From: syzbot <syzbot+368054937a6a7ead5f35@syzkaller.appspotmail.com>
To: davem@davemloft.net, edumazet@google.com, horms@kernel.org,
kuba@kernel.org, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, pabeni@redhat.com,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] [net?] BUG: sleeping function called from invalid context in dev_set_allmulti
Date: Tue, 11 Mar 2025 09:36:26 -0700 [thread overview]
Message-ID: <67d0668a.050a0220.1939a6.0028.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 40587f749df2 Merge branch 'enic-enable-32-64-byte-cqes-and..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16b35478580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ca99d9d1f4a8ecfa
dashboard link: https://syzkaller.appspot.com/bug?extid=368054937a6a7ead5f35
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6d02993a9211/disk-40587f74.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2c8b300bf362/vmlinux-40587f74.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2d5be21882cf/bzImage-40587f74.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+368054937a6a7ead5f35@syzkaller.appspotmail.com
vlan2: entered allmulticast mode
bond0: entered allmulticast mode
bond_slave_0: entered allmulticast mode
bond_slave_1: entered allmulticast mode
team0: entered allmulticast mode
team_slave_0: entered allmulticast mode
team_slave_1: entered allmulticast mode
batadv0: entered allmulticast mode
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:562
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 23629, name: syz.4.5165
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
3 locks held by syz.4.5165/23629:
#0: ffffffff903f0bd0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff903f0bd0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff903f0bd0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x22/0x250 net/core/rtnetlink.c:570
#1: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc4c/0x1d90 net/core/rtnetlink.c:4054
#2: ffffffff8eb392e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#2: ffffffff8eb392e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8eb392e0 (rcu_read_lock){....}-{1:3}, at: team_change_rx_flags+0x29/0x330 drivers/net/team/team_core.c:1781
CPU: 1 UID: 0 PID: 23629 Comm: syz.4.5165 Not tainted 6.14.0-rc5-syzkaller-01183-g40587f749df2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
__might_resched+0x5d4/0x780 kernel/sched/core.c:8767
__mutex_lock_common kernel/locking/mutex.c:562 [inline]
__mutex_lock+0x126/0x1010 kernel/locking/mutex.c:730
netdev_lock include/linux/netdevice.h:2731 [inline]
netdev_lock_ops include/net/netdev_lock.h:40 [inline]
dev_set_allmulti+0x11c/0x270 net/core/dev_api.c:279
team_change_rx_flags+0x1a8/0x330 drivers/net/team/team_core.c:1789
dev_change_rx_flags net/core/dev.c:9154 [inline]
netif_set_allmulti+0x20e/0x380 net/core/dev.c:9256
dev_set_allmulti+0x143/0x270 net/core/dev_api.c:280
bond_set_allmulti drivers/net/bonding/bond_main.c:946 [inline]
bond_change_rx_flags+0x4e1/0x6b0 drivers/net/bonding/bond_main.c:4737
dev_change_rx_flags net/core/dev.c:9154 [inline]
netif_set_allmulti+0x20e/0x380 net/core/dev.c:9256
dev_set_allmulti+0x143/0x270 net/core/dev_api.c:280
vlan_dev_open+0x2be/0x8a0 net/8021q/vlan_dev.c:278
__dev_open+0x45a/0x8a0 net/core/dev.c:1644
netif_open+0xae/0x1b0 net/core/dev.c:1667
dev_open+0x13e/0x260 net/core/dev_api.c:191
bond_enslave+0x103c/0x3910 drivers/net/bonding/bond_main.c:2135
do_set_master+0x579/0x730 net/core/rtnetlink.c:2943
rtnl_newlink_create+0x6e6/0xbd0 net/core/rtnetlink.c:3837
__rtnl_newlink net/core/rtnetlink.c:3940 [inline]
rtnl_newlink+0x167a/0x1d90 net/core/rtnetlink.c:4055
rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6945
netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:709 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:724
____sys_sendmsg+0x53a/0x860 net/socket.c:2564
___sys_sendmsg net/socket.c:2618 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2650
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe00998d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe00a843038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fe009ba5fa0 RCX: 00007fe00998d169
RDX: 0000000000000000 RSI: 0000400000000280 RDI: 0000000000000003
RBP: 00007fe009a0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe009ba5fa0 R15: 00007ffdc9be6f48
</TASK>
=============================
[ BUG: Invalid wait context ]
6.14.0-rc5-syzkaller-01183-g40587f749df2 #0 Tainted: G W
-----------------------------
syz.4.5165/23629 is trying to lock:
ffff88807bce0d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2731 [inline]
ffff88807bce0d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:40 [inline]
ffff88807bce0d28 (&dev->lock){+.+.}-{4:4}, at: dev_set_allmulti+0x11c/0x270 net/core/dev_api.c:279
other info that might help us debug this:
context-{5:5}
3 locks held by syz.4.5165/23629:
#0: ffffffff903f0bd0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff903f0bd0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff903f0bd0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x22/0x250 net/core/rtnetlink.c:570
#1: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc4c/0x1d90 net/core/rtnetlink.c:4054
#2: ffffffff8eb392e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#2: ffffffff8eb392e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8eb392e0 (rcu_read_lock){....}-{1:3}, at: team_change_rx_flags+0x29/0x330 drivers/net/team/team_core.c:1781
stack backtrace:
CPU: 1 UID: 0 PID: 23629 Comm: syz.4.5165 Tainted: G W 6.14.0-rc5-syzkaller-01183-g40587f749df2 #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4828 [inline]
check_wait_context kernel/locking/lockdep.c:4900 [inline]
__lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5178
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
netdev_lock include/linux/netdevice.h:2731 [inline]
netdev_lock_ops include/net/netdev_lock.h:40 [inline]
dev_set_allmulti+0x11c/0x270 net/core/dev_api.c:279
team_change_rx_flags+0x1a8/0x330 drivers/net/team/team_core.c:1789
dev_change_rx_flags net/core/dev.c:9154 [inline]
netif_set_allmulti+0x20e/0x380 net/core/dev.c:9256
dev_set_allmulti+0x143/0x270 net/core/dev_api.c:280
bond_set_allmulti drivers/net/bonding/bond_main.c:946 [inline]
bond_change_rx_flags+0x4e1/0x6b0 drivers/net/bonding/bond_main.c:4737
dev_change_rx_flags net/core/dev.c:9154 [inline]
netif_set_allmulti+0x20e/0x380 net/core/dev.c:9256
dev_set_allmulti+0x143/0x270 net/core/dev_api.c:280
vlan_dev_open+0x2be/0x8a0 net/8021q/vlan_dev.c:278
__dev_open+0x45a/0x8a0 net/core/dev.c:1644
netif_open+0xae/0x1b0 net/core/dev.c:1667
dev_open+0x13e/0x260 net/core/dev_api.c:191
bond_enslave+0x103c/0x3910 drivers/net/bonding/bond_main.c:2135
do_set_master+0x579/0x730 net/core/rtnetlink.c:2943
rtnl_newlink_create+0x6e6/0xbd0 net/core/rtnetlink.c:3837
__rtnl_newlink net/core/rtnetlink.c:3940 [inline]
rtnl_newlink+0x167a/0x1d90 net/core/rtnetlink.c:4055
rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6945
netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:709 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:724
____sys_sendmsg+0x53a/0x860 net/socket.c:2564
___sys_sendmsg net/socket.c:2618 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2650
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe00998d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe00a843038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fe009ba5fa0 RCX: 00007fe00998d169
RDX: 0000000000000000 RSI: 0000400000000280 RDI: 0000000000000003
RBP: 00007fe009a0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe009ba5fa0 R15: 00007ffdc9be6f48
</TASK>
netdevsim netdevsim4 netdevsim0: entered allmulticast mode
bond0: left allmulticast mode
bond_slave_0: left allmulticast mode
bond_slave_1: left allmulticast mode
team0: left allmulticast mode
team_slave_0: left allmulticast mode
team_slave_1: left allmulticast mode
batadv0: left allmulticast mode
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:562
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 23629, name: syz.4.5165
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
CPU: 0 UID: 0 PID: 23629 Comm: syz.4.5165 Tainted: G W 6.14.0-rc5-syzkaller-01183-g40587f749df2 #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
__might_resched+0x5d4/0x780 kernel/sched/core.c:8767
__mutex_lock_common kernel/locking/mutex.c:562 [inline]
__mutex_lock+0x126/0x1010 kernel/locking/mutex.c:730
netdev_lock include/linux/netdevice.h:2731 [inline]
netdev_lock_ops include/net/netdev_lock.h:40 [inline]
dev_set_allmulti+0x11c/0x270 net/core/dev_api.c:279
team_change_rx_flags+0x1a8/0x330 drivers/net/team/team_core.c:1789
dev_change_rx_flags net/core/dev.c:9154 [inline]
netif_set_allmulti+0x20e/0x380 net/core/dev.c:9256
dev_set_allmulti+0x143/0x270 net/core/dev_api.c:280
bond_set_allmulti drivers/net/bonding/bond_main.c:946 [inline]
bond_change_rx_flags+0x4e1/0x6b0 drivers/net/bonding/bond_main.c:4737
dev_change_rx_flags net/core/dev.c:9154 [inline]
netif_set_allmulti+0x20e/0x380 net/core/dev.c:9256
dev_set_allmulti+0x143/0x270 net/core/dev_api.c:280
vlan_dev_stop+0xb0/0x330 net/8021q/vlan_dev.c:320
__dev_close_many+0x3a6/0x700 net/core/dev.c:1717
dev_close_many+0x24e/0x4c0 net/core/dev.c:1742
netif_close+0x1c0/0x2c0 net/core/dev.c:1759
dev_close+0x137/0x280 net/core/dev_api.c:210
bond_enslave+0x26ca/0x3910 drivers/net/bonding/bond_main.c:2438
do_set_master+0x579/0x730 net/core/rtnetlink.c:2943
rtnl_newlink_create+0x6e6/0xbd0 net/core/rtnetlink.c:3837
__rtnl_newlink net/core/rtnetlink.c:3940 [inline]
rtnl_newlink+0x167a/0x1d90 net/core/rtnetlink.c:4055
rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6945
netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:709 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:724
____sys_sendmsg+0x53a/0x860 net/socket.c:2564
___sys_sendmsg net/socket.c:2618 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2650
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe00998d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe00a843038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fe009ba5fa0 RCX: 00007fe00998d169
RDX: 0000000000000000 RSI: 0000400000000280 RDI: 0000000000000003
RBP: 00007fe009a0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe009ba5fa0 R15: 00007ffdc9be6f48
</TASK>
netdevsim netdevsim4 netdevsim0: left allmulticast mode
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2025-03-11 16:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=67d0668a.050a0220.1939a6.0028.GAE@google.com \
--to=syzbot+368054937a6a7ead5f35@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.