------------[ cut here ]------------
WARNING: CPU: 0 PID: 3645 at net/ipv4/af_inet.c:153 inet_sock_destruct+0x6b9/0x880 net/ipv4/af_inet.c:153
Modules linked in:
CPU: 0 PID: 3645 Comm: syz-executor.2 Not tainted 5.19.0-syzkaller-00428-g9de1f9c8ca51 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:inet_sock_destruct+0x6b9/0x880 net/ipv4/af_inet.c:153
Code: 41 8b 9c 24 28 02 00 00 e9 f2 fe ff ff e8 bf e0 8f f9 0f 0b e9 df fd ff ff e8 b3 e0 8f f9 0f 0b e9 30 fe ff ff e8 a7 e0 8f f9 <0f> 0b e9 6b fe ff ff e8 9b e0 8f f9 0f 0b e9 d8 fe ff ff e8 0f 1a
RSP: 0018:ffffc90000007bd0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000002879d0 RCX: 0000000000000100
RDX: ffff8880457f80c0 RSI: ffffffff87e9d3b9 RDI: 0000000000000005
RBP: ffff888016eb6d68 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000002879d0 R11: 0000000000000001 R12: ffff888016eb6d40
R13: ffff888016eb6fb4 R14: 0000000000000003 R15: 0000000000000000
FS: 00005555570c9400(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0253b0000 CR3: 000000004440a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sk_destruct+0x4d/0x710 net/core/sock.c:2067
sk_destruct net/core/sock.c:2112 [inline]
__sk_free+0x1a4/0x4a0 net/core/sock.c:2123
sk_free+0x78/0xa0 net/core/sock.c:2134
tcp_wfree+0x3d9/0x4e0 net/ipv4/tcp_output.c:1181
skb_orphan include/linux/skbuff.h:3164 [inline]
loopback_xmit+0x17b/0x740 drivers/net/loopback.c:79
__netdev_start_xmit include/linux/netdevice.h:4805 [inline]
netdev_start_xmit include/linux/netdevice.h:4819 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0x188/0x880 net/core/dev.c:3606
sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x4c0/0x1720 net/sched/sch_generic.c:415
qdisc_run include/net/pkt_sched.h:126 [inline]
qdisc_run include/net/pkt_sched.h:123 [inline]
net_tx_action+0x77a/0xd30 net/core/dev.c:5085
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:lock_acquire+0xcb/0x570 kernel/locking/lockdep.c:5639
Code: d0 48 89 54 24 08 48 c1 f8 06 48 8d 3c c5 d0 1e bb 8d e8 98 55 68 00 48 8b 54 24 08 48 0f a3 15 bb 83 5d 0c 0f 82 83 03 00 00 <48> c7 c0 8c 52 bb 8d 48 ba 00 00 00 00 00 fc ff df 48 89 c1 83 e0
RSP: 0018:ffffc900031a79a0 EFLAGS: 00000286
RAX: 0000000000000001 RBX: 1ffff92000634f36 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8dbb1ed7
R10: fffffbfff1b763da R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: ffffffff8c5c0d28 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:269 [inline]
srcu_read_lock include/linux/srcu.h:165 [inline]
tomoyo_read_lock security/tomoyo/common.h:1110 [inline]
tomoyo_path_perm+0x20d/0x400 security/tomoyo/file.c:821
security_inode_getattr+0xcf/0x140 security/security.c:1345
vfs_getattr fs/stat.c:157 [inline]
vfs_statx+0x16a/0x390 fs/stat.c:232
vfs_fstatat+0x8c/0xb0 fs/stat.c:255
vfs_lstat include/linux/fs.h:3272 [inline]
__do_sys_newlstat+0x8b/0x110 fs/stat.c:411
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb89fa882a6
================================
WARNING: inconsistent lock state
5.19.0-syzkaller-00428-g9de1f9c8ca51 #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz-executor.2/3645 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffffffff8beb4718 (vmap_area_lock){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
ffffffff8beb4718 (vmap_area_lock){+.?.}-{2:2}, at: find_vmap_area+0x1c/0x130 mm/vmalloc.c:1805
{SOFTIRQ-ON-W} state was registered at:
lock_acquire kernel/locking/lockdep.c:5666 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
alloc_vmap_area+0xa49/0x1f00 mm/vmalloc.c:1586
