syzbot


possible deadlock in nr_rt_device_down (3)

Status: upstream: reported C repro on 2024/09/14 18:32
Subsystems: hams
[Documentation on labels]
Reported-by: syzbot+ccdfb85a561b973219c7@syzkaller.appspotmail.com
First crash: 243d, last: 3h40m
Cause bisection: failed (error log, bisect log)
  
Discussions (6)
Title Replies (including bot) Last reply
[syzbot] Monthly hams report (Apr 2025) 0 (1) 2025/04/22 10:11
[syzbot] Monthly hams report (Mar 2025) 0 (1) 2025/03/19 21:27
[syzbot] Monthly hams report (Feb 2025) 0 (1) 2025/02/16 21:54
[syzbot] [hams?] possible deadlock in nr_rt_device_down (3) 0 (3) 2025/02/11 02:23
[syzbot] Monthly hams report (Jan 2025) 0 (1) 2025/01/16 10:12
[syzbot] Monthly hams report (Nov 2024) 0 (1) 2024/11/15 10:49
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in nr_rt_device_down (2) hams 2 289d 289d 0/28 closed as invalid on 2024/09/04 18:18
linux-6.1 possible deadlock in nr_rt_device_down origin:upstream syz 49 6d04h 130d 0/3 upstream: reported syz repro on 2025/01/01 09:10
linux-5.15 possible deadlock in nr_rt_device_down origin:upstream C error 50 3d19h 365d 0/3 upstream: reported C repro on 2024/05/12 01:54

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
6.15.0-rc2-syzkaller-00278-gfc96b232f8e7 #0 Not tainted
------------------------------------------------------
syz-executor107/6105 is trying to acquire lock:
ffffffff902543b8 (nr_node_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffffffff902543b8 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xb5/0x7b0 net/netrom/nr_route.c:517

but task is already holding lock:
ffffffff90254358 (nr_neigh_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffffffff90254358 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x7b0 net/netrom/nr_route.c:514

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (nr_neigh_list_lock){+...}-{3:3}:
       lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
       spin_lock_bh include/linux/spinlock.h:356 [inline]
       nr_remove_neigh net/netrom/nr_route.c:307 [inline]
       nr_dec_obs net/netrom/nr_route.c:472 [inline]
       nr_rt_ioctl+0x39a/0xff0 net/netrom/nr_route.c:692
       sock_do_ioctl+0x152/0x400 net/socket.c:1190
       sock_ioctl+0x644/0x900 net/socket.c:1311
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:906 [inline]
       __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (&nr_node->node_lock){+...}-{3:3}:
       lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
       spin_lock_bh include/linux/spinlock.h:356 [inline]
       nr_node_lock include/net/netrom.h:152 [inline]
       nr_dec_obs net/netrom/nr_route.c:459 [inline]
       nr_rt_ioctl+0x194/0xff0 net/netrom/nr_route.c:692
       sock_do_ioctl+0x152/0x400 net/socket.c:1190
       sock_ioctl+0x644/0x900 net/socket.c:1311
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:906 [inline]
       __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (nr_node_list_lock){+...}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3166 [inline]
       check_prevs_add kernel/locking/lockdep.c:3285 [inline]
       validate_chain+0xa69/0x24e0 kernel/locking/lockdep.c:3909
       __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235
       lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
       spin_lock_bh include/linux/spinlock.h:356 [inline]
       nr_rt_device_down+0xb5/0x7b0 net/netrom/nr_route.c:517
       nr_device_event+0x134/0x150 net/netrom/af_netrom.c:126
       notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
       __dev_notify_flags+0x209/0x410 net/core/dev.c:-1
       netif_change_flags+0xf0/0x1a0 net/core/dev.c:9434
       dev_change_flags+0x146/0x270 net/core/dev_api.c:68
       dev_ioctl+0x80f/0x1260 net/core/dev_ioctl.c:821
       sock_do_ioctl+0x22f/0x400 net/socket.c:1204
       sock_ioctl+0x644/0x900 net/socket.c:1311
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:906 [inline]
       __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(nr_neigh_list_lock);
                               lock(&nr_node->node_lock);
                               lock(nr_neigh_list_lock);
  lock(nr_node_list_lock);

 *** DEADLOCK ***

2 locks held by syz-executor107/6105:
 #0: ffffffff900fd788 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff900fd788 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7fd/0x1260 net/core/dev_ioctl.c:820
 #1: ffffffff90254358 (nr_neigh_list_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
 #1: ffffffff90254358 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x7b0 net/netrom/nr_route.c:514

