binder: 22376:22385 transaction failed 29201/-28, size 0-0 line 3137 binder: 22376:22377 unknown command 0 binder: 22376:22377 ioctl c0306201 20000140 returned -22 binder: undelivered TRANSACTION_ERROR: 29201 ====================================================== [ INFO: possible circular locking dependency detected ] 4.4.174+ #17 Not tainted ------------------------------------------------------- syz-executor.4/22391 is trying to acquire lock: (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 but task is already holding lock: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1497 [inline] (sk_lock-AF_INET6){+.+.+.}, at: [] do_ipv6_setsockopt.isra.0+0x28a/0x30c0 net/ipv6/ipv6_sockglue.c:166 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (sk_lock-AF_INET6){+.+.+.}: [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] lock_sock_nested+0xc6/0x120 net/core/sock.c:2463 [] lock_sock include/net/sock.h:1497 [inline] [] do_ip_setsockopt.isra.0+0x100/0x33a0 net/ipv4/ip_sockglue.c:625 [] compat_ip_setsockopt+0x4e/0xd0 net/ipv4/ip_sockglue.c:1244 [] compat_udp_setsockopt+0x4e/0x90 net/ipv4/udp.c:2172 [] compat_ipv6_setsockopt+0xb4/0x1d0 net/ipv6/ipv6_sockglue.c:923 [] inet_csk_compat_setsockopt+0x99/0x120 net/ipv4/inet_connection_sock.c:914 [] compat_tcp_setsockopt+0x40/0x70 net/ipv4/tcp.c:2654 [] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2674 [] C_SYSC_setsockopt net/compat.c:385 [inline] [] compat_SyS_setsockopt+0x15c/0x720 net/compat.c:368 [] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] [] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397 [] sysenter_flags_fixed+0xd/0x1a -> #0 (rtnl_mutex){+.+.+.}: [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 [] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288 [] do_ipv6_setsockopt.isra.0+0x1bd1/0x30c0 net/ipv6/ipv6_sockglue.c:202 [] compat_ipv6_setsockopt net/ipv6/ipv6_sockglue.c:935 [inline] [] compat_ipv6_setsockopt+0xe7/0x1d0 net/ipv6/ipv6_sockglue.c:916 [] compat_udpv6_setsockopt+0x4e/0x90 net/ipv6/udp.c:1446 [] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2674 [] C_SYSC_setsockopt net/compat.c:385 [inline] [] compat_SyS_setsockopt+0x15c/0x720 net/compat.c:368 [] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] [] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397 [] sysenter_flags_fixed+0xd/0x1a other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_INET6); lock(rtnl_mutex); lock(sk_lock-AF_INET6); lock(rtnl_mutex); *** DEADLOCK *** 1 lock held by syz-executor.4/22391: #0: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1497 [inline] #0: (sk_lock-AF_INET6){+.+.+.}, at: [] do_ipv6_setsockopt.isra.0+0x28a/0x30c0 net/ipv6/ipv6_sockglue.c:166 stack backtrace: CPU: 0 PID: 22391 Comm: syz-executor.4 Not tainted 4.4.174+ #17 0000000000000000 ee7b53aad66c1deb ffff8801a41c7540 ffffffff81aad1a1 ffffffff84057a80 ffff8801bdb12f80 ffffffff83a8d7f0 ffffffff83acc910 ffffffff83a8d7f0 ffff8801a41c7590 ffffffff813abcda ffff8801a41c7670 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] print_circular_bug.cold+0x2f7/0x44e kernel/locking/lockdep.c:1226 [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 [] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288 [] do_ipv6_setsockopt.isra.0+0x1bd1/0x30c0 net/ipv6/ipv6_sockglue.c:202 [] compat_ipv6_setsockopt net/ipv6/ipv6_sockglue.c:935 [inline] [] compat_ipv6_setsockopt+0xe7/0x1d0 net/ipv6/ipv6_sockglue.c:916 [] compat_udpv6_setsockopt+0x4e/0x90 net/ipv6/udp.c:1446 [] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2674 [] C_SYSC_setsockopt net/compat.c:385 [inline] [] compat_SyS_setsockopt+0x15c/0x720 net/compat.c:368 [] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] [] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397 [] sysenter_flags_fixed+0xd/0x1a netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. binder: BINDER_SET_CONTEXT_MGR already set binder: 22388:22406 ioctl 40046207 0 returned -16 binder: 22388:22406 transaction failed 29201/-28, size 0-0 line 3137 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. binder: 22388:22390 transaction failed 29201/-28, size 0-0 line 3137 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. binder: BINDER_SET_CONTEXT_MGR already set binder: 22435:22437 ioctl 40046207 0 returned -16 binder: 22435:22437 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22494:22495 ioctl 40046207 0 returned -16 binder: 22494:22498 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22502:22516 ioctl 40046207 0 returned -16 binder: 22502:22524 transaction failed 29201/-28, size 0-0 line 3137 binder: BINDER_SET_CONTEXT_MGR already set binder: 22502:22529 ioctl 40046207 0 returned -16 binder: 22502:22528 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22546:22554 ioctl 40046207 0 returned -16 binder: 22546:22564 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22546:22573 transaction failed 29201/-28, size 0-0 line 3137 binder: 22546:22571 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 22582:22583 ioctl 40046207 0 returned -16 binder: 22582:22592 transaction failed 29201/-28, size 0-0 line 3137 binder: 22582:22583 unknown command 251683596 binder: undelivered TRANSACTION_ERROR: 29201 binder: 22582:22583 ioctl c0306201 20000140 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 22600:22603 ioctl 40046207 0 returned -16 binder: 22600:22623 transaction failed 29201/-28, size 0-0 line 3137 binder: BINDER_SET_CONTEXT_MGR already set binder: 22630:22634 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 22630:22634 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 22694:22697 ioctl 40046207 0 returned -16 binder: 22694:22707 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22717:22722 ioctl 40046207 0 returned -16 binder: 22717:22722 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22717:22722 ioctl 40046207 0 returned -16 binder: 22717:22756 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22785:22789 ioctl 40046207 0 returned -16 binder: 22785:22806 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22829:22835 ioctl 40046207 0 returned -16 binder: 22829:22838 transaction failed 29201/-28, size 0-0 line 3137 binder: 22829:22835 unknown command -1042971541 binder: undelivered TRANSACTION_ERROR: 29201 binder: 22829:22835 ioctl c0306201 20000140 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 22829:22852 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 22861:22864 ioctl 40046207 0 returned -16 binder: 22861:22870 unknown command 4210688 binder: 22861:22870 ioctl c0306201 20000440 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 22878:22883 ioctl 40046207 0 returned -16 binder: 22878:22895 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 nla_parse: 7 callbacks suppressed netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. binder: BINDER_SET_CONTEXT_MGR already set binder: 22905:22910 ioctl 40046207 0 returned -16 binder: 22905:22914 transaction failed 29201/-28, size 0-0 line 3137 binder: 22905:22910 unknown command -1717966815 binder: undelivered TRANSACTION_ERROR: 29201 binder: 22905:22910 ioctl c0306201 20000140 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 22905:22921 transaction failed 29201/-28, size 0-0 line 3137 binder: 22914:22914 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22937:22944 ioctl 40046207 0 returned -16 binder: 22937:22955 transaction failed 29201/-28, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29201 binder: BINDER_SET_CONTEXT_MGR already set binder: 22937:22957 ioctl 40046207 0 returned -16 binder: 22955:22955 transaction failed 29201/-28, size 0-0 line 3137