====================================================== WARNING: possible circular locking dependency detected 4.17.0-rc2+ #22 Not tainted ------------------------------------------------------ syz-executor0/7509 is trying to acquire lock: (ptrval) (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1469 [inline] (ptrval) (sk_lock-AF_INET6){+.+.}, at: tcp_mmap+0x1c7/0x14f0 net/ipv4/tcp.c:1759 but task is already holding lock: (ptrval) (&mm->mmap_sem){++++}, at: vm_mmap_pgoff+0x1a1/0x2a0 mm/util.c:355 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: cannot load conntrack support for proto=7 -> #1 (&mm->mmap_sem){++++}: __might_fault+0x155/0x1e0 mm/memory.c:4555 _copy_from_iter_full+0x2fd/0xd10 lib/iov_iter.c:607 copy_from_iter_full include/linux/uio.h:124 [inline] udplite_getfrag+0x34/0x60 include/net/udplite.h:24 __ip_append_data.isra.47+0xce9/0x29b0 net/ipv4/ip_output.c:1085 ip_append_data.part.48+0xf3/0x180 net/ipv4/ip_output.c:1190 ip_append_data+0x6d/0x90 net/ipv4/ip_output.c:1179 udp_sendmsg+0xf83/0x3450 net/ipv4/udp.c:1123 udpv6_sendmsg+0x2747/0x32a0 net/ipv6/udp.c:1197 inet_sendmsg+0x19f/0x690 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:639 ___sys_sendmsg+0x525/0x940 net/socket.c:2117 __sys_sendmmsg+0x240/0x6f0 net/socket.c:2212 __do_sys_sendmmsg net/socket.c:2241 [inline] __se_sys_sendmmsg net/socket.c:2238 [inline] __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2238 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe cannot load conntrack support for proto=7 -> #0 (sk_lock-AF_INET6){+.+.}: lock_acquire+0x1dc/0x520 kernel/locking/lockdep.c:3920 lock_sock_nested+0xd0/0x120 net/core/sock.c:2844 lock_sock include/net/sock.h:1469 [inline] tcp_mmap+0x1c7/0x14f0 net/ipv4/tcp.c:1759 sock_mmap+0x8e/0xc0 net/socket.c:1144 call_mmap include/linux/fs.h:1789 [inline] mmap_region+0xd13/0x1820 mm/mmap.c:1723 do_mmap+0xc79/0x11d0 mm/mmap.c:1494 do_mmap_pgoff include/linux/mm.h:2237 [inline] vm_mmap_pgoff+0x1fb/0x2a0 mm/util.c:357 ksys_mmap_pgoff+0x4c9/0x640 mm/mmap.c:1544 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline] __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&mm->mmap_sem); lock(sk_lock-AF_INET6); lock(&mm->mmap_sem); lock(sk_lock-AF_INET6); *** DEADLOCK *** 1 lock held by syz-executor0/7509: #0: (ptrval) (&mm->mmap_sem){++++}, at: vm_mmap_pgoff+0x1a1/0x2a0 mm/util.c:355 stack backtrace: CPU: 0 PID: 7509 Comm: syz-executor0 Not tainted 4.17.0-rc2+ #22 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 print_circular_bug.isra.36.cold.54+0x1bd/0x27d kernel/locking/lockdep.c:1223 check_prev_add kernel/locking/lockdep.c:1863 [inline] check_prevs_add kernel/locking/lockdep.c:1976 [inline] validate_chain kernel/locking/lockdep.c:2417 [inline] __lock_acquire+0x343e/0x5140 kernel/locking/lockdep.c:3431 lock_acquire+0x1dc/0x520 kernel/locking/lockdep.c:3920 lock_sock_nested+0xd0/0x120 net/core/sock.c:2844 lock_sock include/net/sock.h:1469 [inline] tcp_mmap+0x1c7/0x14f0 net/ipv4/tcp.c:1759 sock_mmap+0x8e/0xc0 net/socket.c:1144 call_mmap include/linux/fs.h:1789 [inline] mmap_region+0xd13/0x1820 mm/mmap.c:1723 do_mmap+0xc79/0x11d0 mm/mmap.c:1494 do_mmap_pgoff include/linux/mm.h:2237 [inline] vm_mmap_pgoff+0x1fb/0x2a0 mm/util.c:357 ksys_mmap_pgoff+0x4c9/0x640 mm/mmap.c:1544 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline] __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x455979 RSP: 002b:00007ff8007c4c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007ff8007c56d4 RCX: 0000000000455979 RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffc000 RBP: 000000000072bea0 R08: 0000000000000013 R09: 0000000000000000 R10: 0000000000002811 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000003fe R14: 00000000006f9070 R15: 0000000000000000 RDS: rds_bind could not find a transport for 224.0.0.2, load rds_tcp or rds_rdma? RDS: rds_bind could not find a transport for 224.0.0.2, load rds_tcp or rds_rdma? netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 'syz-executor5': attribute type 3 has an invalid length. netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. kernel msg: ebtables bug: please report to author: entry offsets not in right order netlink: 'syz-executor3': attribute type 25 has an invalid length. netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. kernel msg: ebtables bug: please report to author: entry offsets not in right order TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'. IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'. IPVS: ftp: loaded support on port[0] = 21 netlink: 'syz-executor2': attribute type 1 has an invalid length. netlink: 'syz-executor2': attribute type 1 has an invalid length. bridge0: port 3(erspan0) entered blocking state bridge0: port 3(erspan0) entered disabled state device erspan0 entered promiscuous mode netlink: 'syz-executor2': attribute type 1 has an invalid length. bridge0: port 3(erspan0) entered blocking state bridge0: port 3(erspan0) entered forwarding state netlink: 'syz-executor2': attribute type 1 has an invalid length. FAULT_INJECTION: forcing a failure. name fail_page_alloc, interval 1, probability 0, space 0, times 1 CPU: 0 PID: 8315 Comm: syz-executor3 Not tainted 4.17.0-rc2+ #22 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.4+0xa/0x1a lib/fault-inject.c:149 should_fail_alloc_page mm/page_alloc.c:3082 [inline] prepare_alloc_pages mm/page_alloc.c:4322 [inline] __alloc_pages_nodemask+0x34e/0xd70 mm/page_alloc.c:4358 alloc_pages_current+0x10c/0x210 mm/mempolicy.c:2093 alloc_pages include/linux/gfp.h:492 [inline] skb_page_frag_refill+0x453/0x6a0 net/core/sock.c:2214 tun_build_skb.isra.51+0x345/0x2040 drivers/net/tun.c:1631 tun_get_user+0xc04/0x3ff0 drivers/net/tun.c:1807 tun_chr_write_iter+0xb9/0x154 drivers/net/tun.c:1996 call_write_iter include/linux/fs.h:1784 [inline] do_iter_readv_writev+0x859/0xa50 fs/read_write.c:680 do_iter_write+0x185/0x5f0 fs/read_write.c:959 vfs_writev+0x1c7/0x330 fs/read_write.c:1004 do_writev+0x112/0x2f0 fs/read_write.c:1039 __do_sys_writev fs/read_write.c:1112 [inline] __se_sys_writev fs/read_write.c:1109 [inline] __x64_sys_writev+0x75/0xb0 fs/read_write.c:1109 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x455831 RSP: 002b:00007f70ae71bba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000066 RCX: 0000000000455831 RDX: 0000000000000001 RSI: 00007f70ae71bbf0 RDI: 00000000000000fc RBP: 0000000020000080 R08: 00000000000000fc R09: 0000000000000000 R10: 0000000000000066 R11: 0000000000000293 R12: 0000000000000013 R13: 0000000000000661 R14: 00000000006fc9b8 R15: 0000000000000000 netlink: 'syz-executor2': attribute type 1 has an invalid length. netlink: 'syz-executor2': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 3 has an invalid length. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 1 PID: 8393 Comm: syz-executor3 Not tainted 4.17.0-rc2+ #22 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 netlink: 'syz-executor4': attribute type 1 has an invalid length. fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.4+0xa/0x1a lib/fault-inject.c:149 netlink: 'syz-executor4': attribute type 3 has an invalid length. kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher kernel msg: ebtables bug: please report to author: bad policy kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher __should_failslab+0x124/0x180 mm/failslab.c:32 should_failslab+0x9/0x14 mm/slab_common.c:1522 slab_pre_alloc_hook mm/slab.h:423 [inline] slab_alloc mm/slab.c:3378 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3552 kernel msg: ebtables bug: please report to author: bad policy __build_skb+0xa3/0x410 net/core/skbuff.c:281 build_skb+0x6f/0x2e0 net/core/skbuff.c:312 netlink: 'syz-executor2': attribute type 1 has an invalid length. tun_build_skb.isra.51+0x878/0x2040 drivers/net/tun.c:1701 netlink: 'syz-executor2': attribute type 1 has an invalid length. tun_get_user+0xc04/0x3ff0 drivers/net/tun.c:1807 netlink: 'syz-executor0': attribute type 21 has an invalid length. tun_chr_write_iter+0xb9/0x154 drivers/net/tun.c:1996 call_write_iter include/linux/fs.h:1784 [inline] do_iter_readv_writev+0x859/0xa50 fs/read_write.c:680 do_iter_write+0x185/0x5f0 fs/read_write.c:959 vfs_writev+0x1c7/0x330 fs/read_write.c:1004 netlink: 'syz-executor0': attribute type 21 has an invalid length. do_writev+0x112/0x2f0 fs/read_write.c:1039 __do_sys_writev fs/read_write.c:1112 [inline] __se_sys_writev fs/read_write.c:1109 [inline] __x64_sys_writev+0x75/0xb0 fs/read_write.c:1109 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x455831 RSP: 002b:00007f70ae71bba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000066 RCX: 0000000000455831 RDX: 0000000000000001 RSI: 00007f70ae71bbf0 RDI: 00000000000000fc RBP: 0000000020000080 R08: 00000000000000fc R09: 0000000000000000 R10: 0000000000000066 R11: 0000000000000293 R12: 0000000000000013 R13: 0000000000000661 R14: 00000000006fc9b8 R15: 0000000000000001