======================================================
WARNING: possible circular locking dependency detected
4.15.0+ #287 Not tainted
------------------------------------------------------
syz-executor5/5353 is trying to acquire lock:
(sk_lock-AF_INET6){+.+.}, at: [<00000000acb8bcf0>] lock_sock include/net/sock.h:1459 [inline]
(sk_lock-AF_INET6){+.+.}, at: [<00000000acb8bcf0>] do_ipv6_setsockopt.isra.8+0x3c5/0x39d0 net/ipv6/ipv6_sockglue.c:167
but task is already holding lock:
(rtnl_mutex){+.+.}, at: [<00000000534ad75a>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:72
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (rtnl_mutex){+.+.}:
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
rtnl_lock+0x17/0x20 net/core/rtnetlink.c:72
unregister_netdevice_notifier+0x91/0x4e0 net/core/dev.c:1656
tee_tg_destroy+0x61/0xc0 net/netfilter/xt_TEE.c:123
cleanup_entry+0x218/0x350 net/ipv4/netfilter/ip_tables.c:654
__do_replace+0x7d7/0xa90 net/ipv4/netfilter/ip_tables.c:1091
do_replace net/ipv4/netfilter/ip_tables.c:1147 [inline]
do_ipt_set_ctl+0x40f/0x5f0 net/ipv4/netfilter/ip_tables.c:1677
nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115
ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1256
sctp_setsockopt+0x2a0/0x5de0 net/sctp/socket.c:4074
sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968
SYSC_setsockopt net/socket.c:1831 [inline]
SyS_setsockopt+0x189/0x360 net/socket.c:1810
entry_SYSCALL_64_fastpath+0x29/0xa0
-> #1 (&xt[i].mutex){+.+.}:
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
xt_find_table_lock+0x40/0x3d0 net/netfilter/x_tables.c:1036
get_info+0x154/0x790 net/ipv6/netfilter/ip6_tables.c:989
do_ip6t_get_ctl+0x159/0xaf0 net/ipv6/netfilter/ip6_tables.c:1712
nf_sockopt net/netfilter/nf_sockopt.c:104 [inline]
nf_getsockopt+0x6a/0xc0 net/netfilter/nf_sockopt.c:122
ipv6_getsockopt+0x1df/0x2e0 net/ipv6/ipv6_sockglue.c:1378
tcp_getsockopt+0x82/0xd0 net/ipv4/tcp.c:3329
sock_common_getsockopt+0x95/0xd0 net/core/sock.c:2927
SYSC_getsockopt net/socket.c:1862 [inline]
SyS_getsockopt+0x178/0x340 net/socket.c:1844
entry_SYSCALL_64_fastpath+0x29/0xa0
-> #0 (sk_lock-AF_INET6){+.+.}:
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
lock_sock_nested+0xc2/0x110 net/core/sock.c:2770
lock_sock include/net/sock.h:1459 [inline]
do_ipv6_setsockopt.isra.8+0x3c5/0x39d0 net/ipv6/ipv6_sockglue.c:167
ipv6_setsockopt+0xd7/0x150 net/ipv6/ipv6_sockglue.c:922
udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452
sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968
SYSC_setsockopt net/socket.c:1831 [inline]
SyS_setsockopt+0x189/0x360 net/socket.c:1810
entry_SYSCALL_64_fastpath+0x29/0xa0
other info that might help us debug this:
Chain exists of:
sk_lock-AF_INET6 --> &xt[i].mutex --> rtnl_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(rtnl_mutex);
lock(&xt[i].mutex);
lock(rtnl_mutex);
lock(sk_lock-AF_INET6);
*** DEADLOCK ***
1 lock held by syz-executor5/5353:
#0: (rtnl_mutex){+.+.}, at: [<00000000534ad75a>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:72
stack backtrace:
CPU: 1 PID: 5353 Comm: syz-executor5 Not tainted 4.15.0+ #287
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
print_circular_bug.isra.38+0x2cd/0x2dc kernel/locking/lockdep.c:1223
check_prev_add kernel/locking/lockdep.c:1863 [inline]
check_prevs_add kernel/locking/lockdep.c:1976 [inline]
validate_chain kernel/locking/lockdep.c:2417 [inline]
__lock_acquire+0x30a8/0x3e00 kernel/locking/lockdep.c:3431
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
lock_sock_nested+0xc2/0x110 net/core/sock.c:2770
lock_sock include/net/sock.h:1459 [inline]
do_ipv6_setsockopt.isra.8+0x3c5/0x39d0 net/ipv6/ipv6_sockglue.c:167
ipv6_setsockopt+0xd7/0x150 net/ipv6/ipv6_sockglue.c:922
udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452
sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968
SYSC_setsockopt net/socket.c:1831 [inline]
SyS_setsockopt+0x189/0x360 net/socket.c:1810
entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x453299
RSP: 002b:00007fb4981f2c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299
RDX: 0000000000000001 RSI: 0000000000000029 RDI: 0000000000000014
RBP: 000000000000005a R08: 0000000000000004 R09: 0000000000000000
R10: 0000000020e10ffc R11: 0000000000000212 R12: 00000000006ef910
R13: 00000000ffffffff R14: 00007fb4981f36d4 R15: 0000000000000000
can: request_module (can-proto-0) failed.
kvm [5484]: vcpu0, guest rIP: 0xfff0 Hyper-V uhandled wrmsr: 0x40000020 data 0x9
kvm [5484]: vcpu0, guest rIP: 0xfff0 Hyper-V uhandled wrmsr: 0x40000020 data 0x9
can: request_module (can-proto-0) failed.
kauditd_printk_skb: 11 callbacks suppressed
audit: type=1400 audit(1517368015.163:37): avc: denied { ipc_owner } for pid=5506 comm="syz-executor2" capability=15 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
QAT: Invalid ioctl