syzbot


possible deadlock in __unix_dgram_recvmsg

Status: closed as invalid on 2021/10/04 21:06
Subsystems: net
[Documentation on labels]
First crash: 1014d, last: 998d
Cause bisection: introduced by (bisect log) [merge commit]:
commit 371fb85457c857eeac1611d3661ee8e637f6548c
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue Jun 29 19:21:21 2021 +0000

  Merge tag 'smp-core-2021-06-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Crash: BUG: sleeping function called from invalid context in lock_sock_nested (log)
Repro: syz .config
  
Fix bisection: fixed by (bisect log) [no-op commit]:
commit 2fa9fd69b3ee015a873e44f7c645ad7bcb79d290
Author: Biju Das <biju.das.jz@bp.renesas.com>
Date: Sat Jun 26 08:13:35 2021 +0000

  clk: renesas: rzg2l: Add multi clock PM support

  
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in __unix_dgram_recvmsg (2) net 3 67d 69d 26/26 fixed on 2024/03/29 01:33

Sample crash report:
============================================
WARNING: possible recursive locking detected
5.14.0-rc1-syzkaller #0 Not tainted
--------------------------------------------
syz-executor.0/8707 is trying to acquire lock:
ffff888029ce4340 (&u->iolock){+.+.}-{3:3}, at: __unix_dgram_recvmsg+0x226/0xb60 net/unix/af_unix.c:2119

but task is already holding lock:
ffff888029ce4340 (&u->iolock){+.+.}-{3:3}, at: unix_msg_wait_data net/unix/unix_bpf.c:33 [inline]
ffff888029ce4340 (&u->iolock){+.+.}-{3:3}, at: unix_dgram_bpf_recvmsg+0xa49/0xd10 net/unix/unix_bpf.c:67

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&u->iolock);
  lock(&u->iolock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

1 lock held by syz-executor.0/8707:
 #0: ffff888029ce4340 (&u->iolock){+.+.}-{3:3}, at: unix_msg_wait_data net/unix/unix_bpf.c:33 [inline]
 #0: ffff888029ce4340 (&u->iolock){+.+.}-{3:3}, at: unix_dgram_bpf_recvmsg+0xa49/0xd10 net/unix/unix_bpf.c:67

stack backtrace:
CPU: 0 PID: 8707 Comm: syz-executor.0 Not tainted 5.14.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:105
 print_deadlock_bug kernel/locking/lockdep.c:2944 [inline]
 check_deadlock kernel/locking/lockdep.c:2987 [inline]
 validate_chain kernel/locking/lockdep.c:3776 [inline]
 __lock_acquire.cold+0x149/0x3ab kernel/locking/lockdep.c:5015
 lock_acquire kernel/locking/lockdep.c:5625 [inline]
 lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
 __mutex_lock_common kernel/locking/mutex.c:959 [inline]
 __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
 __unix_dgram_recvmsg+0x226/0xb60 net/unix/af_unix.c:2119
 unix_dgram_bpf_recvmsg+0x630/0xd10 net/unix/unix_bpf.c:71
 unix_dgram_recvmsg net/unix/af_unix.c:2215 [inline]
 unix_seqpacket_recvmsg+0xed/0x150 net/unix/af_unix.c:2088
 sock_recvmsg_nosec net/socket.c:943 [inline]
 sock_recvmsg net/socket.c:961 [inline]
 sock_recvmsg net/socket.c:957 [inline]
 ____sys_recvmsg+0x2c4/0x600 net/socket.c:2611
 ___sys_recvmsg+0x127/0x200 net/socket.c:2653
 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2683
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb9cdf8e188 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000005
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007fffd2897e1f R14: 00007fb9cdf8e300 R15: 0000000000022000

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/31 00:17 bpf-next f309b4ba989d 6c236867 .config console log report syz ci-upstream-bpf-next-kasan-gce possible deadlock in __unix_dgram_recvmsg
2021/07/22 06:37 bpf-next 807b8f0e24e6 29c3f20f .config console log report syz ci-upstream-bpf-next-kasan-gce possible deadlock in __unix_dgram_recvmsg
2021/07/16 23:54 bpf-next c50524ec4e3a f115ae98 .config console log report syz ci-upstream-bpf-next-kasan-gce possible deadlock in __unix_dgram_recvmsg
2021/08/01 23:21 linux-next 8d4b477da1a8 6c236867 .config console log report syz ci-upstream-linux-next-kasan-gce-root possible deadlock in __unix_dgram_recvmsg
2021/08/01 14:13 linux-next 8d4b477da1a8 6c236867 .config console log report syz ci-upstream-linux-next-kasan-gce-root possible deadlock in __unix_dgram_recvmsg
2021/07/22 07:19 bpf-next 807b8f0e24e6 29c3f20f .config console log report info ci-upstream-bpf-next-kasan-gce possible deadlock in __unix_dgram_recvmsg
2021/07/22 06:20 bpf-next 807b8f0e24e6 29c3f20f .config console log report info ci-upstream-bpf-next-kasan-gce possible deadlock in __unix_dgram_recvmsg
2021/07/18 18:32 bpf-next 78e4a955928e f115ae98 .config console log report info ci-upstream-bpf-next-kasan-gce possible deadlock in __unix_dgram_recvmsg
2021/07/16 23:35 bpf-next c50524ec4e3a f115ae98 .config console log report info ci-upstream-bpf-next-kasan-gce possible deadlock in __unix_dgram_recvmsg
2021/08/01 23:04 linux-next 8d4b477da1a8 6c236867 .config console log report info ci-upstream-linux-next-kasan-gce-root possible deadlock in __unix_dgram_recvmsg
2021/08/01 13:52 linux-next 8d4b477da1a8 6c236867 .config console log report info ci-upstream-linux-next-kasan-gce-root possible deadlock in __unix_dgram_recvmsg
* Struck through repros no longer work on HEAD.