syzbot

 sign-in | mailing list | source | docs
🐞 Open [717] 🐞 Fixed [181] 🐞 Invalid [640] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

possible deadlock in sk_clone_lock

Status: upstream: reported C repro on 2021/03/22 00:35
Reported-by: syzbot+c072c80706efe72675eb@syzkaller.appspotmail.com
First crash: 1123d, last: 597d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 possible deadlock in sk_clone_lock C error 4 934d 1184d 0/1 upstream: reported C repro on 2021/01/19 15:48
upstream possible deadlock in sk_clone_lock mm 1 1148d 1146d 0/26 auto-closed as invalid on 2021/04/25 05:11
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2023/03/05 03:32 0m retest repro linux-4.14.y error OK
2023/03/05 02:32 0m retest repro linux-4.14.y error OK
▶ ▼ Fix bisection attempts (18)
Created Duration User Patch Repo Result
2022/10/13 02:10 0m bisect fix linux-4.14.y error job log (0)
2022/08/29 22:21 29m bisect fix linux-4.14.y job log (0) log
2022/07/28 06:23 22m bisect fix linux-4.14.y job log (0) log
2022/06/28 06:02 20m bisect fix linux-4.14.y job log (0) log
2022/05/28 16:25 21m bisect fix linux-4.14.y job log (0) log
2022/04/28 16:02 22m bisect fix linux-4.14.y job log (0) log
2022/03/29 15:35 27m bisect fix linux-4.14.y job log (0) log
2022/02/25 17:39 25m bisect fix linux-4.14.y job log (0) log
2022/01/26 17:09 23m bisect fix linux-4.14.y job log (0) log
2021/12/27 16:33 27m bisect fix linux-4.14.y job log (0) log
2021/11/27 15:59 21m bisect fix linux-4.14.y job log (0) log
2021/10/28 15:36 22m bisect fix linux-4.14.y job log (0) log
2021/09/24 14:10 25m bisect fix linux-4.14.y job log (0) log
2021/08/25 13:06 25m bisect fix linux-4.14.y job log (0) log
2021/07/26 12:40 25m bisect fix linux-4.14.y job log (0) log
2021/06/26 12:04 29m bisect fix linux-4.14.y job log (0) log
2021/05/27 11:31 30m bisect fix linux-4.14.y job log (0) log
2021/04/21 02:48 20m bisect fix linux-4.14.y job log (0) log

Sample crash report:
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
4.14.231-syzkaller #0 Not tainted
-----------------------------------------------------
syz-executor908/8000 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire:
 (hugetlb_lock){+.+.}, at: [<ffffffff817baecb>] spin_lock include/linux/spinlock.h:317 [inline]
 (hugetlb_lock){+.+.}, at: [<ffffffff817baecb>] free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309

and this task is already holding:
 (slock-AF_INET){+.-.}, at: [<ffffffff861072b0>] spin_lock include/linux/spinlock.h:317 [inline]
 (slock-AF_INET){+.-.}, at: [<ffffffff861072b0>] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234
which would create a new lock dependency:
 (slock-AF_INET){+.-.} -> (hugetlb_lock){+.+.}

but this new dependency connects a SOFTIRQ-irq-safe lock:
 (slock-AF_INET){+.-.}

... which became SOFTIRQ-irq-safe at:
  lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
  spin_lock include/linux/spinlock.h:317 [inline]
  sk_clone_lock+0x3cf/0x11e0 net/core/sock.c:1666
  inet_csk_clone_lock+0x1e/0x3f0 net/ipv4/inet_connection_sock.c:815
  tcp_create_openreq_child+0x2c/0x1880 net/ipv4/tcp_minisocks.c:437
  tcp_v4_syn_recv_sock+0xa8/0xf80 net/ipv4/tcp_ipv4.c:1358
  tcp_check_req+0x4c1/0x1460 net/ipv4/tcp_minisocks.c:764
  tcp_v4_rcv+0x1c36/0x3560 net/ipv4/tcp_ipv4.c:1701
  ip_local_deliver_finish+0x3f2/0xab0 net/ipv4/ip_input.c:216
  NF_HOOK include/linux/netfilter.h:250 [inline]
  ip_local_deliver+0x167/0x460 net/ipv4/ip_input.c:257
  dst_input include/net/dst.h:476 [inline]
  ip_rcv_finish+0x6e3/0x19f0 net/ipv4/ip_input.c:396
  NF_HOOK include/linux/netfilter.h:250 [inline]
  ip_rcv+0x8a7/0xf10 net/ipv4/ip_input.c:493
  __netif_receive_skb_core+0x15ee/0x2a30 net/core/dev.c:4474
  __netif_receive_skb+0x27/0x1a0 net/core/dev.c:4512
  netif_receive_skb_internal+0xd7/0x580 net/core/dev.c:4585
  napi_skb_finish net/core/dev.c:4946 [inline]
  napi_gro_receive+0x2e2/0x400 net/core/dev.c:4977
  receive_buf+0xaef/0x4b90 drivers/net/virtio_net.c:852
  virtnet_receive drivers/net/virtio_net.c:1098 [inline]
  virtnet_poll+0x4b7/0x960 drivers/net/virtio_net.c:1189
  napi_poll net/core/dev.c:5596 [inline]
  net_rx_action+0x466/0xfd0 net/core/dev.c:5662
  __do_softirq+0x24d/0x9ff kernel/softirq.c:288
  invoke_softirq kernel/softirq.c:368 [inline]
  irq_exit+0x193/0x240 kernel/softirq.c:409
  exiting_irq arch/x86/include/asm/apic.h:638 [inline]
  do_IRQ+0x112/0x1d0 arch/x86/kernel/irq.c:242
  ret_from_intr+0x0/0x1e
  arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
  text_poke+0x388/0x470 arch/x86/kernel/alternative.c:720
  text_poke_bp+0xc9/0x110 arch/x86/kernel/alternative.c:812
  __jump_label_transform+0x269/0x300 arch/x86/kernel/jump_label.c:102
  arch_jump_label_transform+0x26/0x40 arch/x86/kernel/jump_label.c:110
  __jump_label_update+0x113/0x170 kernel/jump_label.c:374
  jump_label_update kernel/jump_label.c:741 [inline]
  jump_label_update+0x140/0x2d0 kernel/jump_label.c:720
  __static_key_slow_dec_cpuslocked+0x3d/0xf0 kernel/jump_label.c:204
  __static_key_slow_dec kernel/jump_label.c:214 [inline]
  static_key_slow_dec+0x53/0x70 kernel/jump_label.c:228
  once_deferred+0x58/0x80 lib/once.c:18
  process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
  worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
  kthread+0x30d/0x420 kernel/kthread.c:232
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

to a SOFTIRQ-irq-unsafe lock:
 (hugetlb_lock){+.+.}

... which became SOFTIRQ-irq-unsafe at:
...
  lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
  spin_lock include/linux/spinlock.h:317 [inline]
  hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
  proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
  __vfs_write+0xe4/0x630 fs/read_write.c:480
  vfs_write+0x17f/0x4d0 fs/read_write.c:544
  SYSC_write fs/read_write.c:590 [inline]
  SyS_write+0xf2/0x210 fs/read_write.c:582
  do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
  entry_SYSCALL_64_after_hwframe+0x46/0xbb

other info that might help us debug this:

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(hugetlb_lock);
                               local_irq_disable();
                               lock(slock-AF_INET);
                               lock(hugetlb_lock);
  <Interrupt>
    lock(slock-AF_INET);

 *** DEADLOCK ***

3 locks held by syz-executor908/8000:
 #0:  (&sb->s_type->i_mutex_key#13){+.+.}, at: [<ffffffff85bb82c6>] inode_lock include/linux/fs.h:719 [inline]
 #0:  (&sb->s_type->i_mutex_key#13){+.+.}, at: [<ffffffff85bb82c6>] __sock_release+0x86/0x2b0 net/socket.c:601
 #1:  (sk_lock-AF_INET){+.+.}, at: [<ffffffff86106d95>] lock_sock include/net/sock.h:1471 [inline]
 #1:  (sk_lock-AF_INET){+.+.}, at: [<ffffffff86106d95>] tcp_close+0x25/0xed0 net/ipv4/tcp.c:2144
 #2:  (slock-AF_INET){+.-.}, at: [<ffffffff861072b0>] spin_lock include/linux/spinlock.h:317 [inline]
 #2:  (slock-AF_INET){+.-.}, at: [<ffffffff861072b0>] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234

