syzbot


possible deadlock in l2tp_tunnel_register

Status: fixed on 2023/04/11 15:29
Reported-by: syzbot+4b1195d0985ca5c60ea7@syzkaller.appspotmail.com
Fix commit: f6df58aa15f7 l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
First crash: 438d, last: 435d
Fix bisection: fixed by (bisect log) :
commit f6df58aa15f7d469f69b1dd21b001ff483255244
Author: Shigeru Yoshida <syoshida@redhat.com>
Date: Thu Feb 16 16:37:10 2023 +0000

  l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()

  
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in l2tp_tunnel_register (2) net C 153 439d 449d 22/26 fixed on 2023/06/08 14:41
linux-6.1 possible deadlock in l2tp_tunnel_register C done 44 435d 438d 3/3 fixed on 2023/04/11 15:30
upstream possible deadlock in l2tp_tunnel_register net C error 9492 449d 548d 22/26 fixed on 2023/02/24 13:50

Sample crash report:
============================================
WARNING: possible recursive locking detected
5.15.98-syzkaller #0 Not tainted
--------------------------------------------
syz-executor154/4051 is trying to acquire lock:
ffff0000c26fd120 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1649 [inline]
ffff0000c26fd120 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: l2tp_tunnel_register+0x888/0x1974 net/l2tp/l2tp_core.c:1485

but task is already holding lock:
ffff0000c1006120 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1649 [inline]
ffff0000c1006120 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0x53c/0x1348 net/l2tp/l2tp_ppp.c:676

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sk_lock-AF_PPPOX);
  lock(sk_lock-AF_PPPOX);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

1 lock held by syz-executor154/4051:
 #0: ffff0000c1006120 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1649 [inline]
 #0: ffff0000c1006120 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0x53c/0x1348 net/l2tp/l2tp_ppp.c:676

stack backtrace:
CPU: 1 PID: 4051 Comm: syz-executor154 Not tainted 5.15.98-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 __lock_acquire+0x62b4/0x7620 kernel/locking/lockdep.c:5011
 lock_acquire+0x2b8/0x894 kernel/locking/lockdep.c:5622
 lock_sock_nested+0xec/0x1ec net/core/sock.c:3207
 lock_sock include/net/sock.h:1649 [inline]
 l2tp_tunnel_register+0x888/0x1974 net/l2tp/l2tp_core.c:1485
 pppol2tp_connect+0x944/0x1348 net/l2tp/l2tp_ppp.c:724
 __sys_connect_file net/socket.c:1899 [inline]
 __sys_connect+0x268/0x290 net/socket.c:1916
 __do_sys_connect net/socket.c:1926 [inline]
 __se_sys_connect net/socket.c:1923 [inline]
 __arm64_sys_connect+0x7c/0x94 net/socket.c:1923
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
 el0t_64_sync+0x1a0/0x1a4 <unknown>:584

Crashes (41):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/03/09 00:14 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/08 10:22 linux-5.15.y d9b4a0c83a2d d2b00170 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/10 05:41 linux-5.15.y d9b4a0c83a2d f08b59ac .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/10 08:26 linux-5.15.y d9b4a0c83a2d 5205ef30 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/10 05:52 linux-5.15.y d9b4a0c83a2d f08b59ac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/10 01:45 linux-5.15.y d9b4a0c83a2d f08b59ac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/09 22:59 linux-5.15.y d9b4a0c83a2d f08b59ac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/09 12:46 linux-5.15.y d9b4a0c83a2d f08b59ac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/09 08:15 linux-5.15.y d9b4a0c83a2d f08b59ac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 23:30 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 20:47 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 20:47 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 19:45 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 16:53 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 08:37 linux-5.15.y d9b4a0c83a2d d2b00170 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 07:32 linux-5.15.y d9b4a0c83a2d d2b00170 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 06:29 linux-5.15.y d9b4a0c83a2d d2b00170 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 04:39 linux-5.15.y d9b4a0c83a2d d2b00170 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/08 04:17 linux-5.15.y d9b4a0c83a2d d2b00170 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/07 22:41 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/07 22:31 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/07 21:39 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/07 21:10 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/07 20:59 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/07 17:55 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/07 16:42 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in l2tp_tunnel_register
2023/03/10 10:07 linux-5.15.y d9b4a0c83a2d 5205ef30 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/10 07:10 linux-5.15.y d9b4a0c83a2d 5205ef30 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/10 01:53 linux-5.15.y d9b4a0c83a2d f08b59ac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/10 00:01 linux-5.15.y d9b4a0c83a2d f08b59ac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/09 23:06 linux-5.15.y d9b4a0c83a2d f08b59ac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/09 00:31 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/08 22:15 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/08 18:37 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/08 18:37 linux-5.15.y d9b4a0c83a2d 4fc6d98d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/08 05:54 linux-5.15.y d9b4a0c83a2d d2b00170 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/08 04:30 linux-5.15.y d9b4a0c83a2d d2b00170 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/07 18:39 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/07 18:32 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/07 16:54 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
2023/03/07 16:31 linux-5.15.y d9b4a0c83a2d d7ea8bc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in l2tp_tunnel_register
* Struck through repros no longer work on HEAD.