__get_vm_area_node+0x142/0x3f0 mm/vmalloc.c:2453
__vmalloc_node_range+0x250/0x13e0 mm/vmalloc.c:3125
__vmalloc_node mm/vmalloc.c:3230 [inline]
__vmalloc+0x69/0x80 mm/vmalloc.c:3244
pcpu_mem_zalloc mm/percpu.c:516 [inline]
pcpu_mem_zalloc+0x51/0xa0 mm/percpu.c:508
pcpu_alloc_chunk mm/percpu.c:1454 [inline]
pcpu_create_chunk+0xd7/0x930 mm/percpu-vm.c:338
pcpu_alloc+0x1012/0x13d0 mm/percpu.c:1834
alloc_kmem_cache_cpus.constprop.0+0x29/0xc0 mm/slab.c:1729
do_tune_cpucache+0x37/0x230 mm/slab.c:3844
enable_cpucache+0x3c/0xa0 mm/slab.c:3938
kmem_cache_init_late+0x33/0x66 mm/slab.c:1276
start_kernel+0x2f5/0x48f init/main.c:1058
secondary_startup_64_no_verify+0xce/0xdb
irq event stamp: 17562234
hardirqs last enabled at (17562234): [] __up_console_sem+0xae/0xc0 kernel/printk/printk.c:264
hardirqs last disabled at (17562233): [] __up_console_sem+0x93/0xc0 kernel/printk/printk.c:262
softirqs last enabled at (17560968): [] invoke_softirq kernel/softirq.c:445 [inline]
softirqs last enabled at (17560968): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
softirqs last disabled at (17561295): [] invoke_softirq kernel/softirq.c:445 [inline]
softirqs last disabled at (17561295): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(vmap_area_lock);
lock(vmap_area_lock);
*** DEADLOCK ***
1 lock held by syz-executor.2/3645:
#0: ffffffff8bd84d20 (rcu_read_lock){....}-{1:2}, at: net_tx_action+0x352/0xd30 net/core/dev.c:5051
stack backtrace:
CPU: 0 PID: 3645 Comm: syz-executor.2 Not tainted 5.19.0-syzkaller-00428-g9de1f9c8ca51 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_usage_bug kernel/locking/lockdep.c:3961 [inline]
valid_state kernel/locking/lockdep.c:3973 [inline]
mark_lock_irq kernel/locking/lockdep.c:4176 [inline]
mark_lock.part.0.cold+0x18/0xd8 kernel/locking/lockdep.c:4632
mark_lock kernel/locking/lockdep.c:4596 [inline]
mark_usage kernel/locking/lockdep.c:4527 [inline]
__lock_acquire+0x11e7/0x5660 kernel/locking/lockdep.c:5007
lock_acquire kernel/locking/lockdep.c:5666 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
find_vmap_area+0x1c/0x130 mm/vmalloc.c:1805
check_heap_object mm/usercopy.c:176 [inline]
__check_object_size mm/usercopy.c:250 [inline]
__check_object_size+0x1f8/0x700 mm/usercopy.c:212
check_object_size include/linux/thread_info.h:199 [inline]
__copy_from_user_inatomic include/linux/uaccess.h:62 [inline]
copy_from_user_nmi arch/x86/lib/usercopy.c:47 [inline]
copy_from_user_nmi+0xcb/0x130 arch/x86/lib/usercopy.c:31
copy_code arch/x86/kernel/dumpstack.c:91 [inline]
show_opcodes+0x59/0xb0 arch/x86/kernel/dumpstack.c:121
show_iret_regs+0xd/0x33 arch/x86/kernel/dumpstack.c:149
__show_regs+0x1e/0x60 arch/x86/kernel/process_64.c:74
show_trace_log_lvl+0x25b/0x2ba arch/x86/kernel/dumpstack.c:292
__warn+0xe2/0x190 kernel/panic.c:620
report_bug+0x1bc/0x210 lib/bug.c:198
handle_bug+0x3c/0x60 arch/x86/kernel/traps.c:316
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:336
asm_exc_invalid_op+0x16/0x20 arch/x86/include/asm/idtentry.h:568
RIP: 0010:inet_sock_destruct+0x6b9/0x880 net/ipv4/af_inet.c:153
Code: 41 8b 9c 24 28 02 00 00 e9 f2 fe ff ff e8 bf e0 8f f9 0f 0b e9 df fd ff ff e8 b3 e0 8f f9 0f 0b e9 30 fe ff ff e8 a7 e0 8f f9 <0f> 0b e9 6b fe ff ff e8 9b e0 8f f9 0f 0b e9 d8 fe ff ff e8 0f 1a
RSP: 0018:ffffc90000007bd0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000002879d0 RCX: 0000000000000100
RDX: ffff8880457f80c0 RSI: ffffffff87e9d3b9 RDI: 0000000000000005
RBP: ffff888016eb6d68 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000002879d0 R11: 0000000000000001 R12: ffff888016eb6d40
R13: ffff888016eb6fb4 R14: 0000000000000003 R15: 0000000000000000