the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
-> (slock-AF_INET){+.-.} ops: 6909 {
   HARDIRQ-ON-W at:
                    lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                    _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:176
                    spin_lock_bh include/linux/spinlock.h:322 [inline]
                    lock_sock_nested+0x39/0x100 net/core/sock.c:2788
                    lock_sock include/net/sock.h:1471 [inline]
                    inet_autobind+0x1a/0x180 net/ipv4/af_inet.c:178
                    inet_dgram_connect+0x134/0x1f0 net/ipv4/af_inet.c:538
                    SYSC_connect net/socket.c:1655 [inline]
                    SyS_connect+0x1f4/0x240 net/socket.c:1636
                    do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
                    entry_SYSCALL_64_after_hwframe+0x46/0xbb
   IN-SOFTIRQ-W at:
                    lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
                    spin_lock include/linux/spinlock.h:317 [inline]
                    sk_clone_lock+0x3cf/0x11e0 net/core/sock.c:1666
                    inet_csk_clone_lock+0x1e/0x3f0 net/ipv4/inet_connection_sock.c:815
                    tcp_create_openreq_child+0x2c/0x1880 net/ipv4/tcp_minisocks.c:437
                    tcp_v4_syn_recv_sock+0xa8/0xf80 net/ipv4/tcp_ipv4.c:1358
                    tcp_check_req+0x4c1/0x1460 net/ipv4/tcp_minisocks.c:764
                    tcp_v4_rcv+0x1c36/0x3560 net/ipv4/tcp_ipv4.c:1701
                    ip_local_deliver_finish+0x3f2/0xab0 net/ipv4/ip_input.c:216
                    NF_HOOK include/linux/netfilter.h:250 [inline]
                    ip_local_deliver+0x167/0x460 net/ipv4/ip_input.c:257
                    dst_input include/net/dst.h:476 [inline]
                    ip_rcv_finish+0x6e3/0x19f0 net/ipv4/ip_input.c:396
                    NF_HOOK include/linux/netfilter.h:250 [inline]
                    ip_rcv+0x8a7/0xf10 net/ipv4/ip_input.c:493
                    __netif_receive_skb_core+0x15ee/0x2a30 net/core/dev.c:4474
                    __netif_receive_skb+0x27/0x1a0 net/core/dev.c:4512
                    netif_receive_skb_internal+0xd7/0x580 net/core/dev.c:4585
                    napi_skb_finish net/core/dev.c:4946 [inline]
                    napi_gro_receive+0x2e2/0x400 net/core/dev.c:4977
                    receive_buf+0xaef/0x4b90 drivers/net/virtio_net.c:852
                    virtnet_receive drivers/net/virtio_net.c:1098 [inline]
                    virtnet_poll+0x4b7/0x960 drivers/net/virtio_net.c:1189
                    napi_poll net/core/dev.c:5596 [inline]
                    net_rx_action+0x466/0xfd0 net/core/dev.c:5662
                    __do_softirq+0x24d/0x9ff kernel/softirq.c:288
                    invoke_softirq kernel/softirq.c:368 [inline]
                    irq_exit+0x193/0x240 kernel/softirq.c:409
                    exiting_irq arch/x86/include/asm/apic.h:638 [inline]
                    do_IRQ+0x112/0x1d0 arch/x86/kernel/irq.c:242
                    ret_from_intr+0x0/0x1e
                    arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
                    text_poke+0x388/0x470 arch/x86/kernel/alternative.c:720
                    text_poke_bp+0xc9/0x110 arch/x86/kernel/alternative.c:812
                    __jump_label_transform+0x269/0x300 arch/x86/kernel/jump_label.c:102
                    arch_jump_label_transform+0x26/0x40 arch/x86/kernel/jump_label.c:110
                    __jump_label_update+0x113/0x170 kernel/jump_label.c:374
                    jump_label_update kernel/jump_label.c:741 [inline]
                    jump_label_update+0x140/0x2d0 kernel/jump_label.c:720
                    __static_key_slow_dec_cpuslocked+0x3d/0xf0 kernel/jump_label.c:204
                    __static_key_slow_dec kernel/jump_label.c:214 [inline]
                    static_key_slow_dec+0x53/0x70 kernel/jump_label.c:228
                    once_deferred+0x58/0x80 lib/once.c:18
                    process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
                    worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
                    kthread+0x30d/0x420 kernel/kthread.c:232
                    ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
   INITIAL USE at:
                   lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                   _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:176
                   spin_lock_bh include/linux/spinlock.h:322 [inline]
                   lock_sock_nested+0x39/0x100 net/core/sock.c:2788
                   lock_sock include/net/sock.h:1471 [inline]
                   inet_autobind+0x1a/0x180 net/ipv4/af_inet.c:178
                   inet_dgram_connect+0x134/0x1f0 net/ipv4/af_inet.c:538
                   SYSC_connect net/socket.c:1655 [inline]
                   SyS_connect+0x1f4/0x240 net/socket.c:1636
                   do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
                   entry_SYSCALL_64_after_hwframe+0x46/0xbb
 }
 ... key      at: [<ffffffff8c988bf0>] af_family_slock_keys+0x10/0x180
 ... acquired at:
   lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
   spin_lock include/linux/spinlock.h:317 [inline]
   free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
   __put_page+0xb9/0x2f0 mm/swap.c:111
   put_page include/linux/mm.h:875 [inline]
   __skb_frag_unref include/linux/skbuff.h:2829 [inline]
   skb_release_data+0x25a/0x820 net/core/skbuff.c:577
   skb_release_all net/core/skbuff.c:640 [inline]
   __kfree_skb+0x46/0x60 net/core/skbuff.c:654
   sk_wmem_free_skb include/net/sock.h:1425 [inline]
   tcp_write_queue_purge include/net/tcp.h:1631 [inline]
   tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904
   inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866
   tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298
   inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
   __sock_release+0xcd/0x2b0 net/socket.c:602
   sock_close+0x15/0x20 net/socket.c:1139
   __fput+0x25f/0x7a0 fs/file_table.c:210
   task_work_run+0x11f/0x190 kernel/task_work.c:113
   exit_task_work include/linux/task_work.h:22 [inline]
   do_exit+0xa44/0x2850 kernel/exit.c:868
   do_group_exit+0x100/0x2e0 kernel/exit.c:965
   SYSC_exit_group kernel/exit.c:976 [inline]
   SyS_exit_group+0x19/0x20 kernel/exit.c:974
   do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
   entry_SYSCALL_64_after_hwframe+0x46/0xbb


the dependencies between the lock to be acquired
 and SOFTIRQ-irq-unsafe lock:
-> (hugetlb_lock){+.+.} ops: 32 {
   HARDIRQ-ON-W at:
                    lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
                    spin_lock include/linux/spinlock.h:317 [inline]
                    hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
                    proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
                    __vfs_write+0xe4/0x630 fs/read_write.c:480
                    vfs_write+0x17f/0x4d0 fs/read_write.c:544
                    SYSC_write fs/read_write.c:590 [inline]
                    SyS_write+0xf2/0x210 fs/read_write.c:582
                    do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
                    entry_SYSCALL_64_after_hwframe+0x46/0xbb
   SOFTIRQ-ON-W at:
                    lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
                    spin_lock include/linux/spinlock.h:317 [inline]
                    hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
                    proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
                    __vfs_write+0xe4/0x630 fs/read_write.c:480
                    vfs_write+0x17f/0x4d0 fs/read_write.c:544
                    SYSC_write fs/read_write.c:590 [inline]
                    SyS_write+0xf2/0x210 fs/read_write.c:582
                    do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
                    entry_SYSCALL_64_after_hwframe+0x46/0xbb
   INITIAL USE at:
                   lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
                   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                   _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
                   spin_lock include/linux/spinlock.h:317 [inline]
                   hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034
                   proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598
                   __vfs_write+0xe4/0x630 fs/read_write.c:480
                   vfs_write+0x17f/0x4d0 fs/read_write.c:544
                   SYSC_write fs/read_write.c:590 [inline]
                   SyS_write+0xf2/0x210 fs/read_write.c:582
                   do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
                   entry_SYSCALL_64_after_hwframe+0x46/0xbb
 }
 ... key      at: [<ffffffff89000cf8>] hugetlb_lock+0x18/0x15e0
 ... acquired at:
   lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
   spin_lock include/linux/spinlock.h:317 [inline]
   free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
   __put_page+0xb9/0x2f0 mm/swap.c:111
   put_page include/linux/mm.h:875 [inline]
   __skb_frag_unref include/linux/skbuff.h:2829 [inline]
   skb_release_data+0x25a/0x820 net/core/skbuff.c:577
   skb_release_all net/core/skbuff.c:640 [inline]
   __kfree_skb+0x46/0x60 net/core/skbuff.c:654
   sk_wmem_free_skb include/net/sock.h:1425 [inline]
   tcp_write_queue_purge include/net/tcp.h:1631 [inline]
   tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904
   inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866
   tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298
   inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
   __sock_release+0xcd/0x2b0 net/socket.c:602
   sock_close+0x15/0x20 net/socket.c:1139
   __fput+0x25f/0x7a0 fs/file_table.c:210
   task_work_run+0x11f/0x190 kernel/task_work.c:113
   exit_task_work include/linux/task_work.h:22 [inline]
   do_exit+0xa44/0x2850 kernel/exit.c:868
   do_group_exit+0x100/0x2e0 kernel/exit.c:965
   SYSC_exit_group kernel/exit.c:976 [inline]
   SyS_exit_group+0x19/0x20 kernel/exit.c:974
   do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
   entry_SYSCALL_64_after_hwframe+0x46/0xbb


stack backtrace:
CPU: 1 PID: 8000 Comm: syz-executor908 Not tainted 4.14.231-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_bad_irq_dependency kernel/locking/lockdep.c:1609 [inline]
 check_usage.cold+0x806/0xbe6 kernel/locking/lockdep.c:1641
 check_irq_usage kernel/locking/lockdep.c:1697 [inline]
 check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline]
 check_prev_add kernel/locking/lockdep.c:1910 [inline]
 check_prevs_add kernel/locking/lockdep.c:2022 [inline]
 validate_chain kernel/locking/lockdep.c:2464 [inline]
 __lock_acquire+0x1cfc/0x3f20 kernel/locking/lockdep.c:3491
 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
 spin_lock include/linux/spinlock.h:317 [inline]
 free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309
 __put_page+0xb9/0x2f0 mm/swap.c:111
 put_page include/linux/mm.h:875 [inline]
 __skb_frag_unref include/linux/skbuff.h:2829 [inline]
 skb_release_data+0x25a/0x820 net/core/skbuff.c:577
 skb_release_all net/core/skbuff.c:640 [inline]
 __kfree_skb+0x46/0x60 net/core/skbuff.c:654
 sk_wmem_free_skb include/net/sock.h:1425 [inline]
 tcp_write_queue_purge include/net/tcp.h:1631 [inline]
 tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904
 inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866
 tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298
 inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
 __sock_release+0xcd/0x2b0 net/socket.c:602
 sock_close+0x15/0x20 net/socket.c:1139
 __fput+0x25f/0x7a0 fs/file_table.c:210
 task_work_run+0x11f/0x190 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xa44/0x2850 kernel/exit.c:868
 do_group_exit+0x100/0x2e0 kernel/exit.c:965
 SYSC_exit_group kernel/exit.c:976 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:974
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x44c1c9
RSP: 002b:00007ffe057b8458 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00000000004cb370 RCX: 000000000044c1c9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffb8 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004cb370
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/04/27 11:29 linux-4.14.y cf256fbcbe34 805b5003 .config console log report syz C ci2-linux-4-14 possible deadlock in sk_clone_lock
2021/03/22 00:55 linux-4.14.y cb83ddcd5332 4c9a64da .config console log report syz C ci2-linux-4-14 possible deadlock in sk_clone_lock
2021/03/22 00:34 linux-4.14.y cb83ddcd5332 4c9a64da .config console log report info ci2-linux-4-14 possible deadlock in sk_clone_lock
* Struck through repros no longer work on HEAD.