* [syzbot] [x25?] possible deadlock in lapb_data_received
@ 2026-10-19 19:20 syzbot
0 siblings, 0 replies; only message in thread
From: syzbot @ 2026-10-19 19:20 UTC (permalink / raw)
To: linux-kernel, linux-x25, ms, netdev, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 2c7935600733 Merge branch 'bpf-zero-extend-the-index-in-in..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=13598f01580000
kernel config: https://syzkaller.appspot.com/x/.config?x=964a8fc052e56fe5
dashboard link: https://syzkaller.appspot.com/bug?extid=059a2795ad4cff2a2695
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117c5031580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+059a2795ad4cff2a2695@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz-executor220/6011 is trying to acquire lock:
ffffffff913da7b8 (lapb_list_lock){++..}-{3:3}, at: lapb_devtostruct net/lapb/lapb_iface.c:102 [inline]
ffffffff913da7b8 (lapb_list_lock){++..}-{3:3}, at: lapb_data_received+0x2f/0x1c0 net/lapb/lapb_iface.c:394
but task is already holding lock:
ffff88802af94f00 (&lapbeth->up_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
ffff88802af94f00 (&lapbeth->up_lock){+...}-{3:3}, at: lapbeth_rcv+0x24e/0x640 drivers/net/wan/lapbether.c:131
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&lapbeth->up_lock){+...}-{3:3}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
spin_lock_bh include/linux/spinlock.h:353 [inline]
lapbeth_xmit+0x32/0x260 drivers/net/wan/lapbether.c:191
__netdev_start_xmit include/linux/netdevice.h:5432 [inline]
netdev_start_xmit include/linux/netdevice.h:5441 [inline]
xmit_one net/core/dev.c:3953 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3969
__dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:4958
dev_queue_xmit include/linux/netdevice.h:3464 [inline]
tx+0x6b/0x190 drivers/block/aoe/aoenet.c:62
kthread+0x1ed/0x420 drivers/block/aoe/aoecmd.c:1241
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #2 (_xmit_X25#2){+...}-{3:3}:
__raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
spin_lock include/linux/spinlock.h:347 [inline]
__netif_tx_lock include/linux/netdevice.h:4841 [inline]
__dev_queue_xmit+0xe9d/0x3920 net/core/dev.c:4952
neigh_output include/net/neighbour.h:560 [inline]
ip_finish_output2+0xc4b/0x10b0 net/ipv4/ip_output.c:236
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
iptunnel_xmit+0x626/0xd10 net/ipv4/ip_tunnel_core.c:97
udp_tunnel_xmit_skb+0x29b/0x3e0 net/ipv4/udp_tunnel_core.c:187
vxlan_xmit_one+0x21f6/0x2eb0 drivers/net/vxlan/vxlan_core.c:2571
vxlan_xmit+0x1e19/0x33b0 drivers/net/vxlan/vxlan_core.c:2860
__netdev_start_xmit include/linux/netdevice.h:5432 [inline]
netdev_start_xmit include/linux/netdevice.h:5441 [inline]
xmit_one net/core/dev.c:3953 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3969
__dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:4958
lapb_data_transmit+0x90/0xb0 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x163/0x200 net/lapb/lapb_out.c:149
lapb_establish_data_link+0x89/0xe0 net/lapb/lapb_out.c:-1
lapb_device_event+0x4eb/0x680 net/lapb/lapb_iface.c:-1
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
call_netdevice_notifiers net/core/dev.c:2327 [inline]
__dev_notify_flags+0x31e/0x510 net/core/dev.c:9896
netif_change_flags+0xde/0x1b0 net/core/dev.c:9925
dev_change_flags+0x128/0x260 net/core/dev_api.c:68
devinet_ioctl+0x966/0x1c50 net/ipv4/devinet.c:1199
inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1010
sock_do_ioctl+0x101/0x320 net/socket.c:1325
sock_ioctl+0x57a/0x7e0 net/socket.c:1446
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&lapb->lock){+.-.}-{3:3}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
spin_lock_bh include/linux/spinlock.h:353 [inline]
lapb_unregister+0x1e1/0x450 net/lapb/lapb_iface.c:187
lapbeth_close+0x56/0xb0 drivers/net/wan/lapbether.c:350
