vxcan0: j1939_tp_txtimer: 0xffff888075e7c400: tx aborted with unknown reason: -2
======================================================
WARNING: possible circular locking dependency detected
5.19.0-rc6-syzkaller-00104-g72a8e05d4f66 #0 Not tainted
------------------------------------------------------
ksoftirqd/0/15 is trying to acquire lock:
ffff88801c1c10d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline]
ffff88801c1c10d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: j1939_sk_errqueue+0x9f/0x1a0 net/can/j1939/socket.c:1078

but task is already holding lock:
ffff88801c1c1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline]
ffff88801c1c1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
ffff88801c1c1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_cancel+0x40/0x1eb net/can/j1939/transport.c:1130

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&priv->active_session_list_lock){+.-.}-{2:2}:
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:178
       spin_lock_bh include/linux/spinlock.h:354 [inline]
       j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
       j1939_session_activate+0x43/0x4b0 net/can/j1939/transport.c:1553
       j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
       j1939_sk_queue_activate_next+0x29b/0x460 net/can/j1939/socket.c:205
       j1939_session_deactivate_activate_next net/can/j1939/transport.c:1101 [inline]
       j1939_session_completed+0x19a/0x1f0 net/can/j1939/transport.c:1214
       j1939_xtp_rx_eoma_one net/can/j1939/transport.c:1384 [inline]
       j1939_xtp_rx_eoma+0x2a6/0x5f0 net/can/j1939/transport.c:1399
       j1939_tp_cmd_recv net/can/j1939/transport.c:2088 [inline]
       j1939_tp_recv+0x930/0xcb0 net/can/j1939/transport.c:2133
       j1939_can_recv+0x6ff/0x9a0 net/can/j1939/main.c:108
       deliver net/can/af_can.c:574 [inline]
       can_rcv_filter+0x5d4/0x8d0 net/can/af_can.c:608
       can_receive+0x31d/0x580 net/can/af_can.c:665
       can_rcv+0x120/0x1c0 net/can/af_can.c:696
       __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5480
       __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5594
       process_backlog+0x3a0/0x7c0 net/core/dev.c:5922
       __napi_poll+0xb3/0x6e0 net/core/dev.c:6488
       napi_poll net/core/dev.c:6555 [inline]
       net_rx_action+0x9c1/0xd90 net/core/dev.c:6666
       __do_softirq+0x29b/0x9c2 kernel/softirq.c:571
       run_ksoftirqd kernel/softirq.c:934 [inline]
       run_ksoftirqd+0x2d/0x60 kernel/softirq.c:926
       smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
       kthread+0x2e9/0x3a0 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

-> #1 (&jsk->sk_session_queue_lock){+.-.}-{2:2}:
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:178
       spin_lock_bh include/linux/spinlock.h:354 [inline]
       j1939_sk_queue_drop_all+0x40/0x2f0 net/can/j1939/socket.c:139
       j1939_sk_netdev_event_netdown+0x7b/0x160 net/can/j1939/socket.c:1272
       j1939_netdev_notify+0x199/0x1d0 net/can/j1939/main.c:372
       notifier_call_chain+0xb5/0x200 kernel/notifier.c:87
       call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945
       call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]
       call_netdevice_notifiers net/core/dev.c:1997 [inline]
       __dev_notify_flags+0x1da/0x2b0 net/core/dev.c:8573
       dev_change_flags+0x112/0x170 net/core/dev.c:8609
       do_setlink+0x961/0x3bb0 net/core/rtnetlink.c:2780
       __rtnl_newlink+0xd6a/0x17e0 net/core/rtnetlink.c:3546
       rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3593
       rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089
       netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
       netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
       netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
       netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
       sock_sendmsg_nosec net/socket.c:714 [inline]
       sock_sendmsg+0xcf/0x120 net/socket.c:734
       ____sys_sendmsg+0x6eb/0x810 net/socket.c:2488
       ___sys_sendmsg+0xf3/0x170 net/socket.c:2542
       __sys_sendmsg net/socket.c:2571 [inline]
       __do_sys_sendmsg net/socket.c:2580 [inline]
       __se_sys_sendmsg net/socket.c:2578 [inline]
       __x64_sys_sendmsg+0x132/0x220 net/socket.c:2578
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #0 (&priv->j1939_socks_lock){+.-.}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3095 [inline]
       check_prevs_add kernel/locking/lockdep.c:3214 [inline]
       validate_chain kernel/locking/lockdep.c:3829 [inline]
       __lock_acquire+0x2abe/0x5660 kernel/locking/lockdep.c:5053
       lock_acquire kernel/locking/lockdep.c:5665 [inline]
       lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:178
       spin_lock_bh include/linux/spinlock.h:354 [inline]
       j1939_sk_errqueue+0x9f/0x1a0 net/can/j1939/socket.c:1078
       __j1939_session_cancel+0x3b9/0x460 net/can/j1939/transport.c:1124
       j1939_session_cancel+0x1b1/0x1eb net/can/j1939/transport.c:1135
       j1939_tp_txtimer.cold+0x341/0x3b9 net/can/j1939/transport.c:1190
       __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
       __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
       hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766
       __do_softirq+0x29b/0x9c2 kernel/softirq.c:571
       run_ksoftirqd kernel/softirq.c:934 [inline]
       run_ksoftirqd+0x2d/0x60 kernel/softirq.c:926
       smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
       kthread+0x2e9/0x3a0 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

