syzbot


possible deadlock in ppp_dev_uninit

Status: fixed on 2018/01/22 13:19
Subsystems: ppp
[Documentation on labels]
Reported-by: syzbot+367889b9c9e279219175@syzkaller.appspotmail.com
Fix commit: 0171c4183559 ppp: unlock all_ppp_mutex before registering device
First crash: 2305d, last: 2292d
Discussions (5)
Title Replies (including bot) Last reply
[PATCH 3.16 000/366] 3.16.60-rc1 review 370 (370) 2019/03/29 15:47
[PATCH 4.9 00/66] 4.9.79-stable review 72 (72) 2018/02/28 15:46
[PATCH 4.14 00/71] 4.14.16-stable review 77 (77) 2018/01/30 14:52
[PATCH net] ppp: unlock all_ppp_mutex before registering device 2 (2) 2018/01/15 18:23
possible deadlock in ppp_dev_uninit 2 (7) 2018/01/05 19:05

Sample crash report:
RBP: 0000000000000004 R08: 0000000000000001 R09: 0000000000000035
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401f10
R13: 0000000000401fa0 R14: 0000000000000000 R15: 0000000000000000

============================================
WARNING: possible recursive locking detected
4.15.0-rc6-next-20180103+ #87 Not tainted
--------------------------------------------
syzkaller221540/3462 is trying to acquire lock:
 (&pn->all_ppp_mutex){+.+.}, at: [<00000000709ea4fe>] ppp_dev_uninit+0x1be/0x390 drivers/net/ppp/ppp_generic.c:1369

but task is already holding lock:
 (&pn->all_ppp_mutex){+.+.}, at: [<00000000752caad5>] ppp_unit_register drivers/net/ppp/ppp_generic.c:981 [inline]
 (&pn->all_ppp_mutex){+.+.}, at: [<00000000752caad5>] ppp_dev_configure+0x6a4/0xc40 drivers/net/ppp/ppp_generic.c:1066

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&pn->all_ppp_mutex);
  lock(&pn->all_ppp_mutex);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syzkaller221540/3462:
 #0:  (ppp_mutex){+.+.}, at: [<000000000235c4ad>] ppp_ioctl+0x9e/0x2200 drivers/net/ppp/ppp_generic.c:598
 #1:  (rtnl_mutex){+.+.}, at: [<000000002fbce150>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:74
 #2:  (&pn->all_ppp_mutex){+.+.}, at: [<00000000752caad5>] ppp_unit_register drivers/net/ppp/ppp_generic.c:981 [inline]
 #2:  (&pn->all_ppp_mutex){+.+.}, at: [<00000000752caad5>] ppp_dev_configure+0x6a4/0xc40 drivers/net/ppp/ppp_generic.c:1066

stack backtrace:
CPU: 0 PID: 3462 Comm: syzkaller221540 Not tainted 4.15.0-rc6-next-20180103+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x137/0x198 lib/dump_stack.c:53
 print_deadlock_bug kernel/locking/lockdep.c:1756 [inline]
 check_deadlock kernel/locking/lockdep.c:1800 [inline]
 validate_chain kernel/locking/lockdep.c:2396 [inline]
 __lock_acquire+0xec3/0x3cf0 kernel/locking/lockdep.c:3426
 lock_acquire+0x16b/0x420 kernel/locking/lockdep.c:3914
 __mutex_lock_common kernel/locking/mutex.c:756 [inline]
 __mutex_lock+0xec/0x1550 kernel/locking/mutex.c:893
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
 ppp_dev_uninit+0x1be/0x390 drivers/net/ppp/ppp_generic.c:1369
 register_netdevice+0x8bf/0xf30 net/core/dev.c:7835
 ppp_unit_register drivers/net/ppp/ppp_generic.c:1009 [inline]
 ppp_dev_configure+0x854/0xc40 drivers/net/ppp/ppp_generic.c:1066
 ppp_create_interface drivers/net/ppp/ppp_generic.c:3027 [inline]
 ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:866 [inline]
 ppp_ioctl+0x1491/0x2200 drivers/net/ppp/ppp_generic.c:602
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0x190/0xfe0 fs/ioctl.c:686
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
 entry_SYSCALL_64_fastpath+0x23/0x9a
RIP: 0033:0x440649
RSP: 002b:00007fff8dc7fdc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000440649
RDX: 0000000020001000 RSI: 00000000c004743e RDI: 0000000000000003
RBP: 0000000000000004 R08: 0000000000000001 R09: 0000000000000035
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401f10
R13: 0000000000401fa0 R14: 0000000000000000 R15: 0000000000000000

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/03 23:17 linux-next 73005e1a35fd 00193447 .config console log report syz C ci-upstream-next-kasan-gce
2018/01/07 01:51 upstream 3219e264b984 053171ea .config console log report ci-upstream-kasan-gce
2018/01/13 13:30 upstream c92a9a461dff c9e7aeae .config console log report ci-upstream-kasan-gce-386
2018/01/16 19:49 mmots ce3c209f6733 a46e5318 .config console log report ci-upstream-mmots-kasan-gce
2018/01/06 10:58 mmots 69eed2290e1d 00193447 .config console log report ci-upstream-mmots-kasan-gce
2018/01/03 23:02 linux-next 73005e1a35fd 00193447 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.