Message-ID: <67922bbf.050a0220.2eae65.0004.GAE@google.com>
Date: Thu, 23 Jan 2025 03:45:03 -0800
From: syzbot <syzbot+83976e47ec1ef91e66f1@...kaller.appspotmail.com>
To: hdanton@...a.com, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [usb?] general protection fault in status_show

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

slave bond_slave_0): Enslaving as an active interface with an up link
[   77.012704][ T5924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   77.039135][ T5924] team0: Port device team_slave_0 added
[   77.046395][ T5924] team0: Port device team_slave_1 added
[   77.067282][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_0
[   77.074614][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   77.101175][ T5924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   77.114964][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_1
[   77.122115][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   77.148711][ T5924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   77.184083][ T5924] hsr_slave_0: entered promiscuous mode
[   77.190764][ T5924] hsr_slave_1: entered promiscuous mode
[   77.196800][ T5924] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   77.204798][ T5924] Cannot create hsr debugfs directory
[   78.828818][ T5146] Bluetooth: hci0: command tx timeout
[   79.385430][  T768] bridge_slave_1: left allmulticast mode
[   79.392966][  T768] bridge_slave_1: left promiscuous mode
[   79.399801][  T768] bridge0: port 2(bridge_slave_1) entered disabled state
[   79.414825][  T768] bridge_slave_0: left allmulticast mode
[   79.420618][  T768] bridge_slave_0: left promiscuous mode
[   79.426300][  T768] bridge0: port 1(bridge_slave_0) entered disabled state
[   79.729628][  T768] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   79.742640][  T768] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   79.753017][  T768] bond0 (unregistering): Released all slaves
[   79.892147][  T768] hsr_slave_0: left promiscuous mode
[   79.899634][  T768] hsr_slave_1: left promiscuous mode
[   79.905619][  T768] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   79.913870][  T768] batman_adv: batadv0: Removing interface: batadv_slave_0
[   79.922730][  T768] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   79.934653][  T768] batman_adv: batadv0: Removing interface: batadv_slave_1
[   79.952787][  T768] veth1_macvtap: left promiscuous mode
[   79.959105][  T768] veth0_macvtap: left promiscuous mode
[   79.964762][  T768] veth1_vlan: left promiscuous mode
[   79.970637][  T768] veth0_vlan: left promiscuous mode
[   80.369761][  T768] team0 (unregistering): Port device team_slave_1 removed
[   80.404676][  T768] team0 (unregistering): Port device team_slave_0 removed
[   80.813050][ T5924] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   80.846314][ T5924] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   80.867147][ T5924] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   80.877104][ T5924] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   80.910976][ T5146] Bluetooth: hci0: command tx timeout
[   81.003190][ T5924] 8021q: adding VLAN 0 to HW filter on device bond0
[   81.037204][ T5924] 8021q: adding VLAN 0 to HW filter on device team0
[   81.059292][   T11] bridge0: port 1(bridge_slave_0) entered blocking state
[   81.066421][   T11] bridge0: port 1(bridge_slave_0) entered forwarding state
[   81.083510][ T3581] bridge0: port 2(bridge_slave_1) entered blocking state
[   81.090678][ T3581] bridge0: port 2(bridge_slave_1) entered forwarding state
[   81.292195][  T768] 
[   81.294581][  T768] ======================================================
[   81.301707][  T768] WARNING: possible circular locking dependency detected
[   81.308856][  T768] 6.13.0-syzkaller-g21266b8df522-dirty #0 Not tainted
[   81.315640][  T768] ------------------------------------------------------
[   81.322674][  T768] kworker/u8:5/768 is trying to acquire lock:
[   81.328756][  T768] ffffffff8fed5628 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1a51/0x21a0
[   81.339251][  T768] 
[   81.339251][  T768] but task is already holding lock:
[   81.339480][ T5924] 8021q: adding VLAN 0 to HW filter on device batadv0
[   81.346611][  T768] ffff888071950768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf1/0x720
[   81.363937][  T768] 
[   81.363937][  T768] which lock already depends on the new lock.
