syzbot


possible deadlock in ppp_input

Status: upstream: reported on 2024/09/14 14:35
Reported-by: syzbot+32f622ecfda20eccd42d@syzkaller.appspotmail.com
First crash: 97d, last: 65d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 possible deadlock in ppp_input 7 66d 87d 0/3 upstream: reported on 2024/09/25 02:52
upstream possible deadlock in ppp_input ppp 197 74d 95d 0/28 auto-obsoleted due to no activity on 2024/12/17 07:14

Sample crash report:
=====================================================
WARNING: SOFTIRQ-READ-safe -> SOFTIRQ-READ-unsafe lock order detected
5.15.167-syzkaller #0 Not tainted
-----------------------------------------------------
syz.3.652/7412 [HC0[0]:SC0[8]:HE1:SE0] is trying to acquire:
ffff8880750b91e0 (&pch->downl){+.+.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline]
ffff8880750b91e0 (&pch->downl){+.+.}-{2:2}, at: ppp_connect_channel+0x190/0x640 drivers/net/ppp/ppp_generic.c:3484

and this task is already holding:
ffff888077558dd0 (&ppp->rlock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline]
ffff888077558dd0 (&ppp->rlock){+...}-{2:2}, at: ppp_connect_channel+0x181/0x640 drivers/net/ppp/ppp_generic.c:3483
which would create a new lock dependency:
 (&ppp->rlock){+...}-{2:2} -> (&pch->downl){+.+.}-{2:2}

but this new dependency connects a SOFTIRQ-READ-irq-safe lock:
 (&pch->upl){++.-}-{2:2}

... which became SOFTIRQ-READ-irq-safe at:
  lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
  __raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
  _raw_read_lock_bh+0x39/0x50 kernel/locking/spinlock.c:252
  ppp_input+0x361/0x980 drivers/net/ppp/ppp_generic.c:2306
  ppp_async_process+0x7b/0x140 drivers/net/ppp/ppp_async.c:505
  tasklet_action_common+0x3cb/0x4a0
  handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
  __do_softirq kernel/softirq.c:592 [inline]
  invoke_softirq kernel/softirq.c:432 [inline]
  __irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
  irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
  sysvec_call_function_single+0x8e/0xb0 arch/x86/kernel/smp.c:243
  asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:646
  preempt_schedule_irq+0xf2/0x1c0 kernel/sched/core.c:6777
  irqentry_exit+0x53/0x80 kernel/entry/common.c:432
  asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:643
  __tasklet_schedule_common+0x1f9/0x260 kernel/softirq.c:737
  tasklet_schedule include/linux/interrupt.h:657 [inline]
  ppp_asynctty_receive+0x1ea2/0x2000 drivers/net/ppp/ppp_async.c:354
  tty_ldisc_receive_buf+0x121/0x160 drivers/tty/tty_buffer.c:455
  tty_port_default_receive_buf+0x6a/0x90 drivers/tty/tty_port.c:39
  receive_buf drivers/tty/tty_buffer.c:471 [inline]
  flush_to_ldisc+0x2b9/0x540 drivers/tty/tty_buffer.c:523
  process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
  worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
  kthread+0x3f6/0x4f0 kernel/kthread.c:334
  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

to a SOFTIRQ-READ-irq-unsafe lock:
 (&pch->downl){+.+.}-{2:2}

... which became SOFTIRQ-READ-irq-unsafe at:
...
  lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
  spin_lock include/linux/spinlock.h:363 [inline]
  ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2271 [inline]
  ppp_input+0x160/0x980 drivers/net/ppp/ppp_generic.c:2303
  pppoe_rcv_core+0x109/0x2f0 drivers/net/ppp/pppoe.c:379
  sk_backlog_rcv include/net/sock.h:1059 [inline]
  __release_sock+0x198/0x4b0 net/core/sock.c:2724
  release_sock+0x5d/0x1c0 net/core/sock.c:3265
  pppoe_sendmsg+0xd1/0x740 drivers/net/ppp/pppoe.c:903
  sock_sendmsg_nosec net/socket.c:704 [inline]
  __sock_sendmsg net/socket.c:716 [inline]
  ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2431
  ___sys_sendmsg+0x252/0x2e0 net/socket.c:2485
  __sys_sendmmsg+0x2bf/0x560 net/socket.c:2571
  __do_sys_sendmmsg net/socket.c:2600 [inline]
  __se_sys_sendmmsg net/socket.c:2597 [inline]
  __x64_sys_sendmmsg+0x9c/0xb0 net/socket.c:2597
  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
  do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
  entry_SYSCALL_64_after_hwframe+0x66/0xd0

other info that might help us debug this:

Chain exists of:
  &pch->upl --> &ppp->rlock --> &pch->downl

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&pch->downl);
                               local_irq_disable();
                               lock(&pch->upl);
                               lock(&ppp->rlock);
  <Interrupt>
    lock(&pch->upl);

 *** DEADLOCK ***

5 locks held by syz.3.652/7412:
 #0: ffffffff8d2c7a48 (ppp_mutex){+.+.}-{3:3}, at: ppp_ioctl+0x10e/0x1cd0 drivers/net/ppp/ppp_generic.c:726
 #1: ffff888027df44c0 (&pn->all_ppp_mutex){+.+.}-{3:3}, at: ppp_connect_channel+0x5e/0x640 drivers/net/ppp/ppp_generic.c:3473
 #2: ffff8880750b9240 (&pch->upl){++.-}-{2:2}, at: ppp_connect_channel+0x87/0x640 drivers/net/ppp/ppp_generic.c:3477
 #3: ffff888077558e10 (&ppp->wlock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline]
 #3: ffff888077558e10 (&ppp->wlock){+...}-{2:2}, at: ppp_connect_channel+0x170/0x640 drivers/net/ppp/ppp_generic.c:3483
 #4: ffff888077558dd0 (&ppp->rlock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline]
 #4: ffff888077558dd0 (&ppp->rlock){+...}-{2:2}, at: ppp_connect_channel+0x181/0x640 drivers/net/ppp/ppp_generic.c:3483

