syzbot

BUG: sleeping function called from invalid context at net/core/sock.c:2502
in_atomic(): 1, irqs_disabled(): 0, pid: 3823, name: syz-executor284
2 locks held by syz-executor284/3823:
 #0:  (sk_lock-AF_INET6){+.+...}, at: [<ffffffff835cc199>] lock_sock include/net/sock.h:1404 [inline]
 #0:  (sk_lock-AF_INET6){+.+...}, at: [<ffffffff835cc199>] udpv6_destroy_sock+0x19/0xd0 net/ipv6/udp.c:1328
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] __rcu_reclaim kernel/rcu/rcu.h:108 [inline]
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] rcu_process_callbacks+0x98e/0x12b0 kernel/rcu/tree.c:3037
Preemption disabled at:[   24.801530] [<ffffffff8302b683>] spin_lock_bh include/linux/spinlock.h:307 [inline]
Preemption disabled at:[   24.801530] [<ffffffff8302b683>] lock_sock_nested+0x43/0x120 net/core/sock.c:2503
CPU: 1 PID: 3823 Comm: syz-executor284 Not tainted 4.9.123-g8dd3fc2 #79
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db307d10 ffffffff81eb9689 ffffffff8302b683 0000000000000000
 0000000000000101 ffff8801c8c8c800 ffff8801c8c8c800 ffff8801db307d48
 ffffffff81426911 ffff8801c8c8c800 ffffffff840f8860 00000000000009c6
Call Trace:
 <IRQ> [   24.853636]  [<ffffffff81eb9689>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ> [   24.853636]  [<ffffffff81eb9689>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81426911>] ___might_sleep.cold.123+0x1bc/0x1f5 kernel/sched/core.c:7988
 [<ffffffff811bd9a5>] __might_sleep+0x95/0x1a0 kernel/sched/core.c:7945
 [<ffffffff8302b674>] lock_sock_nested+0x34/0x120 net/core/sock.c:2502
 [<ffffffff83428cd9>] lock_sock include/net/sock.h:1404 [inline]
 [<ffffffff83428cd9>] inet_shutdown+0x69/0x360 net/ipv4/af_inet.c:823
 [<ffffffff836cb9c0>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:441
 [<ffffffff836c51f1>] l2tp_tunnel_closeall+0x231/0x350 net/l2tp/l2tp_core.c:1368
 [<ffffffff836c5a72>] l2tp_tunnel_destruct+0x2f2/0x590 net/l2tp/l2tp_core.c:1324
 [<ffffffff830280f5>] __sk_destruct+0x55/0x590 net/core/sock.c:1428
 [<ffffffff81289aae>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff81289aae>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 [<ffffffff81289aae>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 [<ffffffff81289aae>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 [<ffffffff81289aae>] rcu_process_callbacks+0x8ae/0x12b0 kernel/rcu/tree.c:3037
 [<ffffffff83a08880>] __do_softirq+0x210/0x940 kernel/softirq.c:288
 [<ffffffff83a02c9c>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:843
 <EOI> [   24.984173]  [<ffffffff8114bb52>] do_softirq.part.14+0x62/0x70 kernel/softirq.c:332
 [<ffffffff8114bc28>] do_softirq arch/x86/include/asm/preempt.h:22 [inline]
 [<ffffffff8114bc28>] __local_bh_enable_ip+0xc8/0xd0 kernel/softirq.c:185
 [<ffffffff8302b71c>] local_bh_enable include/linux/bottom_half.h:31 [inline]
 [<ffffffff8302b71c>] lock_sock_nested+0xdc/0x120 net/core/sock.c:2512
 [<ffffffff835cc199>] lock_sock include/net/sock.h:1404 [inline]
 [<ffffffff835cc199>] udpv6_destroy_sock+0x19/0xd0 net/ipv6/udp.c:1328
 [<ffffffff8303195d>] sk_common_release+0x6d/0x300 net/core/sock.c:2727
 [<ffffffff835caee5>] udp_lib_close+0x15/0x20 include/net/udp.h:203
 [<ffffffff834290cf>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:434
 [<ffffffff83550ef0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:440
 [<ffffffff8301aab6>] sock_release+0x96/0x1c0 net/socket.c:600
 [<ffffffff8301abf6>] sock_close+0x16/0x20 net/socket.c:1047
 [<ffffffff8157cb13>] __fput+0x263/0x700 fs/file_table.c:208
 [<ffffffff8157d035>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8119a66c>] task_work_run+0x10c/0x180 kernel/task_work.c:116
 [<ffffffff8100559c>] tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 [<ffffffff8100559c>] exit_to_usermode_loop+0xfc/0x120 arch/x86/entry/common.c:161
 [<ffffffff810064d4>] prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
 [<ffffffff810064d4>] syscall_return_slowpath arch/x86/entry/common.c:260 [inline]
 [<ffffffff810064d4>] do_syscall_64+0x364/0x490 arch/x86/entry/common.c:287
 [<ffffffff83a01c93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

=================================
[ INFO: inconsistent lock state ]
4.9.123-g8dd3fc2 #79 Tainted: G        W      
---------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz-executor284/3823 [HC0[0]:SC1[3]:HE1:SE0] takes:
 (sk_lock-AF_PPPOX){+.?.+.}, at: [<ffffffff83428cd9>] lock_sock include/net/sock.h:1404 [inline]
 (sk_lock-AF_PPPOX){+.?.+.}, at: [<ffffffff83428cd9>] inet_shutdown+0x69/0x360 net/ipv4/af_inet.c:823
  mark_held_locks+0xc7/0x130 kernel/locking/lockdep.c:2660
  __trace_hardirqs_on_caller kernel/locking/lockdep.c:2689 [inline]
  trace_hardirqs_on_caller+0x38b/0x590 kernel/locking/lockdep.c:2736
  trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2743
  __local_bh_enable_ip+0x6a/0xd0 kernel/softirq.c:190
  local_bh_enable include/linux/bottom_half.h:31 [inline]
  lock_sock_nested+0xdc/0x120 net/core/sock.c:2512
  lock_sock include/net/sock.h:1404 [inline]
  pppol2tp_connect+0xd9/0x18f0 net/l2tp/l2tp_ppp.c:590
  SYSC_connect+0x1b8/0x300 net/socket.c:1563
  SyS_connect+0x24/0x30 net/socket.c:1544
  do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
  entry_SYSCALL_64_after_swapgs+0x5d/0xdb
irq event stamp: 798
hardirqs last  enabled at (798): [<ffffffff83a02629>] restore_regs_and_iret+0x0/0x1d
hardirqs last disabled at (797): [<ffffffff83a0259b>] common_interrupt+0x9b/0xa0 arch/x86/entry/entry_64.S:461
softirqs last  enabled at (276): [<ffffffff8302b6d0>] lock_sock_nested+0x90/0x120 net/core/sock.c:2506
softirqs last disabled at (277): [<ffffffff83a02c9c>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:843

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sk_lock-AF_PPPOX);
  <Interrupt>
    lock(sk_lock-AF_PPPOX);

 *** DEADLOCK ***

2 locks held by syz-executor284/3823:
 #0:  (sk_lock-AF_INET6){+.+...}, at: [<ffffffff835cc199>] lock_sock include/net/sock.h:1404 [inline]
 #0:  (sk_lock-AF_INET6){+.+...}, at: [<ffffffff835cc199>] udpv6_destroy_sock+0x19/0xd0 net/ipv6/udp.c:1328
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] __rcu_reclaim kernel/rcu/rcu.h:108 [inline]
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 #1:  (rcu_callback){......}, at: [<ffffffff81289b8e>] rcu_process_callbacks+0x98e/0x12b0 kernel/rcu/tree.c:3037

