random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
BUG: sleeping function called from invalid context at net/core/sock.c:2502
in_atomic(): 1, irqs_disabled(): 0, pid: 3762, name: syz-executor992
1 lock held by syz-executor992/3762:
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] __rcu_reclaim kernel/rcu/rcu.h:108 [inline]
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] rcu_process_callbacks+0x98e/0x12b0 kernel/rcu/tree.c:3037
Preemption disabled at:[ 34.826469] [<ffffffff81f1ba94>] __debug_check_no_obj_freed lib/debugobjects.c:711 [inline]
Preemption disabled at:[ 34.826469] [<ffffffff81f1ba94>] debug_check_no_obj_freed+0x164/0x930 lib/debugobjects.c:749
CPU: 0 PID: 3762 Comm: syz-executor992 Not tainted 4.9.98-gf679e4d #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
ffff8801db207cd8 ffffffff81eb0fc9 ffffffff81f1ba94 0000000000000000
0000000000000101 ffff8801bda3c800 ffff8801bda3c800 ffff8801db207d10
ffffffff81422310 ffff8801bda3c800 ffffffff840f5f60 00000000000009c6
Call Trace:
<IRQ> [ 34.878723] [<ffffffff81eb0fc9>] __dump_stack lib/dump_stack.c:15 [inline]
<IRQ> [ 34.878723] [<ffffffff81eb0fc9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff81422310>] ___might_sleep.cold.123+0x1bc/0x1f5 kernel/sched/core.c:7992
[<ffffffff811b9335>] __might_sleep+0x95/0x1a0 kernel/sched/core.c:7949
[<ffffffff83020614>] lock_sock_nested+0x34/0x120 net/core/sock.c:2502
[<ffffffff8341c369>] lock_sock include/net/sock.h:1404 [inline]
[<ffffffff8341c369>] inet_shutdown+0x69/0x360 net/ipv4/af_inet.c:823
[<ffffffff836be630>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:441
[<ffffffff836b7e61>] l2tp_tunnel_closeall+0x231/0x350 net/l2tp/l2tp_core.c:1368
[<ffffffff836b86e2>] l2tp_tunnel_destruct+0x2f2/0x590 net/l2tp/l2tp_core.c:1324
[<ffffffff8301d095>] __sk_destruct+0x55/0x590 net/core/sock.c:1428
[<ffffffff8128578e>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
[<ffffffff8128578e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
[<ffffffff8128578e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
[<ffffffff8128578e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
[<ffffffff8128578e>] rcu_process_callbacks+0x8ae/0x12b0 kernel/rcu/tree.c:3037
[<ffffffff839fb23b>] __do_softirq+0x20b/0x937 kernel/softirq.c:284
[<ffffffff81149037>] invoke_softirq kernel/softirq.c:364 [inline]
[<ffffffff81149037>] irq_exit+0x147/0x190 kernel/softirq.c:405
[<ffffffff839f9e21>] exiting_irq arch/x86/include/asm/apic.h:659 [inline]
[<ffffffff839f9e21>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:960
[<ffffffff839f5fb0>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:648
<EOI> [ 35.009521] [<ffffffff839f3d5f>] ? arch_local_irq_restore arch/x86/include/asm/paravirt.h:768 [inline]
<EOI> [ 35.009521] [<ffffffff839f3d5f>] ? __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:162 [inline]
<EOI> [ 35.009521] [<ffffffff839f3d5f>] ? _raw_spin_unlock_irqrestore+0x5f/0x70 kernel/locking/spinlock.c:191
[<ffffffff81f1bc1c>] __debug_check_no_obj_freed lib/debugobjects.c:733 [inline]
[<ffffffff81f1bc1c>] debug_check_no_obj_freed+0x2ec/0x930 lib/debugobjects.c:749
[<ffffffff8144838d>] free_pages_prepare mm/page_alloc.c:1061 [inline]
[<ffffffff8144838d>] __free_pages_ok+0x1dd/0x1610 mm/page_alloc.c:1263
[<ffffffff8144981e>] free_compound_page+0x5e/0x70 mm/page_alloc.c:594
[<ffffffff8154f549>] free_transhuge_page+0x99/0xc0 mm/huge_memory.c:2228
[<ffffffff81461b80>] __put_compound_page+0x80/0xc0 mm/swap.c:94
[<ffffffff81463774>] release_pages+0x2f4/0x970 mm/swap.c:763
[<ffffffff81506577>] free_pages_and_swap_cache+0x117/0x160 mm/swap_state.c:273
[<ffffffff814bdd34>] tlb_flush_mmu_free+0xb4/0x150 mm/memory.c:259
[<ffffffff814c616d>] zap_pte_range mm/memory.c:1216 [inline]
