audit: type=1400 audit(1566330282.969:1142): avc: denied { create } for pid=22979 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 ====================================================== [ INFO: possible circular locking dependency detected ] 4.4.174+ #17 Not tainted ------------------------------------------------------- syz-executor.2/23049 is trying to acquire lock: (&(&q->lock)->rlock){+.-...}, at: [] spin_lock include/linux/spinlock.h:302 [inline] (&(&q->lock)->rlock){+.-...}, at: [] ip_defrag+0x322/0x3b70 net/ipv4/ip_fragment.c:690 but task is already holding lock: (_xmit_NETROM){+.-...}, at: [] spin_lock include/linux/spinlock.h:302 [inline] (_xmit_NETROM){+.-...}, at: [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] (_xmit_NETROM){+.-...}, at: [] sch_direct_xmit+0x238/0x700 net/sched/sch_generic.c:163 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:112 [inline] [] _raw_spin_lock_irqsave+0x50/0x70 kernel/locking/spinlock.c:159 [] try_to_wake_up+0x2b/0x1110 kernel/sched/core.c:1974 [] wake_up_q+0xbb/0x130 kernel/sched/core.c:582 [] __mutex_unlock_common_slowpath kernel/locking/mutex.c:754 [inline] [] __mutex_unlock_slowpath+0x25d/0x530 kernel/locking/mutex.c:765 [] mutex_unlock+0x9/0x10 kernel/locking/mutex.c:437 [] __rtnl_unlock+0x15/0x20 net/core/rtnetlink.c:76 [] netdev_run_todo+0xf7/0x770 net/core/dev.c:7028 [] rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:82 [] linkwatch_event+0x45/0x60 net/core/link_watch.c:238 [] process_one_work+0x825/0x1720 kernel/workqueue.c:2064 [] worker_thread+0x4e4/0xf50 kernel/workqueue.c:2196 [] kthread+0x273/0x310 kernel/kthread.c:211 [] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:537 [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline] [] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151 [] spin_lock include/linux/spinlock.h:302 [inline] [] ip_defrag+0x322/0x3b70 net/ipv4/ip_fragment.c:690 [] ip_check_defrag net/ipv4/ip_fragment.c:738 [inline] [] ip_check_defrag+0x3d6/0x5b0 net/ipv4/ip_fragment.c:705 [] packet_rcv_fanout+0x51e/0x5f0 net/packet/af_packet.c:1458 [] deliver_skb net/core/dev.c:1842 [inline] [] dev_queue_xmit_nit net/core/dev.c:1898 [inline] [] xmit_one net/core/dev.c:2777 [inline] [] dev_hard_start_xmit+0x288/0x11e0 net/core/dev.c:2797 [] sch_direct_xmit+0x2b6/0x700 net/sched/sch_generic.c:165 [] __dev_xmit_skb net/core/dev.c:2979 [inline] [] __dev_queue_xmit+0xd24/0x1bb0 net/core/dev.c:3197 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263 [] neigh_resolve_output+0x4a0/0x7a0 net/core/neighbour.c:1329 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:213 [] ip_do_fragment+0x187c/0x1f70 net/ipv4/ip_output.c:635 [] ip_fragment.constprop.0+0x14b/0x200 net/ipv4/ip_output.c:505 [] ip_finish_output+0x3b9/0xc60 net/ipv4/ip_output.c:286 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362 [] dst_output include/net/dst.h:498 [inline] [] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119 [] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1453 [] udp_send_skb+0x4fd/0xc70 net/ipv4/udp.c:842 [] udp_push_pending_frames+0x4e/0xe0 net/ipv4/udp.c:870 [] udp_sendmsg+0x116b/0x1c60 net/ipv4/udp.c:1104 [] udpv6_sendmsg+0x1e5d/0x24f0 net/ipv6/udp.c:1178 [] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755 [] sock_sendmsg_nosec net/socket.c:638 [inline] [] sock_sendmsg+0xbe/0x110 net/socket.c:648 [] ___sys_sendmsg+0x369/0x890 net/socket.c:1975 [] __sys_sendmmsg+0x1d6/0x2e0 net/socket.c:2053 [] C_SYSC_sendmmsg net/compat.c:731 [inline] [] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:728 [] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] [] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397 [] sysenter_flags_fixed+0xd/0x1a other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(_xmit_NETROM); lock(&(&q->lock)->rlock); lock(_xmit_NETROM); lock(&(&q->lock)->rlock); *** DEADLOCK *** 5 locks held by syz-executor.2/23049: #0: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1497 [inline] #0: (sk_lock-AF_INET6){+.+.+.}, at: [] udp_sendmsg+0xe54/0x1c60 net/ipv4/udp.c:922 #1: (rcu_read_lock_bh){......