the dependencies between SOFTIRQ-READ-irq-safe lock and the holding lock:
  -> (&pch->upl){++.-}-{2:2} {
     HARDIRQ-ON-W at:
                        lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                        __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
                        _raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:324
                        ppp_disconnect_channel+0x2f/0x2d0 drivers/net/ppp/ppp_generic.c:3521
                        ppp_unregister_channel+0xb5/0x2f0 drivers/net/ppp/ppp_generic.c:2995
                        pppox_unbind_sock+0x58/0xa0 drivers/net/ppp/pppox.c:58
                        pppoe_release+0x158/0x800 drivers/net/ppp/pppoe.c:584
                        __sock_release net/socket.c:649 [inline]
                        sock_close+0xcd/0x230 net/socket.c:1336
                        __fput+0x3fe/0x8e0 fs/file_table.c:280
                        task_work_run+0x129/0x1a0 kernel/task_work.c:188
                        exit_task_work include/linux/task_work.h:33 [inline]
                        do_exit+0x6a3/0x2480 kernel/exit.c:874
                        do_group_exit+0x144/0x310 kernel/exit.c:996
                        get_signal+0xc66/0x14e0 kernel/signal.c:2897
                        arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
                        handle_signal_work kernel/entry/common.c:154 [inline]
                        exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178
                        exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
                        __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
                        syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
                        do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
                        entry_SYSCALL_64_after_hwframe+0x66/0xd0
     HARDIRQ-ON-R at:
                        lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                        __raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
                        _raw_read_lock_bh+0x39/0x50 kernel/locking/spinlock.c:252
                        ppp_channel_push+0x2c/0x220 drivers/net/ppp/ppp_generic.c:2185
                        ppp_write+0x291/0x390 drivers/net/ppp/ppp_generic.c:537
                        do_iter_write+0x39c/0x760 fs/read_write.c:857
                        vfs_writev fs/read_write.c:928 [inline]
                        do_pwritev+0x219/0x360 fs/read_write.c:1025
                        do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                        do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
                        entry_SYSCALL_64_after_hwframe+0x66/0xd0
     IN-SOFTIRQ-R at:
                        lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                        __raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
                        _raw_read_lock_bh+0x39/0x50 kernel/locking/spinlock.c:252
                        ppp_input+0x361/0x980 drivers/net/ppp/ppp_generic.c:2306
                        ppp_async_process+0x7b/0x140 drivers/net/ppp/ppp_async.c:505
                        tasklet_action_common+0x3cb/0x4a0
                        handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
                        __do_softirq kernel/softirq.c:592 [inline]
                        invoke_softirq kernel/softirq.c:432 [inline]
                        __irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
                        irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
                        sysvec_call_function_single+0x8e/0xb0 arch/x86/kernel/smp.c:243
                        asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:646
                        preempt_schedule_irq+0xf2/0x1c0 kernel/sched/core.c:6777
                        irqentry_exit+0x53/0x80 kernel/entry/common.c:432
                        asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:643
                        __tasklet_schedule_common+0x1f9/0x260 kernel/softirq.c:737
                        tasklet_schedule include/linux/interrupt.h:657 [inline]
                        ppp_asynctty_receive+0x1ea2/0x2000 drivers/net/ppp/ppp_async.c:354
                        tty_ldisc_receive_buf+0x121/0x160 drivers/tty/tty_buffer.c:455
                        tty_port_default_receive_buf+0x6a/0x90 drivers/tty/tty_port.c:39
                        receive_buf drivers/tty/tty_buffer.c:471 [inline]
                        flush_to_ldisc+0x2b9/0x540 drivers/tty/tty_buffer.c:523
                        process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
                        worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
                        kthread+0x3f6/0x4f0 kernel/kthread.c:334
                        ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
     INITIAL USE at:
                       lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                       __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
                       _raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:324
                       ppp_disconnect_channel+0x2f/0x2d0 drivers/net/ppp/ppp_generic.c:3521
                       ppp_unregister_channel+0xb5/0x2f0 drivers/net/ppp/ppp_generic.c:2995
                       pppox_unbind_sock+0x58/0xa0 drivers/net/ppp/pppox.c:58
                       pppoe_release+0x158/0x800 drivers/net/ppp/pppoe.c:584
                       __sock_release net/socket.c:649 [inline]
                       sock_close+0xcd/0x230 net/socket.c:1336
                       __fput+0x3fe/0x8e0 fs/file_table.c:280
                       task_work_run+0x129/0x1a0 kernel/task_work.c:188
                       exit_task_work include/linux/task_work.h:33 [inline]
                       do_exit+0x6a3/0x2480 kernel/exit.c:874
                       do_group_exit+0x144/0x310 kernel/exit.c:996
                       get_signal+0xc66/0x14e0 kernel/signal.c:2897
                       arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
                       handle_signal_work kernel/entry/common.c:154 [inline]
                       exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178
                       exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
                       __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
                       syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
                       do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
                       entry_SYSCALL_64_after_hwframe+0x66/0xd0
     INITIAL READ USE at:
                            lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                            __raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
                            _raw_read_lock_bh+0x39/0x50 kernel/locking/spinlock.c:252
                            ppp_channel_push+0x2c/0x220 drivers/net/ppp/ppp_generic.c:2185
                            ppp_write+0x291/0x390 drivers/net/ppp/ppp_generic.c:537
                            do_iter_write+0x39c/0x760 fs/read_write.c:857
                            vfs_writev fs/read_write.c:928 [inline]
                            do_pwritev+0x219/0x360 fs/read_write.c:1025
                            do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                            do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
                            entry_SYSCALL_64_after_hwframe+0x66/0xd0
   }
   ... key      at: [<ffffffff96bb1580>] ppp_register_net_channel.__key.3+0x0/0x20
 -> (&ppp->wlock){+...}-{2:2} {
    HARDIRQ-ON-W at:
                      lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                      __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                      _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                      spin_lock_bh include/linux/spinlock.h:368 [inline]
                      ppp_get_stats64+0xbf/0x290 drivers/net/ppp/ppp_generic.c:1538
                      dev_get_stats+0x90/0x370 net/core/dev.c:10704
                      rtnl_fill_stats+0x47/0x880 net/core/rtnetlink.c:1205
                      rtnl_fill_ifinfo+0x1598/0x1d60 net/core/rtnetlink.c:1782
                      rtmsg_ifinfo_build_skb+0xdc/0x180 net/core/rtnetlink.c:3856
                      rtmsg_ifinfo_event net/core/rtnetlink.c:3888 [inline]
                      rtmsg_ifinfo+0x71/0x120 net/core/rtnetlink.c:3897
                      register_netdevice+0x13d2/0x1720 net/core/dev.c:10402
                      ppp_unit_register drivers/net/ppp/ppp_generic.c:1216 [inline]
                      ppp_dev_configure+0x853/0xad0 drivers/net/ppp/ppp_generic.c:1272
                      ppp_create_interface drivers/net/ppp/ppp_generic.c:3347 [inline]
                      ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1057 [inline]
                      ppp_ioctl+0x702/0x1cd0 drivers/net/ppp/ppp_generic.c:730
                      vfs_ioctl fs/ioctl.c:51 [inline]
                      __do_sys_ioctl fs/ioctl.c:874 [inline]
                      __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
                      do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                      do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
                      entry_SYSCALL_64_after_hwframe+0x66/0xd0
    INITIAL USE at:
                     lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                     __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                     _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                     spin_lock_bh include/linux/spinlock.h:368 [inline]
                     ppp_get_stats64+0xbf/0x290 drivers/net/ppp/ppp_generic.c:1538
                     dev_get_stats+0x90/0x370 net/core/dev.c:10704
                     rtnl_fill_stats+0x47/0x880 net/core/rtnetlink.c:1205
                     rtnl_fill_ifinfo+0x1598/0x1d60 net/core/rtnetlink.c:1782
                     rtmsg_ifinfo_build_skb+0xdc/0x180 net/core/rtnetlink.c:3856
                     rtmsg_ifinfo_event net/core/rtnetlink.c:3888 [inline]
                     rtmsg_ifinfo+0x71/0x120 net/core/rtnetlink.c:3897
                     register_netdevice+0x13d2/0x1720 net/core/dev.c:10402
                     ppp_unit_register drivers/net/ppp/ppp_generic.c:1216 [inline]
                     ppp_dev_configure+0x853/0xad0 drivers/net/ppp/ppp_generic.c:1272
                     ppp_create_interface drivers/net/ppp/ppp_generic.c:3347 [inline]
                     ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1057 [inline]
                     ppp_ioctl+0x702/0x1cd0 drivers/net/ppp/ppp_generic.c:730
                     vfs_ioctl fs/ioctl.c:51 [inline]
                     __do_sys_ioctl fs/ioctl.c:874 [inline]
                     __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
                     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                     do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
                     entry_SYSCALL_64_after_hwframe+0x66/0xd0
  }
  ... key      at: [<ffffffff96bb16e0>] ppp_dev_configure.__key.62+0x0/0x20
  ... acquired at:
   lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
   _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
   spin_lock_bh include/linux/spinlock.h:368 [inline]
   ppp_connect_channel+0x170/0x640 drivers/net/ppp/ppp_generic.c:3483
   ppp_ioctl+0xbe5/0x1cd0 drivers/net/ppp/ppp_generic.c:758
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:874 [inline]
   __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x66/0xd0

