/params.c:905
kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2173 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x748/0xd70 fs/read_write.c:594
ksys_write+0x153/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f367607ce99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f36742d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3676304fa0 RCX: 00007f367607ce99
RDX: 0000000000000005 RSI: 0000200000000080 RDI: 0000000000000003
RBP: 00007f3676112eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3676305038 R14: 00007f3676304fa0 R15: 00007ffd90a17828
</TASK>
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
infiniband rxe0: set active
infiniband rxe0: added eth0
infiniband rxe0: Couldn't open port 1
RDS/IB: rxe0: added
smc: adding ib device rxe0 with port count 1
smc: ib device rxe0 port 1 has pnetid
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 674f684f7c61 Linux 5.15.212
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=149bbfde580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=d1d4eec0908ddb161a41
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f55be2937b89/disk-674f684f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a19fb0ffc049/vmlinux-674f684f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/365d4529a007/bzImage-674f684f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d1d4ee...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.2.121/5005 is trying to acquire lock:
ffffffff8d232ad0 (devices_rwsem){++++}-{3:3}, at: assign_name drivers/infiniband/core/device.c:1216 [inline]
ffffffff8d232ad0 (devices_rwsem){++++}-{3:3}, at: ib_register_device+0xcb/0x12e0 drivers/infiniband/core/device.c:1380
but task is already holding lock:
ffffffff8c1d4a08 (param_lock){+.+.}-{3:3}, at: kernel_param_lock kernel/params.c:598 [inline]
ffffffff8c1d4a08 (param_lock){+.+.}-{3:3}, at: param_attr_store+0xcb/0x300 kernel/params.c:583
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #5 (param_lock){+.+.}-{3:3}:
__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
ieee80211_rate_control_ops_get net/mac80211/rate.c:192 [inline]
rate_control_alloc net/mac80211/rate.c:239 [inline]
ieee80211_init_rate_ctrl_alg+0x171/0x5e0 net/mac80211/rate.c:983
ieee80211_register_hw+0x23c6/0x3a60 net/mac80211/main.c:1252
mac80211_hwsim_new_radio+0x209d/0x4050 drivers/net/wireless/mac80211_hwsim.c:3373
init_mac80211_hwsim+0x581/0x720 drivers/net/wireless/mac80211_hwsim.c:4606
do_one_initcall+0x272/0x730 init/main.c:1315
do_initcall_level+0x13d/0x1f0 init/main.c:1388
do_initcalls+0x4b/0x90 init/main.c:1404
kernel_init_freeable+0x3d5/0x560 init/main.c:1628
kernel_init+0x19/0x1b0 init/main.c:1519
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
-> #4 (rtnl_mutex){+.+.}-{3:3}:
__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
ib_get_eth_speed+0x16b/0x500 drivers/infiniband/core/verbs.c:1905
rxe_query_port+0x58/0x190 drivers/infiniband/sw/rxe/rxe_verbs.c:41
__ib_query_port drivers/infiniband/core/device.c:2081 [inline]
ib_query_port+0x15e/0x7e0 drivers/infiniband/core/device.c:2113
rxe_port_immutable+0xe0/0x240 drivers/infiniband/sw/rxe/rxe_verbs.c:132
setup_port_data drivers/infiniband/core/device.c:857 [inline]
setup_device drivers/infiniband/core/device.c:1253 [inline]
ib_register_device+0xd42/0x12e0 drivers/infiniband/core/device.c:1392
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_newlink+0x66/0x100 drivers/infiniband/sw/rxe/rxe.c:272
nldev_newlink+0x524/0x580 drivers/infiniband/core/nldev.c:1711
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6d8/0xa00 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #3 (&rxe->usdev_lock){+.+.}-{3:3}:
__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
rxe_query_port+0x46/0x190 drivers/infiniband/sw/rxe/rxe_verbs.c:40
__ib_query_port drivers/infiniband/core/device.c:2081 [inline]
ib_query_port+0x15e/0x7e0 drivers/infiniband/core/device.c:2113
ib_setup_port_attrs+0x27b/0x2140 drivers/infiniband/core/sysfs.c:1422
add_one_compat_dev+0x3da/0x5c0 drivers/infiniband/core/device.c:978
add_compat_devs drivers/infiniband/core/device.c:1036 [inline]
enable_device_and_get+0x2ac/0x3d0 drivers/infiniband/core/device.c:1347
ib_register_device+0x1039/0x12e0 drivers/infiniband/core/device.c:1429
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_newlink+0x66/0x100 drivers/infiniband/sw/rxe/rxe.c:272
nldev_newlink+0x524/0x580 drivers/infiniband/core/nldev.c:1711
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6d8/0xa00 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #2 (&device->compat_devs_mutex){+.+.}-{3:3}:
__mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
add_one_compat_dev+0xee/0x5c0 drivers/infiniband/core/device.c:952
add_compat_devs drivers/infiniband/core/device.c:1036 [inline]
enable_device_and_get+0x2ac/0x3d0 drivers/infiniband/core/device.c:1347
ib_register_device+0x1039/0x12e0 drivers/infiniband/core/device.c:1429
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_newlink+0x66/0x100 drivers/infiniband/sw/rxe/rxe.c:272
nldev_newlink+0x524/0x580 drivers/infiniband/core/nldev.c:1711
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6d8/0xa00 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #1 (rdma_nets_rwsem){++++}-{3:3}:
down_read+0x44/0x2e0 kernel/locking/rwsem.c:1498
add_compat_devs drivers/infiniband/core/device.c:1034 [inline]
enable_device_and_get+0x275/0x3d0 drivers/infiniband/core/device.c:1347
ib_register_device+0x1039/0x12e0 drivers/infiniband/core/device.c:1429
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_newlink+0x66/0x100 drivers/infiniband/sw/rxe/rxe.c:272
nldev_newlink+0x524/0x580 drivers/infiniband/core/nldev.c:1711
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6d8/0xa00 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #0 (devices_rwsem){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c66/0x7b50 kernel/locking/lockdep.c:5012
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
down_write+0x38/0x60 kernel/locking/rwsem.c:1551
assign_name drivers/infiniband/core/device.c:1216 [inline]
ib_register_device+0xcb/0x12e0 drivers/infiniband/core/device.c:1380
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_param_set_add+0x395/0x590 drivers/infiniband/sw/rxe/rxe_sysfs.c:68
param_attr_store+0x20a/0x300 kernel/params.c:585
module_attr_store+0x5b/0x80 kernel/params.c:905
kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2173 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x748/0xd70 fs/read_write.c:594
ksys_write+0x153/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
other info that might help us debug this:
Chain exists of:
devices_rwsem --> rtnl_mutex --> param_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(param_lock);
lock(rtnl_mutex);
lock(param_lock);
lock(devices_rwsem);
*** DEADLOCK ***
5 locks held by syz.2.121/5005:
#0: ffff88807770c870 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
#1: ffff88807f6f8460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
#2: ffff888025519c88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
#3: ffff888142b95578 (kn->active){++++}-{0:0}, at: kernfs_fop_write_iter+0x1fd/0x500 fs/kernfs/file.c:288
#4: ffffffff8c1d4a08 (param_lock){+.+.}-{3:3}, at: kernel_param_lock kernel/params.c:598 [inline]
#4: ffffffff8c1d4a08 (param_lock){+.+.}-{3:3}, at: param_attr_store+0xcb/0x300 kernel/params.c:583
stack backtrace:
CPU: 1 PID: 5005 Comm: syz.2.121 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
check_noncircular+0x296/0x330 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c66/0x7b50 kernel/locking/lockdep.c:5012
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
down_write+0x38/0x60 kernel/locking/rwsem.c:1551
assign_name drivers/infiniband/core/device.c:1216 [inline]
ib_register_device+0xcb/0x12e0 drivers/infiniband/core/device.c:1380
rxe_register_device+0x256/0x360 drivers/infiniband/sw/rxe/rxe_verbs.c:1137
rxe_net_add+0x77/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:549
rxe_param_set_add+0x395/0x590 drivers/infiniband/sw/rxe/rxe_sysfs.c:68
param_attr_store+0x20a/0x300 kernel/params.c:585
module_attr_store+0x5b/0x80 kernel/params.c:905
kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2173 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x748/0xd70 fs/read_write.c:594
ksys_write+0x153/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f367607ce99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f36742d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3676304fa0 RCX: 00007f367607ce99
RDX: 0000000000000005 RSI: 0000200000000080 RDI: 0000000000000003
RBP: 00007f3676112eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3676305038 R14: 00007f3676304fa0 R15: 00007ffd90a17828
</TASK>
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
infiniband rxe0: set active
infiniband rxe0: added eth0
infiniband rxe0: Couldn't open port 1
RDS/IB: rxe0: added
smc: adding ib device rxe0 with port count 1
smc: ib device rxe0 port 1 has pnetid
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
eth0 speed is unknown, defaulting to 1000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages