======================================================
WARNING: possible circular locking dependency detected
5.12.0-rc7-syzkaller #0 Not tainted
------------------------------------------------------
systemd-udevd/26025 is trying to acquire lock:
ffff88802425b3a0 (slock-AF_INET6){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
ffff88802425b3a0 (slock-AF_INET6){+.-.}-{2:2}, at: sctp_addr_wq_timeout_handler+0x1a1/0x550 net/sctp/protocol.c:666
but task is already holding lock:
ffff88802b862ca0 (&net->sctp.addr_wq_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:359 [inline]
ffff88802b862ca0 (&net->sctp.addr_wq_lock){+.-.}-{2:2}, at: sctp_addr_wq_timeout_handler+0x38/0x550 net/sctp/protocol.c:626
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&net->sctp.addr_wq_lock){+.-.}-{2:2}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:175
spin_lock_bh include/linux/spinlock.h:359 [inline]
sctp_destroy_sock+0x204/0x440 net/sctp/socket.c:5028
sctp_v6_destroy_sock+0x11/0x20 net/sctp/socket.c:9528
sk_common_release+0x64/0x390 net/core/sock.c:3264
sctp_close+0x4da/0x940 net/sctp/socket.c:1531
inet_release+0x12e/0x280 net/ipv4/af_inet.c:431
inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478
__sock_release+0xcd/0x280 net/socket.c:599
sock_close+0x18/0x20 net/socket.c:1258
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:140
get_signal+0x1ba2/0x2150 kernel/signal.c:2554
arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:147 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x148/0x250 kernel/entry/common.c:208
__syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (slock-AF_INET6){+.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:2937 [inline]
check_prevs_add kernel/locking/lockdep.c:3060 [inline]
validate_chain kernel/locking/lockdep.c:3675 [inline]
__lock_acquire+0x2b14/0x54c0 kernel/locking/lockdep.c:4901
lock_acquire kernel/locking/lockdep.c:5511 [inline]
lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5476
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
spin_lock include/linux/spinlock.h:354 [inline]
sctp_addr_wq_timeout_handler+0x1a1/0x550 net/sctp/protocol.c:666
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1431
expire_timers kernel/time/timer.c:1476 [inline]
__run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1745
__run_timers kernel/time/timer.c:1726 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1758
__do_softirq+0x29b/0x9f6 kernel/softirq.c:345
invoke_softirq kernel/softirq.c:221 [inline]
__irq_exit_rcu kernel/softirq.c:422 [inline]
irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
_raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:199
finish_lock_switch kernel/sched/core.c:4074 [inline]
finish_task_switch.isra.0+0x15d/0x810 kernel/sched/core.c:4191
context_switch kernel/sched/core.c:4325 [inline]
__schedule+0x919/0x21b0 kernel/sched/core.c:5073
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:5530
irqentry_exit_cond_resched kernel/entry/common.c:392 [inline]
irqentry_exit_cond_resched kernel/entry/common.c:384 [inline]
irqentry_exit+0x7a/0xa0 kernel/entry/common.c:428
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
write_comp_data kernel/kcov.c:240 [inline]
__sanitizer_cov_trace_const_cmp1+0x77/0x80 kernel/kcov.c:270
tomoyo_domain_quota_is_ok+0x32a/0x550 security/tomoyo/util.c:1092
tomoyo_supervisor+0x2f2/0xf00 security/tomoyo/common.c:2089
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x270/0x3a0 security/tomoyo/file.c:573
tomoyo_path_perm+0x2f0/0x400 security/tomoyo/file.c:838
security_inode_getattr+0xcf/0x140 security/security.c:1288
vfs_getattr fs/stat.c:131 [inline]
vfs_statx+0x164/0x390 fs/stat.c:199
vfs_fstatat fs/stat.c:217 [inline]
vfs_lstat include/linux/fs.h:3240 [inline]
__do_sys_newlstat+0x91/0x110 fs/stat.c:372
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&net->sctp.addr_wq_lock);
lock(slock-AF_INET6);
lock(&net->sctp.addr_wq_lock);
lock(slock-AF_INET6);
*** DEADLOCK ***
3 locks held by systemd-udevd/26025:
#0: ffffffff8c706c78 (tomoyo_ss){....}-{0:0}, at: tomoyo_path_perm+0x1c1/0x400 security/tomoyo/file.c:847
#1: ffffc90000007d78 ((&net->sctp.addr_wq_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline]
#1: ffffc90000007d78 ((&net->sctp.addr_wq_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1421
#2: ffff88802b862ca0 (&net->sctp.addr_wq_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:359 [inline]
#2: ffff88802b862ca0 (&net->sctp.addr_wq_lock){+.-.}-{2:2}, at: sctp_addr_wq_timeout_handler+0x38/0x550 net/sctp/protocol.c:626
stack backtrace:
CPU: 0 PID: 26025 Comm: systemd-udevd Not tainted 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2128
check_prev_add kernel/locking/lockdep.c:2937 [inline]
check_prevs_add kernel/locking/lockdep.c:3060 [inline]
validate_chain kernel/locking/lockdep.c:3675 [inline]
__lock_acquire+0x2b14/0x54c0 kernel/locking/lockdep.c:4901
lock_acquire kernel/locking/lockdep.c:5511 [inline]
lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5476
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
spin_lock include/linux/spinlock.h:354 [inline]
sctp_addr_wq_timeout_handler+0x1a1/0x550 net/sctp/protocol.c:666
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1431
expire_timers kernel/time/timer.c:1476 [inline]
__run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1745
__run_timers kernel/time/timer.c:1726 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1758
__do_softirq+0x29b/0x9f6 kernel/softirq.c:345
invoke_softirq kernel/softirq.c:221 [inline]
__irq_exit_rcu kernel/softirq.c:422 [inline]
irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:199
Code: 0f 1f 44 00 00 55 48 8b 74 24 08 48 89 fd 48 83 c7 18 e8 1e 07 54 f8 48 89 ef e8 56 bd 54 f8 e8 d1 46 74 f8 fb bf 01 00 00 00 46 8b 48 f8 65 8b 05 ef 55 fc 76 85 c0 74 02 5d c3 e8 4b ab fa
RSP: 0018:ffffc90001b47658 EFLAGS: 00000202
RAX: 000000000000099b RBX: 0000000000000001 RCX: 1ffffffff1b89e51
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff8880b9c35180 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8179e0c8 R11: 0000000000000001 R12: ffff8880b9c35180
R13: ffff888017a73880 R14: 0000000000000000 R15: ffff888062f9d4c0
finish_lock_switch kernel/sched/core.c:4074 [inline]
finish_task_switch.isra.0+0x15d/0x810 kernel/sched/core.c:4191
context_switch kernel/sched/core.c:4325 [inline]
__schedule+0x919/0x21b0 kernel/sched/core.c:5073
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:5530
irqentry_exit_cond_resched kernel/entry/common.c:392 [inline]
irqentry_exit_cond_resched kernel/entry/common.c:384 [inline]
irqentry_exit+0x7a/0xa0 kernel/entry/common.c:428
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x77/0x80 kernel/kcov.c:272
Code: f0 72 27 41 0f b6 fb 41 0f b6 c9 48 83 c2 01 48 c7 44 30 e0 01 00 00 00 48 89 7c 30 e8 48 89 4c 30 f0 4c 89 54 d8 20 48 89 10 <5b> c3 0f 1f 80 00 00 00 00 53 41 89 fb 41 89 f1 bf 03 00 00 00 65
RSP: 0018:ffffc90001b47860 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000009 RCX: ffff888062f9d4c0
RDX: 0000000000000000 RSI: ffff888062f9d4c0 RDI: 0000000000000003
RBP: ffff888021403b80 R08: 0000000000000000 R09: 0000000000000009
R10: ffffffff8392eaca R11: 0000000000000010 R12: 0000000000000001
R13: 0000000000000170 R14: dffffc0000000000 R15: 0000000000000000
tomoyo_domain_quota_is_ok+0x32a/0x550 security/tomoyo/util.c:1092
tomoyo_supervisor+0x2f2/0xf00 security/tomoyo/common.c:2089
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x270/0x3a0 security/tomoyo/file.c:573
tomoyo_path_perm+0x2f0/0x400 security/tomoyo/file.c:838
security_inode_getattr+0xcf/0x140 security/security.c:1288
vfs_getattr fs/stat.c:131 [inline]
vfs_statx+0x164/0x390 fs/stat.c:199
vfs_fstatat fs/stat.c:217 [inline]
vfs_lstat include/linux/fs.h:3240 [inline]
__do_sys_newlstat+0x91/0x110 fs/stat.c:372
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fab43399335
Code: 69 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 31 db 2b 00 f7 d8 64 89
RSP: 002b:00007ffc3d7abd58 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 00005651022d9180 RCX: 00007fab43399335
RDX: 00007ffc3d7abd90 RSI: 00007ffc3d7abd90 RDI: 00005651022d8180
RBP: 00007ffc3d7abe50 R08: 00007fab43658198 R09: 0000000000001010
R10: 0000000000000020 R11: 0000000000000246 R12: 00005651022d8180
R13: 00005651022d819a R14: 00005651022cb375 R15: 00005651022cb37a