-> (&ppp->rlock){+...}-{2:2} {
   HARDIRQ-ON-W at:
                    lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                    _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                    spin_lock_bh include/linux/spinlock.h:368 [inline]
                    ppp_get_stats64+0x2f/0x290 drivers/net/ppp/ppp_generic.c:1533
                    dev_get_stats+0x90/0x370 net/core/dev.c:10704
                    rtnl_fill_stats+0x47/0x880 net/core/rtnetlink.c:1205
                    rtnl_fill_ifinfo+0x1598/0x1d60 net/core/rtnetlink.c:1782
                    rtmsg_ifinfo_build_skb+0xdc/0x180 net/core/rtnetlink.c:3856
                    rtmsg_ifinfo_event net/core/rtnetlink.c:3888 [inline]
                    rtmsg_ifinfo+0x71/0x120 net/core/rtnetlink.c:3897
                    register_netdevice+0x13d2/0x1720 net/core/dev.c:10402
                    ppp_unit_register drivers/net/ppp/ppp_generic.c:1216 [inline]
                    ppp_dev_configure+0x853/0xad0 drivers/net/ppp/ppp_generic.c:1272
                    ppp_create_interface drivers/net/ppp/ppp_generic.c:3347 [inline]
                    ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1057 [inline]
                    ppp_ioctl+0x702/0x1cd0 drivers/net/ppp/ppp_generic.c:730
                    vfs_ioctl fs/ioctl.c:51 [inline]
                    __do_sys_ioctl fs/ioctl.c:874 [inline]
                    __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
                    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                    do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
                    entry_SYSCALL_64_after_hwframe+0x66/0xd0
   INITIAL USE at:
                   lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                   _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                   spin_lock_bh include/linux/spinlock.h:368 [inline]
                   ppp_get_stats64+0x2f/0x290 drivers/net/ppp/ppp_generic.c:1533
                   dev_get_stats+0x90/0x370 net/core/dev.c:10704
                   rtnl_fill_stats+0x47/0x880 net/core/rtnetlink.c:1205
                   rtnl_fill_ifinfo+0x1598/0x1d60 net/core/rtnetlink.c:1782
                   rtmsg_ifinfo_build_skb+0xdc/0x180 net/core/rtnetlink.c:3856
                   rtmsg_ifinfo_event net/core/rtnetlink.c:3888 [inline]
                   rtmsg_ifinfo+0x71/0x120 net/core/rtnetlink.c:3897
                   register_netdevice+0x13d2/0x1720 net/core/dev.c:10402
                   ppp_unit_register drivers/net/ppp/ppp_generic.c:1216 [inline]
                   ppp_dev_configure+0x853/0xad0 drivers/net/ppp/ppp_generic.c:1272
                   ppp_create_interface drivers/net/ppp/ppp_generic.c:3347 [inline]
                   ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1057 [inline]
                   ppp_ioctl+0x702/0x1cd0 drivers/net/ppp/ppp_generic.c:730
                   vfs_ioctl fs/ioctl.c:51 [inline]
                   __do_sys_ioctl fs/ioctl.c:874 [inline]
                   __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
                   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                   do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
                   entry_SYSCALL_64_after_hwframe+0x66/0xd0
 }
 ... key      at: [<ffffffff96bb16c0>] ppp_dev_configure.__key+0x0/0x20
 ... acquired at:
   lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
   _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
   spin_lock_bh include/linux/spinlock.h:368 [inline]
   ppp_dev_uninit+0x68/0x1a0 drivers/net/ppp/ppp_generic.c:1571
   unregister_netdevice_many+0x12bb/0x18f0 net/core/dev.c:11111
   unregister_netdevice_queue+0x2e6/0x350 net/core/dev.c:11027
   unregister_netdevice include/linux/netdevice.h:3012 [inline]
   ppp_release+0xec/0x1f0 drivers/net/ppp/ppp_generic.c:407
   __fput+0x3fe/0x8e0 fs/file_table.c:280
   task_work_run+0x129/0x1a0 kernel/task_work.c:188
   tracehook_notify_resume include/linux/tracehook.h:189 [inline]
   exit_to_user_mode_loop+0x106/0x130 kernel/entry/common.c:181
   exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
   __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
   syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
   do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
   entry_SYSCALL_64_after_hwframe+0x66/0xd0


