IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready ====================================================== WARNING: possible circular locking dependency detected 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0 Not tainted ------------------------------------------------------ syz-executor.1/13467 is trying to acquire lock: ffff00011e233dc8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline] ffff00011e233dc8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: j1939_sk_queue_drop_all+0x38/0xf8 net/can/j1939/socket.c:139 but task is already holding lock: ffff00011b9e70d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline] ffff00011b9e70d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: j1939_sk_netdev_event_netdown+0x34/0xd8 net/can/j1939/socket.c:1269 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&priv->j1939_socks_lock){+.-.}-{2:2}: __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] j1939_sk_errqueue+0x5c/0xe8 net/can/j1939/socket.c:1081 __j1939_session_cancel+0x29c/0x2b4 net/can/j1939/transport.c:1132 j1939_tp_rxtimer+0x2b4/0x55c net/can/j1939/transport.c:1257 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x210/0x390 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x8c/0x1d8 kernel/time/hrtimer.c:1766 _stext+0x168/0x37c ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq+0x70/0xbc kernel/softirq.c:452 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:580 arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35 default_idle_call+0x48/0xb8 kernel/sched/idle.c:109 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x110/0x2d4 kernel/sched/idle.c:303 cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:400 kernel_init+0x0/0x290 init/main.c:729 start_kernel+0x0/0x620 init/main.c:890 start_kernel+0x450/0x620 init/main.c:1145 __primary_switched+0xb4/0xbc arch/arm64/kernel/head.S:471 -> #1 (&priv->active_session_list_lock){+.-.}-{2:2}: __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] j1939_session_list_lock net/can/j1939/transport.c:238 [inline] j1939_session_activate+0x34/0x274 net/can/j1939/transport.c:1561 j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline] j1939_sk_queue_activate_next+0x134/0x200 net/can/j1939/socket.c:208 j1939_session_deactivate_activate_next net/can/j1939/transport.c:1109 [inline] j1939_session_completed net/can/j1939/transport.c:1222 [inline] j1939_xtp_rx_eoma_one+0x264/0x33c net/can/j1939/transport.c:1392 j1939_xtp_rx_eoma net/can/j1939/transport.c:1407 [inline] j1939_tp_cmd_recv+0x518/0xa08 net/can/j1939/transport.c:2096 j1939_tp_recv+0x150/0x304 net/can/j1939/transport.c:2141 j1939_can_recv+0x380/0x4d8 net/can/j1939/main.c:112 deliver net/can/af_can.c:573 [inline] can_rcv_filter+0x134/0x30c net/can/af_can.c:607 can_receive+0x194/0x26c net/can/af_can.c:664 can_rcv+0x7c/0xf8 net/can/af_can.c:688 __netif_receive_skb_one_core net/core/dev.c:5489 [inline] __netif_receive_skb+0x70/0x14c net/core/dev.c:5603 process_backlog+0x240/0x388 net/core/dev.c:5931 __napi_poll+0x5c/0x24c net/core/dev.c:6498 napi_poll+0x110/0x484 net/core/dev.c:6565 net_rx_action+0x18c/0x414 net/core/dev.c:6676 _stext+0x168/0x37c run_ksoftirqd+0x4c/0x21c kernel/softirq.c:934 smpboot_thread_fn+0x248/0x3ec kernel/smpboot.c:164 kthread+0x12c/0x158 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863 -> #0 (&jsk->sk_session_queue_lock){+.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3097 [inline] check_prevs_add kernel/locking/lockdep.c:3216 [inline] validate_chain kernel/locking/lockdep.c:3831 [inline] __lock_acquire+0x1530/0x3084 kernel/locking/lockdep.c:5055 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] j1939_sk_queue_drop_all+0x38/0xf8 net/can/j1939/socket.c:139 j1939_sk_netdev_event_netdown+0x94/0xd8 net/can/j1939/socket.c:1275 j1939_netdev_notify+0x80/0x150 net/can/j1939/main.c:379 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0x7c/0x108 kernel/notifier.c:455 __dev_notify_flags+0x170/0x2e8 dev_change_flags+0x78/0x9c net/core/dev.c:8619 do_setlink+0x628/0x17a4 net/core/rtnetlink.c:2788 __rtnl_newlink net/core/rtnetlink.c:3547 [inline] rtnl_newlink+0x988/0xa04 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x484/0x82c net/core/rtnetlink.c:6091 netlink_rcv_skb+0xe8/0x1d4 net/netlink/af_netlink.c:2540 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6109 netlink_unicast_kernel+0xfc/0x1dc net/netlink/af_netlink.c:1319 netlink_unicast+0x164/0x248 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x484/0x584 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x2f8/0x440 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline] __sys_sendmsg+0x1ac/0x228 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __arm64_sys_sendmsg+0x2c/0x3c net/socket.c:2572 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 other info that might help us debug this: Chain exists of: &jsk->sk_session_queue_lock --> &priv->active_session_list_lock --> &priv->j1939_socks_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&priv->j1939_socks_lock); lock(&priv->active_session_list_lock); lock(&priv->j1939_socks_lock); lock(&jsk->sk_session_queue_lock); *** DEADLOCK *** 2 locks held by syz-executor.1/13467: #0: ffff80000d87b4f8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff80000d87b4f8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x458/0x82c net/core/rtnetlink.c:6088 #1: ffff00011b9e70d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline] #1: ffff00011b9e70d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: j1939_sk_netdev_event_netdown+0x34/0xd8 net/can/j1939/socket.c:1269 stack backtrace: CPU: 0 PID: 13467 Comm: syz-executor.1 Not tainted 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_circular_bug+0x2c4/0x2c8 kernel/locking/lockdep.c:2055 check_noncircular+0x14c/0x154 kernel/locking/lockdep.c:2177 check_prev_add kernel/locking/lockdep.c:3097 [inline] check_prevs_add kernel/locking/lockdep.c:3216 [inline] validate_chain kernel/locking/lockdep.c:3831 [inline] __lock_acquire+0x1530/0x3084 kernel/locking/lockdep.c:5055 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] j1939_sk_queue_drop_all+0x38/0xf8 net/can/j1939/socket.c:139 j1939_sk_netdev_event_netdown+0x94/0xd8 net/can/j1939/socket.c:1275 j1939_netdev_notify+0x80/0x150 net/can/j1939/main.c:379 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0x7c/0x108 kernel/notifier.c:455 __dev_notify_flags+0x170/0x2e8 dev_change_flags+0x78/0x9c net/core/dev.c:8619 do_setlink+0x628/0x17a4 net/core/rtnetlink.c:2788 __rtnl_newlink net/core/rtnetlink.c:3547 [inline] rtnl_newlink+0x988/0xa04 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x484/0x82c net/core/rtnetlink.c:6091 netlink_rcv_skb+0xe8/0x1d4 net/netlink/af_netlink.c:2540 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6109 netlink_unicast_kernel+0xfc/0x1dc net/netlink/af_netlink.c:1319 netlink_unicast+0x164/0x248 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x484/0x584 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x2f8/0x440 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline] __sys_sendmsg+0x1ac/0x228 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __arm64_sys_sendmsg+0x2c/0x3c net/socket.c:2572 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584