other info that might help us debug this:

Chain exists of:
  &priv->j1939_socks_lock --> &jsk->sk_session_queue_lock --> &priv->active_session_list_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&priv->active_session_list_lock);
                               lock(&jsk->sk_session_queue_lock);
                               lock(&priv->active_session_list_lock);
  lock(&priv->j1939_socks_lock);

 *** DEADLOCK ***

1 lock held by ksoftirqd/0/15:
 #0: ffff88801c1c1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:354 [inline]
 #0: ffff88801c1c1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
 #0: ffff88801c1c1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_cancel+0x40/0x1eb net/can/j1939/transport.c:1130

stack backtrace:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 5.19.0-rc6-syzkaller-00104-g72a8e05d4f66 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2175
 check_prev_add kernel/locking/lockdep.c:3095 [inline]
 check_prevs_add kernel/locking/lockdep.c:3214 [inline]
 validate_chain kernel/locking/lockdep.c:3829 [inline]
 __lock_acquire+0x2abe/0x5660 kernel/locking/lockdep.c:5053
 lock_acquire kernel/locking/lockdep.c:5665 [inline]
 lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
 _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:354 [inline]
 j1939_sk_errqueue+0x9f/0x1a0 net/can/j1939/socket.c:1078
 __j1939_session_cancel+0x3b9/0x460 net/can/j1939/transport.c:1124
 j1939_session_cancel+0x1b1/0x1eb net/can/j1939/transport.c:1135
 j1939_tp_txtimer.cold+0x341/0x3b9 net/can/j1939/transport.c:1190
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571
 run_ksoftirqd kernel/softirq.c:934 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:926
 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
vxcan0: j1939_tp_rxtimer: 0xffff888075e7c400: abort rx timeout. Force session deactivation
vxcan0: j1939_xtp_rx_abort_one: 0xffff88807d569000: 0x00000: (250) Any other reason (if a Connection Abort reason is identified that is not listed in the table use code 250)
vxcan0: j1939_xtp_rx_abort_one: 0xffff88807d56a000: 0x00000: (250) Any other reason (if a Connection Abort reason is identified that is not listed in the table use code 250)
vxcan0: j1939_xtp_rx_abort_one: 0xffff888011a32c00: 0x00000: (250) Any other reason (if a Connection Abort reason is identified that is not listed in the table use code 250)
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3594 at net/can/j1939/transport.c:1090 j1939_session_deactivate net/can/j1939/transport.c:1090 [inline]
WARNING: CPU: 0 PID: 3594 at net/can/j1939/transport.c:1090 j1939_session_deactivate_activate_next+0x95/0xd3 net/can/j1939/transport.c:1100
Modules linked in:
CPU: 0 PID: 3594 Comm: sshd Not tainted 5.19.0-rc6-syzkaller-00104-g72a8e05d4f66 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
RIP: 0010:j1939_session_deactivate net/can/j1939/transport.c:1090 [inline]
RIP: 0010:j1939_session_deactivate_activate_next+0x95/0xd3 net/can/j1939/transport.c:1100
Code: 03 38 d0 7c 0c 84 d2 74 08 4c 89 ef e8 be aa 52 f8 8b 5d 28 bf 01 00 00 00 89 de e8 1f ec 05 f8 83 fb 01 77 07 e8 d5 ef 05 f8 <0f> 0b e8 ce ef 05 f8 48 89 ef e8 46 7d db fe 4c 89 e7 89 c3 e8 cc