__dev_close_many+0x366/0x6e0 net/core/dev.c:1798
__dev_close net/core/dev.c:1811 [inline]
__dev_change_flags+0x3f5/0x820 net/core/dev.c:9853
netif_change_flags+0x7c/0x1b0 net/core/dev.c:9920
dev_change_flags+0x128/0x260 net/core/dev_api.c:68
devinet_ioctl+0x966/0x1c50 net/ipv4/devinet.c:1199
inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1010
sock_do_ioctl+0x101/0x320 net/socket.c:1325
sock_ioctl+0x57a/0x7e0 net/socket.c:1446
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (lapb_list_lock){++..}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3209 [inline]
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__raw_read_lock_bh include/linux/rwlock_api_smp.h:192 [inline]
_raw_read_lock_bh+0x3e/0x50 kernel/locking/spinlock.c:287
lapb_devtostruct net/lapb/lapb_iface.c:102 [inline]
lapb_data_received+0x2f/0x1c0 net/lapb/lapb_iface.c:394
lapbeth_rcv+0x34d/0x640 drivers/net/wan/lapbether.c:142
__netif_receive_skb_one_core net/core/dev.c:6297 [inline]
__netif_receive_skb net/core/dev.c:6410 [inline]
netif_receive_skb_internal net/core/dev.c:6496 [inline]
netif_receive_skb+0x4af/0xbf0 net/core/dev.c:6555
tun_rx_batched+0x1de/0x790 drivers/net/tun.c:1571
tun_get_user+0x2be0/0x44d0 drivers/net/tun.c:2045
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2091
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
lapb_list_lock --> _xmit_X25#2 --> &lapbeth->up_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&lapbeth->up_lock);
lock(_xmit_X25#2);
lock(&lapbeth->up_lock);
rlock(lapb_list_lock);
*** DEADLOCK ***
locks held by syz-executor220/6011: 4, last CPU#0:
#0: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: tun_get_user+0x27b0/0x44d0 drivers/net/tun.c:1986
#1: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_internal net/core/dev.c:6483 [inline]
#1: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb+0x102/0xbf0 net/core/dev.c:6555
#2: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#2: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: lapbeth_rcv+0x12f/0x640 drivers/net/wan/lapbether.c:127
#3: ffff88802af94f00 (&lapbeth->up_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
#3: ffff88802af94f00 (&lapbeth->up_lock){+...}-{3:3}, at: lapbeth_rcv+0x24e/0x640 drivers/net/wan/lapbether.c:131
stack backtrace:
CPU: 0 UID: 0 PID: 6011 Comm: syz-executor220 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
check_prev_add kernel/locking/lockdep.c:3209 [inline]
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__raw_read_lock_bh include/linux/rwlock_api_smp.h:192 [inline]
_raw_read_lock_bh+0x3e/0x50 kernel/locking/spinlock.c:287
lapb_devtostruct net/lapb/lapb_iface.c:102 [inline]
lapb_data_received+0x2f/0x1c0 net/lapb/lapb_iface.c:394
lapbeth_rcv+0x34d/0x640 drivers/net/wan/lapbether.c:142
__netif_receive_skb_one_core net/core/dev.c:6297 [inline]
__netif_receive_skb net/core/dev.c:6410 [inline]
netif_receive_skb_internal net/core/dev.c:6496 [inline]
netif_receive_skb+0x4af/0xbf0 net/core/dev.c:6555
tun_rx_batched+0x1de/0x790 drivers/net/tun.c:1571
tun_get_user+0x2be0/0x44d0 drivers/net/tun.c:2045
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2091
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f523ead1137
Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcbef91f00 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00005555890c4400 RCX: 00007f523ead1137
RDX: 0000000000000010 RSI: 00007ffcbef91fb0 RDI: 0000000000000006
RBP: 0000000000000006 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
R13: 00007ffcbef91fb0 R14: 00007ffcbef91fa0 R15: 000000000000002c
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-10-19 19:20 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-19 19:20 [syzbot] [x25?] possible deadlock in lapb_data_received syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox