syzbot


inconsistent lock state in ppp_input

Status: upstream: reported on 2024/10/03 09:17
Reported-by: syzbot+af56ddc562f8a9faf90f@syzkaller.appspotmail.com
First crash: 79d, last: 66d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 inconsistent lock state in ppp_input origin:lts-only C error 17 65d 90d 0/3 upstream: reported C repro on 2024/09/22 06:33
upstream inconsistent lock state in ppp_input ppp C 15 67d 85d 28/28 fixed on 2024/11/12 23:31

Sample crash report:
================================
WARNING: inconsistent lock state
6.1.112-syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/0/15 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff0000dd7a89e0 (&pch->downl){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff0000dd7a89e0 (&pch->downl){+.?.}-{2:2}, at: ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
ffff0000dd7a89e0 (&pch->downl){+.?.}-{2:2}, at: ppp_input+0x168/0x840 drivers/net/ppp/ppp_generic.c:2304
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
  spin_lock include/linux/spinlock.h:351 [inline]
  ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
  ppp_input+0x168/0x840 drivers/net/ppp/ppp_generic.c:2304
  pppoe_rcv_core+0xfc/0x310 drivers/net/ppp/pppoe.c:379
  sk_backlog_rcv include/net/sock.h:1117 [inline]
  __release_sock+0x1a8/0x408 net/core/sock.c:2936
  release_sock+0x68/0x1cc net/core/sock.c:3500
  pppoe_sendmsg+0xc8/0x5d4 drivers/net/ppp/pppoe.c:903
  sock_sendmsg_nosec net/socket.c:718 [inline]
  __sock_sendmsg net/socket.c:730 [inline]
  ____sys_sendmsg+0x55c/0x848 net/socket.c:2514
  ___sys_sendmsg net/socket.c:2568 [inline]
  __sys_sendmmsg+0x318/0x7d8 net/socket.c:2654
  __do_sys_sendmmsg net/socket.c:2683 [inline]
  __se_sys_sendmmsg net/socket.c:2680 [inline]
  __arm64_sys_sendmmsg+0xa0/0xbc net/socket.c:2680
  __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
  invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
  el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
  do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
  el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
  el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
  el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 359316
hardirqs last  enabled at (359316): [<ffff800012376cfc>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (359316): [<ffff800012376cfc>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (359315): [<ffff800012376b18>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (359315): [<ffff800012376b18>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last  enabled at (359306): [<ffff8000081c80cc>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last  enabled at (359306): [<ffff8000081c80cc>] handle_softirqs+0xb84/0xd58 kernel/softirq.c:599
softirqs last disabled at (359311): [<ffff8000081cabc0>] run_ksoftirqd+0x6c/0x29c kernel/softirq.c:938

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&pch->downl);
  <Interrupt>
    lock(&pch->downl);

 *** DEADLOCK ***

1 lock held by ksoftirqd/0/15:
 #0: ffff800015ba4f20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349

stack backtrace:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.1.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 print_usage_bug+0x654/0x9b0 kernel/locking/lockdep.c:3957
 mark_lock_irq+0x980/0xd2c
 mark_lock+0x258/0x360 kernel/locking/lockdep.c:4628
 __lock_acquire+0xb80/0x7680 kernel/locking/lockdep.c:5003
 lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
 ppp_input+0x168/0x840 drivers/net/ppp/ppp_generic.c:2304
 ppp_sync_process+0x88/0x160 drivers/net/ppp/ppp_synctty.c:499
 tasklet_action_common+0x354/0x3f0
 tasklet_action+0x60/0x84 kernel/softirq.c:822
 handle_softirqs+0x318/0xd58 kernel/softirq.c:571
 run_ksoftirqd+0x6c/0x29c kernel/softirq.c:938
 smpboot_thread_fn+0x4b0/0x96c kernel/smpboot.c:164
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
TCP: request_sock_subflow_v4: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/10/15 21:00 linux-6.1.y aa4cd140bba5 7eb57b4a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in ppp_input
2024/10/15 20:59 linux-6.1.y aa4cd140bba5 7eb57b4a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in ppp_input
2024/10/10 12:45 linux-6.1.y aa4cd140bba5 0278d004 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in ppp_input
2024/10/10 00:30 linux-6.1.y aa4cd140bba5 56fb2cb7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in ppp_input
2024/10/03 09:17 linux-6.1.y aa4cd140bba5 a4c7fd36 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in ppp_input
* Struck through repros no longer work on HEAD.