the dependencies between the lock to be acquired
 and SOFTIRQ-READ-irq-unsafe lock:
-> (&pch->downl){+.+.}-{2:2} {
   HARDIRQ-ON-W at:
                    lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                    _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                    spin_lock_bh include/linux/spinlock.h:368 [inline]
                    ppp_unregister_channel+0x78/0x2f0 drivers/net/ppp/ppp_generic.c:2991
                    pppox_unbind_sock+0x58/0xa0 drivers/net/ppp/pppox.c:58
                    pppoe_release+0x158/0x800 drivers/net/ppp/pppoe.c:584
                    __sock_release net/socket.c:649 [inline]
                    sock_close+0xcd/0x230 net/socket.c:1336
                    __fput+0x3fe/0x8e0 fs/file_table.c:280
                    task_work_run+0x129/0x1a0 kernel/task_work.c:188
                    exit_task_work include/linux/task_work.h:33 [inline]
                    do_exit+0x6a3/0x2480 kernel/exit.c:874
                    do_group_exit+0x144/0x310 kernel/exit.c:996
                    get_signal+0xc66/0x14e0 kernel/signal.c:2897
                    arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
                    handle_signal_work kernel/entry/common.c:154 [inline]
                    exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178
                    exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
                    __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
                    syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
                    do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
                    entry_SYSCALL_64_after_hwframe+0x66/0xd0
   SOFTIRQ-ON-W at:
                    lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
                    spin_lock include/linux/spinlock.h:363 [inline]
                    ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2271 [inline]
                    ppp_input+0x160/0x980 drivers/net/ppp/ppp_generic.c:2303
                    pppoe_rcv_core+0x109/0x2f0 drivers/net/ppp/pppoe.c:379
                    sk_backlog_rcv include/net/sock.h:1059 [inline]
                    __release_sock+0x198/0x4b0 net/core/sock.c:2724
                    release_sock+0x5d/0x1c0 net/core/sock.c:3265
                    pppoe_sendmsg+0xd1/0x740 drivers/net/ppp/pppoe.c:903
                    sock_sendmsg_nosec net/socket.c:704 [inline]
                    __sock_sendmsg net/socket.c:716 [inline]
                    ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2431
                    ___sys_sendmsg+0x252/0x2e0 net/socket.c:2485
                    __sys_sendmmsg+0x2bf/0x560 net/socket.c:2571
                    __do_sys_sendmmsg net/socket.c:2600 [inline]
                    __se_sys_sendmmsg net/socket.c:2597 [inline]
                    __x64_sys_sendmmsg+0x9c/0xb0 net/socket.c:2597
                    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                    do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
                    entry_SYSCALL_64_after_hwframe+0x66/0xd0
   INITIAL USE at:
                   lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                   _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                   spin_lock_bh include/linux/spinlock.h:368 [inline]
                   ppp_unregister_channel+0x78/0x2f0 drivers/net/ppp/ppp_generic.c:2991
                   pppox_unbind_sock+0x58/0xa0 drivers/net/ppp/pppox.c:58
                   pppoe_release+0x158/0x800 drivers/net/ppp/pppoe.c:584
                   __sock_release net/socket.c:649 [inline]
                   sock_close+0xcd/0x230 net/socket.c:1336
                   __fput+0x3fe/0x8e0 fs/file_table.c:280
                   task_work_run+0x129/0x1a0 kernel/task_work.c:188
                   exit_task_work include/linux/task_work.h:33 [inline]
                   do_exit+0x6a3/0x2480 kernel/exit.c:874
                   do_group_exit+0x144/0x310 kernel/exit.c:996
                   get_signal+0xc66/0x14e0 kernel/signal.c:2897
                   arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
                   handle_signal_work kernel/entry/common.c:154 [inline]
                   exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178
                   exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
                   __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
                   syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
                   do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
                   entry_SYSCALL_64_after_hwframe+0x66/0xd0
 }
 ... key      at: [<ffffffff96bb1560>] ppp_register_net_channel.__key.1+0x0/0x20
 ... acquired at:
   lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
   _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
   spin_lock_bh include/linux/spinlock.h:368 [inline]
   ppp_connect_channel+0x190/0x640 drivers/net/ppp/ppp_generic.c:3484
   ppp_ioctl+0xbe5/0x1cd0 drivers/net/ppp/ppp_generic.c:758
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:874 [inline]
   __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x66/0xd0


