======================================================== WARNING: possible irq lock inversion dependency detected 5.4.0-syzkaller #0 Not tainted -------------------------------------------------------- syz-executor.3/9195 just changed the state of lock: ffff8880a1441498 (sb_writers#13){.+-+}, at: spin_lock include/linux/spinlock.h:338 [inline] ffff8880a1441498 (sb_writers#13){.+-+}, at: __netif_tx_lock include/linux/netdevice.h:3897 [inline] ffff8880a1441498 (sb_writers#13){.+-+}, at: sch_direct_xmit+0x2e0/0xd30 net/sched/sch_generic.c:311 but this lock took another, SOFTIRQ-unsafe lock in the past: (&sb->s_type->i_mutex_key#22){+.+.} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sb->s_type->i_mutex_key#22); local_irq_disable(); lock(sb_writers#13); lock(&sb->s_type->i_mutex_key#22); lock(sb_writers#13); *** DEADLOCK *** 7 locks held by syz-executor.3/9195: #0: ffffffff892f54c8 (tomoyo_ss){....}, at: tomoyo_check_open_permission+0xfe/0x3f0 security/tomoyo/file.c:761 #1: ffff8880ae809d50 ((&idev->mc_dad_timer)){+.-.}, at: lockdep_copy_map include/linux/lockdep.h:172 [inline] #1: ffff8880ae809d50 ((&idev->mc_dad_timer)){+.-.}, at: call_timer_fn+0xe0/0x780 kernel/time/timer.c:1394 #2: ffffffff88fab980 (rcu_read_lock){....}, at: dev_net include/linux/netdevice.h:2169 [inline] #2: ffffffff88fab980 (rcu_read_lock){....}, at: mld_sendpack+0x180/0xed0 net/ipv6/mcast.c:1649 #3: ffffffff88fab940 (rcu_read_lock_bh){....}, at: lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline] #3: ffffffff88fab940 (rcu_read_lock_bh){....}, at: ip6_finish_output2+0x214/0x2550 net/ipv6/ip6_output.c:102 #4: ffffffff88fab940 (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x20a/0x3720 net/core/dev.c:3727 #5: ffff88808b6c8250 (&dev->qdisc_tx_busylock_key#25){+...}, at: spin_trylock include/linux/spinlock.h:348 [inline] #5: ffff88808b6c8250 (&dev->qdisc_tx_busylock_key#25){+...}, at: qdisc_run_begin include/net/sch_generic.h:159 [inline] #5: ffff88808b6c8250 (&dev->qdisc_tx_busylock_key#25){+...}, at: __dev_xmit_skb net/core/dev.c:3390 [inline] #5: ffff88808b6c8250 (&dev->qdisc_tx_busylock_key#25){+...}, at: __dev_queue_xmit+0x2501/0x3720 net/core/dev.c:3761 #6: ffff88808b6c8138 (&dev->qdisc_running_key#25){+...}, at: dev_queue_xmit+0x18/0x20 net/core/dev.c:3825 the shortest dependencies between 2nd lock and 1st lock: -> (&sb->s_type->i_mutex_key#22){+.+.} { HARDIRQ-ON-W at: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4487 down_write+0x93/0x150 kernel/locking/rwsem.c:1534 inode_lock include/linux/fs.h:789 [inline] do_mq_open+0x24a/0x8d0 ipc/mqueue.c:818 __do_sys_mq_open ipc/mqueue.c:854 [inline] __se_sys_mq_open ipc/mqueue.c:847 [inline] __x64_sys_mq_open+0x165/0x1f0 ipc/mqueue.c:847 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe SOFTIRQ-ON-W at: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4487 down_write+0x93/0x150 kernel/locking/rwsem.c:1534 inode_lock include/linux/fs.h:789 [inline] do_mq_open+0x24a/0x8d0 ipc/mqueue.c:818 __do_sys_mq_open ipc/mqueue.c:854 [inline] __se_sys_mq_open ipc/mqueue.c:847 [inline] __x64_sys_mq_open+0x165/0x1f0 ipc/mqueue.c:847 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe INITIAL USE at: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4487 down_write+0x93/0x150 kernel/locking/rwsem.c:1534 inode_lock include/linux/fs.h:789 [inline] do_mq_open+0x24a/0x8d0 ipc/mqueue.c:818 __do_sys_mq_open ipc/mqueue.c:854 [inline] __se_sys_mq_open ipc/mqueue.c:847 [inline] __x64_sys_mq_open+0x165/0x1f0 ipc/mqueue.c:847 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe } ... key at: [] mqueue_fs_type+0xb8/0x940 ... acquired at: down_write+0x93/0x150 kernel/locking/rwsem.c:1534 inode_lock include/linux/fs.h:789 [inline] do_mq_open+0x24a/0x8d0 ipc/mqueue.c:818 __do_sys_mq_open ipc/mqueue.c:854 [inline] __se_sys_mq_open ipc/mqueue.c:847 [inline] __x64_sys_mq_open+0x165/0x1f0 ipc/mqueue.c:847 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> (sb_writers#13){.+-+} { HARDIRQ-ON-R at: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4487 percpu_down_read include/linux/percpu-rwsem.h:40 [inline] __sb_start_write+0x241/0x460 fs/super.c:1672 sb_start_write include/linux/fs.h:1648 [inline] mnt_want_write+0x3f/0xc0 fs/namespace.c:354 do_mq_open+0x1f9/0x8d0 ipc/mqueue.c:817 __do_sys_mq_open ipc/mqueue.c:854 [inline] __se_sys_mq_open ipc/mqueue.c:847 [inline] __x64_sys_mq_open+0x165/0x1f0 ipc/mqueue.c:847 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe IN-SOFTIRQ-W at: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4487 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] __netif_tx_lock include/linux/netdevice.h:3897 [inline] sch_direct_xmit+0x2e0/0xd30 net/sched/sch_generic.c:311 __dev_xmit_skb net/core/dev.c:3400 [inline] __dev_queue_xmit+0x286f/0x3720 net/core/dev.c:3761 dev_queue_xmit+0x18/0x20 net/core/dev.c:3825 neigh_hh_output include/net/neighbour.h:500 [inline] neigh_output include/net/neighbour.h:509 [inline] ip6_finish_output2+0xf58/0x2550 net/ipv6/ip6_output.c:116 __ip6_finish_output+0x444/0xaa0 net/ipv6/ip6_output.c:142 ip6_finish_output+0x38/0x1f0 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0x235/0x7f0 net/ipv6/ip6_output.c:175 dst_output include/net/dst.h:436 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] mld_sendpack+0x9c7/0xed0 net/ipv6/mcast.c:1682 mld_send_initial_cr.part.0+0x114/0x160 net/ipv6/mcast.c:2099 mld_send_initial_cr net/ipv6/mcast.c:2083 [inline] mld_dad_timer_expire+0x42/0x1c0 net/ipv6/mcast.c:2118 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786 __do_softirq+0x262/0x98c kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x19b/0x1e0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 tomoyo_domain_quota_is_ok+0x312/0x540 security/tomoyo/util.c:1069 tomoyo_supervisor+0x2e8/0xef0 security/tomoyo/common.c:2087 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x263/0x360 security/tomoyo/file.c:573 tomoyo_check_open_permission+0x3ab/0x3f0 security/tomoyo/file.c:777 tomoyo_file_open security/tomoyo/tomoyo.c:319 [inline] tomoyo_file_open+0xa9/0xd0 security/tomoyo/tomoyo.c:314 security_file_open+0x71/0x300 security/security.c:1497 do_dentry_open+0x364/0x12e0 fs/open.c:780 vfs_open+0xa0/0xd0 fs/open.c:910 do_last fs/namei.c:3408 [inline] path_openat+0x10e9/0x46d0 fs/namei.c:3525 do_filp_open+0x1a1/0x280 fs/namei.c:3555 do_sys_open+0x3fe/0x5d0 fs/open.c:1093 __do_sys_openat fs/open.c:1120 [inline] __se_sys_openat fs/open.c:1114 [inline] __x64_sys_openat+0x9d/0x100 fs/open.c:1114 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe SOFTIRQ-ON-R at: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4487 percpu_down_read include/linux/percpu-rwsem.h:40 [inline] __sb_start_write+0x241/0x460 