[syzbot] [hams?] possible deadlock in nr_rt_ioctl (2)

3 views
Skip to first unread message

syzbot

unread,
Jun 26, 2025, 9:33:33 AMJun 26
to da...@davemloft.net, edum...@google.com, ho...@kernel.org, ku...@kernel.org, linux...@vger.kernel.org, linux-...@vger.kernel.org, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 09a0fa92e5b4 Merge tag 'selinux-pr-20250107' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=122714b0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7bdfbaac3fbb90d6
dashboard link: https://syzkaller.appspot.com/bug?extid=14afda08dc3484d5db82
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17b8db0f980000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-09a0fa92.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/38215ac79538/vmlinux-09a0fa92.xz
kernel image: https://storage.googleapis.com/syzbot-assets/117da94a1c81/bzImage-09a0fa92.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+14afda...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc6-syzkaller-00038-g09a0fa92e5b4 #0 Not tainted
------------------------------------------------------
syz.3.32/6172 is trying to acquire lock:
ffffffff9012a4f8 (nr_neigh_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffffffff9012a4f8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh net/netrom/nr_route.c:307 [inline]
ffffffff9012a4f8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_del_node net/netrom/nr_route.c:342 [inline]
ffffffff9012a4f8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x207f/0x29e0 net/netrom/nr_route.c:678

but task is already holding lock:
ffff88810370fa70 (&nr_node->node_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88810370fa70 (&nr_node->node_lock){+...}-{3:3}, at: nr_node_lock include/net/netrom.h:152 [inline]
ffff88810370fa70 (&nr_node->node_lock){+...}-{3:3}, at: nr_del_node net/netrom/nr_route.c:335 [inline]
ffff88810370fa70 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x2aa/0x29e0 net/netrom/nr_route.c:678

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&nr_node->node_lock){+...}-{3:3}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_node_lock include/net/netrom.h:152 [inline]
nr_rt_device_down+0x188/0x7f0 net/netrom/nr_route.c:519
nr_device_event+0x126/0x170 net/netrom/af_netrom.c:126
notifier_call_chain+0xb7/0x410 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1996
call_netdevice_notifiers_extack net/core/dev.c:2034 [inline]
call_netdevice_notifiers net/core/dev.c:2048 [inline]
__dev_notify_flags+0x1f9/0x2e0 net/core/dev.c:8992
dev_change_flags+0x10c/0x160 net/core/dev.c:9028
dev_ifsioc+0x9c8/0x10b0 net/core/dev_ioctl.c:526
dev_ioctl+0x224/0x10c0 net/core/dev_ioctl.c:783
sock_do_ioctl+0x19e/0x280 net/socket.c:1223
sock_ioctl+0x228/0x6c0 net/socket.c:1328
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (nr_node_list_lock){+...}-{3:3}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_rt_device_down+0xd5/0x7f0 net/netrom/nr_route.c:517
nr_device_event+0x126/0x170 net/netrom/af_netrom.c:126
notifier_call_chain+0xb7/0x410 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1996
call_netdevice_notifiers_extack net/core/dev.c:2034 [inline]
call_netdevice_notifiers net/core/dev.c:2048 [inline]
__dev_notify_flags+0x1f9/0x2e0 net/core/dev.c:8992
dev_change_flags+0x10c/0x160 net/core/dev.c:9028
dev_ifsioc+0x9c8/0x10b0 net/core/dev_ioctl.c:526
dev_ioctl+0x224/0x10c0 net/core/dev_ioctl.c:783
sock_do_ioctl+0x19e/0x280 net/socket.c:1223
sock_ioctl+0x228/0x6c0 net/socket.c:1328
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (nr_neigh_list_lock){+...}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5226
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_remove_neigh net/netrom/nr_route.c:307 [inline]
nr_del_node net/netrom/nr_route.c:342 [inline]
nr_rt_ioctl+0x207f/0x29e0 net/netrom/nr_route.c:678
nr_ioctl+0x19a/0x2e0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x116/0x280 net/socket.c:1209
sock_ioctl+0x228/0x6c0 net/socket.c:1328
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&nr_node->node_lock);
lock(nr_node_list_lock);
lock(&nr_node->node_lock);
lock(nr_neigh_list_lock);

