======================================================
WARNING: possible circular locking dependency detected
4.17.0-rc2+ #25 Not tainted
------------------------------------------------------
syz-executor5/6631 is trying to acquire lock:
        (ptrval) (&mm->mmap_sem){++++}, at: __might_fault+0xfb/0x1e0 mm/memory.c:4554

but task is already holding lock:
        (ptrval) (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1469 [inline]
        (ptrval) (sk_lock-AF_INET6){+.+.}, at: do_ipv6_setsockopt.isra.9+0x5ba/0x4680 net/ipv6/ipv6_sockglue.c:167

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (sk_lock-AF_INET6){+.+.}:
       lock_sock_nested+0xd0/0x120 net/core/sock.c:2844
       lock_sock include/net/sock.h:1469 [inline]
       tcp_mmap+0x1c7/0x14f0 net/ipv4/tcp.c:1759
       sock_mmap+0x8e/0xc0 net/socket.c:1144
       call_mmap include/linux/fs.h:1789 [inline]
       mmap_region+0xd13/0x1820 mm/mmap.c:1723
       do_mmap+0xc79/0x11d0 mm/mmap.c:1494
       do_mmap_pgoff include/linux/mm.h:2237 [inline]
       vm_mmap_pgoff+0x1fb/0x2a0 mm/util.c:357
       ksys_mmap_pgoff+0x4c9/0x640 mm/mmap.c:1544
       __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
       __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]
       __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91
       do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (&mm->mmap_sem){++++}:
       lock_acquire+0x1dc/0x520 kernel/locking/lockdep.c:3920
       __might_fault+0x155/0x1e0 mm/memory.c:4555
       _copy_from_user+0x30/0x150 lib/usercopy.c:10
       copy_from_user include/linux/uaccess.h:147 [inline]
       ipv6_flowlabel_opt+0x258/0x3310 net/ipv6/ip6_flowlabel.c:529
       do_ipv6_setsockopt.isra.9+0xb81/0x4680 net/ipv6/ipv6_sockglue.c:803
       ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:922
       udpv6_setsockopt+0x62/0xa0 net/ipv6/udp.c:1445
       sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3042
       __sys_setsockopt+0x1bd/0x390 net/socket.c:1903
       __do_sys_setsockopt net/socket.c:1914 [inline]
       __se_sys_setsockopt net/socket.c:1911 [inline]
       __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911
       do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(sk_lock-AF_INET6);
                               lock(&mm->mmap_sem);
                               lock(sk_lock-AF_INET6);
  lock(&mm->mmap_sem);

 *** DEADLOCK ***

1 lock held by syz-executor5/6631:
 #0:         (ptrval) (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1469 [inline]
 #0:         (ptrval) (sk_lock-AF_INET6){+.+.}, at: do_ipv6_setsockopt.isra.9+0x5ba/0x4680 net/ipv6/ipv6_sockglue.c:167

stack backtrace:
CPU: 0 PID: 6631 Comm: syz-executor5 Not tainted 4.17.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 print_circular_bug.isra.36.cold.54+0x1bd/0x27d kernel/locking/lockdep.c:1223
 check_prev_add kernel/locking/lockdep.c:1863 [inline]
 check_prevs_add kernel/locking/lockdep.c:1976 [inline]
 validate_chain kernel/locking/lockdep.c:2417 [inline]
 __lock_acquire+0x343e/0x5140 kernel/locking/lockdep.c:3431
 lock_acquire+0x1dc/0x520 kernel/locking/lockdep.c:3920
 __might_fault+0x155/0x1e0 mm/memory.c:4555
 _copy_from_user+0x30/0x150 lib/usercopy.c:10
 copy_from_user include/linux/uaccess.h:147 [inline]
 ipv6_flowlabel_opt+0x258/0x3310 net/ipv6/ip6_flowlabel.c:529
 do_ipv6_setsockopt.isra.9+0xb81/0x4680 net/ipv6/ipv6_sockglue.c:803
 ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:922
 udpv6_setsockopt+0x62/0xa0 net/ipv6/udp.c:1445
 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3042
 __sys_setsockopt+0x1bd/0x390 net/socket.c:1903
 __do_sys_setsockopt net/socket.c:1914 [inline]
 __se_sys_setsockopt net/socket.c:1911 [inline]
 __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455979
RSP: 002b:00007f1206933c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007f12069346d4 RCX: 0000000000455979
RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 0000000000000020 R09: 0000000000000000
R10: 0000000020f68000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000593 R14: 00000000006fc668 R15: 0000000000000000
syz-executor2 uses obsolete (PF_INET,SOCK_PACKET)
IPVS: ftp: loaded support on port[0] = 21
netlink: 'syz-executor2': attribute type 25 has an invalid length.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'.
IPVS: ftp: loaded support on port[0] = 21
kernel msg: ebtables bug: please report to author: Wrong len argument
kernel msg: ebtables bug: please report to author: Wrong len argument
netlink: 'syz-executor0': attribute type 26 has an invalid length.
kernel msg: ebtables bug: please report to author: counter_offset != totalcnt
netlink: 'syz-executor0': attribute type 26 has an invalid length.
kernel msg: ebtables bug: please report to author: counter_offset != totalcnt
netlink: 4 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor2'.
IPVS: set_ctl: invalid protocol: 60 0.0.0.1:20000 nq
IPVS: set_ctl: invalid protocol: 60 0.0.0.1:20000 nq
kernel msg: ebtables bug: please report to author: Wrong len argument
kernel msg: ebtables bug: please report to author: Wrong len argument
syz-executor6 (6969) used greatest stack depth: 12712 bytes left
ieee80211 phy2: Selected rate control algorithm 'minstrel_ht'
device lo entered promiscuous mode
sctp: [Deprecated]: syz-executor4 (pid 7015) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
device lo left promiscuous mode
sctp: [Deprecated]: syz-executor4 (pid 7039) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
ieee80211 phy3: Selected rate control algorithm 'minstrel_ht'
device lo entered promiscuous mode
netlink: 3760 bytes leftover after parsing attributes in process `syz-executor0'.
ieee80211 phy4: Selected rate control algorithm 'minstrel_ht'
netlink: 3760 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 3760 bytes leftover after parsing attributes in process `syz-executor0'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 1 PID: 7115 Comm: syz-executor7 Not tainted 4.17.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold.4+0xa/0x1a lib/fault-inject.c:149
 __should_failslab+0x124/0x180 mm/failslab.c:32
 should_failslab+0x9/0x14 mm/slab_common.c:1522
 slab_pre_alloc_hook mm/slab.h:423 [inline]
 slab_alloc mm/slab.c:3378 [inline]
 kmem_cache_alloc+0x2af/0x760 mm/slab.c:3552
 __split_vma+0x11a/0x7f0 mm/mmap.c:2582
 do_munmap+0x2fe/0xf90 mm/mmap.c:2696
 mmap_region+0x658/0x1820 mm/mmap.c:1664
 do_mmap+0xc79/0x11d0 mm/mmap.c:1494
 do_mmap_pgoff include/linux/mm.h:2237 [inline]
 vm_mmap_pgoff+0x1fb/0x2a0 mm/util.c:357
 ksys_mmap_pgoff+0x4c9/0x640 mm/mmap.c:1544
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]
 __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455979
RSP: 002b:00007f36a01a1c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f36a01a26d4 RCX: 0000000000455979
RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffe000
RBP: 000000000072bea0 R08: 0000000000000013 R09: 0000000000000000
R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000014
R13: 000000000000043a R14: 00000000006fa610 R15: 0000000000000000
netlink: 3760 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 3760 bytes leftover after parsing attributes in process `syz-executor0'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 7167 Comm: syz-executor7 Not tainted 4.17.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold.4+0xa/0x1a lib/fault-inject.c:149
 __should_failslab+0x124/0x180 mm/failslab.c:32
 should_failslab+0x9/0x14 mm/slab_common.c:1522
 slab_pre_alloc_hook mm/slab.h:423 [inline]
 slab_alloc mm/slab.c:3378 [inline]
 kmem_cache_alloc+0x2af/0x760 mm/slab.c:3552
 kmem_cache_zalloc include/linux/slab.h:691 [inline]
 mmap_region+0x9a6/0x1820 mm/mmap.c:1691
 do_mmap+0xc79/0x11d0 mm/mmap.c:1494
 do_mmap_pgoff include/linux/mm.h:2237 [inline]
 vm_mmap_pgoff+0x1fb/0x2a0 mm/util.c:357
 ksys_mmap_pgoff+0x4c9/0x640 mm/mmap.c:1544
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]
 __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455979
RSP: 002b:00007f36a01a1c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f36a01a26d4 RCX: 0000000000455979
RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffe000
RBP: 000000000072bea0 R08: 0000000000000013 R09: 0000000000000000
R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000014
R13: 000000000000043a R14: 00000000006fa610 R15: 0000000000000001
netlink: 3760 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 3760 bytes leftover after parsing attributes in process `syz-executor0'.
TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor3'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 7412 Comm: syz-executor0 Not tainted 4.17.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
IPVS: length: 131 != 24
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold.4+0xa/0x1a lib/fault-inject.c:149
IPVS: length: 131 != 24
 __should_failslab+0x124/0x180 mm/failslab.c:32
 should_failslab+0x9/0x14 mm/slab_common.c:1522
 slab_pre_alloc_hook mm/slab.h:423 [inline]
 slab_alloc_node mm/slab.c:3299 [inline]
 kmem_cache_alloc_node+0x272/0x780 mm/slab.c:3642
 __alloc_skb+0x111/0x780 net/core/skbuff.c:193
 alloc_skb include/linux/skbuff.h:989 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
 netlink_sendmsg+0xb01/0xfa0 net/netlink/af_netlink.c:1876
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:639
 ___sys_sendmsg+0x805/0x940 net/socket.c:2117
 __sys_sendmsg+0x115/0x270 net/socket.c:2155
 __do_sys_sendmsg net/socket.c:2164 [inline]
 __se_sys_sendmsg net/socket.c:2162 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2162
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455979
RSP: 002b:00007fb40b40ec68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fb40b40f6d4 RCX: 0000000000455979
RDX: 0000000000000000 RSI: 0000000020001780 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014
R13: 000000000000053e R14: 00000000006fbe70 R15: 0000000000000000