stack backtrace:
CPU: 0 UID: 0 PID: 6105 Comm: syz-executor107 Not tainted 6.15.0-rc2-syzkaller-00278-gfc96b232f8e7 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2079
 check_noncircular+0x142/0x160 kernel/locking/lockdep.c:2211
 check_prev_add kernel/locking/lockdep.c:3166 [inline]
 check_prevs_add kernel/locking/lockdep.c:3285 [inline]
 validate_chain+0xa69/0x24e0 kernel/locking/lockdep.c:3909
 __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235
 lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
 _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:356 [inline]
 nr_rt_device_down+0xb5/0x7b0 net/netrom/nr_route.c:517
 nr_device_event+0x134/0x150 net/netrom/af_netrom.c:126
 notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
 __dev_notify_flags+0x209/0x410 net/core/dev.c:-1
 netif_change_flags+0xf0/0x1a0 net/core/dev.c:9434
 dev_change_flags+0x146/0x270 net/core/dev_api.c:68
 dev_ioctl+0x80f/0x1260 net/core/dev_ioctl.c:821
 sock_do_ioctl+0x22f/0x400 net/socket.c:1204
 sock_ioctl+0x644/0x900 net/socket.c:1311
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5876088829
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc710e6dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5876088829
RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000007
RBP: 0000000000000000 R08: 00007f58760d6214 R09: 00007f58760d6214
R10: fffffffffffffe1d R11: 0000000000000246 R12: 00007ffc710e6dec
R13: 00007ffc710e6e20 R14: 00007ffc710e6e00 R15: 000000000000006d
 </TASK>

Crashes (3943):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/18 18:37 upstream fc96b232f8e7 2a20f901 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/02/11 02:22 net-next 34c84b394890 43f51a00 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2024/12/26 05:33 upstream 9b2ffa6148b1 444551c4 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root possible deadlock in nr_rt_device_down
2025/02/13 13:50 net-next 2f4720318d02 2afad16e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/02/20 06:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci e6747d19291c cbd8edab .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in nr_rt_device_down
2025/05/09 15:47 upstream 9c69f8884904 bb813bcc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root possible deadlock in nr_rt_device_down
2025/05/05 17:56 upstream 92a09c47464d 6ca47dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in nr_rt_device_down
2025/05/05 03:17 upstream e8ab83e34bdc b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root possible deadlock in nr_rt_device_down
2025/05/02 07:40 upstream ebd297a2affa 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in nr_rt_device_down
2025/05/02 06:06 upstream ebd297a2affa 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in nr_rt_device_down
2025/05/09 06:44 upstream 2c89c1b655c0 bb813bcc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/09 02:57 upstream 2c89c1b655c0 bb813bcc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/09 00:54 upstream 2c89c1b655c0 bb813bcc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/08 14:20 upstream d76bb1ebb558 dbf35fa1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/07 04:07 upstream 0d8d44db295c 350f4ffc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/07 02:22 upstream 0d8d44db295c 350f4ffc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/06 09:07 upstream 01f95500a162 ae98e6b9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/05 16:22 upstream 92a09c47464d 6ca47dd8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/05 14:25 upstream 92a09c47464d 6ca47dd8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/05 12:42 upstream 92a09c47464d 6ca47dd8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/04 17:34 upstream e8ab83e34bdc b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/04 09:13 upstream 2a239ffbebb5 b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in nr_rt_device_down
2025/05/02 00:25 upstream 4f79eaa2ceac 51b137cd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream possible deadlock in nr_rt_device_down
2025/05/11 16:39 net 4d64321c4f6f 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/11 04:42 net 4d64321c4f6f 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/11 03:00 net 4d64321c4f6f 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/10 21:10 net 4d64321c4f6f 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/10 18:15 net 4d64321c4f6f 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/10 10:05 net 4d64321c4f6f 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/10 02:51 net 12f4ee312c95 bb813bcc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/09 20:36 net 12f4ee312c95 bb813bcc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/08 18:23 net 3c44b2d615e6 dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/06 19:04 net e8716b5b0dff ae98e6b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/06 10:12 net 4397684a292a ae98e6b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/05 23:26 net ebd297a2affa 6ca47dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/05 08:28 net ebd297a2affa b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/05 07:01 net ebd297a2affa b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/05 01:24 net ebd297a2affa b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/04 15:03 net ebd297a2affa b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2024/09/10 18:26 net 4c8002277167 784df80e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in nr_rt_device_down
2025/05/12 02:29 net-next 0b28182c73a3 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/11 20:34 net-next 0b28182c73a3 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/10 13:59 net-next 0b28182c73a3 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/09 22:46 net-next a9ce2ce1800e bb813bcc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/08 21:46 net-next 46431fd5224f dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/08 08:26 net-next 3e52667a9c32 dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/06 21:30 net-next 075001c9eb41 ae98e6b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/06 17:45 net-next 075001c9eb41 ae98e6b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/06 17:18 net-next 075001c9eb41 ae98e6b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/06 16:12 net-next 075001c9eb41 ae98e6b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/06 07:52 net-next 953d9480f7d1 ae98e6b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/06 04:39 net-next 953d9480f7d1 ae98e6b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/05 04:53 net-next 836b313a14a3 b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/04 23:40 net-next 836b313a14a3 b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/04 18:52 net-next 836b313a14a3 b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/04 15:21 net-next 836b313a14a3 b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/05/04 07:10 net-next 836b313a14a3 b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in nr_rt_device_down
2025/02/23 11:47 linux-next e5d3fd687aac d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in nr_rt_device_down
2025/03/11 22:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 0ed841ede7ac f2eee6b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in nr_rt_device_down
* Struck through repros no longer work on HEAD.