vxcan0: j1939_tp_rxtimer: 0x00000000bc1e8329: rx timeout, send abort ====================================================== WARNING: possible circular locking dependency detected 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0 Not tainted ------------------------------------------------------ syz-executor.4/5783 is trying to acquire lock: ffff000139d250d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline] ffff000139d250d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: j1939_sk_errqueue+0x5c/0xe8 net/can/j1939/socket.c:1081 but task is already holding lock: ffff000139d25088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline] ffff000139d25088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline] ffff000139d25088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_tp_rxtimer+0x60/0x55c net/can/j1939/transport.c:1248 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&priv->active_session_list_lock){+.-.}-{2:2}: __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] j1939_session_list_lock net/can/j1939/transport.c:238 [inline] j1939_session_activate+0x34/0x274 net/can/j1939/transport.c:1561 j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline] j1939_sk_queue_activate_next+0x134/0x200 net/can/j1939/socket.c:208 j1939_session_deactivate_activate_next net/can/j1939/transport.c:1109 [inline] j1939_session_completed net/can/j1939/transport.c:1222 [inline] j1939_xtp_rx_eoma_one+0x264/0x33c net/can/j1939/transport.c:1392 j1939_xtp_rx_eoma net/can/j1939/transport.c:1407 [inline] j1939_tp_cmd_recv+0x518/0xa08 net/can/j1939/transport.c:2096 j1939_tp_recv+0x150/0x304 net/can/j1939/transport.c:2141 j1939_can_recv+0x380/0x4d8 net/can/j1939/main.c:112 deliver net/can/af_can.c:572 [inline] can_rcv_filter+0x134/0x30c net/can/af_can.c:606 can_receive+0x194/0x26c net/can/af_can.c:663 can_rcv+0x9c/0x124 net/can/af_can.c:687 __netif_receive_skb_one_core net/core/dev.c:5482 [inline] __netif_receive_skb+0x70/0x14c net/core/dev.c:5596 process_backlog+0x240/0x388 net/core/dev.c:5924 __napi_poll+0x5c/0x24c net/core/dev.c:6485 napi_poll+0x110/0x484 net/core/dev.c:6552 net_rx_action+0x18c/0x414 net/core/dev.c:6663 _stext+0x168/0x37c ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq+0x70/0xbc kernel/softirq.c:452 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:580 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] count_memcg_events include/linux/memcontrol.h:1065 [inline] count_memcg_event_mm+0x1a4/0x290 include/linux/memcontrol.h:1097 handle_mm_fault+0xd0/0xb28 mm/memory.c:5196 __do_page_fault arch/arm64/mm/fault.c:512 [inline] do_page_fault+0x428/0x79c arch/arm64/mm/fault.c:612 do_translation_fault+0x78/0x194 arch/arm64/mm/fault.c:695 do_mem_abort+0x54/0x130 arch/arm64/mm/fault.c:831 el0_da+0x70/0x16c arch/arm64/kernel/entry-common.c:515 el0t_64_sync_handler+0xcc/0xf0 arch/arm64/kernel/entry-common.c:658 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 -> #1 (&jsk->sk_session_queue_lock){+.-.}-{2:2}: __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] j1939_sk_queue_drop_all+0x38/0xf8 net/can/j1939/socket.c:139 j1939_sk_netdev_event_netdown+0x94/0xd8 net/can/j1939/socket.c:1275 j1939_netdev_notify+0x80/0x150 net/can/j1939/main.c:379 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0x7c/0x108 kernel/notifier.c:455 __dev_notify_flags+0x184/0x300 dev_change_flags+0x80/0xa4 net/core/dev.c:8607 do_setlink+0x628/0x17a4 net/core/rtnetlink.c:2827 __rtnl_newlink net/core/rtnetlink.c:3590 [inline] rtnl_newlink+0x98c/0xa08 net/core/rtnetlink.c:3637 rtnetlink_rcv_msg+0x484/0x82c net/core/rtnetlink.c:6141 netlink_rcv_skb+0xfc/0x1e8 net/netlink/af_netlink.c:2564 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6159 netlink_unicast_kernel+0xfc/0x1dc net/netlink/af_netlink.c:1330 netlink_unicast+0x164/0x248 net/netlink/af_netlink.c:1356 netlink_sendmsg+0x484/0x584 net/netlink/af_netlink.c:1932 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x2f8/0x440 net/socket.c:2476 ___sys_sendmsg net/socket.c:2530 [inline] __sys_sendmsg+0x1ac/0x228 net/socket.c:2559 __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __arm64_sys_sendmsg+0x2c/0x3c net/socket.c:2566 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 -> #0 (&priv->j1939_socks_lock){+.