================================
WARNING: inconsistent lock state
6.1.0-rc6-syzkaller #0 Not tainted
--------------------------------
inconsistent {IN-SOFTIRQ-R} -> {SOFTIRQ-ON-W} usage.
syz-executor.2/28400 [HC0[0]:SC0[0]:HE1:SE1] takes:
ffff88804370d3b8 (clock-AF_INET6){+++-}-{2:2}, at: l2tp_tunnel_register+0x126/0x1210 net/l2tp/l2tp_core.c:1477
{IN-SOFTIRQ-R} state was registered at:
lock_acquire kernel/locking/lockdep.c:5668 [inline]
lock_acquire+0x1e3/0x630 kernel/locking/lockdep.c:5633
__raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
_raw_read_lock_bh+0x3f/0x70 kernel/locking/spinlock.c:252
rds_tcp_write_space+0x29/0x690 net/rds/tcp_send.c:184
tcp_new_space net/ipv4/tcp_input.c:5471 [inline]
tcp_check_space+0x11b/0x810 net/ipv4/tcp_input.c:5490
tcp_data_snd_check net/ipv4/tcp_input.c:5499 [inline]
tcp_rcv_established+0x93e/0x2230 net/ipv4/tcp_input.c:6007
tcp_v6_do_rcv+0x814/0x13c0 net/ipv6/tcp_ipv6.c:1502
tcp_v6_rcv+0x2ea6/0x3840 net/ipv6/tcp_ipv6.c:1761
ip6_protocol_deliver_rcu+0x2df/0x1950 net/ipv6/ip6_input.c:439
ip6_input_finish+0x150/0x2c0 net/ipv6/ip6_input.c:484
NF_HOOK include/linux/netfilter.h:302 [inline]
NF_HOOK include/linux/netfilter.h:296 [inline]
ip6_input+0xa0/0xd0 net/ipv6/ip6_input.c:493
dst_input include/net/dst.h:455 [inline]
ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
NF_HOOK include/linux/netfilter.h:296 [inline]
ipv6_rcv+0x250/0x380 net/ipv6/ip6_input.c:309
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5489
__netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5603
process_backlog+0x3e4/0x810 net/core/dev.c:5931
__napi_poll+0xb8/0x770 net/core/dev.c:6498
napi_poll net/core/dev.c:6565 [inline]
net_rx_action+0xa00/0xde0 net/core/dev.c:6676
__do_softirq+0x1fb/0xadc kernel/softirq.c:571
do_softirq.part.0+0xde/0x130 kernel/softirq.c:472
do_softirq kernel/softirq.c:464 [inline]
__local_bh_enable_ip+0x106/0x130 kernel/softirq.c:396
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:808 [inline]
ip6_finish_output2+0x5be/0x1530 net/ipv6/ip6_output.c:135
__ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
ip6_finish_output+0x694/0x1170 net/ipv6/ip6_output.c:206
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x1f1/0x540 net/ipv6/ip6_output.c:227
dst_output include/net/dst.h:445 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
NF_HOOK include/linux/netfilter.h:296 [inline]
ip6_xmit+0x11f7/0x1c60 net/ipv6/ip6_output.c:343
inet6_csk_xmit+0x3b5/0x6d0 net/ipv6/inet6_connection_sock.c:135
__tcp_transmit_skb+0x1967/0x3800 net/ipv4/tcp_output.c:1402
__tcp_send_ack.part.0+0x3a7/0x760 net/ipv4/tcp_output.c:3986
__tcp_send_ack net/ipv4/tcp_output.c:3992 [inline]
tcp_send_ack+0x81/0xa0 net/ipv4/tcp_output.c:3992
__tcp_ack_snd_check+0x156/0x9c0 net/ipv4/tcp_input.c:5524
tcp_ack_snd_check net/ipv4/tcp_input.c:5570 [inline]
tcp_rcv_established+0x992/0x2230 net/ipv4/tcp_input.c:6008
tcp_v6_do_rcv+0x814/0x13c0 net/ipv6/tcp_ipv6.c:1502
sk_backlog_rcv include/net/sock.h:1109 [inline]
__release_sock+0x133/0x3b0 net/core/sock.c:2906
release_sock+0x58/0x1b0 net/core/sock.c:3462
inet_wait_for_connect net/ipv4/af_inet.c:598 [inline]
__inet_stream_connect+0x757/0xed0 net/ipv4/af_inet.c:690
inet_stream_connect+0x57/0xa0 net/ipv4/af_inet.c:729
mptcp_connect+0x4b2/0x8c0 net/mptcp/protocol.c:3573
__inet_stream_connect+0x69e/0xed0 net/ipv4/af_inet.c:665
mptcp_stream_connect+0xb0/0x110 net/mptcp/protocol.c:3657
__sys_connect_file+0x153/0x1a0 net/socket.c:1976
__sys_connect+0x165/0x1a0 net/socket.c:1993
__do_sys_connect net/socket.c:2003 [inline]
__se_sys_connect net/socket.c:2000 [inline]
__ia32_sys_connect+0x72/0xb0 net/socket.c:2000
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
irq event stamp: 315
hardirqs last enabled at (315): [<ffffffff89f06914>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (315): [<ffffffff89f06914>] _raw_spin_unlock_irqrestore+0x54/0x70 kernel/locking/spinlock.c:194
hardirqs last disabled at (314): [<ffffffff89f066a2>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (314): [<ffffffff89f066a2>] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:162
softirqs last enabled at (310): [<ffffffff88ec325b>] rcu_read_unlock_bh include/linux/rcupdate.h:804 [inline]
