| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <0000000000000b8884060a59ba9b@google.com>
Date: Fri, 17 Nov 2023 06:12:29 -0800
From: syzbot <syzbot+db9ad150a8969744d703@...kaller.appspotmail.com>
To: andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
daniel@...earbox.net, haoluo@...gle.com, john.fastabend@...il.com,
jolsa@...nel.org, kpsingh@...nel.org, linux-kernel@...r.kernel.org,
linux-trace-kernel@...r.kernel.org, martin.lau@...ux.dev,
mhiramat@...nel.org, rostedt@...dmis.org, sdf@...gle.com,
song@...nel.org, syzkaller-bugs@...glegroups.com,
yonghong.song@...ux.dev
Subject: [syzbot] [bpf?] [trace?] possible deadlock in dev_watchdog
Hello,
syzbot found the following issue on:
HEAD commit: eff99d8edbed Add linux-next specific files for 20231117
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1155289f680000
kernel config: https://syzkaller.appspot.com/x/.config?x=61991b2630c19677
dashboard link: https://syzkaller.appspot.com/bug?extid=db9ad150a8969744d703
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/727bd99b8512/disk-eff99d8e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4a535e264e50/vmlinux-eff99d8e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/23c31e53f4d8/bzImage-eff99d8e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+db9ad150a8969744d703@...kaller.appspotmail.com
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
6.7.0-rc1-next-20231117-syzkaller #0 Not tainted
-----------------------------------------------------
syz-executor.3/8448 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire:
ffff888031a44a18 (&sighand->siglock){+.+.}-{2:2}, at: __lock_task_sighand+0xc2/0x340 kernel/signal.c:1422
and this task is already holding:
ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4381 [inline]
ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: __dev_direct_xmit+0x431/0x730 net/core/dev.c:4400
which would create a new lock dependency:
(_xmit_NONE#2){+...}-{2:2} -> (&sighand->siglock){+.+.}-{2:2}
but this new dependency connects a SOFTIRQ-irq-safe lock:
(&dev->tx_global_lock){+.-.}-{2:2}
... which became SOFTIRQ-irq-safe at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
dev_watchdog+0x7f/0x8b0 net/sched/sch_generic.c:500
call_timer_fn+0x1a0/0x5a0 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x769/0xb20 kernel/time/timer.c:2022
run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035
__do_softirq+0x216/0x8d5 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu kernel/softirq.c:632 [inline]
irq_exit_rcu+0xb5/0x120 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline]
acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:112
acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:707
cpuidle_enter_state+0x83/0x500 drivers/cpuidle/cpuidle.c:267
cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:388
cpuidle_idle_call kernel/sched/idle.c:215 [inline]
do_idle+0x314/0x3f0 kernel/sched/idle.c:312
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:410
rest_init+0x16f/0x2b0 init/main.c:730
arch_call_rest_init+0x13/0x30 init/main.c:827
start_kernel+0x39e/0x480 init/main.c:1072
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:555
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:536
secondary_startup_64_no_verify+0x166/0x16b
to a SOFTIRQ-irq-unsafe lock:
(&sighand->siglock){+.+.}-{2:2}
... which became SOFTIRQ-irq-unsafe at:
...
