====================================================== WARNING: possible circular locking dependency detected 6.15.0-rc1-syzkaller-00221-gb65999e7238e #0 Not tainted ------------------------------------------------------ syz.3.356/7313 is trying to acquire lock: ffffffff900fd448 (rtnl_mutex){+.+.}-{4:4}, at: ip_mroute_setsockopt+0x161/0x11f0 net/ipv4/ipmr.c:1396 but task is already holding lock: ffff88807d72b8a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_setsockopt+0x1b2/0xd50 net/smc/af_smc.c:3073 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&smc->clcsock_release_lock){+.+.}-{4:4}: lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866 __mutex_lock_common kernel/locking/mutex.c:601 [inline] __mutex_lock+0x1a5/0x10c0 kernel/locking/mutex.c:746 smc_switch_to_fallback+0x35/0xda0 net/smc/af_smc.c:903 smc_sendmsg+0x11f/0x530 net/smc/af_smc.c:2781 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:727 __sys_sendto+0x365/0x4c0 net/socket.c:2180 __do_sys_sendto net/socket.c:2187 [inline] __se_sys_sendto net/socket.c:2183 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2183 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (sk_lock-AF_INET){+.+.}-{0:0}: lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866 lock_sock_nested+0x48/0x100 net/core/sock.c:3698 do_ip_setsockopt+0x17e9/0x39c0 net/ipv4/ip_sockglue.c:1078 ip_setsockopt+0x63/0x100 net/ipv4/ip_sockglue.c:1417 do_sock_setsockopt+0x3b1/0x710 net/socket.c:2296 __sys_setsockopt net/socket.c:2321 [inline] __do_sys_setsockopt net/socket.c:2327 [inline] __se_sys_setsockopt net/socket.c:2324 [inline] __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2324 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (rtnl_mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3166 [inline] check_prevs_add kernel/locking/lockdep.c:3285 [inline] validate_chain+0xa69/0x24e0 kernel/locking/lockdep.c:3909 __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235 lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866 __mutex_lock_common kernel/locking/mutex.c:601 [inline] __mutex_lock+0x1a5/0x10c0 kernel/locking/mutex.c:746 ip_mroute_setsockopt+0x161/0x11f0 net/ipv4/ipmr.c:1396 do_ip_setsockopt+0x1114/0x39c0 net/ipv4/ip_sockglue.c:948 ip_setsockopt+0x63/0x100 net/ipv4/ip_sockglue.c:1417 smc_setsockopt+0x25c/0xd50 net/smc/af_smc.c:3081 do_sock_setsockopt+0x3b1/0x710 net/socket.c:2296 __sys_setsockopt net/socket.c:2321 [inline] __do_sys_setsockopt net/socket.c:2327 [inline] __se_sys_setsockopt net/socket.c:2324 [inline] __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2324 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: rtnl_mutex --> sk_lock-AF_INET --> &smc->clcsock_release_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&smc->clcsock_release_lock); lock(sk_lock-AF_INET); lock(&smc->clcsock_release_lock); lock(rtnl_mutex); *** DEADLOCK *** 1 lock held by syz.3.356/7313: #0: ffff88807d72b8a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_setsockopt+0x1b2/0xd50 net/smc/af_smc.c:3073 stack backtrace: CPU: 1 UID: 0 PID: 7313 Comm: syz.3.356 Not tainted 6.15.0-rc1-syzkaller-00221-gb65999e7238e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2079 check_noncircular+0x142/0x160 kernel/locking/lockdep.c:2211 check_prev_add kernel/locking/lockdep.c:3166 [inline] check_prevs_add kernel/locking/lockdep.c:3285 [inline] validate_chain+0xa69/0x24e0 kernel/locking/lockdep.c:3909 __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235 lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866 __mutex_lock_common kernel/locking/mutex.c:601 [inline] __mutex_lock+0x1a5/0x10c0 kernel/locking/mutex.c:746 ip_mroute_setsockopt+0x161/0x11f0 net/ipv4/ipmr.c:1396 do_ip_setsockopt+0x1114/0x39c0 net/ipv4/ip_sockglue.c:948 ip_setsockopt+0x63/0x100 net/ipv4/ip_sockglue.c:1417 smc_setsockopt+0x25c/0xd50 net/smc/af_smc.c:3081 do_sock_setsockopt+0x3b1/0x710 net/socket.c:2296 __sys_setsockopt net/socket.c:2321 [inline] __do_sys_setsockopt net/socket.c:2327 [inline] __se_sys_setsockopt net/socket.c:2324 [inline] __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2324 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc703f8d169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc704e90038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fc7041a5fa0 RCX: 00007fc703f8d169 RDX: 00000000000000c9 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007fc70400e990 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fc7041a5fa0 R15: 00007fffa11cef48 syz.3.356: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 CPU: 0 UID: 0 PID: 7313 Comm: syz.3.356 Not tainted 6.15.0-rc1-syzkaller-00221-gb65999e7238e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 warn_alloc+0x27c/0x410 mm/page_alloc.c:3726 __vmalloc_node_range_noprof+0x128/0x1390 mm/vmalloc.c:3781 vmalloc_user_noprof+0x74/0x80 mm/vmalloc.c:3996 xskq_create+0xb6/0x170 net/xdp/xsk_queue.c:49 xsk_init_queue+0xa1/0x100 net/xdp/xsk.c:1021 xsk_setsockopt+0x449/0x840 net/xdp/xsk.c:1435 do_sock_setsockopt+0x3b1/0x710 net/socket.c:2296 __sys_setsockopt net/socket.c:2321 [inline] __do_sys_setsockopt net/socket.c:2327 [inline] __se_sys_setsockopt net/socket.c:2324 [inline] __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2324 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc703f8d169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc704e90038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fc7041a5fa0 RCX: 00007fc703f8d169 RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000a RBP: 00007fc70400e990 R08: 0000000000000004 R09: 0000000000000000 R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fc7041a5fa0 R15: 00007fffa11cef48 Mem-Info: active_anon:8186 inactive_anon:0 isolated_anon:0 active_file:1396 inactive_file:38318 isolated_file:0 unevictable:768 dirty:123 writeback:0 slab_reclaimable:9681 slab_unreclaimable:114403 mapped:31574 shmem:4296 pagetables:820 sec_pagetables:0 bounce:0 kernel_misc_reclaimable:0 free:1327015 free_pcp:660 free_cma:0 Node 0 active_anon:21144kB inactive_anon:0kB active_file:5584kB inactive_file:153196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:114796kB dirty:492kB writeback:0kB shmem:4248kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11024kB pagetables:3280kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:76kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2487 2487 2487 2487 Node 0 DMA32 free:1395340kB boost:0kB min:34152kB low:42688kB high:51224kB reserved_highatomic:0KB active_anon:21136kB inactive_anon:0kB active_file:5584kB inactive_file:153096kB unevictable:1536kB writepending:492kB present:3129332kB managed:2547528kB mlocked:0kB bounce:0kB free_pcp:280kB local_pcp:32kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 0 Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:8kB inactive_anon:0kB active_file:0kB inactive_file:100kB unevictable:0kB writepending:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 0 Node 1 Normal free:3914956kB boost:0kB min:55748kB low:69684kB high:83620kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:76kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:32kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 0 Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB Node 0 DMA32: 826*4kB (UM) 462*8kB (UME) 618*16kB (UME) 496*32kB (UME) 381*64kB (UME) 237*128kB (UME) 130*256kB (UME) 65*512kB (UME) 28*1024kB (UME) 4*2048kB (ME) 294*4096kB (M) = 1395128kB Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB Node 1 Normal: 209*4kB (UME) 47*8kB (UME) 35*16kB (UME) 173*32kB (UME) 85*64kB (UME) 28*128kB (UME) 13*256kB (UME) 10*512kB (UM) 5*1024kB (UME) 3*2048kB (UE) 947*4096kB (M) = 3914956kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB 41176 total pagecache pages 0 pages in swap cache Free swap = 124996kB Total swap = 124996kB 2097051 pages RAM 0 pages HighMem/MovableOnly 428511 pages reserved 0 pages cma reserved