[<ffffffff814c616d>] zap_pmd_range mm/memory.c:1258 [inline]
[<ffffffff814c616d>] zap_pud_range mm/memory.c:1279 [inline]
[<ffffffff814c616d>] unmap_page_range+0x104d/0x1730 mm/memory.c:1300
[<ffffffff814c6951>] unmap_single_vma+0x101/0x260 mm/memory.c:1345
[<ffffffff814c7292>] unmap_vmas+0x102/0x1d0 mm/memory.c:1375
[<ffffffff814df9f4>] exit_mmap+0x214/0x3f0 mm/mmap.c:2988
[<ffffffff81129dd3>] __mmput kernel/fork.c:878 [inline]
[<ffffffff81129dd3>] mmput+0xf3/0x2d0 kernel/fork.c:900
[<ffffffff8113ebb6>] exit_mm kernel/exit.c:518 [inline]
[<ffffffff8113ebb6>] do_exit+0x906/0x27c0 kernel/exit.c:824
[<ffffffff81144d91>] do_group_exit+0x111/0x340 kernel/exit.c:941
[<ffffffff81144fdd>] SYSC_exit_group kernel/exit.c:952 [inline]
[<ffffffff81144fdd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:950
[<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
[<ffffffff839f4653>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
=================================
[ INFO: inconsistent lock state ]
4.9.98-gf679e4d #14 Tainted: G W
---------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz-executor992/3762 [HC0[0]:SC1[3]:HE1:SE0] takes:
(sk_lock-AF_PPPOX){+.?.+.}, at: [<ffffffff8341c369>] lock_sock include/net/sock.h:1404 [inline]
(sk_lock-AF_PPPOX){+.?.+.}, at: [<ffffffff8341c369>] inet_shutdown+0x69/0x360 net/ipv4/af_inet.c:823
mark_held_locks+0xc7/0x130 kernel/locking/lockdep.c:2660
__trace_hardirqs_on_caller kernel/locking/lockdep.c:2689 [inline]
trace_hardirqs_on_caller+0x38b/0x590 kernel/locking/lockdep.c:2736
trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2743
__local_bh_enable_ip+0x6a/0xd0 kernel/softirq.c:186
local_bh_enable include/linux/bottom_half.h:31 [inline]
lock_sock_nested+0xdc/0x120 net/core/sock.c:2512
lock_sock include/net/sock.h:1404 [inline]
pppol2tp_connect+0xd9/0x18f0 net/l2tp/l2tp_ppp.c:590
SYSC_connect+0x1b8/0x300 net/socket.c:1562
SyS_connect+0x24/0x30 net/socket.c:1543
do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
entry_SYSCALL_64_after_swapgs+0x5d/0xdb
irq event stamp: 2702
hardirqs last enabled at (2702): [<ffffffff839f4fe9>] restore_regs_and_iret+0x0/0x1d
hardirqs last disabled at (2701): [<ffffffff839f5fab>] apic_timer_interrupt+0x9b/0xb0 arch/x86/entry/entry_64.S:648
softirqs last enabled at (342): [<ffffffff8302109e>] spin_unlock_bh include/linux/spinlock.h:352 [inline]
softirqs last enabled at (342): [<ffffffff8302109e>] release_sock+0x14e/0x1c0 net/core/sock.c:2531
softirqs last disabled at (1917): [<ffffffff81149037>] invoke_softirq kernel/softirq.c:364 [inline]
softirqs last disabled at (1917): [<ffffffff81149037>] irq_exit+0x147/0x190 kernel/softirq.c:405
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_PPPOX);
<Interrupt>
lock(sk_lock-AF_PPPOX);
*** DEADLOCK ***
1 lock held by syz-executor992/3762:
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] __rcu_reclaim kernel/rcu/rcu.h:108 [inline]
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
#0: (rcu_callback){......}, at: [<ffffffff8128586e>] rcu_process_callbacks+0x98e/0x12b0 kernel/rcu/tree.c:3037
stack backtrace:
CPU: 0 PID: 3762 Comm: syz-executor992 Tainted: G W 4.9.98-gf679e4d #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
ffff8801db207a58 ffffffff81eb0fc9 ffff8801bda3c800 ffffffff855ef880
ffff8801bda3d0f0 ffff8801bda3d110 0000000000000000 ffff8801db207ac8
ffffffff814256bb 0000000000000003 0000000000000001 ffff880100000000
Call Trace:
<IRQ> [ 35.440378] [<ffffffff81eb0fc9>] __dump_stack lib/dump_stack.c:15 [inline]
<IRQ> [ 35.440378] [<ffffffff81eb0fc9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff814256bb>] print_usage_bug.cold.56+0x327/0x421 kernel/locking/lockdep.c:2387
[<ffffffff81233196>] valid_state kernel/locking/lockdep.c:2400 [inline]
[<ffffffff81233196>] mark_lock_irq kernel/locking/lockdep.c:2602 [inline]
[<ffffffff81233196>] mark_lock+0xcc6/0x1280 kernel/locking/lockdep.c:3065
[<ffffffff812350c0>] mark_irqflags kernel/locking/lockdep.c:2923 [inline]
[<ffffffff812350c0>] __lock_acquire+0xd40/0x4070 kernel/locking/lockdep.c:3302
[<ffffffff81238e60>] lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
[<ffffffff830206a6>] lock_sock_nested+0xc6/0x120 net/core/sock.c:2511
[<ffffffff8341c369>] lock_sock include/net/sock.h:1404 [inline]
[<ffffffff8341c369>] inet_shutdown+0x69/0x360 net/ipv4/af_inet.c:823
[<ffffffff836be630>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:441
[<ffffffff836b7e61>] l2tp_tunnel_closeall+0x231/0x350 net/l2tp/l2tp_core.c:1368
[<ffffffff836b86e2>] l2tp_tunnel_destruct+0x2f2/0x590 net/l2tp/l2tp_core.c:1324
[<ffffffff8301d095>] __sk_destruct+0x55/0x590 net/core/sock.c:1428
[<ffffffff8128578e>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
[<ffffffff8128578e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
[<ffffffff8128578e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
[<ffffffff8128578e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
[<ffffffff8128578e>] rcu_process_callbacks+0x8ae/0x12b0 kernel/rcu/tree.c:3037
[<ffffffff839fb23b>] __do_softirq+0x20b/0x937 kernel/softirq.c:284
[<ffffffff81149037>] invoke_softirq kernel/softirq.c:364 [inline]
[<ffffffff81149037>] irq_exit+0x147/0x190 kernel/softirq.c:405
[<ffffffff839f9e21>] exiting_irq arch/x86/include/asm/apic.h:659 [inline]
[<ffffffff839f9e21>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:960
[<ffffffff839f5fb0>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:648
<EOI> [ 35.612338] [<ffffffff839f3d5f>] ? arch_local_irq_restore arch/x86/include/asm/paravirt.h:768 [inline]
<EOI> [ 35.612338] [<ffffffff839f3d5f>] ? __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:162 [inline]
<EOI> [ 35.612338] [<ffffffff839f3d5f>] ? _raw_spin_unlock_irqrestore+0x5f/0x70 kernel/locking/spinlock.c:191
[<ffffffff81f1bc1c>] __debug_check_no_obj_freed lib/debugobjects.c:733 [inline]
[<ffffffff81f1bc1c>] debug_check_no_obj_freed+0x2ec/0x930 lib/debugobjects.c:749
[<ffffffff8144838d>] free_pages_prepare mm/page_alloc.c:1061 [inline]
[<ffffffff8144838d>] __free_pages_ok+0x1dd/0x1610 mm/page_alloc.c:1263
[<ffffffff8144981e>] free_compound_page+0x5e/0x70 mm/page_alloc.c:594
[<ffffffff8154f549>] free_transhuge_page+0x99/0xc0 mm/huge_memory.c:2228
[<ffffffff81461b80>] __put_compound_page+0x80/0xc0 mm/swap.c:94
[<ffffffff81463774>] release_pages+0x2f4/0x970 mm/swap.c:763
[<ffffffff81506577>] free_pages_and_swap_cache+0x117/0x160 mm/swap_state.c:273
[<ffffffff814bdd34>] tlb_flush_mmu_free+0xb4/0x150 mm/memory.c:259
[<ffffffff814c616d>] zap_pte_range mm/memory.c:1216 [inline]
[<ffffffff814c616d>] zap_pmd_range mm/memory.c:1258 [inline]
[<ffffffff814c616d>] zap_pud_range mm/memory.c:1279 [inline]
[<ffffffff814c616d>] unmap_page_range+0x104d/0x1730 mm/memory.c:1300
[<ffffffff814c6951>] unmap_single_vma+0x101/0x260 mm/memory.c:1345
[<ffffffff814c7292>] unmap_vmas+0x102/0x1d0 mm/memory.c:1375
[<ffffffff814df9f4>] exit_mmap+0x214/0x3f0 mm/mmap.c:2988
[<ffffffff81129dd3>] __mmput kernel/fork.c:878 [inline]
[<ffffffff81129dd3>] mmput+0xf3/0x2d0 kernel/fork.c:900
[<ffffffff8113ebb6>] exit_mm kernel/exit.c:518 [inline]
[<ffffffff8113ebb6>] do_exit+0x906/0x27c0 kernel/exit.c:824
[<ffffffff81144d91>] do_group_exit+0x111/0x340 kernel/exit.c:941
[<ffffffff81144fdd>] SYSC_exit_group kernel/exit.c:952 [inline]
[<ffffffff81144fdd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:950
[<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
[<ffffffff839f4653>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3762 at net/ipv4/af_inet.c:167 inet_sock_destruct+0x598/0x760 net/ipv4/af_inet.c:167