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
class_spinlock_constructor include/linux/spinlock.h:530 [inline]
ptrace_set_stopped kernel/ptrace.c:391 [inline]
ptrace_attach+0x401/0x650 kernel/ptrace.c:478
__do_sys_ptrace+0x204/0x230 kernel/ptrace.c:1290
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a
other info that might help us debug this:
Chain exists of:
&dev->tx_global_lock --> _xmit_NONE#2 --> &sighand->siglock
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sighand->siglock);
local_irq_disable();
lock(&dev->tx_global_lock);
lock(_xmit_NONE#2);
<Interrupt>
lock(&dev->tx_global_lock);
*** DEADLOCK ***
3 locks held by syz-executor.3/8448:
#0: ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#0: ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4381 [inline]
#0: ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: __dev_direct_xmit+0x431/0x730 net/core/dev.c:4400
#1: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline]
#1: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline]
#1: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2310 [inline]
#1: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xe4/0x410 kernel/trace/bpf_trace.c:2350
#2: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline]
#2: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline]
#2: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: __lock_task_sighand+0x3f/0x340 kernel/signal.c:1405
the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
-> (&dev->tx_global_lock){+.-.}-{2:2} {
HARDIRQ-ON-W at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
netif_tx_lock net/sched/sch_generic.c:467 [inline]
netif_tx_lock_bh include/linux/netdevice.h:4465 [inline]
dev_watchdog_down net/sched/sch_generic.c:564 [inline]
dev_deactivate_many+0x1c6/0xb30 net/sched/sch_generic.c:1350
dev_deactivate+0xed/0x1b0 net/sched/sch_generic.c:1384
linkwatch_do_dev+0x115/0x150 net/core/link_watch.c:180
__linkwatch_run_queue+0x233/0x680 net/core/link_watch.c:235
linkwatch_event+0x8f/0xc0 net/core/link_watch.c:278
process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2636
process_scheduled_works kernel/workqueue.c:2709 [inline]
worker_thread+0x8b6/0x1290 kernel/workqueue.c:2790
kthread+0x2c1/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
IN-SOFTIRQ-W at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
dev_watchdog+0x7f/0x8b0 net/sched/sch_generic.c:500
call_timer_fn+0x1a0/0x5a0 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x769/0xb20 kernel/time/timer.c:2022
run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035
__do_softirq+0x216/0x8d5 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu kernel/softirq.c:632 [inline]
irq_exit_rcu+0xb5/0x120 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline]
acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:112
acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:707
cpuidle_enter_state+0x83/0x500 drivers/cpuidle/cpuidle.c:267
cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:388
cpuidle_idle_call kernel/sched/idle.c:215 [inline]
do_idle+0x314/0x3f0 kernel/sched/idle.c:312
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:410
rest_init+0x16f/0x2b0 init/main.c:730
arch_call_rest_init+0x13/0x30 init/main.c:827
start_kernel+0x39e/0x480 init/main.c:1072
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:555
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:536
secondary_startup_64_no_verify+0x166/0x16b
INITIAL USE at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
netif_tx_lock net/sched/sch_generic.c:467 [inline]
netif_tx_lock_bh include/linux/netdevice.h:4465 [inline]
dev_watchdog_down net/sched/sch_generic.c:564 [inline]
dev_deactivate_many+0x1c6/0xb30 net/sched/sch_generic.c:1350
dev_deactivate+0xed/0x1b0 net/sched/sch_generic.c:1384
linkwatch_do_dev+0x115/0x150 net/core/link_watch.c:180
__linkwatch_run_queue+0x233/0x680 net/core/link_watch.c:235
linkwatch_event+0x8f/0xc0 net/core/link_watch.c:278
process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2636
process_scheduled_works kernel/workqueue.c:2709 [inline]
worker_thread+0x8b6/0x1290 kernel/workqueue.c:2790
kthread+0x2c1/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
}
... key at: [<ffffffff92b3a960>] __key.7+0x0/0x40
-> (_xmit_NONE#2){+...}-{2:2} {
HARDIRQ-ON-W at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
__netif_tx_lock include/linux/netdevice.h:4381 [inline]
netif_freeze_queues+0xdd/0x1e0 net/sched/sch_generic.c:459
netif_tx_lock net/sched/sch_generic.c:468 [inline]
netif_tx_lock_bh include/linux/netdevice.h:4465 [inline]
dev_watchdog_down net/sched/sch_generic.c:564 [inline]
dev_deactivate_many+0x1ce/0xb30 net/sched/sch_generic.c:1350
__dev_close_many+0x133/0x2f0 net/core/dev.c:1518
__dev_close net/core/dev.c:1543 [inline]
__dev_change_flags+0x4e5/0x730 net/core/dev.c:8603
dev_change_flags+0x9a/0x170 net/core/dev.c:8677
do_setlink+0x1a2f/0x3fa0 net/core/rtnetlink.c:2916
rtnl_group_changelink net/core/rtnetlink.c:3458 [inline]
__rtnl_newlink+0xded/0x1930 net/core/rtnetlink.c:3717
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3754
rtnetlink_rcv_msg+0x3c7/0xe00 net/core/rtnetlink.c:6558
netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x939/0xe40 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
__sys_sendmsg+0x117/0x1e0 net/socket.c:2667
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a
INITIAL USE at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
__netif_tx_lock include/linux/netdevice.h:4381 [inline]
netif_freeze_queues+0xdd/0x1e0 net/sched/sch_generic.c:459
netif_tx_lock net/sched/sch_generic.c:468 [inline]
netif_tx_lock_bh include/linux/netdevice.h:4465 [inline]
dev_watchdog_down net/sched/sch_generic.c:564 [inline]
dev_deactivate_many+0x1ce/0xb30 net/sched/sch_generic.c:1350
__dev_close_many+0x133/0x2f0 net/core/dev.c:1518
__dev_close net/core/dev.c:1543 [inline]
__dev_change_flags+0x4e5/0x730 net/core/dev.c:8603
dev_change_flags+0x9a/0x170 net/core/dev.c:8677
do_setlink+0x1a2f/0x3fa0 net/core/rtnetlink.c:2916
rtnl_group_changelink net/core/rtnetlink.c:3458 [inline]
__rtnl_newlink+0xded/0x1930 net/core/rtnetlink.c:3717
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3754
rtnetlink_rcv_msg+0x3c7/0xe00 net/core/rtnetlink.c:6558
netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x939/0xe40 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
__sys_sendmsg+0x117/0x1e0 net/socket.c:2667
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a
}
... key at: [<ffffffff92b3b360>] netdev_xmit_lock_key+0x380/0x3c0
... acquired at:
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
__netif_tx_lock include/linux/netdevice.h:4381 [inline]
netif_freeze_queues+0xdd/0x1e0 net/sched/sch_generic.c:459
netif_tx_lock net/sched/sch_generic.c:468 [inline]
netif_tx_lock_bh include/linux/netdevice.h:4465 [inline]
dev_watchdog_down net/sched/sch_generic.c:564 [inline]
dev_deactivate_many+0x1ce/0xb30 net/sched/sch_generic.c:1350
__dev_close_many+0x133/0x2f0 net/core/dev.c:1518
__dev_close net/core/dev.c:1543 [inline]
__dev_change_flags+0x4e5/0x730 net/core/dev.c:8603
dev_change_flags+0x9a/0x170 net/core/dev.c:8677
do_setlink+0x1a2f/0x3fa0 net/core/rtnetlink.c:2916
rtnl_group_changelink net/core/rtnetlink.c:3458 [inline]
__rtnl_newlink+0xded/0x1930 net/core/rtnetlink.c:3717
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3754
rtnetlink_rcv_msg+0x3c7/0xe00 net/core/rtnetlink.c:6558
netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x939/0xe40 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
__sys_sendmsg+0x117/0x1e0 net/socket.c:2667
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a
the dependencies between the lock to be acquired
and SOFTIRQ-irq-unsafe lock:
-> (&sighand->siglock){+.+.}-{2:2} {
HARDIRQ-ON-W at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
class_spinlock_constructor include/linux/spinlock.h:530 [inline]
ptrace_set_stopped kernel/ptrace.c:391 [inline]
ptrace_attach+0x401/0x650 kernel/ptrace.c:478
__do_sys_ptrace+0x204/0x230 kernel/ptrace.c:1290
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a
SOFTIRQ-ON-W at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
class_spinlock_constructor include/linux/spinlock.h:530 [inline]
ptrace_set_stopped kernel/ptrace.c:391 [inline]
ptrace_attach+0x401/0x650 kernel/ptrace.c:478
__do_sys_ptrace+0x204/0x230 kernel/ptrace.c:1290
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a
INITIAL USE at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
_raw_spin_lock_irq+0x36/0x50 kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:376 [inline]
calculate_sigpending+0x44/0xa0 kernel/signal.c:197
ret_from_fork+0x23/0x80 arch/x86/kernel/process.c:143
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
}
... key at: [<ffffffff90b4af80>] __key.341+0x0/0x40
... acquired at:
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162
__lock_task_sighand+0xc2/0x340 kernel/signal.c:1422
lock_task_sighand include/linux/sched/signal.h:748 [inline]
do_send_sig_info kernel/signal.c:1309 [inline]
group_send_sig_info+0x288/0x300 kernel/signal.c:1460
bpf_send_signal_common+0x2e4/0x3a0 kernel/trace/bpf_trace.c:877
____bpf_send_signal kernel/trace/bpf_trace.c:882 [inline]
bpf_send_signal+0x19/0x20 kernel/trace/bpf_trace.c:880
bpf_prog_a7bf4e27797d188e+0x22/0x24
bpf_dispatcher_nop_func include/linux/bpf.h:1196 [inline]
__bpf_prog_run include/linux/filter.h:651 [inline]
bpf_prog_run include/linux/filter.h:658 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2311 [inline]
bpf_trace_run2+0x14e/0x410 kernel/trace/bpf_trace.c:2350
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0xf6/0x150 mm/slab_common.c:1043
skb_kfree_head net/core/skbuff.c:950 [inline]
skb_free_head+0x110/0x1b0 net/core/skbuff.c:962
skb_release_data+0x5ba/0x870 net/core/skbuff.c:992
skb_release_all net/core/skbuff.c:1058 [inline]
__kfree_skb net/core/skbuff.c:1072 [inline]
kfree_skb_reason+0x12d/0x210 net/core/skbuff.c:1108
kfree_skb include/linux/skbuff.h:1234 [inline]
can_dropped_invalid_skb+0x9e/0x7c0 drivers/net/can/dev/skb.c:370
vcan_tx+0x77/0xa90 drivers/net/can/vcan.c:92
__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
netdev_start_xmit include/linux/netdevice.h:4932 [inline]
__dev_direct_xmit+0x59a/0x730 net/core/dev.c:4402
dev_direct_xmit include/linux/netdevice.h:3125 [inline]
packet_xmit+0x201/0x380 net/packet/af_packet.c:285
packet_snd net/packet/af_packet.c:3087 [inline]
packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
__sys_sendto+0x255/0x340 net/socket.c:2190
__do_sys_sendto net/socket.c:2202 [inline]
__se_sys_sendto net/socket.c:2198 [inline]
__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a
stack backtrace:
CPU: 1 PID: 8448 Comm: syz-executor.3 Not tainted 6.7.0-rc1-next-20231117-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline]
check_irq_usage+0xe18/0x1470 kernel/locking/lockdep.c:2865
check_prev_add kernel/locking/lockdep.c:3138 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x247c/0x3b10 kernel/locking/lockdep.c:5136
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162
__lock_task_sighand+0xc2/0x340 kernel/signal.c:1422
lock_task_sighand include/linux/sched/signal.h:748 [inline]
do_send_sig_info kernel/signal.c:1309 [inline]
group_send_sig_info+0x288/0x300 kernel/signal.c:1460
bpf_send_signal_common+0x2e4/0x3a0 kernel/trace/bpf_trace.c:877
____bpf_send_signal kernel/trace/bpf_trace.c:882 [inline]
bpf_send_signal+0x19/0x20 kernel/trace/bpf_trace.c:880
bpf_prog_a7bf4e27797d188e+0x22/0x24
bpf_dispatcher_nop_func include/linux/bpf.h:1196 [inline]
__bpf_prog_run include/linux/filter.h:651 [inline]
bpf_prog_run include/linux/filter.h:658 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2311 [inline]
bpf_trace_run2+0x14e/0x410 kernel/trace/bpf_trace.c:2350
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0xf6/0x150 mm/slab_common.c:1043
skb_kfree_head net/core/skbuff.c:950 [inline]
skb_free_head+0x110/0x1b0 net/core/skbuff.c:962
skb_release_data+0x5ba/0x870 net/core/skbuff.c:992
skb_release_all net/core/skbuff.c:1058 [inline]
__kfree_skb net/core/skbuff.c:1072 [inline]
kfree_skb_reason+0x12d/0x210 net/core/skbuff.c:1108
kfree_skb include/linux/skbuff.h:1234 [inline]
can_dropped_invalid_skb+0x9e/0x7c0 drivers/net/can/dev/skb.c:370
vcan_tx+0x77/0xa90 drivers/net/can/vcan.c:92
__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
netdev_start_xmit include/linux/netdevice.h:4932 [inline]
__dev_direct_xmit+0x59a/0x730 net/core/dev.c:4402
dev_direct_xmit include/linux/netdevice.h:3125 [inline]
packet_xmit+0x201/0x380 net/packet/af_packet.c:285
packet_snd net/packet/af_packet.c:3087 [inline]
packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
__sys_sendto+0x255/0x340 net/socket.c:2190
__do_sys_sendto net/socket.c:2202 [inline]
__se_sys_sendto net/socket.c:2198 [inline]
__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a
RIP: 0033:0x7f36a647cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f36a71eb0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f36a659bf80 RCX: 00007f36a647cae9
RDX: 000000000000fc13 RSI: 0000000020000280 RDI: 0000000000000003
RBP: 00007f36a64c847a R08: 0000000000000000 R09: 000000000000002f
R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f36a659bf80 R15: 00007fff7fb05d78
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Powered by blists - more mailing lists