print_req_error: I/O error, dev loop4, sector 0 device lo entered promiscuous mode print_req_error: I/O error, dev loop4, sector 0 ====================================================== WARNING: possible circular locking dependency detected 4.14.292-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.3/9540 is trying to acquire lock: ((&strp->work)){+.+.}, at: [] flush_work+0x88/0x770 kernel/workqueue.c:2887 but task is already holding lock: (sk_lock-AF_INET){+.+.}, at: [] lock_sock include/net/sock.h:1473 [inline] (sk_lock-AF_INET){+.+.}, at: [] kcm_attach net/kcm/kcmsock.c:1390 [inline] (sk_lock-AF_INET){+.+.}, at: [] kcm_attach_ioctl net/kcm/kcmsock.c:1490 [inline] (sk_lock-AF_INET){+.+.}, at: [] kcm_ioctl+0x328/0xfb0 net/kcm/kcmsock.c:1701 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (sk_lock-AF_INET){+.+.}: lock_sock_nested+0xb7/0x100 net/core/sock.c:2813 do_strp_work net/strparser/strparser.c:415 [inline] strp_work+0x3e/0x100 net/strparser/strparser.c:434 process_one_work+0x793/0x14a0 kernel/workqueue.c:2117 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 -> #0 ((&strp->work)){+.+.}: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 flush_work+0xad/0x770 kernel/workqueue.c:2890 __cancel_work_timer+0x321/0x460 kernel/workqueue.c:2965 strp_done+0x53/0xd0 net/strparser/strparser.c:519 kcm_attach net/kcm/kcmsock.c:1429 [inline] kcm_attach_ioctl net/kcm/kcmsock.c:1490 [inline] kcm_ioctl+0x828/0xfb0 net/kcm/kcmsock.c:1701 sock_do_ioctl net/socket.c:974 [inline] sock_ioctl+0x2cc/0x4c0 net/socket.c:1071 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_INET); lock((&strp->work)); lock(sk_lock-AF_INET); lock((&strp->work)); *** DEADLOCK *** 1 lock held by syz-executor.3/9540: #0: (sk_lock-AF_INET){+.+.}, at: [] lock_sock include/net/sock.h:1473 [inline] #0: (sk_lock-AF_INET){+.+.}, at: [] kcm_attach net/kcm/kcmsock.c:1390 [inline] #0: (sk_lock-AF_INET){+.+.}, at: [] kcm_attach_ioctl net/kcm/kcmsock.c:1490 [inline] #0: (sk_lock-AF_INET){+.+.}, at: [] kcm_ioctl+0x328/0xfb0 net/kcm/kcmsock.c:1701 stack backtrace: CPU: 0 PID: 9540 Comm: syz-executor.3 Not tainted 4.14.292-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1905 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 flush_work+0xad/0x770 kernel/workqueue.c:2890 __cancel_work_timer+0x321/0x460 kernel/workqueue.c:2965 strp_done+0x53/0xd0 net/strparser/strparser.c:519 kcm_attach net/kcm/kcmsock.c:1429 [inline] kcm_attach_ioctl net/kcm/kcmsock.c:1490 [inline] kcm_ioctl+0x828/0xfb0 net/kcm/kcmsock.c:1701 sock_do_ioctl net/socket.c:974 [inline] sock_ioctl+0x2cc/0x4c0 net/socket.c:1071 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f7b36dcb409 RSP: 002b:00007f7b3571f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f7b36ede050 RCX: 00007f7b36dcb409 RDX: 0000000020000040 RSI: 00000000000089e0 RDI: 0000000000000003 RBP: 00007f7b36e26367 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd9554607f R14: 00007f7b3571f300 R15: 0000000000022000 Y4`Ҙ: renamed from lo device vxcan0 entered promiscuous mode device vlan2 entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready attempt to access beyond end of device loop1: rw=2049, want=17, limit=16 device vxcan0 left promiscuous mode ISO 9660 Extensions: Microsoft Joliet Level 3 device vxcan0 entered promiscuous mode device vlan2 entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready attempt to access beyond end of device device vxcan0 left promiscuous mode ISO 9660 Extensions: Microsoft Joliet Level 3 loop2: rw=2049, want=17, limit=16 attempt to access beyond end of device loop1: rw=2049, want=17, limit=16 ISO 9660 Extensions: Microsoft Joliet Level 3 device vxcan0 entered promiscuous mode ISO 9660 Extensions: Microsoft Joliet Level 3 device vlan2 entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready device vxcan0 left promiscuous mode device vxcan0 entered promiscuous mode device vlan2 entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready device vxcan0 left promiscuous mode EXT4-fs (loop5): VFS: Can't find ext4 filesystem ISO 9660 Extensions: Microsoft Joliet Level 3 IPVS: ftp: loaded support on port[0] = 21 ISO 9660 Extensions: Microsoft Joliet Level 3 device vxcan0 entered promiscuous mode device vlan2 entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready device vxcan0 left promiscuous mode (unnamed net_device) (uninitialized): option updelay: invalid value (18446744073709551615) (unnamed net_device) (uninitialized): option updelay: allowed values 0 - 2147483647 ISO 9660 Extensions: Microsoft Joliet Level 3 device vxcan0 entered promiscuous mode device vlan2 entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready device vxcan0 left promiscuous mode ISO 9660 Extensions: Microsoft Joliet Level 3 ISO 9660 Extensions: Microsoft Joliet Level 3 (unnamed net_device) (uninitialized): option updelay: invalid value (18446744073709551615) (unnamed net_device) (uninitialized): option updelay: allowed values 0 - 2147483647 ISO 9660 Extensions: Microsoft Joliet Level 3 ISO 9660 Extensions: Microsoft Joliet Level 3 (unnamed net_device) (uninitialized): option updelay: invalid value (18446744073709551615) (unnamed net_device) (uninitialized): option updelay: allowed values 0 - 2147483647 print_req_error: I/O error, dev loop3, sector 0 ISO 9660 Extensions: Microsoft Joliet Level 3 ISO 9660 Extensions: Microsoft Joliet Level 3 (unnamed net_device) (uninitialized): option updelay: invalid value (18446744073709551615) (unnamed net_device) (uninitialized): option updelay: allowed values 0 - 2147483647 ISO 9660 Extensions: Microsoft Joliet Level 3 device vxcan0 entered promiscuous mode device vlan2 entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready device vxcan0 left promiscuous mode (unnamed net_device) (uninitialized): option updelay: invalid value (18446744073709551615) (unnamed net_device) (uninitialized): option updelay: allowed values 0 - 2147483647 (unnamed net_device) (uninitialized): option updelay: invalid value (18446744073709551615) (unnamed net_device) (uninitialized): option updelay: allowed values 0 - 2147483647 device vxcan0 entered promiscuous mode device vlan2 entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready device vxcan0 left promiscuous mode ISO 9660 Extensions: Microsoft Joliet Level 3 (unnamed net_device) (uninitialized): option updelay: invalid value (18446744073709551615) (unnamed net_device) (uninitialized): option updelay: allowed values 0 - 2147483647 device vxcan0 entered promiscuous mode device vlan2 entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready ================================================================== BUG: KASAN: slab-out-of-bounds in tipc_nametbl_lookup_dst_nodes+0x4ad/0x4c0 net/tipc/name_table.c:670 Read of size 4 at addr ffff8880af8062d0 by task syz-executor.0/10218 CPU: 0 PID: 10218 Comm: syz-executor.0 Not tainted 4.14.292-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load4_noabort+0x68/0x70 mm/kasan/report.c:429 tipc_nametbl_lookup_dst_nodes+0x4ad/0x4c0 net/tipc/name_table.c:670 tipc_sendmcast+0x51a/0xac0 net/tipc/socket.c:768 __tipc_sendmsg+0xbab/0xf90 net/tipc/socket.c:975 tipc_sendmsg+0x4c/0x70 net/tipc/socket.c:923 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f08c41ba409 RSP: 002b:00007f08c2b2f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f08c42ccf80 RCX: 00007f08c41ba409 RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000004 RBP: 00007f08c4215367 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff358061ef R14: 00007f08c2b2f300 R15: 0000000000022000 Allocated by task 7980: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3720 [inline] __kmalloc+0x15a/0x400 mm/slab.c:3729 tipc_nameseq_create+0x53/0x290 net/tipc/name_table.c:152 tipc_nametbl_insert_publ+0xb37/0x14e0 net/tipc/name_table.c:476 tipc_nametbl_publish+0x211/0x3f0 net/tipc/name_table.c:701 tipc_sk_publish net/tipc/socket.c:2206 [inline] tipc_bind+0x2c4/0x600 net/tipc/socket.c:630 tipc_create_listen_sock net/tipc/server.c:338 [inline] tipc_open_listening_sock net/tipc/server.c:396 [inline] tipc_server_start+0x31f/0x880 net/tipc/server.c:611 tipc_topsrv_start net/tipc/subscr.c:382 [inline] tipc_topsrv_init_net+0x53b/0x730 net/tipc/subscr.c:397 ops_init+0xaa/0x3e0 net/core/net_namespace.c:118 setup_net+0x22f/0x530 net/core/net_namespace.c:298 copy_net_ns+0x19b/0x440 net/core/net_namespace.c:422 create_new_namespaces+0x375/0x720 kernel/nsproxy.c:107 unshare_nsproxy_namespaces+0xa1/0x1d0 kernel/nsproxy.c:206 SYSC_unshare kernel/fork.c:2413 [inline] SyS_unshare+0x308/0x7f0 kernel/fork.c:2363 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb Freed by task 7806: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xc9/0x250 mm/slab.c:3815 load_elf_binary+0x305d/0x4750 fs/binfmt_elf.c:1087 search_binary_handler.part.0+0xd5/0x640 fs/exec.c:1653 search_binary_handler+0x62/0x80 fs/exec.c:1642 load_script+0x525/0x730 fs/binfmt_script.c:148 search_binary_handler.part.0+0xd5/0x640 fs/exec.c:1653 search_binary_handler fs/exec.c:1642 [inline] exec_binprm fs/exec.c:1695 [inline] do_execveat_common+0x1151/0x2030 fs/exec.c:1832 do_execve fs/exec.c:1877 [inline] SYSC_execve fs/exec.c:1958 [inline] SyS_execve+0x3b/0x50 fs/exec.c:1953 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb The buggy address belongs to the object at ffff8880af8062c0 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 16 bytes inside of 32-byte region [ffff8880af8062c0, ffff8880af8062e0) The buggy address belongs to the page: page:ffffea0002be0180 count:1 mapcount:0 mapping:ffff8880af806000 index:0xffff8880af806fc1 flags: 0xfff00000000100(slab) raw: 00fff00000000100 ffff8880af806000 ffff8880af806fc1 000000010000002d raw: ffffea00025fb320 ffffea0002889a60 ffff88813fe741c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880af806180: 05 fc fc fc fc fc fc fc 05 fc fc fc fc fc fc fc ffff8880af806200: 00 00 fc fc fc fc fc fc 05 fc fc fc fc fc fc fc >ffff8880af806280: 05 fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc ^ ffff8880af806300: fb fb fb fb fc fc fc fc 00 fc fc fc fc fc fc fc ffff8880af806380: 05 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc ==================================================================