__sk_destruct+0x4d/0x710 net/core/sock.c:2067
sk_destruct net/core/sock.c:2112 [inline]
__sk_free+0x1a4/0x4a0 net/core/sock.c:2123
sk_free+0x78/0xa0 net/core/sock.c:2134
tcp_wfree+0x3d9/0x4e0 net/ipv4/tcp_output.c:1181
skb_orphan include/linux/skbuff.h:3164 [inline]
loopback_xmit+0x17b/0x740 drivers/net/loopback.c:79
__netdev_start_xmit include/linux/netdevice.h:4805 [inline]
netdev_start_xmit include/linux/netdevice.h:4819 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0x188/0x880 net/core/dev.c:3606
sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x4c0/0x1720 net/sched/sch_generic.c:415
qdisc_run include/net/pkt_sched.h:126 [inline]
qdisc_run include/net/pkt_sched.h:123 [inline]
net_tx_action+0x77a/0xd30 net/core/dev.c:5085
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:lock_acquire+0xcb/0x570 kernel/locking/lockdep.c:5639
Code: d0 48 89 54 24 08 48 c1 f8 06 48 8d 3c c5 d0 1e bb 8d e8 98 55 68 00 48 8b 54 24 08 48 0f a3 15 bb 83 5d 0c 0f 82 83 03 00 00 <48> c7 c0 8c 52 bb 8d 48 ba 00 00 00 00 00 fc ff df 48 89 c1 83 e0
RSP: 0018:ffffc900031a79a0 EFLAGS: 00000286
RAX: 0000000000000001 RBX: 1ffff92000634f36 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8dbb1ed7
R10: fffffbfff1b763da R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: ffffffff8c5c0d28 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:269 [inline]
srcu_read_lock include/linux/srcu.h:165 [inline]
tomoyo_read_lock security/tomoyo/common.h:1110 [inline]
tomoyo_path_perm+0x20d/0x400 security/tomoyo/file.c:821
security_inode_getattr+0xcf/0x140 security/security.c:1345
vfs_getattr fs/stat.c:157 [inline]
vfs_statx+0x16a/0x390 fs/stat.c:232
vfs_fstatat+0x8c/0xb0 fs/stat.c:255
vfs_lstat include/linux/fs.h:3272 [inline]
__do_sys_newlstat+0x8b/0x110 fs/stat.c:411
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb89fa882a6
Code: ff ff ff 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 41 89 f8 48 89 f7 48 89 d6 41 83 f8 01 77 29 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 c3 90 48 c7 c2 b8 ff ff ff f7 d8 64 89 02
RSP: 002b:00007ffe5451cd18 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb89fa882a6
RDX: 00007ffe5451cd50 RSI: 00007ffe5451cd50 RDI: 00007ffe5451cde0
RBP: 00007ffe5451cde0 R08: 0000000000000001 R09: 00007ffe5451cbb0
R10: 00005555570ca893 R11: 0000000000000246 R12: 00007fb89fae22a6
R13: 00007ffe5451dea0 R14: 00005555570ca810 R15: 00007ffe5451dee0
Code: ff ff ff 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 41 89 f8 48 89 f7 48 89 d6 41 83 f8 01 77 29 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 c3 90 48 c7 c2 b8 ff ff ff f7 d8 64 89 02
RSP: 002b:00007ffe5451cd18 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb89fa882a6
RDX: 00007ffe5451cd50 RSI: 00007ffe5451cd50 RDI: 00007ffe5451cde0
RBP: 00007ffe5451cde0 R08: 0000000000000001 R09: 00007ffe5451cbb0
R10: 00005555570ca893 R11: 0000000000000246 R12: 00007fb89fae22a6
R13: 00007ffe5451dea0 R14: 00005555570ca810 R15: 00007ffe5451dee0
----------------
Code disassembly (best guess):
0: d0 48 89 rorb -0x77(%rax)
3: 54 push %rsp
4: 24 08 and $0x8,%al
6: 48 c1 f8 06 sar $0x6,%rax
a: 48 8d 3c c5 d0 1e bb lea -0x7244e130(,%rax,8),%rdi
11: 8d
12: e8 98 55 68 00 callq 0x6855af
17: 48 8b 54 24 08 mov 0x8(%rsp),%rdx
1c: 48 0f a3 15 bb 83 5d bt %rdx,0xc5d83bb(%rip) # 0xc5d83df
23: 0c
24: 0f 82 83 03 00 00 jb 0x3ad
* 2a: 48 c7 c0 8c 52 bb 8d mov $0xffffffff8dbb528c,%rax <-- trapping instruction
31: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx
38: fc ff df
3b: 48 89 c1 mov %rax,%rcx
3e: 83 .byte 0x83
3f: e0 .byte 0xe0