Message-ID: <089e0825d4a4d2cb2a0562e878f1@google.com>
Date:   Tue, 16 Jan 2018 09:58:02 -0800
From:   syzbot <syzbot+29cc278357da941e304e@...kaller.appspotmail.com>
To:     davem@...emloft.net, jhs@...atatu.com, jiri@...nulli.us,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, xiyou.wangcong@...il.com
Subject: possible deadlock in sch_direct_xmit

Hello,

syzkaller hit the following crash on  
6bd39bc3da0f4a301fae69c4a32db2768f5118be
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+29cc278357da941e304e@...kaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for  
details.
If you forward the report, please keep this part and the footer.


============================================
WARNING: possible recursive locking detected
4.15.0-rc7+ #187 Not tainted
--------------------------------------------
syzkaller554623/3701 is trying to acquire lock:
  (_xmit_ETHER#2){+.-.}, at: [<000000002ed00198>] spin_lock  
include/linux/spinlock.h:310 [inline]
  (_xmit_ETHER#2){+.-.}, at: [<000000002ed00198>] __netif_tx_lock  
include/linux/netdevice.h:3541 [inline]
  (_xmit_ETHER#2){+.-.}, at: [<000000002ed00198>]  
sch_direct_xmit+0x361/0x1140 net/sched/sch_generic.c:325

but task is already holding lock:
  (_xmit_ETHER#2){+.-.}, at: [<000000002ed00198>] spin_lock  
include/linux/spinlock.h:310 [inline]
  (_xmit_ETHER#2){+.-.}, at: [<000000002ed00198>] __netif_tx_lock  
include/linux/netdevice.h:3541 [inline]
  (_xmit_ETHER#2){+.-.}, at: [<000000002ed00198>]  
sch_direct_xmit+0x361/0x1140 net/sched/sch_generic.c:325

other info that might help us debug this:
  Possible unsafe locking scenario:

        CPU0
        ----
   lock(_xmit_ETHER#2);
   lock(_xmit_ETHER#2);

  *** DEADLOCK ***

  May be due to missing lock nesting notation

8 locks held by syzkaller554623/3701:
  #0:  (&tfile->napi_mutex){+.+.}, at: [<0000000006e081cb>]  
tun_get_user+0xe6c/0x3940 drivers/net/tun.c:1783
  #1:  (rcu_read_lock){....}, at: [<0000000049ffedca>] arch_static_branch  
arch/x86/include/asm/jump_label.h:36 [inline]
  #1:  (rcu_read_lock){....}, at: [<0000000049ffedca>] static_key_false  
include/linux/jump_label.h:142 [inline]
  #1:  (rcu_read_lock){....}, at: [<0000000049ffedca>]  
netif_receive_skb_internal+0xa2/0x670 net/core/dev.c:4651
  #2:  (k-slock-AF_INET){+...}, at: [<000000001ad88698>] spin_trylock  
include/linux/spinlock.h:320 [inline]
  #2:  (k-slock-AF_INET){+...}, at: [<000000001ad88698>] icmp_xmit_lock  
net/ipv4/icmp.c:219 [inline]
  #2:  (k-slock-AF_INET){+...}, at: [<000000001ad88698>]  
icmp_send+0x758/0x19b0 net/ipv4/icmp.c:668
  #3:  (rcu_read_lock_bh){....}, at: [<00000000e077a35b>]  
lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline]
  #3:  (rcu_read_lock_bh){....}, at: [<00000000e077a35b>]  
ip_finish_output2+0x2aa/0x14f0 net/ipv4/ip_output.c:213
  #4:  (rcu_read_lock_bh){....}, at: [<00000000826f73dd>]  
__dev_queue_xmit+0x2d8/0x2b50 net/core/dev.c:3467
  #5:  (_xmit_ETHER#2){+.-.}, at: [<000000002ed00198>] spin_lock  
include/linux/spinlock.h:310 [inline]
  #5:  (_xmit_ETHER#2){+.-.}, at: [<000000002ed00198>] __netif_tx_lock  
include/linux/netdevice.h:3541 [inline]
  #5:  (_xmit_ETHER#2){+.-.}, at: [<000000002ed00198>]  
sch_direct_xmit+0x361/0x1140 net/sched/sch_generic.c:325
  #6:  (rcu_read_lock_bh){....}, at: [<00000000e077a35b>]  
lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline]
  #6:  (rcu_read_lock_bh){....}, at: [<00000000e077a35b>]  
ip_finish_output2+0x2aa/0x14f0 net/ipv4/ip_output.c:213
  #7:  (rcu_read_lock_bh){....}, at: [<00000000826f73dd>]  
__dev_queue_xmit+0x2d8/0x2b50 net/core/dev.c:3467