stack backtrace:
CPU: 1 PID: 7412 Comm: syz.3.652 Not tainted 5.15.167-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 print_bad_irq_dependency kernel/locking/lockdep.c:2567 [inline]
 check_irq_usage kernel/locking/lockdep.c:2806 [inline]
 check_prev_add kernel/locking/lockdep.c:3057 [inline]
 check_prevs_add kernel/locking/lockdep.c:3172 [inline]
 validate_chain+0x4d01/0x5930 kernel/locking/lockdep.c:3788
 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
 _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:368 [inline]
 ppp_connect_channel+0x190/0x640 drivers/net/ppp/ppp_generic.c:3484
 ppp_ioctl+0xbe5/0x1cd0 drivers/net/ppp/ppp_generic.c:758
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f1ebf2f1ff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1ebd505038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1ebf4aa208 RCX: 00007f1ebf2f1ff9
RDX: 0000000020000300 RSI: 000000004004743a RDI: 0000000000000005
RBP: 00007f1ebf364296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f1ebf4aa208 R15: 00007ffe83837c88
 </TASK>

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/10/16 23:46 linux-5.15.y 3a5928702e71 666f77ed .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/10/11 14:51 linux-5.15.y 3a5928702e71 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/10/11 11:11 linux-5.15.y 3a5928702e71 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/10/10 07:41 linux-5.15.y 3a5928702e71 0278d004 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/10/05 13:38 linux-5.15.y 3a5928702e71 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/10/03 20:47 linux-5.15.y 3a5928702e71 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/10/03 08:19 linux-5.15.y 3a5928702e71 a4c7fd36 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/09/28 15:37 linux-5.15.y 3a5928702e71 ba29ff75 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/09/26 21:56 linux-5.15.y 3a5928702e71 9314348a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/09/26 05:12 linux-5.15.y 3a5928702e71 0d19f247 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/09/26 01:38 linux-5.15.y 3a5928702e71 0d19f247 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/09/25 13:01 linux-5.15.y 3a5928702e71 349a68c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/09/14 14:35 linux-5.15.y 3a5928702e71 c7e35043 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/09/14 14:35 linux-5.15.y 3a5928702e71 c7e35043 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in ppp_input
2024/09/28 04:22 linux-5.15.y 3a5928702e71 440b26ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in ppp_input
2024/09/24 20:37 linux-5.15.y 3a5928702e71 5643e0e9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in ppp_input
2024/09/23 16:40 linux-5.15.y 3a5928702e71 89298aad .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in ppp_input
* Struck through repros no longer work on HEAD.