======================================================
WARNING: possible circular locking dependency detected
6.7.0-syzkaller-12377-g9d1694dc91ce #0 Not tainted
------------------------------------------------------
udevd/17026 is trying to acquire lock:
ffff8880718e5088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff8880718e5088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
ffff8880718e5088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_activate+0x51/0x3e0 net/can/j1939/transport.c:1564
but task is already holding lock:
ffff88802e3565b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88802e3565b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: j1939_sk_queue_activate_next+0x58/0x3f0 net/can/j1939/socket.c:207
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&jsk->sk_session_queue_lock){+.-.}-{2:2}:
lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
j1939_sk_queue_drop_all+0x3a/0x240 net/can/j1939/socket.c:139
j1939_sk_netdev_event_netdown+0xed/0x160 net/can/j1939/socket.c:1282
j1939_netdev_notify+0xe2/0x140 net/can/j1939/main.c:381
notifier_call_chain+0x18c/0x3b0 kernel/notifier.c:93
__dev_notify_flags+0x207/0x400
dev_change_flags+0xf0/0x1a0 net/core/dev.c:8725
do_setlink+0xcc4/0x4200 net/core/rtnetlink.c:2903
rtnl_group_changelink net/core/rtnetlink.c:3452 [inline]
__rtnl_newlink net/core/rtnetlink.c:3711 [inline]
rtnl_newlink+0x1114/0x2080 net/core/rtnetlink.c:3748
rtnetlink_rcv_msg+0x882/0x1030 net/core/rtnetlink.c:6615
netlink_rcv_skb+0x1df/0x430 net/netlink/af_netlink.c:2543
netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
netlink_unicast+0x7e6/0x980 net/netlink/af_netlink.c:1367
netlink_sendmsg+0xa37/0xd70 net/netlink/af_netlink.c:1908
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x592/0x890 net/socket.c:2584
___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
-> #1 (&priv->j1939_socks_lock){+.-.}-{2:2}:
lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
j1939_sk_errqueue+0x96/0x150 net/can/j1939/socket.c:1083
__j1939_session_release net/can/j1939/transport.c:294 [inline]
kref_put include/linux/kref.h:65 [inline]
j1939_session_put+0xff/0x460 net/can/j1939/transport.c:299
j1939_session_deactivate_locked net/can/j1939/transport.c:1086 [inline]
j1939_cancel_active_session+0x354/0x490 net/can/j1939/transport.c:2194
j1939_netdev_notify+0xda/0x140 net/can/j1939/main.c:380
notifier_call_chain+0x18c/0x3b0 kernel/notifier.c:93
__dev_notify_flags+0x207/0x400
dev_change_flags+0xf0/0x1a0 net/core/dev.c:8725
do_setlink+0xcc4/0x4200 net/core/rtnetlink.c:2903
rtnl_group_changelink net/core/rtnetlink.c:3452 [inline]
__rtnl_newlink net/core/rtnetlink.c:3711 [inline]
rtnl_newlink+0x1114/0x2080 net/core/rtnetlink.c:3748
rtnetlink_rcv_msg+0x882/0x1030 net/core/rtnetlink.c:6615
netlink_rcv_skb+0x1df/0x430 net/netlink/af_netlink.c:2543
netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
netlink_unicast+0x7e6/0x980 net/netlink/af_netlink.c:1367
netlink_sendmsg+0xa37/0xd70 net/netlink/af_netlink.c:1908
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x592/0x890 net/socket.c:2584
___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
-> #0 (&priv->active_session_list_lock){+.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
j1939_session_activate+0x51/0x3e0 net/can/j1939/transport.c:1564
j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
j1939_sk_queue_activate_next+0x26c/0x3f0 net/can/j1939/socket.c:208
j1939_session_deactivate_activate_next net/can/j1939/transport.c:1108 [inline]
j1939_session_completed net/can/j1939/transport.c:1222 [inline]
j1939_xtp_rx_eoma_one net/can/j1939/transport.c:1395 [inline]
j1939_xtp_rx_eoma+0x323/0x530 net/can/j1939/transport.c:1410
j1939_tp_cmd_recv net/can/j1939/transport.c:2099 [inline]
