syzbot


possible deadlock in hsr_dev_xmit

Status: auto-obsoleted due to no activity on 2024/10/15 17:23
Reported-by: syzbot+6866f758b12eff7002ef@syzkaller.appspotmail.com
First crash: 153d, last: 100d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 possible deadlock in hsr_dev_xmit 1 129d 129d 0/3 auto-obsoleted due to no activity on 2024/09/16 01:23
upstream possible deadlock in hsr_dev_xmit (2) net C done 441 1d00h 201d 0/28 upstream: reported C repro on 2024/03/28 14:20
upstream possible deadlock in hsr_dev_xmit net 1 566d 562d 0/28 auto-obsoleted due to no activity on 2023/07/27 11:35

Sample crash report:
============================================
WARNING: possible recursive locking detected
5.15.162-syzkaller #0 Not tainted
--------------------------------------------
udevd/2963 is trying to acquire lock:
ffff888076b36d88 (&hsr->seqnr_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline]
ffff888076b36d88 (&hsr->seqnr_lock){+.-.}-{2:2}, at: hsr_dev_xmit+0x13a/0x1e0 net/hsr/hsr_device.c:222

but task is already holding lock:
ffff88807f4e0d88 (&hsr->seqnr_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline]
ffff88807f4e0d88 (&hsr->seqnr_lock){+.-.}-{2:2}, at: send_hsr_supervision_frame+0x272/0xad0 net/hsr/hsr_device.c:303

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&hsr->seqnr_lock);
  lock(&hsr->seqnr_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

8 locks held by udevd/2963:
 #0: ffffffff8c91fb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
 #1: ffffc90000dd0be0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
 #1: ffffc90000dd0be0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x560 kernel/time/timer.c:1441
 #2: ffffffff8c91fb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
 #3: ffff88807f4e0d88 (&hsr->seqnr_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline]
 #3: ffff88807f4e0d88 (&hsr->seqnr_lock){+.-.}-{2:2}, at: send_hsr_supervision_frame+0x272/0xad0 net/hsr/hsr_device.c:303
 #4: ffffffff8c91fb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
 #5: ffffffff8c91fb80 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:312
 #6: ffffffff8c91fb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
 #7: ffffffff8c91fb80 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:312

stack backtrace:
CPU: 1 PID: 2963 Comm: udevd Not tainted 5.15.162-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 print_deadlock_bug kernel/locking/lockdep.c:2946 [inline]
 check_deadlock kernel/locking/lockdep.c:2989 [inline]
 validate_chain+0x46d2/0x5930 kernel/locking/lockdep.c:3775
 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
 _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:368 [inline]
 hsr_dev_xmit+0x13a/0x1e0 net/hsr/hsr_device.c:222
 __netdev_start_xmit include/linux/netdevice.h:5019 [inline]
 netdev_start_xmit include/linux/netdevice.h:5033 [inline]
 xmit_one net/core/dev.c:3617 [inline]
 dev_hard_start_xmit+0x298/0x7a0 net/core/dev.c:3633
 __dev_queue_xmit+0x1cee/0x3230 net/core/dev.c:4248
 br_dev_queue_push_xmit+0x6e1/0x8a0 net/bridge/br_forward.c:53
 NF_HOOK+0x36c/0x420 include/linux/netfilter.h:302
 br_forward_finish+0x74/0x80 net/bridge/br_forward.c:66
 NF_HOOK+0x36c/0x420 include/linux/netfilter.h:302
 __br_forward+0x430/0x5f0 net/bridge/br_forward.c:115
 deliver_clone net/bridge/br_forward.c:131 [inline]
 maybe_deliver+0xb3/0x150 net/bridge/br_forward.c:189
 br_flood+0x2e7/0x440 net/bridge/br_forward.c:231
 br_dev_xmit+0xfb3/0x1520
 __netdev_start_xmit include/linux/netdevice.h:5019 [inline]
 netdev_start_xmit include/linux/netdevice.h:5033 [inline]
 xmit_one net/core/dev.c:3617 [inline]
 dev_hard_start_xmit+0x298/0x7a0 net/core/dev.c:3633
 __dev_queue_xmit+0x1cee/0x3230 net/core/dev.c:4248
 hsr_xmit net/hsr/hsr_forward.c:338 [inline]
 hsr_forward_do net/hsr/hsr_forward.c:429 [inline]
 hsr_forward_skb+0x133c/0x1b50 net/hsr/hsr_forward.c:577
 send_hsr_supervision_frame+0x540/0xad0 net/hsr/hsr_device.c:326
 hsr_announce+0x176/0x300 net/hsr/hsr_device.c:382
 call_timer_fn+0x16d/0x560 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x67c/0x890 kernel/time/timer.c:1767
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
 handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
 __do_softirq kernel/softirq.c:592 [inline]
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1096
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:native_irq_enable arch/x86/include/asm/irqflags.h:45 [inline]
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/irqflags.h:80 [inline]
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:140 [inline]
RIP: 0010:seqcount_lockdep_reader_access+0x1d2/0x220 include/linux/seqlock.h:105
Code: 5e e8 e2 d5 a6 ff 4d 85 f6 48 bb 00 00 00 00 00 fc ff df 75 07 e8 ce d5 a6 ff eb 06 e8 c7 d5 a6 ff fb 48 c7 04 24 0e 36 e0 45 <4a> c7 04 23 00 00 00 00 66 42 c7 44 23 09 00 00 42 c6 44 23 0b 00
RSP: 0018:ffffc90002517820 EFLAGS: 00000293
RAX: ffffffff81d98599 RBX: dffffc0000000000 RCX: ffff88807d9c5940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900025178c8 R08: ffffffff81d98574 R09: fffffbfff1bc8e76
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920004a2f04
R13: ffffc90002517840 R14: 0000000000000200 R15: 0000000000000046
 set_root+0x175/0x3b0 fs/namei.c:942
 nd_jump_root+0x2a6/0x410 fs/namei.c:963
 path_init+0x36d/0x1190 fs/namei.c:2365
 path_lookupat+0x27/0x450 fs/namei.c:2445
 filename_lookup+0x230/0x5c0 fs/namei.c:2484
 user_path_at_empty+0x40/0x180 fs/namei.c:2883
 user_path_at include/linux/namei.h:57 [inline]
 vfs_statx+0x106/0x3b0 fs/stat.c:221
 vfs_fstatat fs/stat.c:243 [inline]
 __do_sys_newfstatat fs/stat.c:411 [inline]
 __se_sys_newfstatat fs/stat.c:405 [inline]
 __x64_sys_newfstatat+0x12c/0x1b0 fs/stat.c:405
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f93d55835f4
Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8
RSP: 002b:00007fffc08a4618 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007fffc08a5fb8 RCX: 00007f93d55835f4
RDX: 00007fffc08a4628 RSI: 00007fffc08a4ab8 RDI: 00000000ffffff9c
RBP: 00007fffc08a46b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffc08a4ab8
R13: 00007fffc08a4628 R14: 000055fe69e32910 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	5e                   	pop    %rsi
   1:	e8 e2 d5 a6 ff       	call   0xffa6d5e8
   6:	4d 85 f6             	test   %r14,%r14
   9:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
  10:	fc ff df
  13:	75 07                	jne    0x1c
  15:	e8 ce d5 a6 ff       	call   0xffa6d5e8
  1a:	eb 06                	jmp    0x22
  1c:	e8 c7 d5 a6 ff       	call   0xffa6d5e8
  21:	fb                   	sti
  22:	48 c7 04 24 0e 36 e0 	movq   $0x45e0360e,(%rsp)
  29:	45
* 2a:	4a c7 04 23 00 00 00 	movq   $0x0,(%rbx,%r12,1) <-- trapping instruction
  31:	00
  32:	66 42 c7 44 23 09 00 	movw   $0x0,0x9(%rbx,%r12,1)
  39:	00
  3a:	42 c6 44 23 0b 00    	movb   $0x0,0xb(%rbx,%r12,1)

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/07 17:23 linux-5.15.y f45bea23c39c 2a40360c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hsr_dev_xmit
2024/05/15 14:39 linux-5.15.y 284087d4f7d5 94b087b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hsr_dev_xmit
2024/06/08 01:02 linux-5.15.y c61bd26ae81a 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hsr_dev_xmit
2024/06/08 01:02 linux-5.15.y c61bd26ae81a 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hsr_dev_xmit
2024/05/15 15:27 linux-5.15.y 284087d4f7d5 94b087b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hsr_dev_xmit
* Struck through repros no longer work on HEAD.