*** DEADLOCK ***

2 locks held by syz.3.32/6172:
#0: ffffffff9012a558 (nr_node_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#0: ffffffff9012a558 (nr_node_list_lock){+...}-{3:3}, at: nr_del_node net/netrom/nr_route.c:334 [inline]
#0: ffffffff9012a558 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x22e/0x29e0 net/netrom/nr_route.c:678
#1: ffff88810370fa70 (&nr_node->node_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#1: ffff88810370fa70 (&nr_node->node_lock){+...}-{3:3}, at: nr_node_lock include/net/netrom.h:152 [inline]
#1: ffff88810370fa70 (&nr_node->node_lock){+...}-{3:3}, at: nr_del_node net/netrom/nr_route.c:335 [inline]
#1: ffff88810370fa70 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x2aa/0x29e0 net/netrom/nr_route.c:678

stack backtrace:
CPU: 3 UID: 0 PID: 6172 Comm: syz.3.32 Not tainted 6.13.0-rc6-syzkaller-00038-g09a0fa92e5b4 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x419/0x5d0 kernel/locking/lockdep.c:2074
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5226
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_remove_neigh net/netrom/nr_route.c:307 [inline]
nr_del_node net/netrom/nr_route.c:342 [inline]
nr_rt_ioctl+0x207f/0x29e0 net/netrom/nr_route.c:678
nr_ioctl+0x19a/0x2e0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x116/0x280 net/socket.c:1209
sock_ioctl+0x228/0x6c0 net/socket.c:1328
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbff7985d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbff8769038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fbff7b75fa0 RCX: 00007fbff7985d29
RDX: 0000000020000180 RSI: 000000000000890c RDI: 0000000000000005
RBP: 00007fbff7a01b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fbff7b75fa0 R15: 00007ffd23708838
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Edward Adam Davis

unread,
Jun 26, 2025, 10:14:03 AMJun 26
to syzbot+14afda...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
#syz test

diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index b94cb2ffbaf8..cf49d5c78805 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -331,7 +331,6 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n
return -EINVAL;
}

- spin_lock_bh(&nr_node_list_lock);
nr_node_lock(nr_node);
for (i = 0; i < nr_node->count; i++) {
if (nr_node->routes[i].neighbour == nr_neigh) {
@@ -360,14 +359,12 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n
nr_node_put(nr_node);
}
nr_node_unlock(nr_node);
- spin_unlock_bh(&nr_node_list_lock);

return 0;
}
}
nr_neigh_put(nr_neigh);
nr_node_unlock(nr_node);
- spin_unlock_bh(&nr_node_list_lock);
nr_node_put(nr_node);

return -EINVAL;

Edward Adam Davis

unread,
Jun 26, 2025, 10:20:47 AMJun 26
to syzbot+14afda...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
#syz test

diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index b94cb2ffbaf8..a9ae329d598e 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -331,7 +331,6 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n
return -EINVAL;
}

- spin_lock_bh(&nr_node_list_lock);
nr_node_lock(nr_node);
for (i = 0; i < nr_node->count; i++) {
if (nr_node->routes[i].neighbour == nr_neigh) {
@@ -345,7 +344,9 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n
nr_node->count--;

if (nr_node->count == 0) {
+ spin_lock_bh(&nr_node_list_lock);
nr_remove_node_locked(nr_node);
+ spin_unlock_bh(&nr_node_list_lock);
} else {
switch (i) {
case 0:
@@ -360,14 +361,12 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n

syzbot

unread,
Jun 26, 2025, 10:28:06 AMJun 26
to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in nr_remove_node_locked

