vcan0: j1939_xtp_rx_abort_one: 0xffff888022062400: 0x00000: (5) Maximal retransmit request limit reached
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3605 at net/can/j1939/transport.c:1090 j1939_session_deactivate net/can/j1939/transport.c:1090 [inline]
WARNING: CPU: 0 PID: 3605 at net/can/j1939/transport.c:1090 j1939_session_deactivate_activate_next+0x95/0xd3 net/can/j1939/transport.c:1100
Modules linked in:
CPU: 0 PID: 3605 Comm: sshd Not tainted 5.19.0-rc6-syzkaller-00026-g5a29232d870d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
RIP: 0010:j1939_session_deactivate net/can/j1939/transport.c:1090 [inline]
RIP: 0010:j1939_session_deactivate_activate_next+0x95/0xd3 net/can/j1939/transport.c:1100
Code: 03 38 d0 7c 0c 84 d2 74 08 4c 89 ef e8 bb 8e 51 f8 8b 5d 28 bf 01 00 00 00 89 de e8 9c 70 05 f8 83 fb 01 77 07 e8 52 74 05 f8 <0f> 0b e8 4b 74 05 f8 48 89 ef e8 93 6b db fe 4c 89 e7 89 c3 e8 39
RSP: 0018:ffffc90000007ad0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff888017f70140 RSI: ffffffff8974263e RDI: 0000000000000005
RBP: ffff888022062400 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888023175070
R13: ffff888022062428 R14: ffff8880207a5c18 R15: ffffffff8ae83de0
FS: 00007f56ad09f800(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555a305d0 CR3: 0000000078948000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
j1939_xtp_rx_abort_one.cold+0x20b/0x33c net/can/j1939/transport.c:1340
j1939_xtp_rx_abort net/can/j1939/transport.c:1351 [inline]
j1939_tp_cmd_recv net/can/j1939/transport.c:2100 [inline]
j1939_tp_recv+0xb28/0xcb0 net/can/j1939/transport.c:2133
j1939_can_recv+0x6ff/0x9a0 net/can/j1939/main.c:108
deliver net/can/af_can.c:574 [inline]
can_rcv_filter+0x5d4/0x8d0 net/can/af_can.c:608
can_receive+0x31d/0x580 net/can/af_can.c:665
can_rcv+0x120/0x1c0 net/can/af_can.c:696
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5480
__netif_receive_skb+0x24/0x1b0 net/core/dev.c:5594
process_backlog+0x3a0/0x7c0 net/core/dev.c:5922
__napi_poll+0xb3/0x6e0 net/core/dev.c:6488
napi_poll net/core/dev.c:6555 [inline]
net_rx_action+0x9c1/0xd90 net/core/dev.c:6666
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
do_softirq.part.0+0xde/0x130 kernel/softirq.c:472
do_softirq kernel/softirq.c:464 [inline]
__local_bh_enable_ip+0x102/0x120 kernel/softirq.c:396
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:765 [inline]
ip_finish_output2+0x7d0/0x2170 net/ipv4/ip_output.c:229
__ip_finish_output net/ipv4/ip_output.c:306 [inline]
__ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288
ip_finish_output+0x32/0x280 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip_output+0x19f/0x310 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:451 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
__ip_queue_xmit+0x8de/0x1be0 net/ipv4/ip_output.c:532
__tcp_transmit_skb+0x190e/0x38c0 net/ipv4/tcp_output.c:1405
tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
tcp_write_xmit+0xd92/0x60e0 net/ipv4/tcp_output.c:2693
__tcp_push_pending_frames+0xaa/0x390 net/ipv4/tcp_output.c:2877
tcp_push+0x499/0x720 net/ipv4/tcp.c:726
tcp_sendmsg_locked+0x216e/0x2fd0 net/ipv4/tcp.c:1420
tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1448
inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
sock_write_iter+0x284/0x3c0 net/socket.c:1108
call_write_iter include/linux/fs.h:2058 [inline]
new_sync_write+0x38a/0x560 fs/read_write.c:504
vfs_write+0x7c0/0xac0 fs/read_write.c:591
ksys_write+0x1e8/0x250 fs/read_write.c:644
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f56acd259a3
================================
WARNING: inconsistent lock state
5.19.0-rc6-syzkaller-00026-g5a29232d870d #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
sshd/3605 [HC0[0]:SC1[3]:HE1:SE0] takes:
ffffffff8beb2fd8 (vmap_area_lock){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
ffffffff8beb2fd8 (vmap_area_lock){+.?.}-{2:2}, at: find_vmap_area+0x1c/0x130 mm/vmalloc.c:1805
{SOFTIRQ-ON-W} state was registered at:
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
alloc_vmap_area+0xa49/0x1f00 mm/vmalloc.c:1586
__get_vm_area_node+0x142/0x3f0 mm/vmalloc.c:2453
__vmalloc_node_range+0x250/0x13e0 mm/vmalloc.c:3125
__vmalloc_node mm/vmalloc.c:3230 [inline]
__vmalloc+0x69/0x80 mm/vmalloc.c:3244
pcpu_mem_zalloc mm/percpu.c:516 [inline]
pcpu_mem_zalloc+0x51/0xa0 mm/percpu.c:508
pcpu_alloc_chunk mm/percpu.c:1454 [inline]
pcpu_create_chunk+0xd7/0x930 mm/percpu-vm.c:338
pcpu_alloc+0x1012/0x13d0 mm/percpu.c:1834
alloc_kmem_cache_cpus.constprop.0+0x29/0xc0 mm/slab.c:1729
do_tune_cpucache+0x37/0x230 mm/slab.c:3844
enable_cpucache+0x3c/0xa0 mm/slab.c:3938
kmem_cache_init_late+0x33/0x66 mm/slab.c:1276
start_kernel+0x2f5/0x48f init/main.c:1058
secondary_startup_64_no_verify+0xce/0xdb
irq event stamp: 2390888
hardirqs last enabled at (2390888): [] __up_console_sem+0xae/0xc0 kernel/printk/printk.c:264
hardirqs last disabled at (2390887): [] __up_console_sem+0x93/0xc0 kernel/printk/printk.c:262
softirqs last enabled at (2389164): [] rcu_read_unlock_bh include/linux/rcupdate.h:761 [inline]
softirqs last enabled at (2389164): [] ip_finish_output2+0x7a2/0x2170 net/ipv4/ip_output.c:229
softirqs last disabled at (2389165): [] do_softirq.part.0+0xde/0x130 kernel/softirq.c:472
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(vmap_area_lock);
lock(vmap_area_lock);
*** DEADLOCK ***
5 locks held by sshd/3605:
#0: ffff88801c5501b0 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1677 [inline]
#0: ffff88801c5501b0 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x1d/0x40 net/ipv4/tcp.c:1447
#1: ffffffff8bd83ba0 (rcu_read_lock){....}-{1:2}, at: read_pnet include/net/net_namespace.h:361 [inline]
#1: ffffffff8bd83ba0 (rcu_read_lock){....}-{1:2}, at: sock_net include/net/sock.h:590 [inline]
#1: ffffffff8bd83ba0 (rcu_read_lock){....}-{1:2}, at: __ip_queue_xmit+0x3d/0x1be0 net/ipv4/ip_output.c:457
#2: ffffffff8bd83ba0 (rcu_read_lock){....}-{1:2}, at: __skb_unlink include/linux/skbuff.h:2469 [inline]
#2: ffffffff8bd83ba0 (rcu_read_lock){....}-{1:2}, at: __skb_dequeue include/linux/skbuff.h:2484 [inline]
#2: ffffffff8bd83ba0 (rcu_read_lock){....}-{1:2}, at: process_backlog+0x34b/0x7c0 net/core/dev.c:5920
#3: ffffffff8bd83ba0 (rcu_read_lock){....}-{1:2}, at: can_receive+0x1ef/0x580 net/can/af_can.c:655
