syzbot


WARNING: bad unlock balance in release_sock

Status: fixed on 2020/02/18 14:31
Subsystems: net
[Documentation on labels]
Fix commit: 90d72256addf gtp: fix bad unlock balance in gtp_encap_enable_socket
First crash: 1796d, last: 1796d

Sample crash report:
=====================================
WARNING: bad unlock balance detected!
5.5.0-rc4-syzkaller #0 Not tainted
-------------------------------------
syz-executor.1/31393 is trying to release lock (sk_lock-AF_INET) at:
[<ffffffff8620419a>] release_sock+0xba/0x1c0 net/core/sock.c:2959
but there are no more locks to release!

other info that might help us debug this:
2 locks held by syz-executor.1/31393:
 #0: ffffffff8a4d8340 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8a4d8340 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x405/0xaf0 net/core/rtnetlink.c:5426
 #1: ffff888095b671a0 (slock-AF_INET){+.-.}, at: spin_lock_bh include/linux/spinlock.h:343 [inline]
 #1: ffff888095b671a0 (slock-AF_INET){+.-.}, at: release_sock+0x20/0x1c0 net/core/sock.c:2951

stack backtrace:
CPU: 0 PID: 31393 Comm: syz-executor.1 Not tainted 5.5.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_unlock_imbalance_bug kernel/locking/lockdep.c:4008 [inline]
 print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3984
 __lock_release kernel/locking/lockdep.c:4242 [inline]
 lock_release+0x5f2/0x960 kernel/locking/lockdep.c:4503
 sock_release_ownership include/net/sock.h:1496 [inline]
 tcp_release_cb+0x37f/0x3d0 net/ipv4/tcp_output.c:885
 release_sock+0xba/0x1c0 net/core/sock.c:2959
 gtp_encap_enable_socket+0x146/0x400 drivers/net/gtp.c:830
 gtp_encap_enable drivers/net/gtp.c:852 [inline]
 gtp_newlink+0x9fc/0xc60 drivers/net/gtp.c:666
 __rtnl_newlink+0x109d/0x1790 net/core/rtnetlink.c:3310
 rtnl_newlink+0x69/0xa0 net/core/rtnetlink.c:3368
 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5429
 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5447
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0x58c/0x7d0 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:643 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:663
 ____sys_sendmsg+0x753/0x880 net/socket.c:2342
 ___sys_sendmsg+0x100/0x170 net/socket.c:2396
 __sys_sendmsg+0x105/0x1d0 net/socket.c:2429
 __do_sys_sendmsg net/socket.c:2438 [inline]
 __se_sys_sendmsg net/socket.c:2436 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2436
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45af49
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd2b4f00c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045af49
RDX: 0000000020000000 RSI: 0000000020000180 RDI: 0000000000000003
RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd2b4f016d4
R13: 00000000004ca9a0 R14: 00000000004e3d80 R15: 00000000ffffffff

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/08 06:12 net-next-old 1ece2fbe9b42 6738e0b3 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.