audit: type=1400 audit(1541980860.702:577): avc:  denied  { write } for  pid=13634 comm="syz-executor3" path="socket:[41972]" dev="sockfs" ino=41972 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1

======================================================
[ INFO: possible circular locking dependency detected ]
4.4.163+ #11 Not tainted
-------------------------------------------------------
syz-executor4/13644 is trying to acquire lock:
 (rtnl_mutex){+.+.+.}, at: [  322.783849] audit: type=1400 audit(1541980860.832:578): avc:  denied  { write } for  pid=13634 comm="syz-executor3" path="socket:[41972]" dev="sockfs" ino=41972 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980860.842:579): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[<ffffffff822669d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70

but task is already holding lock:
 (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff825f71e2>] lock_sock include/net/sock.h:1493 [inline]
 (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff825f71e2>] do_ipv6_setsockopt.isra.4+0x252/0x2d50 net/ipv6/ipv6_sockglue.c:166

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

       [<ffffffff8120301e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff821dc686>] lock_sock_nested+0xc6/0x120 net/core/sock.c:2459
       [<ffffffff825f7162>] lock_sock include/net/sock.h:1493 [inline]
       [<ffffffff825f7162>] do_ipv6_setsockopt.isra.4+0x1d2/0x2d50 net/ipv6/ipv6_sockglue.c:166
       [<ffffffff825f9d77>] ipv6_setsockopt+0x97/0x130 net/ipv6/ipv6_sockglue.c:904
       [<ffffffff822a2dd8>] compat_mc_setsockopt+0x278/0x6e0 net/compat.c:627
       [<ffffffff825f9f36>] compat_ipv6_setsockopt+0x126/0x1d0 net/ipv6/ipv6_sockglue.c:932
       [<ffffffff823dd397>] inet_csk_compat_setsockopt+0x97/0x120 net/ipv4/inet_connection_sock.c:914
       [<ffffffff823f10dd>] compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2654
       [<ffffffff821d6984>] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2670
       [<ffffffff822a4ff9>] C_SYSC_setsockopt net/compat.c:385 [inline]
       [<ffffffff822a4ff9>] compat_SyS_setsockopt+0x169/0x700 net/compat.c:368
       [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
       [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
       [<ffffffff82713b50>] sysenter_flags_fixed+0xd/0x1a

audit: type=1400 audit(1541980861.022:618): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980861.022:619): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980861.022:620): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980861.022:621): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980861.022:622): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980861.032:623): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980861.032:624): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980861.032:625): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980861.032:626): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1541980861.042:627): avc:  denied  { write } for  pid=13634 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
 (rtnl_mutex){+.+.+.}:
       [<ffffffff811ff43c>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
       [<ffffffff811ff43c>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
       [<ffffffff811ff43c>] validate_chain kernel/locking/lockdep.c:2144 [inline]
       [<ffffffff811ff43c>] __lock_acquire+0x3e6c/0x5f10 kernel/locking/lockdep.c:3213
       [<ffffffff8120301e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff82706e5b>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff82706e5b>] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621
       [<ffffffff822669d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
       [<ffffffff82630aee>] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288
       [<ffffffff825f7c97>] do_ipv6_setsockopt.isra.4+0xd07/0x2d50 net/ipv6/ipv6_sockglue.c:202
       [<ffffffff825f9ef9>] compat_ipv6_setsockopt+0xe9/0x1d0 net/ipv6/ipv6_sockglue.c:935
       [<ffffffff8260e3ea>] compat_udpv6_setsockopt+0x4a/0x90 net/ipv6/udp.c:1446
       [<ffffffff821d6984>] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2670
       [<ffffffff822a4ff9>] C_SYSC_setsockopt net/compat.c:385 [inline]
       [<ffffffff822a4ff9>] compat_SyS_setsockopt+0x169/0x700 net/compat.c:368
       [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
       [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
       [<ffffffff82713b50>] sysenter_flags_fixed+0xd/0x1a

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(sk_lock-AF_INET6);
                               lock(rtnl_mutex);
                               lock(sk_lock-AF_INET6);
  lock(rtnl_mutex);

 *** DEADLOCK ***

1 lock held by syz-executor4/13644:
 #0:  (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff825f71e2>] lock_sock include/net/sock.h:1493 [inline]
 #0:  (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff825f71e2>] do_ipv6_setsockopt.isra.4+0x252/0x2d50 net/ipv6/ipv6_sockglue.c:166

stack backtrace:
CPU: 1 PID: 13644 Comm: syz-executor4 Not tainted 4.4.163+ #11
 0000000000000000 8be7a5a8b5f1f4c1 ffff8801d438f538 ffffffff81aa556d
 ffffffff83a85b10 ffffffff83ac48d0 ffffffff83a85b10 ffff8800b4e7a0a8
 ffff8800b4e797c0 ffff8801d438f580 ffffffff813a8827 0000000000000001
Call Trace:
 [<ffffffff81aa556d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aa556d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff813a8827>] print_circular_bug.cold.34+0x2f7/0x432 kernel/locking/lockdep.c:1226
 [<ffffffff811ff43c>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
 [<ffffffff811ff43c>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
 [<ffffffff811ff43c>] validate_chain kernel/locking/lockdep.c:2144 [inline]
 [<ffffffff811ff43c>] __lock_acquire+0x3e6c/0x5f10 kernel/locking/lockdep.c:3213
 [<ffffffff8120301e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff82706e5b>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
 [<ffffffff82706e5b>] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621
 [<ffffffff822669d7>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
 [<ffffffff82630aee>] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288
 [<ffffffff825f7c97>] do_ipv6_setsockopt.isra.4+0xd07/0x2d50 net/ipv6/ipv6_sockglue.c:202
 [<ffffffff825f9ef9>] compat_ipv6_setsockopt+0xe9/0x1d0 net/ipv6/ipv6_sockglue.c:935
 [<ffffffff8260e3ea>] compat_udpv6_setsockopt+0x4a/0x90 net/ipv6/udp.c:1446
 [<ffffffff821d6984>] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2670
 [<ffffffff822a4ff9>] C_SYSC_setsockopt net/compat.c:385 [inline]
 [<ffffffff822a4ff9>] compat_SyS_setsockopt+0x169/0x700 net/compat.c:368
 [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
 [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
 [<ffffffff82713b50>] sysenter_flags_fixed+0xd/0x1a
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=96 sclass=netlink_route_socket
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=96 sclass=netlink_route_socket