fs/super.c:1672 sb_start_write include/linux/fs.h:1648 [inline] mnt_want_write+0x3f/0xc0 fs/namespace.c:354 do_mq_open+0x1f9/0x8d0 ipc/mqueue.c:817 __do_sys_mq_open ipc/mqueue.c:854 [inline] __se_sys_mq_open ipc/mqueue.c:847 [inline] __x64_sys_mq_open+0x165/0x1f0 ipc/mqueue.c:847 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe INITIAL USE at: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4487 percpu_down_read include/linux/percpu-rwsem.h:40 [inline] __sb_start_write+0x241/0x460 fs/super.c:1672 sb_start_write include/linux/fs.h:1648 [inline] mnt_want_write+0x3f/0xc0 fs/namespace.c:354 do_mq_open+0x1f9/0x8d0 ipc/mqueue.c:817 __do_sys_mq_open ipc/mqueue.c:854 [inline] __se_sys_mq_open ipc/mqueue.c:847 [inline] __x64_sys_mq_open+0x165/0x1f0 ipc/mqueue.c:847 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe } ... key at: [] mqueue_fs_type+0x78/0x940 ... acquired at: mark_lock_irq kernel/locking/lockdep.c:3317 [inline] mark_lock+0x517/0x1220 kernel/locking/lockdep.c:3666 mark_usage kernel/locking/lockdep.c:3566 [inline] __lock_acquire+0x1e8e/0x4a00 kernel/locking/lockdep.c:3909 lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4487 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] __netif_tx_lock include/linux/netdevice.h:3897 [inline] sch_direct_xmit+0x2e0/0xd30 net/sched/sch_generic.c:311 __dev_xmit_skb net/core/dev.c:3400 [inline] __dev_queue_xmit+0x286f/0x3720 net/core/dev.c:3761 dev_queue_xmit+0x18/0x20 net/core/dev.c:3825 neigh_hh_output include/net/neighbour.h:500 [inline] neigh_output include/net/neighbour.h:509 [inline] ip6_finish_output2+0xf58/0x2550 net/ipv6/ip6_output.c:116 __ip6_finish_output+0x444/0xaa0 net/ipv6/ip6_output.c:142 ip6_finish_output+0x38/0x1f0 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0x235/0x7f0 net/ipv6/ip6_output.c:175 dst_output include/net/dst.h:436 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] mld_sendpack+0x9c7/0xed0 net/ipv6/mcast.c:1682 mld_send_initial_cr.part.0+0x114/0x160 net/ipv6/mcast.c:2099 mld_send_initial_cr net/ipv6/mcast.c:2083 [inline] mld_dad_timer_expire+0x42/0x1c0 net/ipv6/mcast.c:2118 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786 __do_softirq+0x262/0x98c kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x19b/0x1e0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 tomoyo_domain_quota_is_ok+0x312/0x540 security/tomoyo/util.c:1069 tomoyo_supervisor+0x2e8/0xef0 security/tomoyo/common.c:2087 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x263/0x360 security/tomoyo/file.c:573 tomoyo_check_open_permission+0x3ab/0x3f0 security/tomoyo/file.c:777 tomoyo_file_open security/tomoyo/tomoyo.c:319 [inline] tomoyo_file_open+0xa9/0xd0 security/tomoyo/tomoyo.c:314 security_file_open+0x71/0x300 security/security.c:1497 do_dentry_open+0x364/0x12e0 fs/open.c:780 vfs_open+0xa0/0xd0 fs/open.c:910 do_last fs/namei.c:3408 [inline] path_openat+0x10e9/0x46d0 fs/namei.c:3525 do_filp_open+0x1a1/0x280 fs/namei.c:3555 do_sys_open+0x3fe/0x5d0 fs/open.c:1093 __do_sys_openat fs/open.c:1120 [inline] __se_sys_openat fs/open.c:1114 [inline] __x64_sys_openat+0x9d/0x100 fs/open.c:1114 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe stack backtrace: CPU: 0 PID: 9195 Comm: syz-executor.3 Not tainted 5.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_irq_inversion_bug.part.0+0x2e4/0x2f1 kernel/locking/lockdep.c:3179 print_irq_inversion_bug kernel/locking/lockdep.c:3180 [inline] check_usage_forwards.cold+0x20/0x29 kernel/locking/lockdep.c:3204 mark_lock_irq kernel/locking/lockdep.c:3317 [inline] mark_lock+0x517/0x1220 kernel/locking/lockdep.c:3666 mark_usage kernel/locking/lockdep.c:3566 [inline] __lock_acquire+0x1e8e/0x4a00 kernel/locking/lockdep.c:3909 lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4487 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] __netif_tx_lock include/linux/netdevice.h:3897 [inline] sch_direct_xmit+0x2e0/0xd30 net/sched/sch_generic.c:311 __dev_xmit_skb net/core/dev.c:3400 [inline] __dev_queue_xmit+0x286f/0x3720 net/core/dev.c:3761 dev_queue_xmit+0x18/0x20 net/core/dev.c:3825 neigh_hh_output include/net/neighbour.h:500 [inline] neigh_output include/net/neighbour.h:509 [inline] ip6_finish_output2+0xf58/0x2550 net/ipv6/ip6_output.c:116 __ip6_finish_output+0x444/0xaa0 net/ipv6/ip6_output.c:142 ip6_finish_output+0x38/0x1f0 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0x235/0x7f0 net/ipv6/ip6_output.c:175 dst_output include/net/dst.h:436 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] mld_sendpack+0x9c7/0xed0 net/ipv6/mcast.c:1682 mld_send_initial_cr.part.0+0x114/0x160 net/ipv6/mcast.c:2099 mld_send_initial_cr net/ipv6/mcast.c:2083 [inline] mld_dad_timer_expire+0x42/0x1c0 net/ipv6/mcast.c:2118 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786 __do_softirq+0x262/0x98c kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x19b/0x1e0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 RIP: 0010:tomoyo_domain_quota_is_ok+0x312/0x540 security/tomoyo/util.c:1069 Code: 5c 41 5d 41 5e 41 5f 5d c3 41 bd 01 00 00 00 31 db e8 a2 77 64 fe 89 d9 44 89 ee 31 ff d3 fe 83 e6 01 41 89 f7 e8 0e 79 64 fe <45> 85 ff 74 09 e8 84 77 64 fe 41 83 c6 01 e8 7b 77 64 fe 8d 73 01 RSP: 0018:ffff88805a08f4d0 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000002 RBX: 0000000000000006 RCX: ffffffff830edf92 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: ffff88805a08f510 R08: ffff8880a42d0240 R09: ffffed100b411eaf R10: ffffed100b411eae R11: 0000000000000000 R12: ffff8880952cf880 R13: 0000000000000010 R14: 0000000000000066 R15: 0000000000000000 tomoyo_supervisor+0x2e8/0xef0 security/tomoyo/common.c:2087 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x263/0x360 security/tomoyo/file.c:573 tomoyo_check_open_permission+0x3ab/0x3f0 security/tomoyo/file.c:777 tomoyo_file_open security/tomoyo/tomoyo.c:319 [inline] tomoyo_file_open+0xa9/0xd0 security/tomoyo/tomoyo.c:314 security_file_open+0x71/0x300 security/security.c:1497 do_dentry_open+0x364/0x12e0 fs/open.c:780 vfs_open+0xa0/0xd0 fs/open.c:910 do_last fs/namei.c:3408 [inline] path_openat+0x10e9/0x46d0 fs/namei.c:3525 do_filp_open+0x1a1/0x280 fs/namei.c:3555 do_sys_open+0x3fe/0x5d0 fs/open.c:1093 __do_sys_openat fs/open.c:1120 [inline] __se_sys_openat fs/open.c:1114 [inline] __x64_sys_openat+0x9d/0x100 fs/open.c:1114 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45a639 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff93678bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a639 RDX: 0000000000004000 RSI: 0000000020000040 RDI: ffffffffffffff9c RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff93678c6d4 R13: 00000000004c77be R14: 00000000004dd660 R15: 00000000ffffffff