================================= [ INFO: inconsistent lock state ] 4.1.0 #1 Not tainted --------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. syz-executor.3/12484 [HC0[0]:SC0[0]:HE1:SE1] takes: (slock-AF_NETROM){+.?...}, at: [] spin_lock include/linux/spinlock.h:312 [inline] (slock-AF_NETROM){+.?...}, at: [] nr_find_socket+0x5d/0x80 net/netrom/af_netrom.c:177 {IN-SOFTIRQ-W} state was registered at: [] mark_irqflags kernel/locking/lockdep.c:2799 [inline] [] __lock_acquire+0x86b/0x1c70 kernel/locking/lockdep.c:3161 [] lock_acquire+0xe6/0x310 kernel/locking/lockdep.c:3623 [] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline] [] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151 [] spin_lock include/linux/spinlock.h:312 [inline] [] nr_find_listener net/netrom/af_netrom.c:156 [inline] [] nr_rx_frame+0x2be/0x6c0 net/netrom/af_netrom.c:953 [] nr_loopback_timer+0x3e/0xb0 net/netrom/nr_loopback.c:62 [] call_timer_fn+0xa5/0x520 kernel/time/timer.c:1153 [] __run_timers kernel/time/timer.c:1225 [inline] [] run_timer_softirq+0x2ac/0x4a0 kernel/time/timer.c:1415 [] __do_softirq+0x15c/0x6c0 kernel/softirq.c:273 [] invoke_softirq kernel/softirq.c:350 [inline] [] irq_exit+0xc5/0xe0 kernel/softirq.c:391 [] exiting_irq arch/x86/include/asm/apic.h:649 [inline] [] smp_apic_timer_interrupt+0x41/0x50 arch/x86/kernel/apic/apic.c:915 [] apic_timer_interrupt+0x73/0x80 arch/x86/kernel/entry_64.S:923 [] arch_safe_halt arch/x86/include/asm/paravirt.h:111 [inline] [] default_idle+0x29/0x270 arch/x86/kernel/process.c:341 [] arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:332 [] cpuidle_idle_call kernel/sched/idle.c:195 [inline] [] cpu_idle_loop kernel/sched/idle.c:249 [inline] [] cpu_startup_entry+0x2e9/0x660 kernel/sched/idle.c:297 [] rest_init+0x134/0x140 init/main.c:409 [] start_kernel+0x438/0x445 init/main.c:677 [] x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:197 [] x86_64_start_kernel+0x145/0x154 arch/x86/kernel/head64.c:186 irq event stamp: 248 hardirqs last enabled at (245): [] __local_bh_enable_ip+0x7d/0x140 kernel/softirq.c:175 hardirqs last disabled at (247): [] __local_bh_enable_ip+0x45/0x140 kernel/softirq.c:152 softirqs last enabled at (248): [] spin_unlock_bh include/linux/spinlock.h:362 [inline] softirqs last enabled at (248): [] nr_find_socket+0x69/0x80 net/netrom/af_netrom.c:183 softirqs last disabled at (246): [] spin_lock_bh include/linux/spinlock.h:317 [inline] softirqs last disabled at (246): [] nr_find_socket+0x1f/0x80 net/netrom/af_netrom.c:172 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(slock-AF_NETROM); lock(slock-AF_NETROM); *** DEADLOCK *** 1 lock held by syz-executor.3/12484: #0: (slock-AF_NETROM){+.?...}, at: [] spin_lock include/linux/spinlock.h:312 [inline] #0: (slock-AF_NETROM){+.?...}, at: [] nr_find_socket+0x5d/0x80 net/netrom/af_netrom.c:177 stack backtrace: CPU: 1 PID: 12484 Comm: syz-executor.3 Not tainted 4.1.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 ffff88003b5ba450 ffff88003a44fc48 ffffffff8263a09b 0000000000000011 ffffffff83dd1e20 ffff88003a44fca8 ffffffff811c40ad 0000000000000000 0000000000000001 ffff880000000001 ffffffff8108ff1a ffff88003b5bacb8 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0x4f/0x7b lib/dump_stack.c:50 [] print_usage_bug+0x27d/0x2a0 kernel/locking/lockdep.c:2267 [] valid_state kernel/locking/lockdep.c:2280 [inline] [] mark_lock_irq kernel/locking/lockdep.c:2478 [inline] [] mark_lock+0x654/0x750 kernel/locking/lockdep.c:2933 [] mark_held_locks+0x75/0xc0 kernel/locking/lockdep.c:2536 [] __trace_hardirqs_on_caller kernel/locking/lockdep.c:2565 [inline] [] trace_hardirqs_on_caller+0x155/0x200 kernel/locking/lockdep.c:2612 [] trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2619 [] __local_bh_enable_ip+0x7d/0x140 kernel/softirq.c:175 [] __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:178 [inline] [] _raw_spin_unlock_bh+0x34/0x40 kernel/locking/spinlock.c:207 [] spin_unlock_bh include/linux/spinlock.h:362 [inline] [] nr_find_socket+0x69/0x80 net/netrom/af_netrom.c:183 [] nr_find_next_circuit+0x3e/0x50 net/netrom/af_netrom.c:225 [] nr_connect+0xc1/0x3f0 net/netrom/af_netrom.c:704 [] SYSC_connect+0xc7/0x100 net/socket.c:1552 [] SyS_connect+0x9/0x10 net/socket.c:1533 [] system_call_fastpath+0x16/0x7a kobject: 'loop5' (ffff88007c4bd8a0): kobject_uevent_env kobject: 'loop5' (ffff88007c4bd8a0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop2' (ffff88007c4b50a0): kobject_uevent_env kobject: 'loop2' (ffff88007c4b50a0): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop2' (ffff88007c4b50a0): kobject_uevent_env kobject: 'loop2' (ffff88007c4b50a0): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop4' (ffff88007c4aa0a0): kobject_uevent_env kobject: 'loop4' (ffff88007c4aa0a0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop0' (ffff88007c4a70a0): kobject_uevent_env kobject: 'loop0' (ffff88007c4a70a0): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop1' (ffff88007c4b58a0): kobject_uevent_env kobject: 'loop1' (ffff88007c4b58a0): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop3' (ffff88007c4aa8a0): kobject_uevent_env kobject: 'loop3' (ffff88007c4aa8a0): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop5' (ffff88007c4bd8a0): kobject_uevent_env kobject: 'loop5' (ffff88007c4bd8a0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop5' (ffff88007c4bd8a0): kobject_uevent_env kobject: 'loop5' (ffff88007c4bd8a0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop2' (ffff88007c4b50a0): kobject_uevent_env kobject: 'loop2' (ffff88007c4b50a0): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop4' (ffff88007c4aa0a0): kobject_uevent_env kobject: 'loop4' (ffff88007c4aa0a0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop0' (ffff88007c4a70a0): kobject_uevent_env kobject: 'loop0' (ffff88007c4a70a0): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop1' (ffff88007c4b58a0): kobject_uevent_env kobject: 'loop1' (ffff88007c4b58a0): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop3' (ffff88007c4aa8a0): kobject_uevent_env kobject: 'loop3' (ffff88007c4aa8a0): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop5' (ffff88007c4bd8a0): kobject_uevent_env kobject: 'loop5' (ffff88007c4bd8a0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop3' (ffff88007c4aa8a0): kobject_uevent_env kobject: 'loop3' (ffff88007c4aa8a0): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop2' (ffff88007c4b50a0): kobject_uevent_env kobject: 'loop2' (ffff88007c4b50a0): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop4' (ffff88007c4aa0a0): kobject_uevent_env kobject: 'loop4' (ffff88007c4aa0a0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop0' (ffff88007c4a70a0): kobject_uevent_env kobject: 'loop0' (ffff88007c4a70a0): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop1' (ffff88007c4b58a0): kobject_uevent_env kobject: 'loop1' (ffff88007c4b58a0): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop1' (ffff88007c4b58a0): kobject_uevent_env kobject: 'loop1' (ffff88007c4b58a0): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop3' (ffff88007c4aa8a0): kobject_uevent_env kobject: 'loop3' (ffff88007c4aa8a0): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop5' (ffff88007c4bd8a0): kobject_uevent_env kobject: 'loop5' (ffff88007c4bd8a0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop1' (ffff88007c4b58a0): kobject_uevent_env kobject: 'loop1' (ffff88007c4b58a0): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop2' (ffff88007c4b50a0): kobject_uevent_env kobject: 'loop2' (ffff88007c4b50a0): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop0' (ffff88007c4a70a0): kobject_uevent_env kobject: 'loop0' (ffff88007c4a70a0): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop4' (ffff88007c4aa0a0): kobject_uevent_env kobject: 'loop4' (ffff88007c4aa0a0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop3' (ffff88007c4aa8a0): kobject_uevent_env kobject: 'loop3' (ffff88007c4aa8a0): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop5' (ffff88007c4bd8a0): kobject_uevent_env kobject: 'loop5' (ffff88007c4bd8a0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop4' (ffff88007c4aa0a0): kobject_uevent_env kobject: 'loop4' (ffff88007c4aa0a0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop1' (ffff88007c4b58a0): kobject_uevent_env kobject: 'loop1' (ffff88007c4b58a0): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop2' (ffff88007c4b50a0): kobject_uevent_env kobject: 'loop2' (ffff88007c4b50a0): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop0' (ffff88007c4a70a0): kobject_uevent_env kobject: 'loop0' (ffff88007c4a70a0): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop2' (ffff88007c4b50a0): kobject_uevent_env kobject: 'loop2' (ffff88007c4b50a0): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop2' (ffff88007c4b50a0): kobject_uevent_env kobject: 'loop2' (ffff88007c4b50a0): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'rx-0' (ffff880078e89890): kobject_cleanup, parent ffff88007fb8d748 kobject: 'rx-0' (ffff880078e89890): auto cleanup 'remove' event kobject: 'rx-0' (ffff880078e89890): kobject_uevent_env kobject: 'rx-0' (ffff880078e89890): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/rx-0' kobject: 'rx-0' (ffff880078e89890): auto cleanup kobject_del kobject: 'rx-0' (ffff880078e89890): calling ktype release kobject: 'rx-0': free name kobject: 'tx-0' (ffff880079460c18): kobject_cleanup, parent ffff88007fb8d748 kobject: 'tx-0' (ffff880079460c18): auto cleanup 'remove' event kobject: 'tx-0' (ffff880079460c18): kobject_uevent_env kobject: 'tx-0' (ffff880079460c18): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/tx-0' kobject: 'tx-0' (ffff880079460c18): auto cleanup kobject_del kobject: 'tx-0' (ffff880079460c18): calling ktype release kobject: 'tx-0': free name kobject: 'queues' (ffff88007fb8d748): kobject_cleanup, parent (null) kobject: 'queues' (ffff88007fb8d748): calling ktype release kobject: 'queues' (ffff88007fb8d748): kset_release kobject: 'queues': free name kobject: 'syz_tun' (ffff88007ac3c4f8): kobject_uevent_env kobject: 'syz_tun' (ffff88007ac3c4f8): fill_kobj_path: path = '/devices/virtual/net/syz_tun' kobject: 'rx-0' (ffff88007ac63190): kobject_cleanup, parent ffff88007dc22148 kobject: 'rx-0' (ffff88007ac63190): auto cleanup 'remove' event kobject: 'rx-0' (ffff88007ac63190): kobject_uevent_env kobject: 'rx-0' (ffff88007ac63190): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/rx-0' kobject: 'rx-0' (ffff88007ac63190): auto cleanup kobject_del kobject: 'rx-0' (ffff88007ac63190): calling ktype release kobject: 'rx-0': free name kobject: 'tx-0' (ffff88007b2cd618): kobject_cleanup, parent ffff88007dc22148 kobject: 'tx-0' (ffff88007b2cd618): auto cleanup 'remove' event kobject: 'tx-0' (ffff88007b2cd618): kobject_uevent_env kobject: 'tx-0' (ffff88007b2cd618): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/tx-0' kobject: 'tx-0' (ffff88007b2cd618): auto cleanup kobject_del kobject: 'tx-0' (ffff88007b2cd618): calling ktype release kobject: 'tx-0': free name kobject: 'queues' (ffff88007dc22148): kobject_cleanup, parent (null) kobject: 'queues' (ffff88007dc22148): calling ktype release kobject: 'queues' (ffff88007dc22148): kset_release kobject: 'queues': free name kobject: 'syz_tun' (ffff88007af384f8): kobject_uevent_env kobject: 'syz_tun' (ffff88007af384f8): fill_kobj_path: path = '/devices/virtual/net/syz_tun' kobject: 'rx-0' (ffff880039688610): kobject_cleanup, parent ffff8800397dca48 kobject: 'rx-0' (ffff880039688610): auto cleanup 'remove' event kobject: 'rx-0' (ffff880039688610): kobject_uevent_env kobject: 'rx-0' (ffff880039688610): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/rx-0' kobject: 'rx-0' (ffff880039688610): auto cleanup kobject_del kobject: 'rx-0' (ffff880039688610): calling ktype release kobject: 'rx-0': free name kobject: 'tx-0' (ffff88003b4da818): kobject_cleanup, parent ffff8800397dca48 kobject: 'tx-0' (ffff88003b4da818): auto cleanup 'remove' event kobject: 'tx-0' (ffff88003b4da818): kobject_uevent_env kobject: 'tx-0' (ffff88003b4da818): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/tx-0' kobject: 'tx-0' (ffff88003b4da818): auto cleanup kobject_del kobject: 'tx-0' (ffff88003b4da818): calling ktype release kobject: 'tx-0': free name kobject: 'queues' (ffff8800397dca48): kobject_cleanup, parent (null) kobject: 'queues' (ffff8800397dca48): calling ktype release kobject: 'queues' (ffff8800397dca48): kset_release kobject: 'queues': free name kobject: 'syz_tun' (ffff8800395e84f8): kobject_uevent_env kobject: 'syz_tun' (ffff8800395e84f8): fill_kobj_path: path = '/devices/virtual/net/syz_tun' kobject: 'rx-0' (ffff88003e3afe90): kobject_cleanup, parent ffff88003e3b3b08 kobject: 'rx-0' (ffff88003e3afe90): auto cleanup 'remove' event kobject: 'rx-0' (ffff88003e3afe90): kobject_uevent_env kobject: 'rx-0' (ffff88003e3afe90): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/rx-0' kobject: 'rx-0' (ffff88003e3afe90): auto cleanup kobject_del kobject: 'rx-0' (ffff88003e3afe90): calling ktype release kobject: 'rx-0': free name kobject: 'tx-0' (ffff8800387bf818): kobject_cleanup, parent ffff88003e3b3b08 kobject: 'tx-0' (ffff8800387bf818): auto cleanup 'remove' event kobject: 'tx-0' (ffff8800387bf818): kobject_uevent_env kobject: 'tx-0' (ffff8800387bf818): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/tx-0' kobject: 'tx-0' (ffff8800387bf818): auto cleanup kobject_del kobject: 'tx-0' (ffff8800387bf818): calling ktype release kobject: 'tx-0': free name kobject: 'queues' (ffff88003e3b3b08): kobject_cleanup, parent (null) kobject: 'queues' (ffff88003e3b3b08): calling ktype release kobject: 'queues' (ffff88003e3b3b08): kset_release kobject: 'queues': free name kobject: 'syz_tun' (ffff88003a7bc4f8): kobject_uevent_env kobject: 'syz_tun' (ffff88003a7bc4f8): fill_kobj_path: path = '/devices/virtual/net/syz_tun' kobject: 'rx-0' (ffff88007d257b90): kobject_cleanup, parent ffff88007c4808c8 kobject: 'rx-0' (ffff88007d257b90): auto cleanup 'remove' event kobject: 'rx-0' (ffff88007d257b90): kobject_uevent_env kobject: 'rx-0' (ffff88007d257b90): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/rx-0' kobject: 'rx-0' (ffff88007d257b90): auto cleanup kobject_del kobject: 'rx-0' (ffff88007d257b90): calling ktype release kobject: 'rx-0': free name kobject: 'tx-0' (ffff88007b100818): kobject_cleanup, parent ffff88007c4808c8 kobject: 'tx-0' (ffff88007b100818): auto cleanup 'remove' event kobject: 'tx-0' (ffff88007b100818): kobject_uevent_env kobject: 'tx-0' (ffff88007b100818): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/tx-0' kobject: 'tx-0' (ffff88007b100818): auto cleanup kobject_del kobject: 'tx-0' (ffff88007b100818): calling ktype release kobject: 'tx-0': free name kobject: 'queues' (ffff88007c4808c8): kobject_cleanup, parent (null) kobject: 'queues' (ffff88007c4808c8): calling ktype release kobject: 'queues' (ffff88007c4808c8): kset_release kobject: 'queues': free name kobject: 'syz_tun' (ffff88007b2384f8): kobject_uevent_env kobject: 'syz_tun' (ffff88007b2384f8): fill_kobj_path: path = '/devices/virtual/net/syz_tun' kobject: 'rx-0' (ffff880079fcd490): kobject_cleanup, parent ffff88007fbe8ec8 kobject: 'rx-0' (ffff880079fcd490): auto cleanup 'remove' event kobject: 'rx-0' (ffff880079fcd490): kobject_uevent_env kobject: 'rx-0' (ffff880079fcd490): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/rx-0' kobject: 'rx-0' (ffff880079fcd490): auto cleanup kobject_del kobject: 'rx-0' (ffff880079fcd490): calling ktype release kobject: 'rx-0': free name kobject: 'tx-0' (ffff880079d66618): kobject_cleanup, parent ffff88007fbe8ec8 kobject: 'tx-0' (ffff880079d66618): auto cleanup 'remove' event kobject: 'tx-0' (ffff880079d66618): kobject_uevent_env kobject: 'tx-0' (ffff880079d66618): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/tx-0' kobject: 'tx-0' (ffff880079d66618): auto cleanup kobject_del kobject: 'tx-0' (ffff880079d66618): calling ktype release kobject: 'tx-0': free name kobject: 'queues' (ffff88007fbe8ec8): kobject_cleanup, parent (null) kobject: 'queues' (ffff88007fbe8ec8): calling ktype release kobject: 'queues' (ffff88007fbe8ec8): kset_release kobject: 'queues': free name kobject: 'syz_tun' (ffff88007ac1c4f8): kobject_uevent_env kobject: 'syz_tun' (ffff88007ac1c4f8): fill_kobj_path: path = '/devices/virtual/net/syz_tun' kobject: 'syz_tun' (ffff88007ac3c4f8): kobject_cleanup, parent (null) kobject: 'syz_tun' (ffff88007ac3c4f8): calling ktype release kobject: 'syz_tun': free name kobject: 'syz_tun' (ffff88007af384f8): kobject_cleanup, parent (null) kobject: 'syz_tun' (ffff8800395e84f8): kobject_cleanup, parent (null) kobject: 'syz_tun' (ffff8800395e84f8): calling ktype release kobject: 'syz_tun': free name kobject: 'syz_tun' (ffff88007af384f8): calling ktype release kobject: 'syz_tun': free name kobject: 'syz_tun' (ffff88007b2384f8): kobject_cleanup, parent (null) kobject: 'syz_tun' (ffff88003a7bc4f8): kobject_cleanup, parent (null) kobject: 'syz_tun' (ffff88003a7bc4f8): calling ktype release kobject: 'syz_tun': free name kobject: 'syz_tun' (ffff88007b2384f8): calling ktype release kobject: 'syz_tun': free name kobject: 'syz_tun' (ffff88007ac1c4f8): kobject_cleanup, parent (null) kobject: 'syz_tun' (ffff88007ac1c4f8): calling ktype release kobject: 'syz_tun': free name