From: syzbot <syzbot+4ec99438ed7450da6272@syzkaller.appspotmail.com>
To: davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com, xiyou.wangcong@gmail.com
Subject: Re: WARNING: bad unlock balance in sch_direct_xmit
Date: Sun, 05 Jan 2020 10:30:08 -0800 [thread overview]
Message-ID: <0000000000007e2951059b68bbf0@google.com> (raw)
In-Reply-To: <000000000000ab3f800598cec624@google.com>
syzbot has found a reproducer for the following crash on:
HEAD commit: 36487907 Merge branch 'akpm' (patches from Andrew)
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=165b3e15e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f2f3ef188b7e16cf
dashboard link: https://syzkaller.appspot.com/bug?extid=4ec99438ed7450da6272
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1722c5c1e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=167aee3ee00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4ec99438ed7450da6272@syzkaller.appspotmail.com
=====================================
WARNING: bad unlock balance detected!
5.5.0-rc4-syzkaller #0 Not tainted
-------------------------------------
swapper/0/0 is trying to release lock (&dev->qdisc_xmit_lock_key) at:
[<ffffffff863f0dda>] spin_unlock include/linux/spinlock.h:378 [inline]
[<ffffffff863f0dda>] __netif_tx_unlock include/linux/netdevice.h:3966
[inline]
[<ffffffff863f0dda>] sch_direct_xmit+0x3fa/0xd30 net/sched/sch_generic.c:315
but there are no more locks to release!
other info that might help us debug this:
6 locks held by swapper/0/0:
#0: ffffc90000007d50 ((&idev->mc_dad_timer)){+.-.}, at: lockdep_copy_map
include/linux/lockdep.h:172 [inline]
#0: ffffc90000007d50 ((&idev->mc_dad_timer)){+.-.}, at:
call_timer_fn+0xe0/0x780 kernel/time/timer.c:1394
#1: ffffffff899a5600 (rcu_read_lock){....}, at: dev_net
include/linux/netdevice.h:2188 [inline]
#1: ffffffff899a5600 (rcu_read_lock){....}, at: mld_sendpack+0x180/0xed0
net/ipv6/mcast.c:1649
#2: ffffffff899a55c0 (rcu_read_lock_bh){....}, at: lwtunnel_xmit_redirect
include/net/lwtunnel.h:92 [inline]
#2: ffffffff899a55c0 (rcu_read_lock_bh){....}, at:
ip6_finish_output2+0x214/0x25c0 net/ipv6/ip6_output.c:102
#3: ffffffff899a55c0 (rcu_read_lock_bh){....}, at:
__dev_queue_xmit+0x20a/0x35c0 net/core/dev.c:3948
#4: ffff88809f1b1250 (&dev->qdisc_tx_busylock_key#3){+...}, at:
spin_trylock include/linux/spinlock.h:348 [inline]
#4: ffff88809f1b1250 (&dev->qdisc_tx_busylock_key#3){+...}, at:
qdisc_run_begin include/net/sch_generic.h:159 [inline]
#4: ffff88809f1b1250 (&dev->qdisc_tx_busylock_key#3){+...}, at:
__dev_xmit_skb net/core/dev.c:3611 [inline]
#4: ffff88809f1b1250 (&dev->qdisc_tx_busylock_key#3){+...}, at:
__dev_queue_xmit+0x2412/0x35c0 net/core/dev.c:3982
#5: ffff88809f1b1138 (&dev->qdisc_running_key#3){+...}, at:
dev_queue_xmit+0x18/0x20 net/core/dev.c:4046
stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.5.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_unlock_imbalance_bug kernel/locking/lockdep.c:4008 [inline]
print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3984
__lock_release kernel/locking/lockdep.c:4242 [inline]
lock_release+0x5f2/0x960 kernel/locking/lockdep.c:4503
__raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
_raw_spin_unlock+0x16/0x40 kernel/locking/spinlock.c:183
spin_unlock include/linux/spinlock.h:378 [inline]
__netif_tx_unlock include/linux/netdevice.h:3966 [inline]
sch_direct_xmit+0x3fa/0xd30 net/sched/sch_generic.c:315
__dev_xmit_skb net/core/dev.c:3621 [inline]
__dev_queue_xmit+0x2707/0x35c0 net/core/dev.c:3982
dev_queue_xmit+0x18/0x20 net/core/dev.c:4046
neigh_hh_output include/net/neighbour.h:499 [inline]
neigh_output include/net/neighbour.h:508 [inline]
ip6_finish_output2+0xfbe/0x25c0 net/ipv6/ip6_output.c:116
__ip6_finish_output+0x444/0xaa0 net/ipv6/ip6_output.c:142
ip6_finish_output+0x38/0x1f0 net/ipv6/ip6_output.c:152
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip6_output+0x25e/0x880 net/ipv6/ip6_output.c:175
dst_output include/net/dst.h:436 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
mld_sendpack+0x9c2/0xed0 net/ipv6/mcast.c:1682
mld_send_initial_cr.part.0+0x114/0x160 net/ipv6/mcast.c:2099
mld_send_initial_cr net/ipv6/mcast.c:2083 [inline]
mld_dad_timer_expire+0x42/0x230 net/ipv6/mcast.c:2118