stack backtrace:
CPU: 1 PID: 3823 Comm: syz-executor284 Tainted: G        W       4.9.123-g8dd3fc2 #79
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db307a88 ffffffff81eb9689 ffff8801c8c8c800 ffffffff855f12f0
 ffff8801c8c8d118 ffff8801c8c8d138 0000000000000000 ffff8801db307af8
 ffffffff81429ce3 0000000000000003 0000000000000001 ffff880100000000
Call Trace:
 <IRQ> [   25.329038]  [<ffffffff81eb9689>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ> [   25.329038]  [<ffffffff81eb9689>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81429ce3>] print_usage_bug.cold.56+0x327/0x421 kernel/locking/lockdep.c:2387
 [<ffffffff81237286>] valid_state kernel/locking/lockdep.c:2400 [inline]
 [<ffffffff81237286>] mark_lock_irq kernel/locking/lockdep.c:2602 [inline]
 [<ffffffff81237286>] mark_lock+0xcc6/0x1280 kernel/locking/lockdep.c:3065
 [<ffffffff812391b0>] mark_irqflags kernel/locking/lockdep.c:2923 [inline]
 [<ffffffff812391b0>] __lock_acquire+0xd40/0x4070 kernel/locking/lockdep.c:3302
 [<ffffffff8123cf50>] lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
 [<ffffffff8302b706>] lock_sock_nested+0xc6/0x120 net/core/sock.c:2511
 [<ffffffff83428cd9>] lock_sock include/net/sock.h:1404 [inline]
 [<ffffffff83428cd9>] inet_shutdown+0x69/0x360 net/ipv4/af_inet.c:823
 [<ffffffff836cb9c0>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:441
 [<ffffffff836c51f1>] l2tp_tunnel_closeall+0x231/0x350 net/l2tp/l2tp_core.c:1368
 [<ffffffff836c5a72>] l2tp_tunnel_destruct+0x2f2/0x590 net/l2tp/l2tp_core.c:1324
 [<ffffffff830280f5>] __sk_destruct+0x55/0x590 net/core/sock.c:1428
 [<ffffffff81289aae>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff81289aae>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 [<ffffffff81289aae>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 [<ffffffff81289aae>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 [<ffffffff81289aae>] rcu_process_callbacks+0x8ae/0x12b0 kernel/rcu/tree.c:3037
 [<ffffffff83a08880>] __do_softirq+0x210/0x940 kernel/softirq.c:288
 [<ffffffff83a02c9c>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:843
 <EOI> [   25.501987]  [<ffffffff8114bb52>] do_softirq.part.14+0x62/0x70 kernel/softirq.c:332
 [<ffffffff8114bc28>] do_softirq arch/x86/include/asm/preempt.h:22 [inline]
 [<ffffffff8114bc28>] __local_bh_enable_ip+0xc8/0xd0 kernel/softirq.c:185
 [<ffffffff8302b71c>] local_bh_enable include/linux/bottom_half.h:31 [inline]
 [<ffffffff8302b71c>] lock_sock_nested+0xdc/0x120 net/core/sock.c:2512
 [<ffffffff835cc199>] lock_sock include/net/sock.h:1404 [inline]
 [<ffffffff835cc199>] udpv6_destroy_sock+0x19/0xd0 net/ipv6/udp.c:1328
 [<ffffffff8303195d>] sk_common_release+0x6d/0x300 net/core/sock.c:2727
 [<ffffffff835caee5>] udp_lib_close+0x15/0x20 include/net/udp.h:203
 [<ffffffff834290cf>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:434
 [<ffffffff83550ef0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:440
 [<ffffffff8301aab6>] sock_release+0x96/0x1c0 net/socket.c:600
 [<ffffffff8301abf6>] sock_close+0x16/0x20 net/socket.c:1047
 [<ffffffff8157cb13>] __fput+0x263/0x700 fs/file_table.c:208
 [<ffffffff8157d035>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8119a66c>] task_work_run+0x10c/0x180 kernel/task_work.c:116
 [<ffffffff8100559c>] tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 [<ffffffff8100559c>] exit_to_usermode_loop+0xfc/0x120 arch/x86/entry/common.c:161
 [<ffffffff810064d4>] prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
 [<ffffffff810064d4>] syscall_return_slowpath arch/x86/entry/common.c:260 [inline]
 [<ffffffff810064d4>] do_syscall_64+0x364/0x490 arch/x86/entry/common.c:287
 [<ffffffff83a01c93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3823 at net/ipv4/af_inet.c:167 inet_sock_destruct+0x598/0x760 net/ipv4/af_inet.c:167