vxcan0: j1939_tp_rxtimer: 0xffff888022422c00: rx timeout, send abort
======================================================
WARNING: possible circular locking dependency detected
6.2.0-rc3-syzkaller-00349-g97ec4d559d93 #0 Not tainted
------------------------------------------------------
ksoftirqd/0/15 is trying to acquire lock:
ffff8880790490d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
ffff8880790490d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: j1939_sk_errqueue+0x92/0x160 net/can/j1939/socket.c:1081
but task is already holding lock:
ffff888079049088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
ffff888079049088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
ffff888079049088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_tp_rxtimer+0xb8/0xa20 net/can/j1939/transport.c:1248
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&priv->active_session_list_lock){+.-.}-{2:2}:
lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
j1939_session_activate+0x4d/0x450 net/can/j1939/transport.c:1561
j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
j1939_sk_queue_activate_next+0x279/0x3f0 net/can/j1939/socket.c:208
j1939_xtp_rx_eoma net/can/j1939/transport.c:1407 [inline]
j1939_tp_cmd_recv net/can/j1939/transport.c:2096 [inline]
j1939_tp_recv+0xc83/0x14f0 net/can/j1939/transport.c:2141
j1939_can_recv+0x700/0xb50 net/can/j1939/main.c:112
deliver net/can/af_can.c:572 [inline]
can_rcv_filter+0x35e/0x800 net/can/af_can.c:606
can_receive+0x2e8/0x410 net/can/af_can.c:663
can_rcv+0x13c/0x250 net/can/af_can.c:687
__netif_receive_skb_one_core net/core/dev.c:5482 [inline]
__netif_receive_skb+0x1c5/0x500 net/core/dev.c:5596
process_backlog+0x568/0x920 net/core/dev.c:5924
__napi_poll+0xbe/0x4b0 net/core/dev.c:6485
napi_poll net/core/dev.c:6552 [inline]
net_rx_action+0x76c/0x1100 net/core/dev.c:6663
__do_softirq+0x277/0x75b kernel/softirq.c:571
run_ksoftirqd+0xc1/0x120 kernel/softirq.c:934
smpboot_thread_fn+0x533/0xa10 kernel/smpboot.c:164
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
-> #1 (&jsk->sk_session_queue_lock){+.-.}-{2:2}:
lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
j1939_sk_queue_drop_all+0x3f/0x250 net/can/j1939/socket.c:139
j1939_sk_netdev_event_netdown+0xf5/0x160 net/can/j1939/socket.c:1275
j1939_netdev_notify+0x204/0x330 net/can/j1939/main.c:379
notifier_call_chain kernel/notifier.c:87 [inline]
raw_notifier_call_chain+0xe7/0x170 kernel/notifier.c:455
__dev_notify_flags+0x339/0x630
dev_change_flags+0xe8/0x190 net/core/dev.c:8607
do_setlink+0xf36/0x3f10 net/core/rtnetlink.c:2827
__rtnl_newlink net/core/rtnetlink.c:3590 [inline]
rtnl_newlink+0x1856/0x20a0 net/core/rtnetlink.c:3637
rtnetlink_rcv_msg+0x7ca/0xec0 net/core/rtnetlink.c:6141
netlink_rcv_skb+0x1f0/0x470 net/netlink/af_netlink.c:2564
netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]
netlink_unicast+0x7e7/0x9c0 net/netlink/af_netlink.c:1356
netlink_sendmsg+0x9b3/0xcd0 net/netlink/af_netlink.c:1932
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]
____sys_sendmsg+0x597/0x8e0 net/socket.c:2476
___sys_sendmsg net/socket.c:2530 [inline]
__sys_sendmsg+0x28e/0x390 net/socket.c:2559
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
-> #0 (&priv->j1939_socks_lock){+.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3097 [inline]
check_prevs_add kernel/locking/lockdep.c:3216 [inline]
validate_chain+0x184a/0x6470 kernel/locking/lockdep.c:3831
__lock_acquire+0x1292/0x1f60 kernel/locking/lockdep.c:5055
lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
j1939_sk_errqueue+0x92/0x160 net/can/j1939/socket.c:1081
j1939_tp_rxtimer+0x479/0xa20 net/can/j1939/transport.c:1257
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x50b/0xa60 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x1a1/0x580 kernel/time/hrtimer.c:1766
__do_softirq+0x277/0x75b kernel/softirq.c:571
run_ksoftirqd+0xc1/0x120 kernel/softirq.c:934
smpboot_thread_fn+0x533/0xa10 kernel/smpboot.c:164
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
other info that might help us debug this:
Chain exists of:
&priv->j1939_socks_lock --> &jsk->sk_session_queue_lock --> &priv->active_session_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&priv->active_session_list_lock);
lock(&jsk->sk_session_queue_lock);
lock(&priv->active_session_list_lock);
lock(&priv->j1939_socks_lock);
*** DEADLOCK ***
1 lock held by ksoftirqd/0/15:
#0: ffff888079049088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:355 [inline]
#0: ffff888079049088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