#4: ffff888023175088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline]
#4: ffff888023175088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
#4: ffff888023175088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_deactivate net/can/j1939/transport.c:1086 [inline]
#4: ffff888023175088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_deactivate_activate_next+0x43/0xd3 net/can/j1939/transport.c:1100
stack backtrace:
CPU: 0 PID: 3605 Comm: sshd Not tainted 5.19.0-rc6-syzkaller-00026-g5a29232d870d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_usage_bug kernel/locking/lockdep.c:3961 [inline]
valid_state kernel/locking/lockdep.c:3973 [inline]
mark_lock_irq kernel/locking/lockdep.c:4176 [inline]
mark_lock.part.0.cold+0x18/0xd8 kernel/locking/lockdep.c:4632
mark_lock kernel/locking/lockdep.c:4596 [inline]
mark_usage kernel/locking/lockdep.c:4527 [inline]
__lock_acquire+0x11e7/0x5660 kernel/locking/lockdep.c:5007
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
find_vmap_area+0x1c/0x130 mm/vmalloc.c:1805
check_heap_object mm/usercopy.c:176 [inline]
__check_object_size mm/usercopy.c:250 [inline]
__check_object_size+0x1f8/0x700 mm/usercopy.c:212
check_object_size include/linux/thread_info.h:199 [inline]
__copy_from_user_inatomic include/linux/uaccess.h:62 [inline]
copy_from_user_nmi arch/x86/lib/usercopy.c:47 [inline]
copy_from_user_nmi+0xcb/0x130 arch/x86/lib/usercopy.c:31
copy_code arch/x86/kernel/dumpstack.c:91 [inline]
show_opcodes+0x59/0xb0 arch/x86/kernel/dumpstack.c:121
show_iret_regs+0xd/0x33 arch/x86/kernel/dumpstack.c:149
__show_regs+0x1e/0x60 arch/x86/kernel/process_64.c:74
show_trace_log_lvl+0x25b/0x2ba arch/x86/kernel/dumpstack.c:292
__warn+0xe2/0x190 kernel/panic.c:620
report_bug+0x1bc/0x210 lib/bug.c:198
handle_bug+0x3c/0x60 arch/x86/kernel/traps.c:316
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:336
asm_exc_invalid_op+0x1b/0x20 arch/x86/include/asm/idtentry.h:568
RIP: 0010:j1939_session_deactivate net/can/j1939/transport.c:1090 [inline]
RIP: 0010:j1939_session_deactivate_activate_next+0x95/0xd3 net/can/j1939/transport.c:1100
Code: 03 38 d0 7c 0c 84 d2 74 08 4c 89 ef e8 bb 8e 51 f8 8b 5d 28 bf 01 00 00 00 89 de e8 9c 70 05 f8 83 fb 01 77 07 e8 52 74 05 f8 <0f> 0b e8 4b 74 05 f8 48 89 ef e8 93 6b db fe 4c 89 e7 89 c3 e8 39
RSP: 0018:ffffc90000007ad0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff888017f70140 RSI: ffffffff8974263e RDI: 0000000000000005
RBP: ffff888022062400 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888023175070
R13: ffff888022062428 R14: ffff8880207a5c18 R15: ffffffff8ae83de0
j1939_xtp_rx_abort_one.cold+0x20b/0x33c net/can/j1939/transport.c:1340
j1939_xtp_rx_abort net/can/j1939/transport.c:1351 [inline]
j1939_tp_cmd_recv net/can/j1939/transport.c:2100 [inline]
j1939_tp_recv+0xb28/0xcb0 net/can/j1939/transport.c:2133
j1939_can_recv+0x6ff/0x9a0 net/can/j1939/main.c:108
deliver net/can/af_can.c:574 [inline]
can_rcv_filter+0x5d4/0x8d0 net/can/af_can.c:608
can_receive+0x31d/0x580 net/can/af_can.c:665
can_rcv+0x120/0x1c0 net/can/af_can.c:696
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5480
__netif_receive_skb+0x24/0x1b0 net/core/dev.c:5594
process_backlog+0x3a0/0x7c0 net/core/dev.c:5922
__napi_poll+0xb3/0x6e0 net/core/dev.c:6488
napi_poll net/core/dev.c:6555 [inline]
net_rx_action+0x9c1/0xd90 net/core/dev.c:6666
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
do_softirq.part.0+0xde/0x130 kernel/softirq.c:472
do_softirq kernel/softirq.c:464 [inline]
__local_bh_enable_ip+0x102/0x120 kernel/softirq.c:396
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:765 [inline]
ip_finish_output2+0x7d0/0x2170 net/ipv4/ip_output.c:229
__ip_finish_output net/ipv4/ip_output.c:306 [inline]
__ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288
ip_finish_output+0x32/0x280 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip_output+0x19f/0x310 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:451 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
__ip_queue_xmit+0x8de/0x1be0 net/ipv4/ip_output.c:532
__tcp_transmit_skb+0x190e/0x38c0 net/ipv4/tcp_output.c:1405
tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
tcp_write_xmit+0xd92/0x60e0 net/ipv4/tcp_output.c:2693
__tcp_push_pending_frames+0xaa/0x390 net/ipv4/tcp_output.c:2877
tcp_push+0x499/0x720 net/ipv4/tcp.c:726
tcp_sendmsg_locked+0x216e/0x2fd0 net/ipv4/tcp.c:1420
tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1448
inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
sock_write_iter+0x284/0x3c0 net/socket.c:1108
call_write_iter include/linux/fs.h:2058 [inline]
new_sync_write+0x38a/0x560 fs/read_write.c:504
vfs_write+0x7c0/0xac0 fs/read_write.c:591
ksys_write+0x1e8/0x250 fs/read_write.c:644
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f56acd259a3
Code: 8b 15 d9 f4 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
RSP: 002b:00007ffdc01548b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000054 RCX: 00007f56acd259a3
RDX: 0000000000000054 RSI: 000056392ed69570 RDI: 0000000000000004
RBP: 000056392ed54e00 R08: 0000000000000000 R09: 00007ffdc0168080
R10: 00007ffdc01680f0 R11: 0000000000000246 R12: 0000000000000004
R13: 0000000000000001 R14: 00007ffdc0154928 R15: 00007ffdc01549a8
Code: 8b 15 d9 f4 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
RSP: 002b:00007ffdc01548b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000054 RCX: 00007f56acd259a3
RDX: 0000000000000054 RSI: 000056392ed69570 RDI: 0000000000000004
RBP: 000056392ed54e00 R08: 0000000000000000 R09: 00007ffdc0168080
R10: 00007ffdc01680f0 R11: 0000000000000246 R12: 0000000000000004
R13: 0000000000000001 R14: 00007ffdc0154928 R15: 00007ffdc01549a8
----------------
Code disassembly (best guess):
0: 8b 15 d9 f4 0c 00 mov 0xcf4d9(%rip),%edx # 0xcf4df
6: f7 d8 neg %eax
8: 64 89 02 mov %eax,%fs:(%rdx)
b: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
12: eb b7 jmp 0xffffffcb
14: 0f 1f 00 nopl (%rax)
17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax
1e: 00
1f: 85 c0 test %eax,%eax
21: 75 14 jne 0x37
23: b8 01 00 00 00 mov $0x1,%eax
28: 0f 05 syscall
* 2a: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 55 ja 0x87
32: c3 retq
33: 0f 1f 40 00 nopl 0x0(%rax)
37: 48 83 ec 28 sub $0x28,%rsp
3b: 48 89 54 24 18 mov %rdx,0x18(%rsp)