vxcan1: j1939_xtp_rx_abort_one: 0x00000000ac682f8d: 0x0f000: (3) A timeout occurred and this is the connection abort to close the session. ====================================================== WARNING: possible circular locking dependency detected 6.0.0-rc6-syzkaller-17727-gaa49f95768a9 #0 Not tainted ------------------------------------------------------ kworker/u4:1/28 is trying to acquire lock: ffff0000fd455088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline] ffff0000fd455088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline] ffff0000fd455088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_activate+0x34/0x274 net/can/j1939/transport.c:1559 but task is already holding lock: ffff0000fe4375b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline] ffff0000fe4375b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: j1939_sk_queue_activate_next+0x3c/0x200 net/can/j1939/socket.c:207 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&jsk->sk_session_queue_lock){+.-.}-{2:2}: __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:354 [inline] j1939_sk_queue_drop_all+0x38/0xf8 net/can/j1939/socket.c:139 j1939_sk_netdev_event_netdown+0x94/0xd8 net/can/j1939/socket.c:1275 j1939_netdev_notify+0x80/0x150 net/can/j1939/main.c:372 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0x7c/0x108 kernel/notifier.c:455 __dev_notify_flags+0x170/0x2e8 dev_change_flags+0x78/0x9c net/core/dev.c:8632 do_setlink+0x550/0x17a4 net/core/rtnetlink.c:2780 __rtnl_newlink net/core/rtnetlink.c:3546 [inline] rtnl_newlink+0x988/0xa04 net/core/rtnetlink.c:3593 rtnetlink_rcv_msg+0x484/0x82c net/core/rtnetlink.c:6090 netlink_rcv_skb+0xe4/0x1d0 net/netlink/af_netlink.c:2501 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6108 netlink_unicast_kernel+0xfc/0x1dc net/netlink/af_netlink.c:1319 netlink_unicast+0x164/0x248 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x484/0x584 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x308/0x450 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline] __sys_sendmsg+0x1ac/0x228 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __arm64_sys_sendmsg+0x2c/0x3c net/socket.c:2572 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654 el0t_64_sync+0x18c/0x190 -> #1 (&priv->j1939_socks_lock){+.-.}-{2:2}: __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:354 [inline] j1939_sk_errqueue+0x5c/0xe8 net/can/j1939/socket.c:1081 __j1939_session_cancel+0x29c/0x2b4 net/can/j1939/transport.c:1130 j1939_tp_rxtimer+0x2b4/0x55c net/can/j1939/transport.c:1255 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x210/0x390 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x8c/0x1d8 kernel/time/hrtimer.c:1766 _stext+0x168/0x37c run_ksoftirqd+0x4c/0x21c kernel/softirq.c:934 smpboot_thread_fn+0x248/0x3e4 kernel/smpboot.c:164 kthread+0x12c/0x158 kernel/kthread.c:376 ret_from_fork+0x10/0x20 -> #0 (&priv->active_session_list_lock){+.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3095 [inline] check_prevs_add kernel/locking/lockdep.c:3214 [inline] validate_chain kernel/locking/lockdep.c:3829 [inline] __lock_acquire+0x1530/0x30a4 kernel/locking/lockdep.c:5053 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:354 [inline] j1939_session_list_lock net/can/j1939/transport.c:238 [inline] j1939_session_activate+0x34/0x274 net/can/j1939/transport.c:1559 j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline] j1939_sk_queue_activate_next+0x134/0x200 net/can/j1939/socket.c:208 j1939_session_deactivate_activate_next net/can/j1939/transport.c:1107 [inline] j1939_xtp_rx_abort_one+0x2e0/0x334 net/can/j1939/transport.c:1346 j1939_xtp_rx_abort net/can/j1939/transport.c:1357 [inline] j1939_tp_cmd_recv+0x3a0/0xa08 net/can/j1939/transport.c:2106 j1939_tp_recv+0x150/0x304 net/can/j1939/transport.c:2139 j1939_can_recv+0x33c/0x494 net/can/j1939/main.c:108 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x134/0x30c net/can/af_can.c:608 can_receive+0x194/0x26c net/can/af_can.c:665 can_rcv+0x80/0x138 net/can/af_can.c:696 __netif_receive_skb_one_core net/core/dev.c:5485 [inline] __netif_receive_skb+0x70/0x14c net/core/dev.c:5599 process_backlog+0x23c/0x384 net/core/dev.c:5927 __napi_poll+0x5c/0x24c net/core/dev.c:6511 napi_poll+0x110/0x484 net/core/dev.c:6578 net_rx_action+0x18c/0x40c net/core/dev.c:6689 _stext+0x168/0x37c ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79 call_on_irq_stack+0x2c/0x54 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84 invoke_softirq+0x70/0xbc kernel/softirq.c:452 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:471 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:485 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:490 el1h_64_irq+0x64/0x68 arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:122 