j1939_tp_recv+0x88e/0x1050 net/can/j1939/transport.c:2144
j1939_can_recv+0x732/0xb20 net/can/j1939/main.c:112
deliver net/can/af_can.c:572 [inline]
can_rcv_filter+0x349/0x7c0 net/can/af_can.c:606
can_receive+0x327/0x480 net/can/af_can.c:663
can_rcv+0x144/0x260 net/can/af_can.c:687
__netif_receive_skb_one_core net/core/dev.c:5534 [inline]
__netif_receive_skb+0x1ca/0x530 net/core/dev.c:5648
process_backlog+0x385/0x760 net/core/dev.c:5976
__napi_poll+0xc7/0x480 net/core/dev.c:6576
napi_poll net/core/dev.c:6645 [inline]
net_rx_action+0x78b/0x1010 net/core/dev.c:6778
__do_softirq+0x2b8/0x939 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1b0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x20 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x97/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
release_free_meta mm/kasan/generic.c:526 [inline]
kasan_release_object_meta+0x83/0xa0 mm/kasan/generic.c:547
qlink_free mm/kasan/quarantine.c:148 [inline]
qlist_free_all+0x59/0xd0 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x14b/0x160 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x23/0x70 mm/kasan/common.c:324
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3813 [inline]
slab_alloc_node mm/slub.c:3860 [inline]
kmem_cache_alloc+0x16f/0x340 mm/slub.c:3867
kmem_cache_zalloc include/linux/slab.h:701 [inline]
lsm_file_alloc security/security.c:648 [inline]
security_file_alloc+0x28/0x120 security/security.c:2681
init_file+0x99/0x200 fs/file_table.c:153
alloc_empty_file+0xb8/0x1d0 fs/file_table.c:207
path_openat+0xfa/0x31e0 fs/namei.c:3784
do_filp_open+0x234/0x490 fs/namei.c:3825
do_sys_openat2+0x13e/0x1d0 fs/open.c:1404
do_sys_open fs/open.c:1419 [inline]
__do_sys_openat fs/open.c:1435 [inline]
__se_sys_openat fs/open.c:1430 [inline]
__x64_sys_openat+0x247/0x290 fs/open.c:1430
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
other info that might help us debug this:
Chain exists of:
&priv->active_session_list_lock --> &priv->j1939_socks_lock --> &jsk->sk_session_queue_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&jsk->sk_session_queue_lock);
lock(&priv->j1939_socks_lock);
lock(&jsk->sk_session_queue_lock);
lock(&priv->active_session_list_lock);
*** DEADLOCK ***
4 locks held by udevd/17026:
#0: ffffffff8da2d630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:116 [inline]
#0: ffffffff8da2d630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x24/0x50 include/linux/srcu.h:215
#1: ffffffff8d92ef20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#1: ffffffff8d92ef20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#1: ffffffff8d92ef20 (rcu_read_lock){....}-{1:2}, at: process_backlog+0x2cd/0x760 net/core/dev.c:5975
#2: ffffffff8d92ef20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#2: ffffffff8d92ef20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#2: ffffffff8d92ef20 (rcu_read_lock){....}-{1:2}, at: can_receive+0x1c9/0x480 net/can/af_can.c:656
#3: ffff88802e3565b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#3: ffff88802e3565b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: j1939_sk_queue_activate_next+0x58/0x3f0 net/can/j1939/socket.c:207
stack backtrace:
CPU: 0 PID: 17026 Comm: udevd Not tainted 6.7.0-syzkaller-12377-g9d1694dc91ce #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
check_noncircular+0x366/0x490 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
j1939_session_activate+0x51/0x3e0 net/can/j1939/transport.c:1564
j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
j1939_sk_queue_activate_next+0x26c/0x3f0 net/can/j1939/socket.c:208
j1939_session_deactivate_activate_next net/can/j1939/transport.c:1108 [inline]
j1939_session_completed net/can/j1939/transport.c:1222 [inline]
j1939_xtp_rx_eoma_one net/can/j1939/transport.c:1395 [inline]