}, at: [] ip_finish_output2+0x20b/0x1280 net/ipv4/ip_output.c:193 #2: (rcu_read_lock_bh){......}, at: [] __dev_queue_xmit+0x1d7/0x1bb0 net/core/dev.c:3161 #3: (_xmit_NETROM){+.-...}, at: [] spin_lock include/linux/spinlock.h:302 [inline] #3: (_xmit_NETROM){+.-...}, at: [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] #3: (_xmit_NETROM){+.-...}, at: [] sch_direct_xmit+0x238/0x700 net/sched/sch_generic.c:163 #4: (rcu_read_lock){......}, at: [] xmit_one net/core/dev.c:2776 [inline] #4: (rcu_read_lock){......}, at: [] dev_hard_start_xmit+0xb3/0x11e0 net/core/dev.c:2797 stack backtrace: CPU: 1 PID: 23049 Comm: syz-executor.2 Not tainted 4.4.174+ #17 0000000000000000 5d20a75c414c6ed1 ffff8800b731e870 ffffffff81aad1a1 ffffffff84057a80 ffff8801d09d8000 ffffffff83adae90 ffffffff83ad5370 ffffffff83adae90 ffff8800b731e8c0 ffffffff813abcda ffff8800b731e9a0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] print_circular_bug.cold+0x2f7/0x44e kernel/locking/lockdep.c:1226 [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline] [] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151 [] spin_lock include/linux/spinlock.h:302 [inline] [] ip_defrag+0x322/0x3b70 net/ipv4/ip_fragment.c:690 [] ip_check_defrag net/ipv4/ip_fragment.c:738 [inline] [] ip_check_defrag+0x3d6/0x5b0 net/ipv4/ip_fragment.c:705 [] packet_rcv_fanout+0x51e/0x5f0 net/packet/af_packet.c:1458 [] deliver_skb net/core/dev.c:1842 [inline] [] dev_queue_xmit_nit net/core/dev.c:1898 [inline] [] xmit_one net/core/dev.c:2777 [inline] [] dev_hard_start_xmit+0x288/0x11e0 net/core/dev.c:2797 [] sch_direct_xmit+0x2b6/0x700 net/sched/sch_generic.c:165 [] __dev_xmit_skb net/core/dev.c:2979 [inline] [] __dev_queue_xmit+0xd24/0x1bb0 net/core/dev.c:3197 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263 [] neigh_resolve_output+0x4a0/0x7a0 net/core/neighbour.c:1329 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:213 [] ip_do_fragment+0x187c/0x1f70 net/ipv4/ip_output.c:635 [] ip_fragment.constprop.0+0x14b/0x200 net/ipv4/ip_output.c:505 [] ip_finish_output+0x3b9/0xc60 net/ipv4/ip_output.c:286 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362 [] dst_output include/net/dst.h:498 [inline] [] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119 [] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1453 [] udp_send_skb+0x4fd/0xc70 net/ipv4/udp.c:842 [] udp_push_pending_frames+0x4e/0xe0 net/ipv4/udp.c:870 [] udp_sendmsg+0x116b/0x1c60 net/ipv4/udp.c:1104 [] udpv6_sendmsg+0x1e5d/0x24f0 net/ipv6/udp.c:1178 [] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755 [] sock_sendmsg_nosec net/socket.c:638 [inline] [] sock_sendmsg+0xbe/0x110 net/socket.c:648 [] ___sys_sendmsg+0x369/0x890 net/socket.c:1975 [] __sys_sendmmsg+0x1d6/0x2e0 net/socket.c:2053 [] C_SYSC_sendmmsg net/compat.c:731 [inline] [] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:728 [] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] [] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397 [] sysenter_flags_fixed+0xd/0x1a blk_update_request: I/O error, dev loop0, sector 0 Buffer I/O error on dev loop0, logical block 0, lost async page write blk_update_request: I/O error, dev loop0, sector 8 Buffer I/O error on dev loop0, logical block 1, lost async page write audit: type=1400 audit(1566330285.159:1143): avc: denied { create } for pid=23071 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 audit: type=1400 audit(1566330285.179:1144): avc: denied { create } for pid=23077 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 blk_update_request: I/O error, dev loop0, sector 16 Buffer I/O error on dev loop0, logical block 2, lost async page write blk_update_request: I/O error, dev loop0, sector 24 Buffer I/O error on dev loop0, logical block 3, lost async page write blk_update_request: I/O error, dev loop0, sector 32 Buffer I/O error on dev loop0, logical block 4, lost async page write blk_update_request: I/O error, dev loop0, sector 40 Buffer I/O error on dev loop0, logical block 5, lost async page write blk_update_request: I/O error, dev loop0, sector 48 Buffer I/O error on dev loop0, logical block 6, lost