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
__do_softirq+0x262/0x98c kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x19b/0x1e0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
</IRQ>
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
Code: 78 94 db f9 eb 8a cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d c4 24 51
00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d b4 24 51 00 fb f4 <c3> cc 55 48 89
e5 41 57 41 56 41 55 41 54 53 e8 9e 68 8b f9 e8 09
RSP: 0018:ffffffff89807ce8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff132669e RBX: ffffffff8987a140 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffffffff8987a9d4
RBP: ffffffff89807d18 R08: ffffffff8987a140 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffffff8a7bb380 R14: 0000000000000000 R15: 0000000000000000
arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
default_idle_call+0x84/0xb0 kernel/sched/idle.c:94
cpuidle_idle_call kernel/sched/idle.c:154 [inline]
do_idle+0x3c8/0x6e0 kernel/sched/idle.c:269
cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
rest_init+0x23b/0x371 init/main.c:451
arch_call_rest_init+0xe/0x1b
start_kernel+0x904/0x943 init/main.c:784
x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:471
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242
kobject: 'brport' (000000006bf26f50): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (000000006bf26f50): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (000000006a34e5a7): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (000000006a34e5a7): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (0000000064bee465): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (0000000064bee465): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000572b5ef3): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (00000000572b5ef3): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000c5891925): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (00000000c5891925): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (000000007996a1ba): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (000000007996a1ba): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000c48f444d): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (00000000c48f444d): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (000000002f26f70f): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (000000002f26f70f): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (000000009742ca09): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (000000009742ca09): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000b1045bd4): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (00000000b1045bd4): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (000000009f21e9dc): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (000000009f21e9dc): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (000000002b66d6a0): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (000000002b66d6a0): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (0000000090c92031): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (0000000090c92031): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000b4538cf1): kobject_cleanup, parent
000000007f2d209d
kobject: 'brport' (00000000b4538cf1): calling ktype release
kobject: 'brport': free name
next prev parent reply other threads:[~2020-01-05 18:30 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-03 15:59 WARNING: bad unlock balance in sch_direct_xmit syzbot
2020-01-05 18:30 ` syzbot [this message]
2020-01-05 22:58 ` syzbot
2020-01-05 22:58 ` syzbot
2020-01-05 22:58 ` syzbot
2020-01-05 22:58 ` [Bridge] " syzbot
2020-01-07 5:36 ` Cong Wang
2020-01-07 11:30 ` Taehee Yoo
2020-01-08 0:34 ` Cong Wang
2020-01-08 11:42 ` Taehee Yoo
2020-01-09 23:38 ` Cong Wang
2020-01-10 3:06 ` Taehee Yoo
2020-01-10 4:43 ` Cong Wang
2020-01-10 6:02 ` Taehee Yoo
2020-01-11 21:53 ` Cong Wang
2020-01-11 23:28 ` Cong Wang
2020-01-13 10:53 ` Taehee Yoo
2020-01-14 19:39 ` Cong Wang
2020-01-13 10:13 ` Taehee Yoo
2020-01-13 11:08 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000007e2951059b68bbf0@google.com \
--to=syzbot+4ec99438ed7450da6272@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.