vxcan1: j1939_xtp_rx_abort_one: 0xffff88806e655c00: 0x00000: (8) Duplicate sequence number (and software is not able to recover)
vxcan1: j1939_xtp_rx_abort_one: 0xffff88806dfd8400: 0x00000: (8) Duplicate sequence number (and software is not able to recover)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3609 at net/can/j1939/transport.c:1090 j1939_session_deactivate net/can/j1939/transport.c:1090 [inline]
WARNING: CPU: 1 PID: 3609 at net/can/j1939/transport.c:1090 j1939_session_deactivate_activate_next+0x95/0xd3 net/can/j1939/transport.c:1100
Modules linked in:
CPU: 1 PID: 3609 Comm: sshd Not tainted 5.19.0-rc7-syzkaller-01445-g3c47fb2f4c4d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:j1939_session_deactivate net/can/j1939/transport.c:1090 [inline]
RIP: 0010:j1939_session_deactivate_activate_next+0x95/0xd3 net/can/j1939/transport.c:1100
Code: 03 38 d0 7c 0c 84 d2 74 08 4c 89 ef e8 71 fc 50 f8 8b 5d 28 bf 01 00 00 00 89 de e8 72 89 03 f8 83 fb 01 77 07 e8 28 8d 03 f8 <0f> 0b e8 21 8d 03 f8 48 89 ef e8 b9 59 da fe 4c 89 e7 89 c3 e8 df
RSP: 0018:ffffc900001e0ad0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff888022d7bb00 RSI: ffffffff8976e458 RDI: 0000000000000005
RBP: ffff88806dfd8400 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880687b1070
R13: ffff88806dfd8428 R14: ffff88807d121018 R15: ffffffff8ae87f40
FS: 00007fefdf2d4800(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020015000 CR3: 0000000020904000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
j1939_xtp_rx_abort_one.cold+0x20b/0x33c net/can/j1939/transport.c:1340
j1939_xtp_rx_abort net/can/j1939/transport.c:1351 [inline]
j1939_tp_cmd_recv net/can/j1939/transport.c:2103 [inline]
j1939_tp_recv+0x61f/0xcb0 net/can/j1939/transport.c:2133
j1939_can_recv+0x6ff/0x9a0 net/can/j1939/main.c:108
deliver net/can/af_can.c:574 [inline]
can_rcv_filter+0x5d4/0x8d0 net/can/af_can.c:608
can_receive+0x31d/0x580 net/can/af_can.c:665
can_rcv+0x120/0x1c0 net/can/af_can.c:696
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5484
__netif_receive_skb+0x24/0x1b0 net/core/dev.c:5598
process_backlog+0x3a0/0x7c0 net/core/dev.c:5926
__napi_poll+0xb3/0x6e0 net/core/dev.c:6510
napi_poll net/core/dev.c:6577 [inline]
net_rx_action+0x9c1/0xd90 net/core/dev.c:6688
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
do_softirq.part.0+0xde/0x130 kernel/softirq.c:472
do_softirq kernel/softirq.c:464 [inline]
__local_bh_enable_ip+0x102/0x120 kernel/softirq.c:396
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:765 [inline]
ip_finish_output2+0x7d0/0x2170 net/ipv4/ip_output.c:229
__ip_finish_output net/ipv4/ip_output.c:306 [inline]
__ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288
ip_finish_output+0x32/0x280 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip_output+0x19f/0x310 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:451 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
__ip_queue_xmit+0x8de/0x1be0 net/ipv4/ip_output.c:532
__tcp_transmit_skb+0x190e/0x38c0 net/ipv4/tcp_output.c:1405
tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
tcp_write_xmit+0xd89/0x6040 net/ipv4/tcp_output.c:2694
__tcp_push_pending_frames+0xaa/0x390 net/ipv4/tcp_output.c:2878
tcp_push+0x499/0x720 net/ipv4/tcp.c:728
tcp_sendmsg_locked+0x2486/0x3050 net/ipv4/tcp.c:1455
tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1483
inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
sock_write_iter+0x291/0x3d0 net/socket.c:1108
call_write_iter include/linux/fs.h:2058 [inline]
new_sync_write+0x38a/0x560 fs/read_write.c:504
vfs_write+0x7c0/0xac0 fs/read_write.c:591
ksys_write+0x1e8/0x250 fs/read_write.c:644
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fefdef259a3
================================
WARNING: inconsistent lock state
5.19.0-rc7-syzkaller-01445-g3c47fb2f4c4d #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
sshd/3609 [HC0[0]:SC1[3]:HE1:SE0] takes:
ffffffff8beba8b8 (vmap_area_lock){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
ffffffff8beba8b8 (vmap_area_lock){+.?.}-{2:2}, at: find_vmap_area+0x1c/0x130 mm/vmalloc.c:1805
{SOFTIRQ-ON-W} state was registered at:
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
alloc_vmap_area+0xa49/0x1f00 mm/vmalloc.c:1586
__get_vm_area_node+0x142/0x3f0 mm/vmalloc.c:2453
get_vm_area_caller+0x43/0x50 mm/vmalloc.c:2506
__ioremap_caller.constprop.0+0x292/0x600 arch/x86/mm/ioremap.c:280
acpi_os_ioremap include/acpi/acpi_io.h:13 [inline]
acpi_map drivers/acpi/osl.c:296 [inline]
acpi_os_map_iomem+0x463/0x550 drivers/acpi/osl.c:355
acpi_tb_acquire_table+0xd8/0x209 drivers/acpi/acpica/tbdata.c:142
acpi_tb_validate_table drivers/acpi/acpica/tbdata.c:317 [inline]
acpi_tb_validate_table+0x50/0x8c drivers/acpi/acpica/tbdata.c:308
acpi_tb_verify_temp_table+0x84/0x674 drivers/acpi/acpica/tbdata.c:504
acpi_reallocate_root_table+0x374/0x3e0 drivers/acpi/acpica/tbxface.c:180
acpi_early_init+0x13a/0x438 drivers/acpi/bus.c:1199
start_kernel+0x3cf/0x48f init/main.c:1098
secondary_startup_64_no_verify+0xce/0xdb
irq event stamp: 7953976
hardirqs last enabled at (7953976): [] __up_console_sem+0xae/0xc0 kernel/printk/printk.c:264
hardirqs last disabled at (7953975): [] __up_console_sem+0x93/0xc0 kernel/printk/printk.c:262
softirqs last enabled at (7952022): [] rcu_read_unlock_bh include/linux/rcupdate.h:761 [inline]
softirqs last enabled at (7952022): [] ip_finish_output2+0x7a2/0x2170 net/ipv4/ip_output.c:229
softirqs last disabled at (7952023): [] do_softirq.part.0+0xde/0x130 kernel/softirq.c:472
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(vmap_area_lock);
lock(vmap_area_lock);
*** DEADLOCK ***
5 locks held by sshd/3609:
#0: ffff888075050d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1659 [inline]
#0: ffff888075050d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x1d/0x40 net/ipv4/tcp.c:1482
#1: ffffffff8bd87120 (rcu_read_lock){....}-{1:2}, at: read_pnet include/net/net_namespace.h:369 [inline]
#1: ffffffff8bd87120 (rcu_read_lock){....}-{1:2}, at: sock_net include/net/sock.h:590 [inline]
#1: ffffffff8bd87120 (rcu_read_lock){....}-{1:2}, at: __ip_queue_xmit+0x3d/0x1be0 net/ipv4/ip_output.c:457
#2: ffffffff8bd87120 (rcu_read_lock){....}-{1:2}, at: __skb_unlink include/linux/skbuff.h:2314 [inline]
#2: ffffffff8bd87120 (rcu_read_lock){....}-{1:2}, at: __skb_dequeue include/linux/skbuff.h:2329 [inline]
#2: ffffffff8bd87120 (rcu_read_lock){....}-{1:2}, at: process_backlog+0x34b/0x7c0 net/core/dev.c:5924
#3: ffffffff8bd87120 (rcu_read_lock){....}-{1:2}, at: can_receive+0x1ef/0x580 net/can/af_can.c:655
#4: ffff8880687b1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline]
#4: ffff8880687b1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
#4: ffff8880687b1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_deactivate net/can/j1939/transport.c:1086 [inline]
#4: ffff8880687b1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_deactivate_activate_next+0x43/0xd3 net/can/j1939/transport.c:1100
stack backtrace:
CPU: 1 PID: 3609 Comm: sshd Not tainted 5.19.0-rc7-syzkaller-01445-g3c47fb2f4c4d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_usage_bug kernel/locking/lockdep.c:3961 [inline]
valid_state kernel/locking/lockdep.c:3973 [inline]
mark_lock_irq kernel/locking/lockdep.c:4176 [inline]
mark_lock.part.0.cold+0x18/0xd8 kernel/locking/lockdep.c:4632
mark_lock kernel/locking/lockdep.c:4596 [inline]
mark_usage kernel/locking/lockdep.c:4527 [inline]
__lock_acquire+0x11e7/0x5660 kernel/locking/lockdep.c:5007
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
find_vmap_area+0x1c/0x130 mm/vmalloc.c:1805
check_heap_object mm/usercopy.c:176 [inline]
__check_object_size mm/usercopy.c:250 [inline]
__check_object_size+0x1f8/0x700 mm/usercopy.c:212
check_object_size include/linux/thread_info.h:199 [inline]
__copy_from_user_inatomic include/linux/uaccess.h:62 [inline]
copy_from_user_nmi arch/x86/lib/usercopy.c:47 [inline]
copy_from_user_nmi+0xcb/0x130 arch/x86/lib/usercopy.c:31
copy_code arch/x86/kernel/dumpstack.c:91 [inline]
show_opcodes+0x59/0xb0 arch/x86/kernel/dumpstack.c:121
show_iret_regs+0xd/0x33 arch/x86/kernel/dumpstack.c:149
__show_regs+0x1e/0x60 arch/x86/kernel/process_64.c:74
show_trace_log_lvl+0x25b/0x2ba arch/x86/kernel/dumpstack.c:292
__warn+0xe2/0x190 kernel/panic.c:620
report_bug+0x1bc/0x210 lib/bug.c:198
handle_bug+0x3c/0x60 arch/x86/kernel/traps.c:316
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:336
asm_exc_invalid_op+0x16/0x20 arch/x86/include/asm/idtentry.h:568
RIP: 0010:j1939_session_deactivate net/can/j1939/transport.c:1090 [inline]
RIP: 0010:j1939_session_deactivate_activate_next+0x95/0xd3 net/can/j1939/transport.c:1100
Code: 03 38 d0 7c 0c 84 d2 74 08 4c 89 ef e8 71 fc 50 f8 8b 5d 28 bf 01 00 00 00 89 de e8 72 89 03 f8 83 fb 01 77 07 e8 28 8d 03 f8 <0f> 0b e8 21 8d 03 f8 48 89 ef e8 b9 59 da fe 4c 89 e7 89 c3 e8 df
RSP: 0018:ffffc900001e0ad0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff888022d7bb00 RSI: ffffffff8976e458 RDI: 0000000000000005
RBP: ffff88806dfd8400 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880687b1070
R13: ffff88806dfd8428 R14: ffff88807d121018 R15: ffffffff8ae87f40
j1939_xtp_rx_abort_one.cold+0x20b/0x33c net/can/j1939/transport.c:1340
j1939_xtp_rx_abort net/can/j1939/transport.c:1351 [inline]
j1939_tp_cmd_recv net/can/j1939/transport.c:2103 [inline]
j1939_tp_recv+0x61f/0xcb0 net/can/j1939/transport.c:2133
j1939_can_recv+0x6ff/0x9a0 net/can/j1939/main.c:108
deliver net/can/af_can.c:574 [inline]
can_rcv_filter+0x5d4/0x8d0 net/can/af_can.c:608
can_receive+0x31d/0x580 net/can/af_can.c:665
can_rcv+0x120/0x1c0 net/can/af_can.c:696
