syzbot


possible deadlock in rhashtable_lookup_insert_fast

Status: fixed on 2018/08/28 17:48
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+b66a5a554991a8ed027c@syzkaller.appspotmail.com
Fix commit: ff93bca76992 ila: make lockdep happy again
First crash: 2086d, last: 2079d
Discussions (2)
Title Replies (including bot) Last reply
[Patch net-next] ila: make lockdep happy again 2 (2) 2018/08/16 19:15
possible deadlock in rhashtable_lookup_insert_fast 1 (2) 2018/08/14 17:39

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
urandom_read: 1 callbacks suppressed
random: sshd: uninitialized urandom read (32 bytes read)

============================================
WARNING: possible recursive locking detected
4.18.0-rc8+ #183 Not tainted
--------------------------------------------
syz-executor821/4372 is trying to acquire lock:
(____ptrval____) (&(&tlocks[i])->rlock){+.+.}, at: spin_lock_bh include/linux/spinlock.h:315 [inline]
(____ptrval____) (&(&tlocks[i])->rlock){+.+.}, at: __rhashtable_insert_fast include/linux/rhashtable.h:596 [inline]
(____ptrval____) (&(&tlocks[i])->rlock){+.+.}, at: rhashtable_lookup_insert_fast.constprop.26+0x436/0x13a0 include/linux/rhashtable.h:784

but task is already holding lock:
(____ptrval____) (&(&tlocks[i])->rlock){+.+.}, at: spin_lock include/linux/spinlock.h:310 [inline]
(____ptrval____) (&(&tlocks[i])->rlock){+.+.}, at: ila_add_mapping net/ipv6/ila/ila_xlat.c:233 [inline]
(____ptrval____) (&(&tlocks[i])->rlock){+.+.}, at: ila_xlat_nl_cmd_add_mapping+0x6bb/0x17e0 net/ipv6/ila/ila_xlat.c:355

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(&tlocks[i])->rlock);
  lock(&(&tlocks[i])->rlock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor821/4372:
 #0: (____ptrval____) (cb_lock){++++}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:636
 #1: (____ptrval____) (&(&tlocks[i])->rlock){+.+.}, at: spin_lock include/linux/spinlock.h:310 [inline]
 #1: (____ptrval____) (&(&tlocks[i])->rlock){+.+.}, at: ila_add_mapping net/ipv6/ila/ila_xlat.c:233 [inline]
 #1: (____ptrval____) (&(&tlocks[i])->rlock){+.+.}, at: ila_xlat_nl_cmd_add_mapping+0x6bb/0x17e0 net/ipv6/ila/ila_xlat.c:355
 #2: (____ptrval____) (rcu_read_lock){....}, at: __rhashtable_insert_fast include/linux/rhashtable.h:579 [inline]
 #2: (____ptrval____) (rcu_read_lock){....}, at: rhashtable_lookup_insert_fast.constprop.26+0x1d7/0x13a0 include/linux/rhashtable.h:784

stack backtrace:
CPU: 1 PID: 4372 Comm: syz-executor821 Not tainted 4.18.0-rc8+ #183
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
 print_deadlock_bug kernel/locking/lockdep.c:1765 [inline]
 check_deadlock kernel/locking/lockdep.c:1809 [inline]
 validate_chain kernel/locking/lockdep.c:2405 [inline]
 __lock_acquire.cold.65+0x1fb/0x486 kernel/locking/lockdep.c:3435
 lock_acquire+0x1e4/0x540 kernel/locking/lockdep.c:3924
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
 _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168
 spin_lock_bh include/linux/spinlock.h:315 [inline]
 __rhashtable_insert_fast include/linux/rhashtable.h:596 [inline]
 rhashtable_lookup_insert_fast.constprop.26+0x436/0x13a0 include/linux/rhashtable.h:784
 ila_add_mapping net/ipv6/ila/ila_xlat.c:240 [inline]
 ila_xlat_nl_cmd_add_mapping+0xafe/0x17e0 net/ipv6/ila/ila_xlat.c:355
 genl_family_rcv_msg+0x8a3/0x1140 net/netlink/genetlink.c:601
 genl_rcv_msg+0xc6/0x168 net/netlink/genetlink.c:626
 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2454
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:637
 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
 netlink_unicast+0x5a0/0x760 net/netlink/af_netlink.c:1343
 netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1908
 sock_sendmsg_nosec net/socket.c:640 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:650
 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2133
 __sys_sendmsg+0x11d/0x290 net/socket.c:2171
 __do_sys_sendmsg net/socket.c:2180 [inline]
 __se_sys_sendmsg net/socket.c:2178 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2178
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4400f9
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 
RSP: 002b:00007fff2e3faf88 EFLAGS: 00000213 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004400f9
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 

Crashes (28):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/08/13 05:51 net-next-old 78cbac647e61 7a88b141 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/12 02:36 net-next-old 8605212a7c37 7a88b141 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/11 02:01 net-next-old 0520344cdb1e 7a88b141 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/11 01:48 net-next-old 0520344cdb1e 7a88b141 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/11 01:35 net-next-old 0520344cdb1e 7a88b141 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 22:42 net-next-old ebddd97afb89 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 21:15 net-next-old ebddd97afb89 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 19:08 net-next-old ebddd97afb89 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 17:02 net-next-old 36d2f761b5aa 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 15:12 net-next-old 36d2f761b5aa 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 13:52 net-next-old 36d2f761b5aa 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 11:37 net-next-old 36d2f761b5aa 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 09:46 net-next-old 36d2f761b5aa 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 08:26 net-next-old 36d2f761b5aa 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 07:10 net-next-old 36d2f761b5aa 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/10 05:11 net-next-old 36d2f761b5aa 1fb62d58 .config console log report syz C ci-upstream-net-kasan-gce
2018/08/17 04:02 linux-next 3070c752f222 9ccc1d45 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/16 00:12 linux-next e5a7da82ad77 9ccc1d45 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/15 23:47 linux-next e5a7da82ad77 9ccc1d45 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/15 22:33 linux-next e5a7da82ad77 9ccc1d45 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/15 00:49 linux-next 4e8b38549b50 0e6dcb88 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/15 00:28 linux-next 4e8b38549b50 0e6dcb88 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/14 19:19 linux-next 4e8b38549b50 5084a625 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/13 05:31 linux-next 4110b42356f3 7a88b141 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/12 03:53 linux-next 4110b42356f3 7a88b141 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/10 20:20 linux-next 4110b42356f3 1fb62d58 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/10 18:52 linux-next 4110b42356f3 1fb62d58 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/10 16:24 linux-next 4110b42356f3 1fb62d58 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.