syzbot


possible deadlock in sock_map_delete_elem

Status: upstream: reported on 2024/03/18 16:03
Subsystems: bpf net
[Documentation on labels]
Reported-by: syzbot+4ac2fe2b496abca8fa4b@syzkaller.appspotmail.com
First crash: 31d, last: 2h59m
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bpf?] [net?] possible deadlock in sock_map_delete_elem 0 (1) 2024/03/18 16:03
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 possible deadlock in sock_map_delete_elem C 14 6h09m 26d 0/3 upstream: reported C repro on 2024/03/21 17:46
linux-6.1 possible deadlock in sock_map_delete_elem C 16 3h48m 10d 0/3 upstream: reported C repro on 2024/04/06 16:22

Sample crash report:
============================================
WARNING: possible recursive locking detected
6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
--------------------------------------------
syz-executor.4/5835 is trying to acquire lock:
ffff88802bfca200 (&stab->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88802bfca200 (&stab->lock){+.-.}-{2:2}, at: __sock_map_delete net/core/sock_map.c:414 [inline]
ffff88802bfca200 (&stab->lock){+.-.}-{2:2}, at: sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446

but task is already holding lock:
ffff88807cafca00 (&stab->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88807cafca00 (&stab->lock){+.-.}-{2:2}, at: sock_map_update_common+0x1b6/0x5b0 net/core/sock_map.c:490

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&stab->lock);
  lock(&stab->lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

5 locks held by syz-executor.4/5835:
 #0: ffff888061653518 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]
 #0: ffff888061653518 (sk_lock-AF_INET){+.+.}-{0:0}, at: sock_map_sk_acquire net/core/sock_map.c:117 [inline]
 #0: ffff888061653518 (sk_lock-AF_INET){+.+.}-{0:0}, at: sock_map_update_elem_sys+0x1cc/0x910 net/core/sock_map.c:575
 #1: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #1: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #1: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: sock_map_sk_acquire net/core/sock_map.c:118 [inline]
 #1: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: sock_map_update_elem_sys+0x1d8/0x910 net/core/sock_map.c:575
 #2: ffff88807cafca00 (&stab->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
 #2: ffff88807cafca00 (&stab->lock){+.-.}-{2:2}, at: sock_map_update_common+0x1b6/0x5b0 net/core/sock_map.c:490
 #3: ffff88801c293290 (&psock->link_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
 #3: ffff88801c293290 (&psock->link_lock){+...}-{2:2}, at: sock_map_del_link net/core/sock_map.c:145 [inline]
 #3: ffff88801c293290 (&psock->link_lock){+...}-{2:2}, at: sock_map_unref+0xcc/0x5e0 net/core/sock_map.c:180
 #4: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #4: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #4: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline]
 #4: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x114/0x420 kernel/trace/bpf_trace.c:2420

stack backtrace:
CPU: 0 PID: 5835 Comm: syz-executor.4 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 check_deadlock kernel/locking/lockdep.c:3062 [inline]
 validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856
 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
 _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:356 [inline]
 __sock_map_delete net/core/sock_map.c:414 [inline]
 sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446
 bpf_prog_9dc0996bccb7470f+0x68/0x6c
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
 bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420
 trace_kfree include/trace/events/kmem.h:94 [inline]
 kfree+0x291/0x380 mm/slub.c:4377
 sk_psock_free_link include/linux/skmsg.h:421 [inline]
 sock_map_del_link net/core/sock_map.c:158 [inline]
 sock_map_unref+0x3ac/0x5e0 net/core/sock_map.c:180
 sock_map_update_common+0x4f0/0x5b0 net/core/sock_map.c:503
 sock_map_update_elem_sys+0x55f/0x910 net/core/sock_map.c:579
 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641
 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619
 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5736 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736
 do_syscall_64+0xfb/0x240
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f668b87de69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f668c55f0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f668b9abf80 RCX: 00007f668b87de69
RDX: 0000000000000020 RSI: 00000000200000c0 RDI: 0000000000000002
RBP: 00007f668b8ca47a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f668b9abf80 R15: 00007ffd11f16598
 </TASK>

Crashes (166):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/10 14:13 upstream fe46a7dd189e 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root possible deadlock in sock_map_delete_elem
2024/04/16 17:51 net f99c5f563c17 0d592ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/16 12:10 bpf 443574b03387 0d592ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/16 04:49 bpf 443574b03387 0d592ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/15 17:20 bpf 443574b03387 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/14 21:18 bpf 443574b03387 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/14 15:58 net f99c5f563c17 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/14 10:29 net f99c5f563c17 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/14 07:53 bpf 443574b03387 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/12 19:29 bpf 443574b03387 27de0a5c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/12 15:00 net f99c5f563c17 27de0a5c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/12 12:02 net f99c5f563c17 27de0a5c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/11 05:31 net f99c5f563c17 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/11 04:14 net f99c5f563c17 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/10 23:54 bpf 443574b03387 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/10 12:07 net f99c5f563c17 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/10 09:22 net f99c5f563c17 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/10 01:31 bpf 443574b03387 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/09 04:38 net f99c5f563c17 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/09 03:13 net f99c5f563c17 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/08 23:01 bpf 443574b03387 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/08 08:01 bpf 443574b03387 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/08 05:32 net f99c5f563c17 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/08 03:10 bpf 443574b03387 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/07 23:45 net f99c5f563c17 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/07 16:46 bpf 443574b03387 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/07 11:43 bpf 443574b03387 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/06 13:22 bpf 443574b03387 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/06 09:23 net f99c5f563c17 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/06 02:54 bpf 443574b03387 18ea8213 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/06 01:49 net f99c5f563c17 18ea8213 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/05 22:15 bpf 443574b03387 18ea8213 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/03/15 21:01 bpf aae08491b943 d615901c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/08 12:39 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/08 01:47 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/07 20:33 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/07 14:29 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/07 09:20 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/07 03:38 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/06 23:51 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/06 15:11 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/06 07:55 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/05 10:10 bpf-next 14bb1e8c8d4a 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in sock_map_delete_elem
2024/03/29 01:15 net-next 237bb5f7f7f5 120789fd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in sock_map_delete_elem
2024/04/15 08:30 linux-next 6bd343537461 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in sock_map_delete_elem
2024/04/13 14:49 linux-next 9ed46da14b9b c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in sock_map_delete_elem
2024/04/11 22:36 linux-next 4118d9533ff3 478efa7f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in sock_map_delete_elem
2024/04/09 10:21 linux-next a053fd3ca5d1 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in sock_map_delete_elem
2024/04/09 07:23 linux-next a053fd3ca5d1 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in sock_map_delete_elem
2024/04/07 06:14 linux-next 8568bb2ccc27 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in sock_map_delete_elem
2024/04/07 00:54 linux-next 8568bb2ccc27 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in sock_map_delete_elem
2024/04/06 16:51 linux-next 8568bb2ccc27 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in sock_map_delete_elem
* Struck through repros no longer work on HEAD.