#0: ffff888079049088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_tp_rxtimer+0xb8/0xa20 net/can/j1939/transport.c:1248
stack backtrace:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.2.0-rc3-syzkaller-00349-g97ec4d559d93 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
check_noncircular+0x2f9/0x3b0 kernel/locking/lockdep.c:2177
check_prev_add kernel/locking/lockdep.c:3097 [inline]
check_prevs_add kernel/locking/lockdep.c:3216 [inline]
validate_chain+0x184a/0x6470 kernel/locking/lockdep.c:3831
__lock_acquire+0x1292/0x1f60 kernel/locking/lockdep.c:5055
lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
j1939_sk_errqueue+0x92/0x160 net/can/j1939/socket.c:1081
j1939_tp_rxtimer+0x479/0xa20 net/can/j1939/transport.c:1257
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x50b/0xa60 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x1a1/0x580 kernel/time/hrtimer.c:1766
__do_softirq+0x277/0x75b kernel/softirq.c:571
run_ksoftirqd+0xc1/0x120 kernel/softirq.c:934
smpboot_thread_fn+0x533/0xa10 kernel/smpboot.c:164
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
vxcan0: j1939_tp_rxtimer: 0xffff88807e710800: rx timeout, send abort
vxcan0: j1939_tp_rxtimer: 0xffff888022422c00: abort rx timeout. Force session deactivation
vxcan0: j1939_tp_rxtimer: 0xffff888085146c00: rx timeout, send abort
vxcan0: j1939_tp_rxtimer: 0xffff88807e710800: abort rx timeout. Force session deactivation
vxcan0: j1939_xtp_rx_dat: no tx connection found
vxcan0: j1939_tp_rxtimer: 0xffff888085146c00: abort rx timeout. Force session deactivation
vxcan0: j1939_tp_rxtimer: 0xffff88802349fc00: rx timeout, send abort
vxcan0: j1939_xtp_rx_abort_one: 0xffff8880217dcc00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
vxcan0: j1939_xtp_rx_abort_one: 0xffff8880217de000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
vxcan0: j1939_xtp_rx_abort_one: 0xffff888087980400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
vxcan0: j1939_tp_rxtimer: 0xffff88802349fc00: abort rx timeout. Force session deactivation
vxcan0: j1939_tp_rxtimer: 0xffff888085146c00: rx timeout, send abort
vxcan0: j1939_xtp_rx_abort_one: 0xffff88807c051000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
vxcan0: j1939_xtp_rx_abort_one: 0xffff88807c051400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 15 at net/can/j1939/transport.c:1098 j1939_session_deactivate_activate_next net/can/j1939/transport.c:1108 [inline]
WARNING: CPU: 0 PID: 15 at net/can/j1939/transport.c:1098 j1939_xtp_rx_abort_one+0x609/0x720 net/can/j1939/transport.c:1348
Modules linked in:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.2.0-rc3-syzkaller-00349-g97ec4d559d93 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:j1939_session_deactivate net/can/j1939/transport.c:1098 [inline]
RIP: 0010:j1939_session_deactivate_activate_next net/can/j1939/transport.c:1108 [inline]
RIP: 0010:j1939_xtp_rx_abort_one+0x609/0x720 net/can/j1939/transport.c:1348
Code: e9 e7 fa ff ff e8 c7 a0 c8 f7 4c 89 f7 be 03 00 00 00 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4c 2f 7e fa e8 a7 a0 c8 f7 <0f> 0b e9 ac fd ff ff e8 9b a0 c8 f7 0f 0b e9 26 fe ff ff 89 e9 80
RSP: 0018:ffffc900001475f8 EFLAGS: 00010246
RAX: ffffffff89c52809 RBX: 0000000000000001 RCX: ffff888012a63a80
RDX: 0000000000000301 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100f80a280 R08: ffffffff89c525ae R09: ffffed100f80a286
R10: ffffed100f80a286 R11: 1ffff1100f80a285 R12: 0000000000000009
R13: ffff88807c051400 R14: dffffc0000000000 R15: ffff88805c399070
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3549f85058 CR3: 0000000027537000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
j1939_xtp_rx_abort net/can/j1939/transport.c:1360 [inline]
j1939_tp_cmd_recv net/can/j1939/transport.c:2108 [inline]
j1939_tp_recv+0x933/0x14f0 net/can/j1939/transport.c:2141
j1939_can_recv+0x700/0xb50 net/can/j1939/main.c:112
deliver net/can/af_can.c:572 [inline]
can_rcv_filter+0x35e/0x800 net/can/af_can.c:606
can_receive+0x2e8/0x410 net/can/af_can.c:663
can_rcv+0x13c/0x250 net/can/af_can.c:687
__netif_receive_skb_one_core net/core/dev.c:5482 [inline]
__netif_receive_skb+0x1c5/0x500 net/core/dev.c:5596
process_backlog+0x568/0x920 net/core/dev.c:5924
__napi_poll+0xbe/0x4b0 net/core/dev.c:6485
napi_poll net/core/dev.c:6552 [inline]
net_rx_action+0x76c/0x1100 net/core/dev.c:6663
__do_softirq+0x277/0x75b kernel/softirq.c:571
run_ksoftirqd+0xc1/0x120 kernel/softirq.c:934
smpboot_thread_fn+0x533/0xa10 kernel/smpboot.c:164
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308