stack backtrace:
CPU: 1 PID: 3701 Comm: syzkaller554623 Not tainted 4.15.0-rc7+ #187
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x194/0x257 lib/dump_stack.c:53
  print_deadlock_bug kernel/locking/lockdep.c:1756 [inline]
  check_deadlock kernel/locking/lockdep.c:1800 [inline]
  validate_chain kernel/locking/lockdep.c:2396 [inline]
  __lock_acquire+0xe8f/0x3e00 kernel/locking/lockdep.c:3426
  lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914
  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144
  spin_lock include/linux/spinlock.h:310 [inline]
  __netif_tx_lock include/linux/netdevice.h:3541 [inline]
  sch_direct_xmit+0x361/0x1140 net/sched/sch_generic.c:325
  qdisc_restart net/sched/sch_generic.c:393 [inline]
  __qdisc_run+0x57d/0x19c0 net/sched/sch_generic.c:401
  __dev_xmit_skb net/core/dev.c:3200 [inline]
  __dev_queue_xmit+0xb62/0x2b50 net/core/dev.c:3501
  dev_queue_xmit+0x17/0x20 net/core/dev.c:3566
  neigh_resolve_output+0x5e2/0xa00 net/core/neighbour.c:1350
  neigh_output include/net/neighbour.h:482 [inline]
  ip_finish_output2+0x8c6/0x14f0 net/ipv4/ip_output.c:229
  ip_finish_output+0x864/0xd10 net/ipv4/ip_output.c:317
  NF_HOOK_COND include/linux/netfilter.h:277 [inline]
  ip_mc_output+0x271/0x1350 net/ipv4/ip_output.c:390
  dst_output include/net/dst.h:443 [inline]
  ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
  iptunnel_xmit+0x556/0x810 net/ipv4/ip_tunnel_core.c:91
  ip_tunnel_xmit+0x1780/0x3650 net/ipv4/ip_tunnel.c:786
  __gre_xmit+0x546/0x8b0 net/ipv4/ip_gre.c:461
  erspan_xmit+0x7eb/0x2430 net/ipv4/ip_gre.c:744
  __netdev_start_xmit include/linux/netdevice.h:4046 [inline]
  netdev_start_xmit include/linux/netdevice.h:4055 [inline]
  xmit_one net/core/dev.c:3020 [inline]
  dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3036
  sch_direct_xmit+0x40d/0x1140 net/sched/sch_generic.c:327
  qdisc_restart net/sched/sch_generic.c:393 [inline]
  __qdisc_run+0x57d/0x19c0 net/sched/sch_generic.c:401
  __dev_xmit_skb net/core/dev.c:3200 [inline]
  __dev_queue_xmit+0xb62/0x2b50 net/core/dev.c:3501
  dev_queue_xmit+0x17/0x20 net/core/dev.c:3566
  neigh_resolve_output+0x5e2/0xa00 net/core/neighbour.c:1350
  neigh_output include/net/neighbour.h:482 [inline]
  ip_finish_output2+0x8c6/0x14f0 net/ipv4/ip_output.c:229
  ip_finish_output+0x864/0xd10 net/ipv4/ip_output.c:317
  NF_HOOK_COND include/linux/netfilter.h:277 [inline]
  ip_mc_output+0x271/0x1350 net/ipv4/ip_output.c:390
  dst_output include/net/dst.h:443 [inline]
  ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
  ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1414
  ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1434
  icmp_push_reply+0x395/0x4f0 net/ipv4/icmp.c:394
  icmp_send+0x1136/0x19b0 net/ipv4/icmp.c:741
  ip_options_compile+0xc21/0x1a50 net/ipv4/ip_options.c:472
  ip_rcv_options net/ipv4/ip_input.c:284 [inline]
  ip_rcv_finish+0x80f/0x1e30 net/ipv4/ip_input.c:365
  NF_HOOK include/linux/netfilter.h:288 [inline]
  ip_rcv+0xc5a/0x1840 net/ipv4/ip_input.c:493
  __netif_receive_skb_core+0x1a41/0x3460 net/core/dev.c:4538
  __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4603
  netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4677
  napi_frags_finish net/core/dev.c:5118 [inline]
  napi_gro_frags+0x58a/0xaf0 net/core/dev.c:5191
  tun_get_user+0x2760/0x3940 drivers/net/tun.c:1907
  tun_chr_write_iter+0xb9/0x160 drivers/net/tun.c:1952
  call_write_iter include/linux/fs.h:1772 [inline]
  do_iter_readv_writev+0x525/0x7f0 fs/read_write.c:653
  do_iter_write+0x154/0x540 fs/read_write.c:932
  vfs_writev+0x18a/0x340 fs/read_write.c:977
  do_writev+0xfc/0x2a0 fs/read_write.c:1012
  SYSC_writev fs/read_write.c:1085 [inline]
  SyS_writev+0x27/0x30 fs/read_write.c:1082
  entry_SYSCALL_64_fastpath+0x23/0x9a
RIP: 0033:0x444f50
RSP: 002b:00007ffe95ccaea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00000000004a6852 RCX: 0000000000444f50
RDX: 0000000000000001 RSI: 00007ffe95ccaee0 RDI: 0000000000000003
RBP: 00007ffe95ccafd8 R08: 0000000000000023 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe95ccafd8
R13: 0000000000402520 R14: 0000000000000000 R15: 0000000000000000


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@...glegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is  
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug  
report.
Note: all commands must start from beginning of the line in the email body.

View attachment "config.txt" of type "text/plain" (135039 bytes)

View attachment "raw.log.txt" of type "text/plain" (16939 bytes)

View attachment "repro.syz.txt" of type "text/plain" (821 bytes)

View attachment "repro.c.txt" of type "text/plain" (11308 bytes)

Powered by blists - more mailing lists