[   81.363937][  T768] 
[   81.374536][  T768] 
[   81.374536][  T768] the existing dependency chain (in reverse order) is:
[   81.376998][ T5924] veth0_vlan: entered promiscuous mode
[   81.383716][  T768] 
[   81.383716][  T768] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}:
[   81.383747][  T768]        __mutex_lock+0x19b/0xb10
[   81.383769][  T768]        wiphy_register+0x1c6b/0x2860
[   81.394705][ T5924] veth1_vlan: entered promiscuous mode
[   81.396991][  T768]        ieee80211_register_hw+0x23ff/0x3ff0
[   81.418951][  T768]        mac80211_hwsim_new_radio+0x2c47/0x56c0
[   81.419880][ T5924] veth0_macvtap: entered promiscuous mode
[   81.425209][  T768]        init_mac80211_hwsim+0x432/0x8c0
[   81.433965][ T5924] veth1_macvtap: entered promiscuous mode
[   81.436970][  T768]        do_one_initcall+0x128/0x630
[   81.447996][  T768]        kernel_init_freeable+0x58f/0x8b0
[   81.452139][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_0
[   81.453824][  T768]        kernel_init+0x1c/0x2b0
[   81.465598][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_1
[   81.465866][  T768]        ret_from_fork+0x45/0x80
[   81.477299][ T5924] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   81.477980][  T768]        ret_from_fork_asm+0x1a/0x30
[   81.478015][  T768] 
[   81.478015][  T768] -> #0 (rtnl_mutex
[   81.486868][ T5924] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   81.491954][  T768] ){+.+.}-{4:4}:
[   81.491975][  T768]        __lock_acquire+0x249e/0x3c40
[   81.491998][  T768]        lock_acquire.part.0+0x11b/0x380
[   81.492015][  T768]        __mutex_lock+0x19b/0xb10
[   81.492032][  T768]        unregister_netdevice_many_notify+0x1a51/0x21a0
[   81.492056][  T768]        unregister_netdevice_queue+0x307/0x3f0
[   81.492079][  T768]        _cfg80211_unregister_wdev+0x64b/0x830
[   81.492106][  T768]        ieee80211_remove_interfaces+0x34f/0x720
[   81.500780][ T5924] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   81.506721][  T768]        ieee80211_unregister_hw+0x55/0x3a0
[   81.510591][ T5924] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   81.515698][  T768]        mac80211_hwsim_del_radio+0x268/0x370
[   81.581363][  T768]        hwsim_exit_net+0x33f/0x6d0
[   81.586575][  T768]        ops_exit_list+0xb0/0x180
[   81.591689][  T768]        cleanup_net+0x5c6/0xbf0
[   81.596654][  T768]        process_one_work+0x958/0x1b30
[   81.602212][  T768]        worker_thread+0x6c8/0xf00
[   81.607334][  T768]        kthread+0x3af/0x750
[   81.611929][  T768]        ret_from_fork+0x45/0x80
[   81.616869][  T768]        ret_from_fork_asm+0x1a/0x30
[   81.622168][  T768] 
[   81.622168][  T768] other info that might help us debug this:
[   81.622168][  T768] 
[   81.632518][  T768]  Possible unsafe locking scenario:
[   81.632518][  T768] 
[   81.639986][  T768]        CPU0                    CPU1
[   81.645346][  T768]        ----                    ----
[   81.650747][  T768]   lock(&rdev->wiphy.mtx);
[   81.655351][  T768]                                lock(rtnl_mutex);
[   81.662043][  T768]                                lock(&rdev->wiphy.mtx);
[   81.669183][  T768]   lock(rtnl_mutex);
[   81.673173][  T768] 
[   81.673173][  T768]  *** DEADLOCK ***
[   81.673173][  T768] 
[   81.681394][  T768] 4 locks held by kworker/u8:5/768:
[   81.686582][  T768]  #0: ffff88801bef5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30
[   81.696991][  T768]  #1: ffffc900034b7d18 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30
[   81.706948][  T768]  #2: ffffffff8febf610 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xca/0xbf0
[   81.716358][  T768]  #3: ffff888071950768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf1/0x720
[   81.727169][  T768] 
[   81.727169][  T768] stack backtrace:
[   81.733068][  T768] CPU: 1 UID: 0 PID: 768 Comm: kworker/u8:5 Not tainted 6.13.0-syzkaller-g21266b8df522-dirty #0
[   81.733091][  T768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[   81.733106][  T768] Workqueue: netns cleanup_net
[   81.733138][  T768] Call Trace:
[   81.733144][  T768]  <TASK>
[   81.733152][  T768]  dump_stack_lvl+0x116/0x1f0
[   81.733185][  T768]  print_circular_bug+0x490/0x760
[   81.733216][  T768]  check_noncircular+0x31a/0x400
[   81.733243][  T768]  ? __pfx_check_noncircular+0x10/0x10
[   81.733272][  T768]  ? lockdep_lock+0x1b8/0x200
[   81.733295][  T768]  ? __pfx_lockdep_lock+0x10/0x10
[   81.733317][  T768]  ? lockdep_hardirqs_on+0x7c/0x110
[   81.733344][  T768]  __lock_acquire+0x249e/0x3c40
[   81.733365][  T768]  ? __pfx___lock_acquire+0x10/0x10
[   81.733382][  T768]  ? synchronize_rcu_expedited+0x426/0x450
[   81.733400][  T768]  ? __pfx_lock_release+0x10/0x10
[   81.733418][  T768]  lock_acquire.part.0+0x11b/0x380
[   81.733435][  T768]  ? unregister_netdevice_many_notify+0x1a51/0x21a0
[   81.733457][  T768]  ? __pfx_lock_acquire.part.0+0x10/0x10
[   81.733475][  T768]  ? rcu_is_watching+0x12/0xc0
[   81.733497][  T768]  ? trace_lock_acquire+0x14e/0x1f0
[   81.733520][  T768]  ? unregister_netdevice_many_notify+0x1a51/0x21a0
[   81.733541][  T768]  ? lock_acquire+0x2f/0xb0
[   81.733556][  T768]  ? unregister_netdevice_many_notify+0x1a51/0x21a0
[   81.733577][  T768]  __mutex_lock+0x19b/0xb10
[   81.733604][  T768]  ? unregister_netdevice_many_notify+0x1a51/0x21a0
[   81.733625][  T768]  ? unregister_netdevice_many_notify+0x1a51/0x21a0
[   81.733646][  T768]  ? __pfx___mutex_lock+0x10/0x10
[   81.733662][  T768]  ? __pfx_synchronize_rcu_expedited+0x10/0x10
[   81.733683][  T768]  ? __pfx_wait_rcu_exp_gp+0x10/0x10
[   81.733700][  T768]  ? __pfx___might_resched+0x10/0x10
[   81.733718][  T768]  ? unregister_netdevice_many_notify+0x959/0x21a0
[   81.733740][  T768]  ? unregister_netdevice_many_notify+0x1a51/0x21a0
[   81.733759][  T768]  ? rtnl_lock+0x9/0x20
[   81.733778][  T768]  unregister_netdevice_many_notify+0x1a51/0x21a0
[   81.733802][  T768]  ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[   81.733824][  T768]  ? find_held_lock+0x2d/0x110
[   81.733848][  T768]  ? kernfs_remove_by_name_ns+0xc4/0x130
[   81.733873][  T768]  ? __pfx_lock_release+0x10/0x10
[   81.733889][  T768]  ? __call_rcu_common.constprop.0+0x3ea/0x870