------------[ cut here ]------------
WARNING: CPU: 2 PID: 6679 at net/netrom/nr_route.c:290 nr_remove_node_locked+0x1b3/0x200 net/netrom/nr_route.c:290
Modules linked in:
CPU: 2 UID: 0 PID: 6679 Comm: syz.0.45 Not tainted 6.16.0-rc3-syzkaller-gee88bddf7f2f-dirty #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:nr_remove_node_locked+0x1b3/0x200 net/netrom/nr_route.c:290
Code: be ff ff ff ff 48 c7 c7 58 50 59 90 e8 46 dc 10 01 31 ff 89 c5 89 c6 e8 6b 65 4f f7 85 ed 0f 85 a4 fe ff ff e8 1e 6a 4f f7 90 <0f> 0b 90 e9 96 fe ff ff 48 c7 c7 44 2d a7 90 e8 e9 47 b6 f7 e9 6e
RSP: 0018:ffffc90003b47ab0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888025854f00 RCX: ffffffff8a6cb3d5
RDX: ffff8880442a0000 RSI: ffffffff8a6cb3e2 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff88803c362000 R14: ffff888026762c00 R15: 0000000000000000
FS: 00007f21787756c0(0000) GS:ffff8880d6974000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e55ffff CR3: 000000004f9b7000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
nr_del_node net/netrom/nr_route.c:347 [inline]
nr_rt_ioctl+0x1fc7/0x26f0 net/netrom/nr_route.c:675
nr_ioctl+0x19a/0x2e0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x115/0x280 net/socket.c:1190
sock_ioctl+0x227/0x6b0 net/socket.c:1311
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2177985d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2178775038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2177b75fa0 RCX: 00007f2177985d29
RDX: 0000000020000180 RSI: 000000000000890c RDI: 0000000000000005
RBP: 00007f2177a01b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f2177b75fa0 R15: 00007fff2cb7c2d8
</TASK>


Tested on:

commit: ee88bddf Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=170adb70580000
kernel config: https://syzkaller.appspot.com/x/.config?x=644a0493ff5118b1
dashboard link: https://syzkaller.appspot.com/bug?extid=14afda08dc3484d5db82
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=116bb182580000

syzbot

unread,
Jun 26, 2025, 10:41:06 AMJun 26
to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in nr_rt_device_down

======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc3-syzkaller-gee88bddf7f2f-dirty #0 Not tainted
------------------------------------------------------
syz.1.46/6768 is trying to acquire lock:
ffff888105e21e70 (&nr_node->node_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888105e21e70 (&nr_node->node_lock){+...}-{3:3}, at: nr_node_lock include/net/netrom.h:152 [inline]
ffff888105e21e70 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_device_down+0x18e/0x810 net/netrom/nr_route.c:518

but task is already holding lock:
ffffffff90595058 (nr_node_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffffffff90595058 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xd3/0x810 net/netrom/nr_route.c:516

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (nr_node_list_lock){+...}-{3:3}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_del_node net/netrom/nr_route.c:347 [inline]
nr_rt_ioctl+0x210f/0x29a0 net/netrom/nr_route.c:677
nr_ioctl+0x19a/0x2e0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x115/0x280 net/socket.c:1190
sock_ioctl+0x227/0x6b0 net/socket.c:1311
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&nr_node->node_lock){+...}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3168 [inline]
check_prevs_add kernel/locking/lockdep.c:3287 [inline]
validate_chain kernel/locking/lockdep.c:3911 [inline]
__lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
lock_acquire kernel/locking/lockdep.c:5871 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_node_lock include/net/netrom.h:152 [inline]
nr_rt_device_down+0x18e/0x810 net/netrom/nr_route.c:518
nr_device_event+0x126/0x170 net/netrom/af_netrom.c:126
notifier_call_chain+0xb9/0x410 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230
call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
call_netdevice_notifiers net/core/dev.c:2282 [inline]
__dev_notify_flags+0x1f7/0x2e0 net/core/dev.c:9499
netif_change_flags+0x108/0x160 net/core/dev.c:9526
dev_change_flags+0xba/0x250 net/core/dev_api.c:68
dev_ifsioc+0x1498/0x1f70 net/core/dev_ioctl.c:565
dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:823
sock_do_ioctl+0x19d/0x280 net/socket.c:1204
sock_ioctl+0x227/0x6b0 net/socket.c:1311
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(nr_node_list_lock);
lock(&nr_node->node_lock);
lock(nr_node_list_lock);
lock(&nr_node->node_lock);