j1939_xtp_rx_eoma+0x323/0x530 net/can/j1939/transport.c:1410
j1939_tp_cmd_recv net/can/j1939/transport.c:2099 [inline]
j1939_tp_recv+0x88e/0x1050 net/can/j1939/transport.c:2144
j1939_can_recv+0x732/0xb20 net/can/j1939/main.c:112
deliver net/can/af_can.c:572 [inline]
can_rcv_filter+0x349/0x7c0 net/can/af_can.c:606
can_receive+0x327/0x480 net/can/af_can.c:663
can_rcv+0x144/0x260 net/can/af_can.c:687
__netif_receive_skb_one_core net/core/dev.c:5534 [inline]
__netif_receive_skb+0x1ca/0x530 net/core/dev.c:5648
process_backlog+0x385/0x760 net/core/dev.c:5976
__napi_poll+0xc7/0x480 net/core/dev.c:6576
napi_poll net/core/dev.c:6645 [inline]
net_rx_action+0x78b/0x1010 net/core/dev.c:6778
__do_softirq+0x2b8/0x939 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1b0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x20 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x97/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:release_free_meta mm/kasan/generic.c:526 [inline]
RIP: 0010:kasan_release_object_meta+0x83/0xa0 mm/kasan/generic.c:547
Code: 80 39 09 49 63 86 c0 00 00 00 48 3d ff ff ff 7f 74 29 4c 01 f8 74 24 49 c1 ef 03 48 b9 00 00 00 00 00 fc ff df 41 80 3c 0f fa <75> 0f 49 01 cf 8b 78 0c e8 c0 48 d8 02 41 c6 07 fb 5b 41 5c 41 5e
RSP: 0018:ffffc90003d3f770 EFLAGS: 00000246
RAX: ffff888030cc4000 RBX: ffff888030cc5000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888030cc5050
RBP: ffff888071b8f540 R08: ffffffff90df240f R09: 0000000000000000
R10: ffff888030cc5048 R11: fffffbfff21be482 R12: ffff888030cc5048
R13: ffff888030cc4000 R14: ffff888012c42140 R15: 1ffff11006198800
qlink_free mm/kasan/quarantine.c:148 [inline]
qlist_free_all+0x59/0xd0 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x14b/0x160 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x23/0x70 mm/kasan/common.c:324
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3813 [inline]
slab_alloc_node mm/slub.c:3860 [inline]
kmem_cache_alloc+0x16f/0x340 mm/slub.c:3867
kmem_cache_zalloc include/linux/slab.h:701 [inline]
lsm_file_alloc security/security.c:648 [inline]
security_file_alloc+0x28/0x120 security/security.c:2681
init_file+0x99/0x200 fs/file_table.c:153
alloc_empty_file+0xb8/0x1d0 fs/file_table.c:207
path_openat+0xfa/0x31e0 fs/namei.c:3784
do_filp_open+0x234/0x490 fs/namei.c:3825
do_sys_openat2+0x13e/0x1d0 fs/open.c:1404
do_sys_open fs/open.c:1419 [inline]
__do_sys_openat fs/open.c:1435 [inline]
__se_sys_openat fs/open.c:1430 [inline]
__x64_sys_openat+0x247/0x290 fs/open.c:1430
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7fa761b16ab9
Code: 00 00 00 44 8b 54 24 58 48 89 44 24 30 48 8d 44 24 40 48 89 44 24 38 64 8b 04 25 18 00 00 00 85 c0 75 21 b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 6f 48 8b 15 40 a3 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffebf6539b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ffebf655b18 RCX: 00007fa761b16ab9
RDX: 0000000000080000 RSI: 00007fa761f74dd8 RDI: 000000000000000b
RBP: 000055f47cc87960 R08: 000055f47cc7e460 R09: 00007fa761bf1b20
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000b
R13: 00007fa761f74dd8 R14: 0000000000080000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 80 39 09 cmpb $0x9,(%rcx)
3: 49 63 86 c0 00 00 00 movslq 0xc0(%r14),%rax
a: 48 3d ff ff ff 7f cmp $0x7fffffff,%rax
10: 74 29 je 0x3b
12: 4c 01 f8 add %r15,%rax
15: 74 24 je 0x3b
17: 49 c1 ef 03 shr $0x3,%r15
1b: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
22: fc ff df
25: 41 80 3c 0f fa cmpb $0xfa,(%r15,%rcx,1)
* 2a: 75 0f jne 0x3b <-- trapping instruction
2c: 49 01 cf add %rcx,%r15
2f: 8b 78 0c mov 0xc(%rax),%edi
32: e8 c0 48 d8 02 call 0x2d848f7
37: 41 c6 07 fb movb $0xfb,(%r15)
3b: 5b pop %rbx
3c: 41 5c pop %r12
3e: 41 5e pop %r14