public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
[parent not found: <PN2PR01MB4891E7B8CF9B3C1531CB9ADEFCFB2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <20240606141413.137516-1-norkam41@gmail.com>]
[parent not found: <20240606135139.134172-1-norkam41@gmail.com>]
[parent not found: <MAXPR01MB316750CFC54579A6A384FF91F7FA2@MAXPR01MB3167.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB4891DFF0F26C14B0A7ED225EFCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB489146FC0041ED737236BE64FCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB4891F53CC6107BBDB25C8C09FCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB489159F2619858474EF92FC5FCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB489190072C2A23C3C1CCCE2FFCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB48911035081582F4B9893F9FFCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB4891AE31D63427B828C79ECBFCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB4891BF795360AE31E349CFECFCF92@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB4891734D357ACCDDD106F360FCF92@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB489119119088A1E7091BB6B9FCF92@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
[parent not found: <PN2PR01MB489171CD7B0E226F8256C23DFCF92@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>]
* [syzbot] [bpf?] possible deadlock in trie_delete_elem
@ 2024-03-20  8:42 syzbot
  2024-03-20 10:32 ` Hillf Danton
                   ` (2 more replies)
  0 siblings, 3 replies; 23+ messages in thread
From: syzbot @ 2024-03-20  8:42 UTC (permalink / raw)
  To: andrii, ast, bpf, daniel, eddyz87, haoluo, john.fastabend, jolsa,
	kpsingh, linux-kernel, martin.lau, netdev, sdf, song,
	syzkaller-bugs, yonghong.song

Hello,

syzbot found the following issue on:

HEAD commit:    32fa4366cc4d net: phy: fix phy_read_poll_timeout argument ..
git tree:       net
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16f5d769180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6fb1be60a193d440
dashboard link: https://syzkaller.appspot.com/bug?extid=9d95beb2a3c260622518
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14572985180000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1676fc6e180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bb05871df8fc/disk-32fa4366.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a774323fb6ec/vmlinux-32fa4366.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1742ae20d76c/bzImage-32fa4366.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9d95beb2a3c260622518@syzkaller.appspotmail.com

============================================
WARNING: possible recursive locking detected
6.8.0-syzkaller-05242-g32fa4366cc4d #0 Not tainted
--------------------------------------------
syz-executor217/5072 is trying to acquire lock:
ffff88802a0fd9f8 (&trie->lock){....}-{2:2}, at: trie_delete_elem+0x96/0x6a0 kernel/bpf/lpm_trie.c:451

but task is already holding lock:
ffff88802a0fc9f8 (&trie->lock){....}-{2:2}, at: trie_update_elem+0xcb/0xc10 kernel/bpf/lpm_trie.c:324

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&trie->lock);
  lock(&trie->lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor217/5072:
 #0: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #0: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #0: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: bpf_map_update_value+0x3c4/0x540 kernel/bpf/syscall.c:202
 #1: ffff88802a0fc9f8 (&trie->lock){....}-{2:2}, at: trie_update_elem+0xcb/0xc10 kernel/bpf/lpm_trie.c:324
 #2: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #2: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #2: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline]
 #2: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x16e/0x490 kernel/trace/bpf_trace.c:2422

stack backtrace:
CPU: 0 PID: 5072 Comm: syz-executor217 Not tainted 6.8.0-syzkaller-05242-g32fa4366cc4d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
 check_deadlock kernel/locking/lockdep.c:3062 [inline]
 validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856
 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
 trie_delete_elem+0x96/0x6a0 kernel/bpf/lpm_trie.c:451
 bpf_prog_2c29ac5cdc6b1842+0x42/0x46
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
 bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422
 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline]
 __alloc_pages+0x657/0x680 mm/page_alloc.c:4591
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 __kmalloc_large_node+0x91/0x1f0 mm/slub.c:3926
 __do_kmalloc_node mm/slub.c:3969 [inline]
 __kmalloc_node+0x33c/0x4e0 mm/slub.c:3988
 kmalloc_node include/linux/slab.h:610 [inline]
 bpf_map_kmalloc_node+0xd3/0x1c0 kernel/bpf/syscall.c:422
 lpm_trie_node_alloc kernel/bpf/lpm_trie.c:291 [inline]
 trie_update_elem+0x1d3/0xc10 kernel/bpf/lpm_trie.c:333
 bpf_map_update_value+0x4d3/0x540 kernel/bpf/syscall.c:203
 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641
 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619
 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5736 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736
 do_syscall_64+0xfb/0x240
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f933485e7a9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc8852b528 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 23+ messages in thread

end of thread, other threads:[~2025-05-08 23:40 UTC | newest]

Thread overview: 23+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <20240606140352.135948-1-norkam41@gmail.com>
2024-06-06 14:26 ` [syzbot] [bpf?] possible deadlock in trie_delete_elem syzbot
     [not found] <PN2PR01MB4891E7B8CF9B3C1531CB9ADEFCFB2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-07  7:45 ` syzbot
     [not found] <20240606141413.137516-1-norkam41@gmail.com>
2024-06-06 14:38 ` syzbot
     [not found] <20240606135139.134172-1-norkam41@gmail.com>
2024-06-06 13:55 ` syzbot
     [not found] <MAXPR01MB316750CFC54579A6A384FF91F7FA2@MAXPR01MB3167.INDPRD01.PROD.OUTLOOK.COM>
2024-06-06 13:40 ` syzbot
     [not found] <PN2PR01MB4891DFF0F26C14B0A7ED225EFCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-06 13:39 ` syzbot
     [not found] <PN2PR01MB489146FC0041ED737236BE64FCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-06 13:17 ` syzbot
     [not found] <PN2PR01MB4891F53CC6107BBDB25C8C09FCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-06 13:10 ` syzbot
     [not found] <PN2PR01MB489159F2619858474EF92FC5FCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-06 12:32 ` syzbot
     [not found] <PN2PR01MB489190072C2A23C3C1CCCE2FFCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-06 12:12 ` syzbot
     [not found] <PN2PR01MB48911035081582F4B9893F9FFCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-06 11:47 ` syzbot
     [not found] <PN2PR01MB4891AE31D63427B828C79ECBFCFA2@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-06  9:27 ` syzbot
     [not found] <PN2PR01MB4891BF795360AE31E349CFECFCF92@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-05  8:24 ` syzbot
     [not found] <PN2PR01MB4891734D357ACCDDD106F360FCF92@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-05  7:57 ` syzbot
     [not found] <PN2PR01MB489119119088A1E7091BB6B9FCF92@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-05  7:39 ` syzbot
     [not found] <PN2PR01MB489171CD7B0E226F8256C23DFCF92@PN2PR01MB4891.INDPRD01.PROD.OUTLOOK.COM>
2024-06-05  7:17 ` syzbot
2024-03-20  8:42 syzbot
2024-03-20 10:32 ` Hillf Danton
2024-03-20 19:42   ` syzbot
2024-03-20 14:20 ` syzbot
2025-05-08  7:13 ` syzbot
2025-05-08 18:00   ` Alexei Starovoitov
2025-05-08 23:39   ` Kumar Kartikeya Dwivedi

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox