syzbot
panic: rw_enter: netlock locking against myself
Status:
fixed on 2020/04/12 23:58
Reported-by: syzbot+7c805a09545d997b924d@syzkaller.appspotmail.com
Fix commit:
27427a72e313
In sosplice(), temporarily release the socket lock before calling FRELE() as the last reference could be dropped which in turn will cause soclose() to be called where the socket lock is unconditionally acquired. Note that this is only a problem for sockets protected by the non-recursive NET_LOCK() right now.
First crash: 2355d, last: 2355d
▶
▼
Last patch testing requests (1)
Sample crash report:
login: panic: rw_enter: netlock locking against myself
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
494976 39781 0 0 0x4000000 0 syz-executor.0
*397038 39781 0 0 0x4000000 1K syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff822277f7) at panic+0x15c sys/kern/subr_prf.c:207
rw_enter(ffffffff825310b8,1) at rw_enter+0x518 sys/kern/kern_rwlock.c:173
solock(fffffd806bdedc90) at solock+0x5a sys/kern/uipc_socket2.c:282
soclose(fffffd806bdedc90,0) at soclose+0x2f sys/kern/uipc_socket.c:290
soo_close(fffffd806d1894d0,ffff800020ec64f8) at soo_close+0x40
fdrop(fffffd806d1894d0,ffff800020ec64f8) at fdrop+0xc2 sys/kern/kern_descrip.c:1276
sosplice(fffffd806eb64c88,3,0,0) at sosplice+0x475
sosetopt(fffffd806eb64c88,ffff,1023,fffffd8070ca4600) at sosetopt+0x830
sys_setsockopt(ffff800020ec64f8,ffff800020f85348,ffff800020f85390) at sys_setsockopt+0x215 sys/kern/uipc_syscalls.c:965
syscall(ffff800020f85410) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020f85410) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x381ca3863e0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
rw_enter: netlock locking against myself
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff822277f7) at panic+0x15c sys/kern/subr_prf.c:207
rw_enter(ffffffff825310b8,1) at rw_enter+0x518 sys/kern/kern_rwlock.c:173
solock(fffffd806bdedc90) at solock+0x5a sys/kern/uipc_socket2.c:282
soclose(fffffd806bdedc90,0) at soclose+0x2f sys/kern/uipc_socket.c:290
soo_close(fffffd806d1894d0,ffff800020ec64f8) at soo_close+0x40
fdrop(fffffd806d1894d0,ffff800020ec64f8) at fdrop+0xc2 sys/kern/kern_descrip.c:1276
sosplice(fffffd806eb64c88,3,0,0) at sosplice+0x475
sosetopt(fffffd806eb64c88,ffff,1023,fffffd8070ca4600) at sosetopt+0x830
sys_setsockopt(ffff800020ec64f8,ffff800020f85348,ffff800020f85390) at sys_setsockopt+0x215 sys/kern/uipc_syscalls.c:965
syscall(ffff800020f85410) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020f85410) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x381ca3863e0, count: -12
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800020f84f50
rbx 0xffff800020f85000
rdx 0x8b
rcx 0x2
rax 0x1
r8 0xffffffff8178384f kprintf+0x16f
r9 0x1
r10 0x4274c828e8ea3f95
r11 0xdceaf1e9746fcff5
r12 0x3000000008
r13 0xffff800020f84f60
r14 0x100
r15 0x1
rip 0xffffffff819f29d8 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020f84f40
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.0) pid=397038 stat=onproc
flags process=0 proc=4000000<THREAD>
pri=32, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff800020ec6768,0xffff800020ec7618
process=0xffff800020e923f8 user=0xffff800020f80000, vmspace=0xfffffd807efff2e0
estcpu=36, cpticks=1, pctcpu=0.0
user=0, sys=1, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
18043 112462 58225 0 2 0 syz-executor.1
18043 69652 58225 0 3 0x4000000 biowait syz-executor.1
39781 125522 97715 0 2 0 syz-executor.0
39781 494976 97715 0 7 0x4000000 syz-executor.0
*39781 397038 97715 0 7 0x4000000 syz-executor.0
73628 109003 0 0 3 0x14200 bored sosplice
58225 146735 37483 0 3 0x82 nanosleep syz-executor.1
97715 21782 37483 0 3 0x82 nanosleep syz-executor.0
37483 465442 86486 0 3 0x82 thrsleep syz-execprog
37483 252417 86486 0 3 0x4000082 thrsleep syz-execprog
37483 490186 86486 0 3 0x4000082 thrsleep syz-execprog
37483 162708 86486 0 3 0x4000082 thrsleep syz-execprog
37483 172525 86486 0 3 0x4000082 thrsleep syz-execprog
37483 168708 86486 0 3 0x4000082 kqread syz-execprog
37483 236979 86486 0 3 0x4000082 thrsleep syz-execprog
37483 10766 86486 0 3 0x4000082 thrsleep syz-execprog
37483 414489 86486 0 3 0x4000082 thrsleep syz-execprog
86486 18340 34670 0 3 0x10008a pause ksh
34670 275753 76058 0 3 0x92 select sshd
91621 152391 1 0 3 0x100083 ttyin getty
76058 344672 1 0 3 0x80 select sshd
92666 448396 47579 74 3 0x100092 bpf pflogd
47579 25173 1 0 3 0x80 netio pflogd
97733 482092 7739 73 3 0x100090 kqread syslogd
7739 273638 1 0 3 0x100082 netio syslogd
65424 171159 1 77 3 0x100090 poll dhclient
8263 222079 1 0 3 0x80 poll dhclient
40252 148762 0 0 3 0x14200 bored smr
77488 389073 0 0 2 0x14200 zerothread
57064 43438 0 0 3 0x14200 aiodoned aiodoned
32801 371001 0 0 3 0x14200 syncer update
12474 502643 0 0 3 0x14200 cleaner cleaner
83231 215732 0 0 3 0x14200 reaper reaper
61647 37901 0 0 3 0x14200 pgdaemon pagedaemon
60611 216570 0 0 3 0x14200 bored crynlk
62037 278992 0 0 3 0x14200 bored crypto
77208 519643 0 0 3 0x40014200 acpi0 acpi0
65680 484914 0 0 3 0x40014200 idle1
65305 365760 0 0 3 0x14200 bored softnet
75049 460865 0 0 3 0x14200 bored systqmp
8321 362535 0 0 3 0x14200 bored systq
58785 159793 0 0 3 0x40014200 bored softclock
99628 68122 0 0 3 0x40014200 idle0
1 29600 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
Process 18043 (syz-executor.1) thread 0xffff800020ec7608 (69652)
exclusive rrwlock inode r = 0 (0xfffffd806bdeeb40)
#0 witness_lock+0x4c5 sys/kern/subr_witness.c:1164
#1 rw_enter+0x453 sys/kern/kern_rwlock.c:311
#2 rrw_enter+0x88 sys/kern/kern_rwlock.c:462
#3 ufs_ihashins+0x45 sys/ufs/ufs/ufs_ihash.c:140
#4 ffs_vget+0x13e sys/ufs/ffs/ffs_vfsops.c:1358
#5 ffs_inode_alloc+0x1cf sys/ufs/ffs/ffs_alloc.c:392
#6 ufs_makeinode+0xaa sys/ufs/ufs/ufs_vnops.c:1830
#7 ufs_mknod+0x4e sys/ufs/ufs/ufs_vnops.c:172
#8 VOP_MKNOD+0xc6 sys/kern/vfs_vops.c:134
#9 domknodat+0x31e sys/kern/vfs_syscalls.c:1633
#10 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#10 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806bdeea30)
#0 witness_lock+0x4c5 sys/kern/subr_witness.c:1164
#1 rw_enter+0x453 sys/kern/kern_rwlock.c:311
#2 rrw_enter+0x88 sys/kern/kern_rwlock.c:462
#3 VOP_LOCK+0x4b sys/kern/vfs_vops.c:603
#4 vn_lock+0x81 sys/kern/vfs_vnops.c:575
#5 vfs_lookup+0xe6 sys/kern/vfs_lookup.c:419
#6 namei+0x63c sys/kern/vfs_lookup.c:249
#7 domknodat+0x92 sys/kern/vfs_syscalls.c:1585
#8 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#8 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#9 Xsyscall+0x128
Process 39781 (syz-executor.0) thread 0xffff800020ec64f8 (397038)
exclusive rwlock netlock r = 0 (0xffffffff825310c8)
#0 witness_lock+0x4c5 sys/kern/subr_witness.c:1164
#1 solock+0x5a sys/kern/uipc_socket2.c:282
#2 sys_setsockopt+0x1fa sys/kern/uipc_syscalls.c:964
#3 syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#3 syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#4 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff826739f0)
#0 witness_lock+0x4c5 sys/kern/subr_witness.c:1164
#1 syscall+0x400 mi_syscall sys/sys/syscall_mi.h:93 [inline]
#1 syscall+0x400 sys/arch/amd64/amd64/trap.c:570
#2 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 9471 6398K 6398K 78643K 10562 0
pcb 13 8K 8K 78643K 15 0
rtable 105 3K 3K 78643K 199 0
ifaddr 44 10K 10K 78643K 45 0
counters 43 33K 33K 78643K 43 0
ioctlops 0 0K 4K 78643K 1469 0
mount 1 1K 1K 78643K 1 0
vnodes 1185 75K 75K 78643K 2305 0
UFS quota 1 32K 32K 78643K 1 0
UFS mount 5 36K 36K 78643K 5 0
shm 2 1K 1K 78643K 2 0
VM map 2 1K 1K 78643K 2 0
sem 2 0K 0K 78643K 2 0
dirhash 12 2K 2K 78643K 12 0
ACPI 1809 196K 290K 78643K 12766 0
file desc 5 16K 24K 78643K 396 0
proc 59 63K 95K 78643K 438 0
NFS srvsock 1 0K 0K 78643K 1 0
NFS daemon 1 16K 16K 78643K 1 0
in_multi 33 2K 2K 78643K 33 0
ether_multi 1 0K 0K 78643K 1 0
ISOFS mount 1 32K 32K 78643K 1 0
MSDOSFS mount 1 16K 16K 78643K 1 0
ttys 19 95K 95K 78643K 19 0
exec 0 0K 1K 78643K 210 0
pagedep 1 8K 8K 78643K 1 0
inodedep 1 32K 32K 78643K 1 0
newblk 1 0K 0K 78643K 1 0
VM swap 7 26K 26K 78643K 7 0
UVM amap 83 20K 20K 78643K 2116 0
UVM aobj 2 2K 2K 78643K 2 0
memdesc 1 4K 4K 78643K 1 0
crypto data 1 1K 1K 78643K 1 0
NDP 6 0K 0K 78643K 10 0
temp 33 3033K 3097K 78643K 2736 0
kqueue 3 4K 4K 78643K 3 0
SYN cache 2 16K 16K 78643K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp 64 6 0 0 1 0 1 1 0 8 0
plcache 128 20 0 0 1 0 1 1 0 8 0
rtpcb 80 19 0 17 1 0 1 1 0 8 0
rtentry 112 45 0 1 2 0 2 2 0 8 0
unpcb 120 29 0 19 1 0 1 1 0 8 0
syncache 264 5 0 5 2 2 0 1 0 8 0