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3097 [inline] check_prevs_add kernel/locking/lockdep.c:3216 [inline] validate_chain kernel/locking/lockdep.c:3831 [inline] __lock_acquire+0x1530/0x3084 kernel/locking/lockdep.c:5055 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] j1939_sk_errqueue+0x5c/0xe8 net/can/j1939/socket.c:1081 __j1939_session_cancel+0x29c/0x2b4 net/can/j1939/transport.c:1132 j1939_tp_rxtimer+0x2b4/0x55c net/can/j1939/transport.c:1257 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x210/0x390 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x8c/0x1d8 kernel/time/hrtimer.c:1766 _stext+0x168/0x37c ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq+0x70/0xbc kernel/softirq.c:452 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:580 arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:122 lock_is_held include/linux/lockdep.h:283 [inline] __might_resched+0x7c/0x218 kernel/sched/core.c:9947 do_recvmmsg+0x4c0/0x64c net/socket.c:2865 __sys_recvmmsg net/socket.c:2910 [inline] __do_sys_recvmmsg net/socket.c:2933 [inline] __se_sys_recvmmsg net/socket.c:2926 [inline] __arm64_sys_recvmmsg+0xbc/0x160 net/socket.c:2926 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 other info that might help us debug this: Chain exists of: &priv->j1939_socks_lock --> &jsk->sk_session_queue_lock --> &priv->active_session_list_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&priv->active_session_list_lock); lock(&jsk->sk_session_queue_lock); lock(&priv->active_session_list_lock); lock(&priv->j1939_socks_lock); *** DEADLOCK *** 1 lock held by syz-executor.4/5783: #0: ffff000139d25088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline] #0: ffff000139d25088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline] #0: ffff000139d25088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_tp_rxtimer+0x60/0x55c net/can/j1939/transport.c:1248 stack backtrace: CPU: 1 PID: 5783 Comm: syz-executor.4 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_circular_bug+0x2c4/0x2c8 kernel/locking/lockdep.c:2055 check_noncircular+0x14c/0x154 kernel/locking/lockdep.c:2177 check_prev_add kernel/locking/lockdep.c:3097 [inline] check_prevs_add kernel/locking/lockdep.c:3216 [inline] validate_chain kernel/locking/lockdep.c:3831 [inline] __lock_acquire+0x1530/0x3084 kernel/locking/lockdep.c:5055 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] j1939_sk_errqueue+0x5c/0xe8 net/can/j1939/socket.c:1081 __j1939_session_cancel+0x29c/0x2b4 net/can/j1939/transport.c:1132 j1939_tp_rxtimer+0x2b4/0x55c net/can/j1939/transport.c:1257 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x210/0x390 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x8c/0x1d8 kernel/time/hrtimer.c:1766 _stext+0x168/0x37c ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq+0x70/0xbc kernel/softirq.c:452 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:580 arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:122 lock_is_held include/linux/lockdep.h:283 [inline] __might_resched+0x7c/0x218 kernel/sched/core.c:9947 do_recvmmsg+0x4c0/0x64c net/socket.c:2865 __sys_recvmmsg net/socket.c:2910 [inline] __do_sys_recvmmsg net/socket.c:2933 [inline] __se_sys_recvmmsg net/socket.c:2926 [inline] __arm64_sys_recvmmsg+0xbc/0x160 net/socket.c:2926 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 vxcan0: j1939_tp_rxtimer: 0x00000000bc1e8329: abort rx timeout. Force session deactivation