From: syzbot <syzbot+e227429f6fa77945d7e4@syzkaller.appspotmail.com>
To: davem@davemloft.net, dsahern@kernel.org, edumazet@google.com,
horms@kernel.org, kuba@kernel.org, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, pabeni@redhat.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] possible deadlock in ip_mroute_setsockopt
Date: Sun, 24 Nov 2024 15:45:16 -0800 [thread overview]
Message-ID: <6743ba8c.050a0220.1cc393.0050.GAE@google.com> (raw)
In-Reply-To: <00000000000009ff2e061ce633d7@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: fcc79e1714e8 Merge tag 'net-next-6.13' of git://git.kernel..
git tree: net-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1448b75f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=275de99a754927af
dashboard link: https://syzkaller.appspot.com/bug?extid=e227429f6fa77945d7e4
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=175459c0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10dc0ee8580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8b723ddc7543/disk-fcc79e17.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ca8fd756cdfc/vmlinux-fcc79e17.xz
kernel image: https://storage.googleapis.com/syzbot-assets/778b3623fb8d/bzImage-fcc79e17.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e227429f6fa77945d7e4@syzkaller.appspotmail.com
lo speed is unknown, defaulting to 1000
lo speed is unknown, defaulting to 1000
iwpm_register_pid: Unable to send a nlmsg (client = 2)
infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
======================================================
WARNING: possible circular locking dependency detected
6.12.0-syzkaller-05480-gfcc79e1714e8 #0 Not tainted
------------------------------------------------------
syz-executor233/5845 is trying to acquire lock:
ffffffff8fce2348 (rtnl_mutex){+.+.}-{4:4}, at: ip_mroute_setsockopt+0x15b/0x1190 net/ipv4/ipmr.c:1370
but task is already holding lock:
ffff88807cfc0aa8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_setsockopt+0x1c3/0xe50 net/smc/af_smc.c:3056
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&smc->clcsock_release_lock){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
smc_switch_to_fallback+0x35/0xdb0 net/smc/af_smc.c:902
smc_sendmsg+0x11f/0x530 net/smc/af_smc.c:2771
sock_sendmsg_nosec net/socket.c:711 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:726
__sys_sendto+0x363/0x4c0 net/socket.c:2197
__do_sys_sendto net/socket.c:2204 [inline]
__se_sys_sendto net/socket.c:2200 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2200
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (sk_lock-AF_INET){+.+.}-{0:0}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
lock_sock_nested+0x48/0x100 net/core/sock.c:3622
lock_sock include/net/sock.h:1617 [inline]
sock_set_reuseaddr+0x17/0x60 net/core/sock.c:781
siw_create_listen+0x196/0xfe0 drivers/infiniband/sw/siw/siw_cm.c:1776
iw_cm_listen+0x15e/0x230 drivers/infiniband/core/iwcm.c:585
cma_iw_listen drivers/infiniband/core/cma.c:2668 [inline]
rdma_listen+0x941/0xd60 drivers/infiniband/core/cma.c:3953
cma_listen_on_dev+0x3e3/0x6f0 drivers/infiniband/core/cma.c:2727
cma_add_one+0x7d7/0xcd0 drivers/infiniband/core/cma.c:5357
add_client_context+0x536/0x8b0 drivers/infiniband/core/device.c:727
enable_device_and_get+0x1e6/0x440 drivers/infiniband/core/device.c:1338
ib_register_device+0x10d4/0x13e0 drivers/infiniband/core/device.c:1449
siw_device_register drivers/infiniband/sw/siw/siw_main.c:72 [inline]
siw_newlink+0x9d9/0xe50 drivers/infiniband/sw/siw/siw_main.c:452
nldev_newlink+0x5c0/0x640 drivers/infiniband/core/nldev.c:1795
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6dd/0x9e0 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347
netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891
sock_sendmsg_nosec net/socket.c:711 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:726
____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583
___sys_sendmsg net/socket.c:2637 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2669
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (lock#7){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
cma_init+0x1e/0x140 drivers/infiniband/core/cma.c:5438
do_one_initcall+0x248/0x880 init/main.c:1266
do_initcall_level+0x157/0x210 init/main.c:1328
do_initcalls+0x3f/0x80 init/main.c:1344
kernel_init_freeable+0x435/0x5d0 init/main.c:1577
kernel_init+0x1d/0x2b0 init/main.c:1466
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 (rtnl_mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
ip_mroute_setsockopt+0x15b/0x1190 net/ipv4/ipmr.c:1370
do_ip_setsockopt+0x129f/0x3cd0 net/ipv4/ip_sockglue.c:948
ip_setsockopt+0x63/0x100 net/ipv4/ip_sockglue.c:1417
smc_setsockopt+0x275/0xe50 net/smc/af_smc.c:3064
do_sock_setsockopt+0x3af/0x720 net/socket.c:2313
__sys_setsockopt net/socket.c:2338 [inline]
__do_sys_setsockopt net/socket.c:2344 [inline]
__se_sys_setsockopt net/socket.c:2341 [inline]
__x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2341
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
rtnl_mutex --> sk_lock-AF_INET --> &smc->clcsock_release_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&smc->clcsock_release_lock);
lock(sk_lock-AF_INET);
lock(&smc->clcsock_release_lock);
lock(rtnl_mutex);
*** DEADLOCK ***
1 lock held by syz-executor233/5845:
#0: ffff88807cfc0aa8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_setsockopt+0x1c3/0xe50 net/smc/af_smc.c:3056
stack backtrace:
CPU: 0 UID: 0 PID: 5845 Comm: syz-executor233 Not tainted 6.12.0-syzkaller-05480-gfcc79e1714e8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
ip_mroute_setsockopt+0x15b/0x1190 net/ipv4/ipmr.c:1370
do_ip_setsockopt+0x129f/0x3cd0 net/ipv4/ip_sockglue.c:948
ip_setsockopt+0x63/0x100 net/ipv4/ip_sockglue.c:1417
smc_setsockopt+0x275/0xe50 net/smc/af_smc.c:3064
do_sock_setsockopt+0x3af/0x720 net/socket.c:2313
__sys_setsockopt net/socket.c:2338 [inline]
__do_sys_setsockopt net/socket.c:2344 [inline]
__se_sys_setsockopt net/socket.c:2341 [inline]
__x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2341
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f018ec824a9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe0c6806e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007ffe0c6808b8 RCX: 00007f018ec824a9
RDX: 00000000000000d2 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 00007f018ecf5610 R08: 0000000000000000 R09: 00007ffe0c6808b8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe0c6808a8 R14: 0000000000000001 R15: 0
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2024-11-24 23:45 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-10 15:21 [syzbot] [net?] possible deadlock in ip_mroute_setsockopt syzbot
2024-11-24 23:45 ` syzbot [this message]
2024-11-25 11:30 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6743ba8c.050a0220.1cc393.0050.GAE@google.com \
--to=syzbot+e227429f6fa77945d7e4@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.