From: syzbot <syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com>
To: andriin@fb.com, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, davem@davemloft.net,
eric.dumazet@gmail.com, herbert@gondor.apana.org.au,
john.fastabend@gmail.com, kafai@fb.com,
linux-crypto@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
songliubraving@fb.com, syzkaller-bugs@googlegroups.com,
viro@zeniv.linux.org.uk, yhs@fb.com
Subject: Re: BUG: sleeping function called from invalid context in lock_sock_nested
Date: Fri, 17 Jan 2020 01:39:10 -0800 [thread overview]
Message-ID: <000000000000bf411c059c52b660@google.com> (raw)
In-Reply-To: <0000000000003e5aa90598ed7415@google.com>
syzbot has found a reproducer for the following crash on:
HEAD commit: 93ad0f96 net: wan: lapbether.c: Use built-in RCU list chec..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=1159eb8ee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e89bd00623fe71e
dashboard link: https://syzkaller.appspot.com/bug?extid=c2f1558d49e25cc36e5e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1070cad1e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17de84a5e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com
BUG: sleeping function called from invalid context at net/core/sock.c:2935
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3198, name:
kworker/0:112
4 locks held by kworker/0:112/3198:
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: __write_once_size
include/linux/compiler.h:226 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: arch_atomic64_set
arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:855 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:40 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: set_work_data
kernel/workqueue.c:615 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at:
process_one_work+0x88b/0x1740 kernel/workqueue.c:2235
#1: ffffc9000951fdc0 ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0x8c1/0x1740 kernel/workqueue.c:2239
#2: ffffffff899a3f00 (rcu_read_lock){....}, at: sock_hash_free+0x0/0x540
net/core/sock_map.c:317
#3: ffffc90002478d20 (&htab->buckets[i].lock){+...}, at:
sock_hash_free+0x131/0x540 net/core/sock_map.c:865
Preemption disabled at:
[<ffffffff86341331>] sock_hash_free+0x131/0x540 net/core/sock_map.c:865
CPU: 0 PID: 3198 Comm: kworker/0:112 Not tainted 5.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_map_free_deferred
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
___might_sleep.cold+0x1fb/0x23e kernel/sched/core.c:6800
__might_sleep+0x95/0x190 kernel/sched/core.c:6753
lock_sock_nested+0x39/0x120 net/core/sock.c:2935
lock_sock include/net/sock.h:1531 [inline]
sock_hash_free+0x29f/0x540 net/core/sock_map.c:868
bpf_map_free_deferred+0xb3/0x100 kernel/bpf/syscall.c:327
process_one_work+0x9af/0x1740 kernel/workqueue.c:2264
worker_thread+0x98/0xe40 kernel/workqueue.c:2410
kthread+0x361/0x430 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
BUG: scheduling while atomic: kworker/0:112/3198/0x00000202
4 locks held by kworker/0:112/3198:
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: __write_once_size
include/linux/compiler.h:226 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: arch_atomic64_set
arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:855 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:40 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at: set_work_data
kernel/workqueue.c:615 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:642 [inline]
#0: ffff8880aa426d28 ((wq_completion)events){+.+.}, at:
process_one_work+0x88b/0x1740 kernel/workqueue.c:2235
#1: ffffc9000951fdc0 ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0x8c1/0x1740 kernel/workqueue.c:2239
#2: ffffffff899a3f00 (rcu_read_lock){....}, at: sock_hash_free+0x0/0x540
net/core/sock_map.c:317
#3: ffffc90002478d20 (&htab->buckets[i].lock){+...}, at:
sock_hash_free+0x131/0x540 net/core/sock_map.c:865
Modules linked in:
Preemption disabled at:
[<ffffffff86341331>] sock_hash_free+0x131/0x540 net/core/sock_map.c:865
prev parent reply other threads:[~2020-01-17 9:39 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-05 4:35 BUG: sleeping function called from invalid context in lock_sock_nested syzbot
2019-12-05 4:59 ` Eric Dumazet
2019-12-05 5:45 ` [PATCH] crypto: af_alg - Use bh_lock_sock in sk_destruct Herbert Xu
2020-01-17 9:39 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000bf411c059c52b660@google.com \
--to=syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com \
--cc=andriin@fb.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=herbert@gondor.apana.org.au \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=songliubraving@fb.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.