softirqs last enabled at (310): [<ffffffff88ec325b>] l2tp_tunnel_get+0x3fb/0x750 net/l2tp/l2tp_core.c:219
softirqs last disabled at (308): [<ffffffff88ec2fad>] rcu_read_unlock include/linux/rcupdate.h:767 [inline]
softirqs last disabled at (308): [<ffffffff88ec2fad>] net_generic include/net/netns/generic.h:48 [inline]
softirqs last disabled at (308): [<ffffffff88ec2fad>] l2tp_pernet net/l2tp/l2tp_core.c:125 [inline]
softirqs last disabled at (308): [<ffffffff88ec2fad>] l2tp_tunnel_get+0x14d/0x750 net/l2tp/l2tp_core.c:207
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(clock-AF_INET6);
<Interrupt>
lock(clock-AF_INET6);
*** DEADLOCK ***
1 lock held by syz-executor.2/28400:
#0: ffff88801ba2b130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1721 [inline]
#0: ffff88801ba2b130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xadc/0x1a10 net/l2tp/l2tp_ppp.c:675
stack backtrace:
CPU: 3 PID: 28400 Comm: syz-executor.2 Not tainted 6.1.0-rc6-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_usage_bug kernel/locking/lockdep.c:222 [inline]
valid_state kernel/locking/lockdep.c:3975 [inline]
mark_lock_irq kernel/locking/lockdep.c:4184 [inline]
mark_lock.part.0.cold+0x3a/0xd8 kernel/locking/lockdep.c:4634
mark_lock kernel/locking/lockdep.c:4598 [inline]
mark_usage kernel/locking/lockdep.c:4547 [inline]
__lock_acquire+0x893/0x56d0 kernel/locking/lockdep.c:5009
lock_acquire kernel/locking/lockdep.c:5668 [inline]
lock_acquire+0x1e3/0x630 kernel/locking/lockdep.c:5633
__raw_write_lock include/linux/rwlock_api_smp.h:209 [inline]
_raw_write_lock+0x2e/0x40 kernel/locking/spinlock.c:300
l2tp_tunnel_register+0x126/0x1210 net/l2tp/l2tp_core.c:1477
pppol2tp_connect+0xcdc/0x1a10 net/l2tp/l2tp_ppp.c:723
__sys_connect_file+0x153/0x1a0 net/socket.c:1976
__sys_connect+0x165/0x1a0 net/socket.c:1993
__do_sys_connect net/socket.c:2003 [inline]
__se_sys_connect net/socket.c:2000 [inline]
__ia32_sys_connect+0x72/0xb0 net/socket.c:2000
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7ff3549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f7fee5cc EFLAGS: 00000296 ORIG_RAX: 000000000000016a
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000200000c0
RDX: 000000000000002e RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:49
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 28400, name: syz-executor.2
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 3 PID: 28400 Comm: syz-executor.2 Not tainted 6.1.0-rc6-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
__might_resched.cold+0x222/0x26b kernel/sched/core.c:9908
percpu_down_read include/linux/percpu-rwsem.h:49 [inline]
cpus_read_lock+0x1b/0x140 kernel/cpu.c:310
static_key_slow_inc+0x12/0x20 kernel/jump_label.c:158
udp_tunnel_encap_enable include/net/udp_tunnel.h:187 [inline]
setup_udp_tunnel_sock+0x43d/0x550 net/ipv4/udp_tunnel_core.c:81
l2tp_tunnel_register+0xc51/0x1210 net/l2tp/l2tp_core.c:1509
pppol2tp_connect+0xcdc/0x1a10 net/l2tp/l2tp_ppp.c:723
__sys_connect_file+0x153/0x1a0 net/socket.c:1976
__sys_connect+0x165/0x1a0 net/socket.c:1993
__do_sys_connect net/socket.c:2003 [inline]
__se_sys_connect net/socket.c:2000 [inline]
__ia32_sys_connect+0x72/0xb0 net/socket.c:2000
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7ff3549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f7fee5cc EFLAGS: 00000296 ORIG_RAX: 000000000000016a
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000200000c0
RDX: 000000000000002e RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
----------------
Code disassembly (best guess):
0: 03 74 c0 01 add 0x1(%rax,%rax,8),%esi
4: 10 05 03 74 b8 01 adc %al,0x1b87403(%rip) # 0x1b8740d
a: 10 06 adc %al,(%rsi)
c: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
10: 10 07 adc %al,(%rdi)
12: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
16: 10 08 adc %cl,(%rax)
18: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1c: 00 00 add %al,(%rax)
1e: 00 00 add %al,(%rax)
20: 00 51 52 add %dl,0x52(%rcx)
23: 55 push %rbp
24: 89 e5 mov %esp,%ebp
26: 0f 34 sysenter
28: cd 80 int $0x80
* 2a: 5d pop %rbp <-- trapping instruction
2b: 5a pop %rdx
2c: 59 pop %rcx
2d: c3 retq
2e: 90 nop
2f: 90 nop
30: 90 nop
31: 90 nop
32: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
39: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi