netdev - WARNING in debug_print

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <94eb2c19ebf4e757370564b50939@google.com>
Date:   Thu, 08 Feb 2018 07:26:41 -0800
From:   syzbot <syzbot+19c09769f14b48810113@...kaller.appspotmail.com>
To:     davem@...emloft.net, jchapman@...alix.com,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: WARNING in debug_print_object

Hello,

syzbot has tested the proposed patch but the reproducer still triggered  
crash:
possible deadlock in pppol2tp_session_free


============================================
WARNING: possible recursive locking detected
4.15.0+ #37 Not tainted
--------------------------------------------
syzkaller163597/27635 is trying to acquire lock:
  (sk_lock-AF_PPPOX){+.+.}, at: [<0000000011240b7f>] lock_sock  
include/net/sock.h:1463 [inline]
  (sk_lock-AF_PPPOX){+.+.}, at: [<0000000011240b7f>]  
pppol2tp_session_free+0x88/0x1d0 net/l2tp/l2tp_ppp.c:469

but task is already holding lock:
  (sk_lock-AF_PPPOX){+.+.}, at: [<000000009bf8de9a>] lock_sock  
include/net/sock.h:1463 [inline]
  (sk_lock-AF_PPPOX){+.+.}, at: [<000000009bf8de9a>]  
pppol2tp_connect+0x14e/0x1550 net/l2tp/l2tp_ppp.c:786

other info that might help us debug this:
  Possible unsafe locking scenario:

        CPU0
        ----
   lock(sk_lock-AF_PPPOX);
   lock(sk_lock-AF_PPPOX);

  *** DEADLOCK ***

  May be due to missing lock nesting notation

1 lock held by syzkaller163597/27635:
  #0:  (sk_lock-AF_PPPOX){+.+.}, at: [<000000009bf8de9a>] lock_sock  
include/net/sock.h:1463 [inline]
  #0:  (sk_lock-AF_PPPOX){+.+.}, at: [<000000009bf8de9a>]  
pppol2tp_connect+0x14e/0x1550 net/l2tp/l2tp_ppp.c:786

stack backtrace:
CPU: 1 PID: 27635 Comm: syzkaller163597 Not tainted 4.15.0+ #37
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x194/0x257 lib/dump_stack.c:53
  print_deadlock_bug kernel/locking/lockdep.c:1761 [inline]
  check_deadlock kernel/locking/lockdep.c:1805 [inline]
  validate_chain kernel/locking/lockdep.c:2401 [inline]
  __lock_acquire+0xe8f/0x3e00 kernel/locking/lockdep.c:3431
  lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
  lock_sock_nested+0xc2/0x110 net/core/sock.c:2777
  lock_sock include/net/sock.h:1463 [inline]
  pppol2tp_session_free+0x88/0x1d0 net/l2tp/l2tp_ppp.c:469
  l2tp_session_free+0x151/0x2b0 net/l2tp/l2tp_core.c:1627
  l2tp_session_dec_refcount net/l2tp/l2tp_core.h:281 [inline]
  pppol2tp_connect+0xfb5/0x1550 net/l2tp/l2tp_ppp.c:892
  SYSC_connect+0x213/0x4a0 net/socket.c:1639
  SyS_connect+0x24/0x30 net/socket.c:1620
  entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x440ca9
RSP: 002b:00007ffe501872e8 EFLAGS: 00000206 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440ca9
RDX: 000000000000002e RSI: 0000000020e77000 RDI: 0000000000000004
RBP: 0000000000074be3 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000003 R14: 00000000006cf050 R15: 00000000004a25db


Tested on  
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master  
commit
617aebe6a97efa539cc4b8a52adccd89596e6be0 (Sun Feb 4 00:25:42 2018 +0000)
Merge tag 'usercopy-v4.16-rc1' of  
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

compiler: gcc (GCC) 7.1.1 20170620
Patch is attached.
Kernel config is attached.
Raw console output is attached.


View attachment "patch.diff" of type "text/plain" (39010 bytes)

View attachment "raw.log.txt" of type "text/plain" (5229 bytes)

View attachment "config.txt" of type "text/plain" (136942 bytes)