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5484
__netif_receive_skb+0x24/0x1b0 net/core/dev.c:5598
process_backlog+0x3a0/0x7c0 net/core/dev.c:5926
__napi_poll+0xb3/0x6e0 net/core/dev.c:6510
napi_poll net/core/dev.c:6577 [inline]
net_rx_action+0x9c1/0xd90 net/core/dev.c:6688
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
do_softirq.part.0+0xde/0x130 kernel/softirq.c:472
do_softirq kernel/softirq.c:464 [inline]
__local_bh_enable_ip+0x102/0x120 kernel/softirq.c:396
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:765 [inline]
ip_finish_output2+0x7d0/0x2170 net/ipv4/ip_output.c:229
__ip_finish_output net/ipv4/ip_output.c:306 [inline]
__ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288
ip_finish_output+0x32/0x280 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip_output+0x19f/0x310 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:451 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
__ip_queue_xmit+0x8de/0x1be0 net/ipv4/ip_output.c:532
__tcp_transmit_skb+0x190e/0x38c0 net/ipv4/tcp_output.c:1405
tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
tcp_write_xmit+0xd89/0x6040 net/ipv4/tcp_output.c:2694
__tcp_push_pending_frames+0xaa/0x390 net/ipv4/tcp_output.c:2878
tcp_push+0x499/0x720 net/ipv4/tcp.c:728
tcp_sendmsg_locked+0x2486/0x3050 net/ipv4/tcp.c:1455
tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1483
inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
sock_write_iter+0x291/0x3d0 net/socket.c:1108
call_write_iter include/linux/fs.h:2058 [inline]
new_sync_write+0x38a/0x560 fs/read_write.c:504
vfs_write+0x7c0/0xac0 fs/read_write.c:591
ksys_write+0x1e8/0x250 fs/read_write.c:644
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fefdef259a3
Code: 8b 15 d9 f4 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
RSP: 002b:00007ffe6835a1b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000000000005c RCX: 00007fefdef259a3
RDX: 000000000000005c RSI: 0000564d26f44800 RDI: 0000000000000004
RBP: 0000564d26f34830 R08: 0000000000000000 R09: 00007ffe6836f080
R10: 00007ffe6836f0f0 R11: 0000000000000246 R12: 0000000000000004
R13: 0000000000000001 R14: 00007ffe6835a228 R15: 00007ffe6835a2a8
Code: 8b 15 d9 f4 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
RSP: 002b:00007ffe6835a1b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000000000005c RCX: 00007fefdef259a3
RDX: 000000000000005c RSI: 0000564d26f44800 RDI: 0000000000000004
RBP: 0000564d26f34830 R08: 0000000000000000 R09: 00007ffe6836f080
R10: 00007ffe6836f0f0 R11: 0000000000000246 R12: 0000000000000004
R13: 0000000000000001 R14: 00007ffe6835a228 R15: 00007ffe6835a2a8
----------------
Code disassembly (best guess):
0: 8b 15 d9 f4 0c 00 mov 0xcf4d9(%rip),%edx # 0xcf4df
6: f7 d8 neg %eax
8: 64 89 02 mov %eax,%fs:(%rdx)
b: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
12: eb b7 jmp 0xffffffcb
14: 0f 1f 00 nopl (%rax)
17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax
1e: 00
1f: 85 c0 test %eax,%eax
21: 75 14 jne 0x37
23: b8 01 00 00 00 mov $0x1,%eax
28: 0f 05 syscall
* 2a: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 55 ja 0x87
32: c3 retq
33: 0f 1f 40 00 nopl 0x0(%rax)
37: 48 83 ec 28 sub $0x28,%rsp
3b: 48 89 54 24 18 mov %rdx,0x18(%rsp)