[   81.733911][  T768]  unregister_netdevice_queue+0x307/0x3f0
[   81.733931][  T768]  ? __pfx_unregister_netdevice_queue+0x10/0x10
[   81.733954][  T768]  _cfg80211_unregister_wdev+0x64b/0x830
[   81.733980][  T768]  ieee80211_remove_interfaces+0x34f/0x720
[   81.734010][  T768]  ? __pfx_ieee80211_remove_interfaces+0x10/0x10
[   81.734041][  T768]  ieee80211_unregister_hw+0x55/0x3a0
[   81.734062][  T768]  mac80211_hwsim_del_radio+0x268/0x370
[   81.734088][  T768]  ? __pfx_mac80211_hwsim_del_radio+0x10/0x10
[   81.734115][  T768]  ? __local_bh_enable_ip+0xa4/0x120
[   81.734136][  T768]  hwsim_exit_net+0x33f/0x6d0
[   81.734163][  T768]  ? __pfx_hwsim_exit_net+0x10/0x10
[   81.734189][  T768]  ? __pfx___might_resched+0x10/0x10
[   81.734207][  T768]  ? ip_vs_sync_net_cleanup+0x72/0xb0
[   81.734228][  T768]  ? __ip_vs_dev_cleanup_batch+0xb1/0x290
[   81.734246][  T768]  ? __pfx_hwsim_exit_net+0x10/0x10
[   81.734272][  T768]  ops_exit_list+0xb0/0x180
[   81.734290][  T768]  cleanup_net+0x5c6/0xbf0
[   81.734310][  T768]  ? __pfx_cleanup_net+0x10/0x10
[   81.734331][  T768]  ? lock_acquire+0x2f/0xb0
[   81.734346][  T768]  ? process_one_work+0x8bb/0x1b30
[   81.734374][  T768]  process_one_work+0x958/0x1b30
[   81.734404][  T768]  ? __pfx_cleanup_net+0x10/0x10
[   81.734422][  T768]  ? __pfx_process_one_work+0x10/0x10
[   81.734448][  T768]  ? rcu_is_watching+0x12/0xc0
[   81.734472][  T768]  ? assign_work+0x1a0/0x250
[   81.734498][  T768]  worker_thread+0x6c8/0xf00
[   81.734527][  T768]  ? __kthread_parkme+0x148/0x220
[   81.734550][  T768]  ? __pfx_worker_thread+0x10/0x10
[   81.734576][  T768]  kthread+0x3af/0x750
[   81.734606][  T768]  ? __pfx_kthread+0x10/0x10
[   81.734630][  T768]  ? lock_acquire+0x2f/0xb0
[   81.734648][  T768]  ? __pfx_kthread+0x10/0x10
[   81.734672][  T768]  ret_from_fork+0x45/0x80
[   81.734690][  T768]  ? __pfx_kthread+0x10/0x10
[   81.734715][  T768]  ret_from_fork_asm+0x1a/0x30
[   81.734746][  T768]  </TASK>
[   82.205328][ T5924] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[   82.988060][ T5146] Bluetooth: hci0: command tx timeout
[   85.068171][ T5146] Bluetooth: hci0: command tx timeout
[   87.233907][  T974] cfg80211: failed to load regulatory.db


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.7'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build744164607=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 6dbc6a9bc7
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=6dbc6a9bc76e06852841ed5c5bdbb78409b17f53 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250110-142744'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"6dbc6a9bc76e06852841ed5c5bdbb78409b17f53\"
/usr/bin/ld: /tmp/ccJVchnk.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1733f964580000


Tested on:

commit:         21266b8d Merge tag 'AT_EXECVE_CHECK-v6.14-rc1' of git:..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=77593a73383cac88
dashboard link: https://syzkaller.appspot.com/bug?extid=83976e47ec1ef91e66f1
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15b85ab0580000

Powered by blists - more mailing lists