tcpcb 544 8 0 5 1 0 1 1 0 8 0
inpcb 280 1485 0 1476 1 0 1 1 0 8 0
nd6 48 6 0 0 1 0 1 1 0 8 0
pfosfp 40 846 0 423 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfstitem 24 11 0 2 1 0 1 1 0 8 0
pfstkey 112 11 0 2 1 0 1 1 0 8 0
pfstate 328 11 0 2 1 0 1 1 0 8 0
pfrule 1360 21 0 16 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 188 0 0 12 0 12 12 0 8 0
art_table 32 189 0 0 2 0 2 2 0 8 0
art_node 16 44 0 4 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino1pl 128 2567 0 1157 46 0 46 46 0 8 0
ffsino 272 2567 0 1157 95 0 95 95 0 8 0
nchpl 144 3150 0 1530 61 0 61 61 0 8 0
uvmvnodes 72 3279 0 0 60 0 60 60 0 8 0
vnodes 208 3279 0 0 173 0 173 173 0 8 0
namei 1024 7847 0 7846 2 1 1 1 0 8 0
percpumem 16 32 0 0 1 0 1 1 0 8 0
scxspl 192 7928 0 7927 9 8 1 7 0 8 0
plimitpl 152 16 0 8 1 0 1 1 0 8 0
sigapl 424 617 0 584 4 0 4 4 0 8 0
futexpl 56 2498 0 2498 1 0 1 1 0 8 1
knotepl 112 51 0 34 1 0 1 1 0 8 0
kqueuepl 144 2 0 0 1 0 1 1 0 8 0
pipelkpl 48 78 0 68 2 1 1 1 0 8 0
pipepl 120 156 0 137 2 1 1 1 0 8 0
fdescpl 496 601 0 584 3 0 3 3 0 8 0
filepl 152 3664 0 3593 3 0 3 3 0 8 0
lockfpl 104 5 0 4 1 0 1 1 0 8 0
lockfspl 48 3 0 2 1 0 1 1 0 8 0
sessionpl 112 20 0 9 1 0 1 1 0 8 0
pgrppl 48 20 0 9 1 0 1 1 0 8 0
ucredpl 96 52 0 43 1 0 1 1 0 8 0
zombiepl 144 584 0 584 2 1 1 1 0 8 1
processpl 984 617 0 584 5 0 5 5 0 8 0
procpl 624 1371 0 1327 4 0 4 4 0 8 0
sosppl 128 721 0 719 1 0 1 1 0 8 0
sockpl 400 1533 0 1512 3 0 3 3 0 8 0
mcl4k 4096 3 0 0 1 0 1 1 0 8 0
mcl2k 2048 56 0 0 7 0 7 7 0 8 0
mtagpl 80 1 0 0 1 0 1 1 0 8 0
mbufpl 256 145 0 0 8 0 8 8 0 8 0
bufpl 280 4115 0 174 282 0 282 282 0 8 0
anonpl 16 43273 0 41129 15 2 13 13 0 124 4
amapchunkpl 152 2907 0 2831 6 0 6 6 0 158 2
amappl16 192 1867 0 1792 4 0 4 4 0 8 0
amappl15 184 1 0 1 1 1 0 1 0 8 0
amappl14 176 7 0 5 2 1 1 1 0 8 0
amappl13 168 26 0 25 2 1 1 1 0 8 0
amappl12 160 191 0 187 2 1 1 1 0 8 0
amappl11 152 88 0 68 2 0 2 2 0 8 1
amappl10 144 15 0 13 1 0 1 1 0 8 0
amappl9 136 235 0 232 1 0 1 1 0 8 0
amappl8 128 290 0 280 1 0 1 1 0 8 0
amappl7 120 129 0 117 1 0 1 1 0 8 0
amappl6 112 27 0 21 1 0 1 1 0 8 0
amappl5 104 676 0 659 1 0 1 1 0 8 0
amappl4 96 529 0 500 2 0 2 2 0 8 1
amappl3 88 111 0 106 1 0 1 1 0 8 0
amappl2 80 3870 0 3794 4 1 3 3 0 8 1
amappl1 72 23171 0 22708 26 8 18 20 0 8 8
amappl 80 1612 0 1577 1 0 1 1 0 84 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 64 1 0 0 1 0 1 1 0 8 0
uaddrrnd 24 601 0 584 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 601 0 584 1 0 1 1 0 8 0
vmmpekpl 168 9206 0 9182 2 0 2 2 0 8 0
vmmpepl 168 63224 0 62070 94 14 80 80 0 357 29
vmsppl 368 600 0 584 2 0 2 2 0 8 0
pdppl 4096 1210 0 1168 6 0 6 6 0 8 0
pvpl 32 168813 0 164099 121 6 115 115 0 265 76
pmappl 232 600 0 584 2 0 2 2 0 8 1
extentpl 40 46 0 29 1 0 1 1 0 8 0
phpool 112 149 0 4 5 0 5 5 0 8 0
ddb{1}>
Struck through repros no longer work on HEAD.