lock_is_held include/linux/lockdep.h:283 [inline] rcu_read_lock_sched_held+0x34/0x70 kernel/rcu/update.c:125 trace_lock_release+0x64/0x158 include/trace/events/lock.h:69 lock_release+0x3c/0x2b4 kernel/locking/lockdep.c:5677 rcu_lock_release+0x2c/0x38 include/linux/rcupdate.h:285 rcu_read_unlock include/linux/rcupdate.h:739 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline] batadv_nc_worker+0x350/0x484 net/batman-adv/network-coding.c:719 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289 worker_thread+0x340/0x610 kernel/workqueue.c:2436 kthread+0x12c/0x158 kernel/kthread.c:376 ret_from_fork+0x10/0x20 other info that might help us debug this: Chain exists of: &priv->active_session_list_lock --> &priv->j1939_socks_lock --> &jsk->sk_session_queue_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&jsk->sk_session_queue_lock); lock(&priv->j1939_socks_lock); lock(&jsk->sk_session_queue_lock); lock(&priv->active_session_list_lock); *** DEADLOCK *** 6 locks held by kworker/u4:1/28: #0: ffff0000c7d9cd38 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x270/0x504 kernel/workqueue.c:2262 #1: ffff80000f5a3d80 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work+0x29c/0x504 kernel/workqueue.c:2264 #2: ffff80000d443440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:279 #3: ffff80000d443440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:280 #4: ffff80000d443440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:279 #5: ffff0000fe4375b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline] #5: ffff0000fe4375b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: j1939_sk_queue_activate_next+0x3c/0x200 net/can/j1939/socket.c:207 stack backtrace: CPU: 0 PID: 28 Comm: kworker/u4:1 Not tainted 6.0.0-rc6-syzkaller-17727-gaa49f95768a9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Workqueue: bat_events batadv_nc_worker Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156 show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_circular_bug+0x2c4/0x2c8 kernel/locking/lockdep.c:2053 check_noncircular+0x14c/0x154 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3095 [inline] check_prevs_add kernel/locking/lockdep.c:3214 [inline] validate_chain kernel/locking/lockdep.c:3829 [inline] __lock_acquire+0x1530/0x30a4 kernel/locking/lockdep.c:5053 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:354 [inline] j1939_session_list_lock net/can/j1939/transport.c:238 [inline] j1939_session_activate+0x34/0x274 net/can/j1939/transport.c:1559 j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline] j1939_sk_queue_activate_next+0x134/0x200 net/can/j1939/socket.c:208 j1939_session_deactivate_activate_next net/can/j1939/transport.c:1107 [inline] j1939_xtp_rx_abort_one+0x2e0/0x334 net/can/j1939/transport.c:1346 j1939_xtp_rx_abort net/can/j1939/transport.c:1357 [inline] j1939_tp_cmd_recv+0x3a0/0xa08 net/can/j1939/transport.c:2106 j1939_tp_recv+0x150/0x304 net/can/j1939/transport.c:2139 j1939_can_recv+0x33c/0x494 net/can/j1939/main.c:108 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x134/0x30c net/can/af_can.c:608 can_receive+0x194/0x26c net/can/af_can.c:665 can_rcv+0x80/0x138 net/can/af_can.c:696 __netif_receive_skb_one_core net/core/dev.c:5485 [inline] __netif_receive_skb+0x70/0x14c net/core/dev.c:5599 process_backlog+0x23c/0x384 net/core/dev.c:5927 __napi_poll+0x5c/0x24c net/core/dev.c:6511 napi_poll+0x110/0x484 net/core/dev.c:6578 net_rx_action+0x18c/0x40c net/core/dev.c:6689 _stext+0x168/0x37c ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79 call_on_irq_stack+0x2c/0x54 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84 invoke_softirq+0x70/0xbc kernel/softirq.c:452 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:471 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:485 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:490 el1h_64_irq+0x64/0x68 arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:122 lock_is_held include/linux/lockdep.h:283 [inline] rcu_read_lock_sched_held+0x34/0x70 kernel/rcu/update.c:125 trace_lock_release+0x64/0x158 include/trace/events/lock.h:69 lock_release+0x3c/0x2b4 kernel/locking/lockdep.c:5677 rcu_lock_release+0x2c/0x38 include/linux/rcupdate.h:285 rcu_read_unlock include/linux/rcupdate.h:739 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline] batadv_nc_worker+0x350/0x484 net/batman-adv/network-coding.c:719 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289 worker_thread+0x340/0x610 kernel/workqueue.c:2436 kthread+0x12c/0x158 kernel/kthread.c:376 ret_from_fork+0x10/0x20 vxcan1: j1939_xtp_rx_abort_one: 0x00000000ae295889: 0x00000: (2) System resources were needed for another task so this connection managed session was terminated.