====================================================== [ INFO: possible circular locking dependency detected ] 4.9.111-g03c70fe #6 Not tainted ------------------------------------------------------- syz-executor1/22106 is trying to acquire lock: (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 but task is already holding lock: (sk_lock-AF_INET){+.+.+.}, at: [] lock_sock include/net/sock.h:1404 [inline] (sk_lock-AF_INET){+.+.+.}, at: [] do_ip_setsockopt.isra.13+0x269/0x2b10 net/ipv4/ip_sockglue.c:636 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756 lock_sock_nested+0xc6/0x120 net/core/sock.c:2511 lock_sock include/net/sock.h:1404 [inline] do_ip_setsockopt.isra.13+0x12a/0x2b10 net/ipv4/ip_sockglue.c:636 ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1240 udp_setsockopt+0x4a/0x90 net/ipv4/udp.c:2091 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2706 SYSC_setsockopt net/socket.c:1772 [inline] SyS_setsockopt+0x166/0x260 net/socket.c:1751 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb check_prev_add kernel/locking/lockdep.c:1828 [inline] check_prevs_add kernel/locking/lockdep.c:1938 [inline] validate_chain kernel/locking/lockdep.c:2265 [inline] __lock_acquire+0x3019/0x4070 kernel/locking/lockdep.c:3345 lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756 __mutex_lock_common kernel/locking/mutex.c:521 [inline] mutex_lock_nested+0xc0/0x870 kernel/locking/mutex.c:621 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 mrtsock_destruct+0x3b/0x1e0 net/ipv4/ipmr.c:1231 ip_ra_control+0x2c2/0x420 net/ipv4/ip_sockglue.c:360 do_ip_setsockopt.isra.13+0x15ff/0x2b10 net/ipv4/ip_sockglue.c:1137 ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1240 raw_setsockopt+0xb7/0xd0 net/ipv4/raw.c:833 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2706 SYSC_setsockopt net/socket.c:1772 [inline] SyS_setsockopt+0x166/0x260 net/socket.c:1751 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_INET); lock(rtnl_mutex); lock(sk_lock-AF_INET); lock(rtnl_mutex); *** DEADLOCK *** 1 lock held by syz-executor1/22106: #0: (sk_lock-AF_INET){+.+.+.}, at: [] lock_sock include/net/sock.h:1404 [inline] #0: (sk_lock-AF_INET){+.+.+.}, at: [] do_ip_setsockopt.isra.13+0x269/0x2b10 net/ipv4/ip_sockglue.c:636 stack backtrace: CPU: 0 PID: 22106 Comm: syz-executor1 Not tainted 4.9.111-g03c70fe #6 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff88019f2675f8 ffffffff81eb2729 ffffffff8559cef0 ffffffff855e7650 ffffffff8559cef0 ffff88019d9d38e8 ffff88019d9d3000 ffff88019f267640 ffffffff814263a4 0000000000000001 000000009d9d3000 0000000000000001 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_circular_bug.cold.51+0x1bd/0x27d kernel/locking/lockdep.c:1202 [] check_prev_add kernel/locking/lockdep.c:1828 [inline] [] check_prevs_add kernel/locking/lockdep.c:1938 [inline] [] validate_chain kernel/locking/lockdep.c:2265 [inline] [] __lock_acquire+0x3019/0x4070 kernel/locking/lockdep.c:3345 [] lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xc0/0x870 kernel/locking/mutex.c:621 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 [] mrtsock_destruct+0x3b/0x1e0 net/ipv4/ipmr.c:1231 [] ip_ra_control+0x2c2/0x420 net/ipv4/ip_sockglue.c:360 [] do_ip_setsockopt.isra.13+0x15ff/0x2b10 net/ipv4/ip_sockglue.c:1137 [] ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1240 [] raw_setsockopt+0xb7/0xd0 net/ipv4/raw.c:833 [] sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2706 [] SYSC_setsockopt net/socket.c:1772 [inline] [] SyS_setsockopt+0x166/0x260 net/socket.c:1751 [] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb IPVS: Creating netns size=2536 id=38 ================================================================== BUG: KASAN: use-after-free in xfrm6_tunnel_free_spi net/ipv6/xfrm6_tunnel.c:205 [inline] BUG: KASAN: use-after-free in xfrm6_tunnel_destroy+0x5b2/0x680 net/ipv6/xfrm6_tunnel.c:300 Read of size 8 at addr ffff8801c1d328f8 by task kworker/0:2/3883 CPU: 0 PID: 3883 Comm: kworker/0:2 Not tainted 4.9.111-g03c70fe #6 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events xfrm_state_gc_task ffff88019f107aa8 ffffffff81eb2729 ffffea0007074c00 ffff8801c1d328f8 0000000000000000 ffff8801c1d328f8 ffff8801c59c8104 ffff88019f107ae0 ffffffff81567b59 ffff8801c1d328f8 0000000000000008 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description+0x6c/0x234 mm/kasan/report.c:256 [] kasan_report_error mm/kasan/report.c:355 [inline] [] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 [] xfrm6_tunnel_free_spi net/ipv6/xfrm6_tunnel.c:205 [inline] [] xfrm6_tunnel_destroy+0x5b2/0x680 net/ipv6/xfrm6_tunnel.c:300 [] xfrm_state_gc_destroy net/xfrm/xfrm_state.c:368 [inline] [] xfrm_state_gc_task+0x3ad/0x510 net/xfrm/xfrm_state.c:388 [] process_one_work+0x7e1/0x1500 kernel/workqueue.c:2092 [] worker_thread+0xd6/0x10a0 kernel/workqueue.c:2226 [] kthread+0x26d/0x300 kernel/kthread.c:211 [] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373 Allocated by task 11238: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609 __kmalloc+0x11d/0x300 mm/slub.c:3741 kmalloc include/linux/slab.h:495 [inline] kzalloc include/linux/slab.h:636 [inline] ops_init+0xeb/0x380 net/core/net_namespace.c:101 setup_net+0x1b9/0x3f0 net/core/net_namespace.c:291 copy_net_ns+0x189/0x290 net/core/net_namespace.c:408 create_new_namespaces+0x51c/0x730 kernel/nsproxy.c:106 unshare_nsproxy_namespaces+0xa5/0x1d0 kernel/nsproxy.c:205 SYSC_unshare kernel/fork.c:2244 [inline] SyS_unshare+0x319/0x710 kernel/fork.c:2194 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb Freed by task 3981: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582 slab_free_hook mm/slub.c:1355 [inline] slab_free_freelist_hook mm/slub.c:1377 [inline] slab_free mm/slub.c:2958 [inline] kfree+0xfb/0x310 mm/slub.c:3878 ops_free net/core/net_namespace.c:126 [inline] ops_free_list.part.10+0x1ff/0x330 net/core/net_namespace.c:148 ops_free_list net/core/net_namespace.c:146 [inline] cleanup_net+0x3bf/0x630 net/core/net_namespace.c:477 process_one_work+0x7e1/0x1500 kernel/workqueue.c:2092 worker_thread+0xd6/0x10a0 kernel/workqueue.c:2226 kthread+0x26d/0x300 kernel/kthread.c:211 ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373 The buggy address belongs to the object at ffff8801c1d32100 which belongs to the cache kmalloc-8192 of size 8192 The buggy address is located 2040 bytes inside of 8192-byte region [ffff8801c1d32100, ffff8801c1d34100) The buggy address belongs to the page: page:ffffea0007074c00 count:1 mapcount:0 mapping: (null) index:0xffff8801c1d34200 compound_mapcount: 0 flags: 0x8000000000004080(slab|head) page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801c1d32780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801c1d32800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8801c1d32880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801c1d32900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801c1d32980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================