*** DEADLOCK ***

3 locks held by syz.1.46/6768:
#0: ffffffff9033f628 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff9033f628 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x212/0x10e0 net/core/dev_ioctl.c:822
#1: ffffffff90594ff8 (nr_neigh_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#1: ffffffff90594ff8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x2c/0x810 net/netrom/nr_route.c:513
#2: ffffffff90595058 (nr_node_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#2: ffffffff90595058 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xd3/0x810 net/netrom/nr_route.c:516

stack backtrace:
CPU: 3 UID: 0 PID: 6768 Comm: syz.1.46 Not tainted 6.16.0-rc3-syzkaller-gee88bddf7f2f-dirty #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x275/0x350 kernel/locking/lockdep.c:2046
check_noncircular+0x14c/0x170 kernel/locking/lockdep.c:2178
check_prev_add kernel/locking/lockdep.c:3168 [inline]
check_prevs_add kernel/locking/lockdep.c:3287 [inline]
validate_chain kernel/locking/lockdep.c:3911 [inline]
__lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
lock_acquire kernel/locking/lockdep.c:5871 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_node_lock include/net/netrom.h:152 [inline]
nr_rt_device_down+0x18e/0x810 net/netrom/nr_route.c:518
nr_device_event+0x126/0x170 net/netrom/af_netrom.c:126
notifier_call_chain+0xb9/0x410 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230
call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
call_netdevice_notifiers net/core/dev.c:2282 [inline]
__dev_notify_flags+0x1f7/0x2e0 net/core/dev.c:9499
netif_change_flags+0x108/0x160 net/core/dev.c:9526
dev_change_flags+0xba/0x250 net/core/dev_api.c:68
dev_ifsioc+0x1498/0x1f70 net/core/dev_ioctl.c:565
dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:823
sock_do_ioctl+0x19d/0x280 net/socket.c:1204
sock_ioctl+0x227/0x6b0 net/socket.c:1311
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6abb785d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6abc617038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6abb975fa0 RCX: 00007f6abb785d29
RDX: 0000000020000000 RSI: 0000000000008914 RDI: 0000000000000006
RBP: 00007f6abb801b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f6abb975fa0 R15: 00007ffc3bc2e9c8
</TASK>


Tested on:

commit: ee88bddf Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1007b182580000
kernel config: https://syzkaller.appspot.com/x/.config?x=644a0493ff5118b1
dashboard link: https://syzkaller.appspot.com/bug?extid=14afda08dc3484d5db82
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=14217dd4580000

Hillf Danton

unread,
Jun 26, 2025, 5:49:20 PMJun 26
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
> Date: Thu, 26 Jun 2025 06:33:30 -0700
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 09a0fa92e5b4 Merge tag 'selinux-pr-20250107' of git://git...
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=122714b0580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=7bdfbaac3fbb90d6
> dashboard link: https://syzkaller.appspot.com/bug?extid=14afda08dc3484d5db82
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17b8db0f980000

#syz test

--- x/net/netrom/nr_route.c
+++ y/net/netrom/nr_route.c
@@ -331,6 +331,7 @@ static int nr_del_node(ax25_address *cal
return -EINVAL;
}

+ spin_lock_bh(&nr_neigh_list_lock);
spin_lock_bh(&nr_node_list_lock);
nr_node_lock(nr_node);
for (i = 0; i < nr_node->count; i++) {
@@ -339,7 +340,7 @@ static int nr_del_node(ax25_address *cal
nr_neigh_put(nr_neigh);

if (nr_neigh->count == 0 && !nr_neigh->locked)
- nr_remove_neigh(nr_neigh);
+ __nr_remove_neigh(nr_neigh);
nr_neigh_put(nr_neigh);

nr_node->count--;
@@ -361,6 +362,7 @@ static int nr_del_node(ax25_address *cal
}
nr_node_unlock(nr_node);
spin_unlock_bh(&nr_node_list_lock);
+ spin_unlock_bh(&nr_neigh_list_lock);

return 0;
}
@@ -368,6 +370,7 @@ static int nr_del_node(ax25_address *cal
nr_neigh_put(nr_neigh);
nr_node_unlock(nr_node);
spin_unlock_bh(&nr_node_list_lock);
+ spin_unlock_bh(&nr_neigh_list_lock);
nr_node_put(nr_node);

return -EINVAL;
--

syzbot

unread,
Jun 26, 2025, 6:09:04 PMJun 26
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+14afda...@syzkaller.appspotmail.com
Tested-by: syzbot+14afda...@syzkaller.appspotmail.com

Tested on:

commit: f02769e7 Merge tag 'devicetree-fixes-for-6.16-1' of gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14217182580000
kernel config: https://syzkaller.appspot.com/x/.config?x=644a0493ff5118b1
dashboard link: https://syzkaller.appspot.com/bug?extid=14afda08dc3484d5db82
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=127e7182580000

Note: testing is done by a robot and is best-effort only.

syzbot

unread,
4:45 AM (5 hours ago) 4:45 AM
to da...@davemloft.net, ead...@qq.com, edum...@google.com, hda...@sina.com, ho...@kernel.org, ku...@kernel.org, linux...@vger.kernel.org, linux-...@vger.kernel.org, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: dc77806cf3b4 Merge tag 'rust-fixes-6.18' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14c0e114580000
kernel config: https://syzkaller.appspot.com/x/.config?x=609c87dcb0628493
dashboard link: https://syzkaller.appspot.com/bug?extid=14afda08dc3484d5db82
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17feb812580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15fb5812580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-dc77806c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/eef2d5e8c3fb/vmlinux-dc77806c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e6323f5f18c6/bzImage-dc77806c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+14afda...@syzkaller.appspotmail.com

bond0: (slave rose0): Error: Device is in use and cannot be enslaved
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.18/6086 is trying to acquire lock:
ffffffff9033ef98 (nr_neigh_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffffffff9033ef98 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh net/netrom/nr_route.c:307 [inline]
ffffffff9033ef98 (nr_neigh_list_lock){+...}-{3:3}, at: nr_del_node net/netrom/nr_route.c:342 [inline]
ffffffff9033ef98 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x2007/0x29b0 net/netrom/nr_route.c:678

but task is already holding lock:
ffff88802acfc870 (&nr_node->node_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88802acfc870 (&nr_node->node_lock){+...}-{3:3}, at: nr_node_lock include/net/netrom.h:152 [inline]
ffff88802acfc870 (&nr_node->node_lock){+...}-{3:3}, at: nr_del_node net/netrom/nr_route.c:335 [inline]
ffff88802acfc870 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x29d/0x29b0 net/netrom/nr_route.c:678

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&nr_node->node_lock){+...}-{3:3}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_node_lock include/net/netrom.h:152 [inline]
nr_del_node net/netrom/nr_route.c:335 [inline]
nr_rt_ioctl+0x29d/0x29b0 net/netrom/nr_route.c:678
nr_ioctl+0x19a/0x2d0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x118/0x280 net/socket.c:1254
sock_ioctl+0x227/0x6b0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (nr_node_list_lock){+...}-{3:3}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_rt_device_down+0xd3/0x810 net/netrom/nr_route.c:517
nr_device_event+0x126/0x170 net/netrom/af_netrom.c:126
notifier_call_chain+0xbc/0x410 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2229
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
netif_close_many+0x319/0x630 net/core/dev.c:1784
netif_close net/core/dev.c:1797 [inline]
netif_close+0x17f/0x230 net/core/dev.c:1791
dev_close+0xaa/0x240 net/core/dev_api.c:220
bpq_device_event+0x6a9/0x910 drivers/net/hamradio/bpqether.c:528
notifier_call_chain+0xbc/0x410 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2229
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
netif_close_many+0x319/0x630 net/core/dev.c:1784
netif_close net/core/dev.c:1797 [inline]
netif_close+0x17f/0x230 net/core/dev.c:1791
dev_close+0xaa/0x240 net/core/dev_api.c:220
bond_setup_by_slave drivers/net/bonding/bond_main.c:1567 [inline]
bond_enslave+0x1e42/0x5de0 drivers/net/bonding/bond_main.c:1972
bond_do_ioctl+0x601/0x6c0 drivers/net/bonding/bond_main.c:4615
dev_siocbond net/core/dev_ioctl.c:516 [inline]
dev_ifsioc+0xe9c/0x1f70 net/core/dev_ioctl.c:666
dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:838
sock_do_ioctl+0x19d/0x280 net/socket.c:1268
sock_ioctl+0x227/0x6b0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (nr_neigh_list_lock){+...}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_remove_neigh net/netrom/nr_route.c:307 [inline]
nr_del_node net/netrom/nr_route.c:342 [inline]
nr_rt_ioctl+0x2007/0x29b0 net/netrom/nr_route.c:678
nr_ioctl+0x19a/0x2d0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x118/0x280 net/socket.c:1254
sock_ioctl+0x227/0x6b0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&nr_node->node_lock);
lock(nr_node_list_lock);
lock(&nr_node->node_lock);
lock(nr_neigh_list_lock);

*** DEADLOCK ***

2 locks held by syz.0.18/6086:
#0: ffffffff9033eff8 (nr_node_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#0: ffffffff9033eff8 (nr_node_list_lock){+...}-{3:3}, at: nr_del_node net/netrom/nr_route.c:334 [inline]
#0: ffffffff9033eff8 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x221/0x29b0 net/netrom/nr_route.c:678
#1: ffff88802acfc870 (&nr_node->node_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#1: ffff88802acfc870 (&nr_node->node_lock){+...}-{3:3}, at: nr_node_lock include/net/netrom.h:152 [inline]
#1: ffff88802acfc870 (&nr_node->node_lock){+...}-{3:3}, at: nr_del_node net/netrom/nr_route.c:335 [inline]
#1: ffff88802acfc870 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x29d/0x29b0 net/netrom/nr_route.c:678

stack backtrace:
CPU: 3 UID: 0 PID: 6086 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x275/0x350 kernel/locking/lockdep.c:2043
check_noncircular+0x14c/0x170 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_remove_neigh net/netrom/nr_route.c:307 [inline]
nr_del_node net/netrom/nr_route.c:342 [inline]
nr_rt_ioctl+0x2007/0x29b0 net/netrom/nr_route.c:678
nr_ioctl+0x19a/0x2d0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x118/0x280 net/socket.c:1254
sock_ioctl+0x227/0x6b0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5a58b8f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff0134ba58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5a58de5fa0 RCX: 00007f5a58b8f6c9
RDX: 0000200000000680 RSI: 000000000000890c RDI: 000000000000000a
RBP: 00007f5a58c11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5a58de5fa0 R14: 00007f5a58de5fa0 R15: 0000000000000003
</TASK>


---
Reply all
Reply to author
Forward
0 new messages