async page write blk_update_request: I/O error, dev loop0, sector 56 Buffer I/O error on dev loop0, logical block 7, lost async page write blk_update_request: I/O error, dev loop0, sector 64 Buffer I/O error on dev loop0, logical block 8, lost async page write blk_update_request: I/O error, dev loop0, sector 72 Buffer I/O error on dev loop0, logical block 9, lost async page write audit: type=1400 audit(1566330285.409:1145): avc: denied { create } for pid=23071 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 loop_reread_partitions: partition scan of loop0 (úqÊˆu¸q‡¢ºMÃ½UÔ¤b¹*,) failed (rc=-13) loop_reread_partitions: partition scan of loop0 () failed (rc=-13) audit: type=1400 audit(1566330285.809:1146): avc: denied { create } for pid=23111 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 audit: type=1400 audit(1566330286.399:1147): avc: denied { create } for pid=23153 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 audit: type=1400 audit(1566330286.479:1148): avc: denied { create } for pid=23145 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 loop_reread_partitions: partition scan of loop0 (úqÊˆu¸q‡¢ºMÃ½UÔ¤b¹*,) failed (rc=-13) loop_reread_partitions: partition scan of loop0 () failed (rc=-13) loop_reread_partitions: partition scan of loop0 (úqÊˆu¸q‡¢ºMÃ½UÔ¤b¹*,) failed (rc=-13) loop_reread_partitions: partition scan of loop0 () failed (rc=-13) audit_printk_skb: 6 callbacks suppressed audit: type=1400 audit(1566330287.749:1151): avc: denied { create } for pid=23251 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 audit: type=1400 audit(1566330288.269:1152): avc: denied { create } for pid=23305 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 audit: type=1400 audit(1566330288.879:1153): avc: denied { create } for pid=23349 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 audit: type=1400 audit(1566330289.339:1154): avc: denied { create } for pid=23398 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 blk_update_request: 510 callbacks suppressed blk_update_request: I/O error, dev loop0, sector 0 buffer_io_error: 510 callbacks suppressed Buffer I/O error on dev loop0, logical block 0, lost async page write blk_update_request: I/O error, dev loop0, sector 8 Buffer I/O error on dev loop0, logical block 1, lost async page write blk_update_request: I/O error, dev loop0, sector 16 Buffer I/O error on dev loop0, logical block 2, lost async page write blk_update_request: I/O error, dev loop0, sector 24 Buffer I/O error on dev loop0, logical block 3, lost async page write blk_update_request: I/O error, dev loop0, sector 32 Buffer I/O error on dev loop0, logical block 4, lost async page write blk_update_request: I/O error, dev loop0, sector 40 audit: type=1400 audit(1566330290.399:1155): avc: denied { create } for pid=23456 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 Buffer I/O error on dev loop0, logical block 5, lost async page write blk_update_request: I/O error, dev loop0, sector 48 Buffer I/O error on dev loop0, logical block 6, lost async page write blk_update_request: I/O error, dev loop0, sector 56 Buffer I/O error on dev loop0, logical block 7, lost async page write blk_update_request: I/O error, dev loop0, sector 64 Buffer I/O error on dev loop0, logical block 8, lost async page write blk_update_request: I/O error, dev loop0, sector 72 Buffer I/O error on dev loop0, logical block 9, lost async page write loop_reread_partitions: partition scan of loop0 (úqÊˆu¸q‡¢ºMÃ½UÔ¤b¹*,) failed (rc=-13) loop_reread_partitions: partition scan of loop0 () failed (rc=-13) audit: type=1400 audit(1566330291.269:1156): avc: denied { create } for pid=23550 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 audit: type=1400 audit(1566330291.309:1157): avc: denied { create } for pid=23550 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 hid-generic 0000:0000:0000.0017: ignoring exceeding usage max hid-generic 0000:0000:0000.0017: hidraw3: HID v0.00 Device [syz1] on sz1 hid-generic 0000:0000:0000.0018: ignoring exceeding usage max hid-generic 0000:0000:0000.0018: hidraw3: HID v0.00 Device [syz1] on sz1