====================================================== binder: 9116:9123 Acquire 1 refcount change on invalid ref 0 ret -22 binder: 9116:9125 unknown command 0 binder: 9116:9125 ioctl c0306201 20a20000 returned -22 [ INFO: possible circular locking dependency detected ] 4.4.174+ #4 Not tainted ------------------------------------------------------- syz-executor.5/9115 is trying to acquire lock: (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 but task is already holding lock: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1497 [inline] (sk_lock-AF_INET6){+.+.+.}, at: [] do_ipv6_setsockopt.isra.0+0x28a/0x30c0 net/ipv6/ipv6_sockglue.c:166 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] lock_sock_nested+0xc6/0x120 net/core/sock.c:2463 [] lock_sock include/net/sock.h:1497 [inline] [] do_ipv6_setsockopt.isra.0+0x2eba/0x30c0 net/ipv6/ipv6_sockglue.c:166 [] ipv6_setsockopt+0xda/0x140 net/ipv6/ipv6_sockglue.c:904 [] udpv6_setsockopt+0x4e/0x90 net/ipv6/udp.c:1436 [] sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2663 [] SYSC_setsockopt net/socket.c:1780 [inline] [] SyS_setsockopt+0x159/0x240 net/socket.c:1759 [] entry_SYSCALL_64_fastpath+0x1e/0x9a [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 [] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288 [] do_ipv6_setsockopt.isra.0+0x1bd1/0x30c0 net/ipv6/ipv6_sockglue.c:202 [] ipv6_setsockopt+0xda/0x140 net/ipv6/ipv6_sockglue.c:904 [] udpv6_setsockopt+0x4e/0x90 net/ipv6/udp.c:1436 [] sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2663 [] SYSC_setsockopt net/socket.c:1780 [inline] [] SyS_setsockopt+0x159/0x240 net/socket.c:1759 [] entry_SYSCALL_64_fastpath+0x1e/0x9a other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_INET6); lock(rtnl_mutex); lock(sk_lock-AF_INET6); lock(rtnl_mutex); *** DEADLOCK *** 1 lock held by syz-executor.5/9115: #0: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1497 [inline] #0: (sk_lock-AF_INET6){+.+.+.}, at: [] do_ipv6_setsockopt.isra.0+0x28a/0x30c0 net/ipv6/ipv6_sockglue.c:166 stack backtrace: CPU: 0 PID: 9115 Comm: syz-executor.5 Not tainted 4.4.174+ #4 0000000000000000 d682f06691576f1b ffff8801ac0075c0 ffffffff81aad1a1 ffffffff84057a80 ffff8800b2412f80 ffffffff83a8db50 ffffffff83acc760 ffffffff83a8db50 ffff8801ac007610 ffffffff813abcda ffff8801ac0076f0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] print_circular_bug.cold+0x2f7/0x44e kernel/locking/lockdep.c:1226 [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621 binder: 9137:9138 Acquire 1 refcount change on invalid ref 0 ret -22 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 [] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288 [] do_ipv6_setsockopt.isra.0+0x1bd1/0x30c0 net/ipv6/ipv6_sockglue.c:202 [] ipv6_setsockopt+0xda/0x140 net/ipv6/ipv6_sockglue.c:904 [] udpv6_setsockopt+0x4e/0x90 net/ipv6/udp.c:1436 [] sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2663 [] SYSC_setsockopt net/socket.c:1780 [inline] [] SyS_setsockopt+0x159/0x240 net/socket.c:1759 [] entry_SYSCALL_64_fastpath+0x1e/0x9a binder: 9149:9157 Acquire 1 refcount change on invalid ref 0 ret -22 audit_printk_skb: 90 callbacks suppressed audit: type=1400 audit(1554290023.555:512): avc: denied { create } for pid=9164 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1554290023.585:513): avc: denied { read } for pid=9150 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9168:9172 Acquire 1 refcount change on invalid ref 0 ret -22 audit: type=1400 audit(1554290023.785:514): avc: denied { write } for pid=9164 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9183:9185 Acquire 1 refcount change on invalid ref 0 ret -22 audit: type=1400 audit(1554290024.075:515): avc: denied { read } for pid=9164 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9190:9192 Acquire 1 refcount change on invalid ref 0 ret -22 audit: type=1400 audit(1554290024.575:516): avc: denied { create } for pid=9196 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9202:9203 Acquire 1 refcount change on invalid ref 0 ret -22 audit: type=1400 audit(1554290024.765:517): avc: denied { write } for pid=9196 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9214:9218 unknown command 0 binder: 9214:9218 ioctl c0306201 20a20000 returned -22 audit: type=1400 audit(1554290025.105:518): avc: denied { read } for pid=9196 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9226:9229 unknown command 0 binder: 9226:9229 ioctl c0306201 20a20000 returned -22 audit: type=1400 audit(1554290025.705:519): avc: denied { create } for pid=9233 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9241:9243 unknown command 0 binder: 9241:9243 ioctl c0306201 20a20000 returned -22 audit: type=1400 audit(1554290025.855:520): avc: denied { write } for pid=9233 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1554290026.015:521): avc: denied { read } for pid=9233 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9343:9347 Acquire 1 refcount change on invalid ref 0 ret -22 binder: 9361:9363 Acquire 1 refcount change on invalid ref 0 ret -22 audit_printk_skb: 42 callbacks suppressed audit: type=1400 audit(1554290028.705:536): avc: denied { read } for pid=9360 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9381:9383 Acquire 1 refcount change on invalid ref 0 ret -22 audit: type=1400 audit(1554290029.245:537): avc: denied { create } for pid=9388 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9396:9398 ioctl c0306201 20a20000 returned -14 audit: type=1400 audit(1554290029.395:538): avc: denied { write } for pid=9388 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9409:9413 ioctl c0306201 20a20000 returned -14 audit: type=1400 audit(1554290029.765:539): avc: denied { read } for pid=9388 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9423:9428 ioctl c0306201 20a20000 returned -14 audit: type=1400 audit(1554290030.295:540): avc: denied { create } for pid=9430 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1554290030.435:541): avc: denied { write } for pid=9430 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9439:9450 Acquire 1 refcount change on invalid ref 0 ret -22 audit: type=1400 audit(1554290030.835:542): avc: denied { read } for pid=9430 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9460:9463 Acquire 1 refcount change on invalid ref 0 ret -22 audit: type=1400 audit(1554290031.425:543): avc: denied { create } for pid=9470 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 9478:9480 Acquire 1 refcount change on invalid ref 0 ret -22 audit: type=1400 audit(1554290031.605:544): avc: denied { write } for pid=9470 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1554290031.805:545): avc: denied { read } for pid=9470 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1