====================================================== WARNING: possible circular locking dependency detected 4.20.0-rc6+ #184 Not tainted ------------------------------------------------------ syz-executor5/10219 is trying to acquire lock: ------------[ cut here ]------------ 000000009f66ebf7 (&tbl->lock){+.-.}, at: neigh_change_state+0x1dc/0x7a0 net/core/neighbour.c:141 downgrading a read lock WARNING: CPU: 0 PID: 10221 at kernel/locking/lockdep.c:3556 __lock_downgrade kernel/locking/lockdep.c:3556 [inline] WARNING: CPU: 0 PID: 10221 at kernel/locking/lockdep.c:3556 lock_downgrade+0x4d7/0x900 kernel/locking/lockdep.c:3819 but task is already holding lock: Kernel panic - not syncing: panic_on_warn set ... 0000000051664b67 (&n->lock){++--}, at: __neigh_update+0xe6/0x1eb0 net/core/neighbour.c:1203 CPU: 0 PID: 10221 Comm: blkid Not tainted 4.20.0-rc6+ #184 which lock already depends on the new lock. Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 the existing dependency chain (in reverse order) is: Call Trace: -> #1 (&n->lock){++--}: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 __raw_write_lock include/linux/rwlock_api_smp.h:210 [inline] _raw_write_lock+0x2d/0x40 kernel/locking/spinlock.c:288 neigh_periodic_work+0x3c0/0xc30 net/core/neighbour.c:894 panic+0x2ad/0x55c kernel/panic.c:188 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 -> #0 (&tbl->lock){+.-.}: __warn.cold.8+0x20/0x45 kernel/panic.c:540 lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844 __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline] _raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:312 report_bug+0x254/0x2d0 lib/bug.c:186 neigh_change_state+0x1dc/0x7a0 net/core/neighbour.c:141 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271 __neigh_update+0x478/0x1eb0 net/core/neighbour.c:1302 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290 neigh_update+0x37/0x50 net/core/neighbour.c:1372 arp_req_set+0x54c/0xaa0 net/ipv4/arp.c:1072 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 arp_ioctl+0x48b/0xae0 net/ipv4/arp.c:1230 RIP: 0010:__lock_downgrade kernel/locking/lockdep.c:3556 [inline] RIP: 0010:lock_downgrade+0x4d7/0x900 kernel/locking/lockdep.c:3819 inet_ioctl+0x237/0x360 net/ipv4/af_inet.c:932 Code: 00 00 fc ff df 41 c6 44 05 00 f8 e9 1b ff ff ff 48 c7 c7 a0 6d 2b 88 4c 89 9d 58 ff ff ff 48 89 85 60 ff ff ff e8 69 1f e7 ff <0f> 0b 48 8b 85 60 ff ff ff 4c 8d 4d d8 4c 89 e9 48 ba 00 00 00 00 sock_do_ioctl+0xeb/0x420 net/socket.c:950 RSP: 0018:ffff888196847b70 EFLAGS: 00010086 sock_ioctl+0x313/0x690 net/socket.c:1074 RAX: 0000000000000000 RBX: 1ffff11032d08f74 RCX: 0000000000000000 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0x1de/0x1790 fs/ioctl.c:696 RDX: 0000000000000000 RSI: ffffffff8165e4b5 RDI: 0000000000000006 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:713 RBP: ffff888196847c28 R08: ffff8881957aa600 R09: fffffbfff12b2314 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 R10: fffffbfff12b2314 R11: ffffffff895918a3 R12: ffffffff8b0fc7e0 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 R13: ffff888196847bc0 R14: 0000000000000001 R15: ffff8881957aa600 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- downgrade_write+0x76/0x270 kernel/locking/rwsem.c:147 lock(&n->lock); lock(&tbl->lock); lock(&n->lock); lock(&tbl->lock); *** DEADLOCK *** __do_munmap+0xcd8/0xf80 mm/mmap.c:2812 2 locks held by syz-executor5/10219: __vm_munmap+0x138/0x1f0 mm/mmap.c:2837 #0: 0000000060861cbb (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77 #1: 0000000051664b67 (&n->lock){++--}, at: __neigh_update+0xe6/0x1eb0 net/core/neighbour.c:1203 stack backtrace: __do_sys_munmap mm/mmap.c:2862 [inline] __se_sys_munmap mm/mmap.c:2859 [inline] __x64_sys_munmap+0x65/0x80 mm/mmap.c:2859 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fb12a114417 Code: f0 ff ff 73 01 c3 48 8d 0d 8a ad 20 00 31 d2 48 29 c2 89 11 48 83 c8 ff eb eb 90 90 90 90 90 90 90 90 90 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 5d ad 20 00 31 d2 48 29 c2 89 RSP: 002b:00007ffec9139468 EFLAGS: 00000203 ORIG_RAX: 000000000000000b RAX: ffffffffffffffda RBX: 00007fb12a31f1c8 RCX: 00007fb12a114417 RDX: 0000000000119800 RSI: 00000000000033ef RDI: 00007fb12a317000 RBP: 00007ffec91395d0 R08: 0000000000000001 R09: 0000000000000007 R10: 00007fb12a10ea0b R11: 0000000000000203 R12: 00000000f32de87a R13: 00000058f32de87a R14: 00000058f31e9c5e R15: 00007fb12a314740 CPU: 1 PID: 10219 Comm: syz-executor5 Not tainted 4.20.0-rc6+ #184 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_circular_bug.isra.35.cold.54+0x1bd/0x27d kernel/locking/lockdep.c:1221 check_prev_add kernel/locking/lockdep.c:1863 [inline] check_prevs_add kernel/locking/lockdep.c:1976 [inline] validate_chain kernel/locking/lockdep.c:2347 [inline] __lock_acquire+0x3399/0x4c20 kernel/locking/lockdep.c:3341 lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844 __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline] _raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:312 neigh_change_state+0x1dc/0x7a0 net/core/neighbour.c:141 __neigh_update+0x478/0x1eb0 net/core/neighbour.c:1302 neigh_update+0x37/0x50 net/core/neighbour.c:1372 arp_req_set+0x54c/0xaa0 net/ipv4/arp.c:1072 arp_ioctl+0x48b/0xae0 net/ipv4/arp.c:1230 inet_ioctl+0x237/0x360 net/ipv4/af_inet.c:932 sock_do_ioctl+0xeb/0x420 net/socket.c:950 sock_ioctl+0x313/0x690 net/socket.c:1074 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0x1de/0x1790 fs/ioctl.c:696 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457669 Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f909f6efc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457669 RDX: 0000000020000040 RSI: 0000000000008955 RDI: 0000000000000003 RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f909f6f06d4 R13: 00000000004c0acd R14: 00000000004d1c98 R15: 00000000ffffffff Kernel Offset: disabled Rebooting in 86400 seconds..