RSP: 0018:ffffc90000007ad0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff88801d9b3b00 RSI: ffffffff89747aab RDI: 0000000000000005
RBP: ffff888011a32c00 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000001 R11: 203a306e61637876 R12: ffff88801bfd1070
R13: ffff888011a32c28 R14: ffff88801fc9bc18 R15: ffffffff8ae87b20
FS:  00007f65c4891800(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c01769c000 CR3: 000000007425f000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 j1939_xtp_rx_abort_one.cold+0x20b/0x33c net/can/j1939/transport.c:1340
 j1939_xtp_rx_abort net/can/j1939/transport.c:1351 [inline]
 j1939_tp_cmd_recv net/can/j1939/transport.c:2103 [inline]
 j1939_tp_recv+0x61f/0xcb0 net/can/j1939/transport.c:2133
 j1939_can_recv+0x6ff/0x9a0 net/can/j1939/main.c:108
 deliver net/can/af_can.c:574 [inline]
 can_rcv_filter+0x5d4/0x8d0 net/can/af_can.c:608
 can_receive+0x31d/0x580 net/can/af_can.c:665
 can_rcv+0x120/0x1c0 net/can/af_can.c:696
 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5480
 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5594
 process_backlog+0x3a0/0x7c0 net/core/dev.c:5922
 __napi_poll+0xb3/0x6e0 net/core/dev.c:6488
 napi_poll net/core/dev.c:6555 [inline]
 net_rx_action+0x9c1/0xd90 net/core/dev.c:6666
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571
 do_softirq.part.0+0xde/0x130 kernel/softirq.c:472
 </IRQ>
 <TASK>
 do_softirq kernel/softirq.c:464 [inline]
 __local_bh_enable_ip+0x102/0x120 kernel/softirq.c:396
 spin_unlock_bh include/linux/spinlock.h:394 [inline]
 nf_conntrack_tcp_packet+0x1183/0x56d0 net/netfilter/nf_conntrack_proto_tcp.c:1138
 nf_conntrack_handle_packet net/netfilter/nf_conntrack_core.c:1911 [inline]
 nf_conntrack_in+0x370/0x1790 net/netfilter/nf_conntrack_core.c:2002
 ipv4_conntrack_local+0x113/0x260 net/netfilter/nf_conntrack_proto.c:213
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_slow+0xc5/0x1f0 net/netfilter/core.c:620
 nf_hook+0x1cb/0x5b0 include/linux/netfilter.h:262
 __ip_local_out+0x262/0x520 net/ipv4/ip_output.c:115
 ip_local_out net/ipv4/ip_output.c:124 [inline]
 __ip_queue_xmit+0x853/0x1be0 net/ipv4/ip_output.c:532
 __tcp_transmit_skb+0x190e/0x38c0 net/ipv4/tcp_output.c:1405
 tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
 tcp_write_xmit+0xd92/0x60e0 net/ipv4/tcp_output.c:2693
 __tcp_push_pending_frames+0xaa/0x390 net/ipv4/tcp_output.c:2877
 tcp_push+0x499/0x720 net/ipv4/tcp.c:726
 tcp_sendmsg_locked+0x2168/0x2fc0 net/ipv4/tcp.c:1420
 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1448
 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:734
 sock_write_iter+0x284/0x3c0 net/socket.c:1108
 call_write_iter include/linux/fs.h:2058 [inline]
 new_sync_write+0x38a/0x560 fs/read_write.c:504
 vfs_write+0x7c0/0xac0 fs/read_write.c:591
 ksys_write+0x1e8/0x250 fs/read_write.c:644
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f65c44629a3
Code: 8b 15 d9 f4 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
RSP: 002b:00007ffe4cedbb68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000001eec RCX: 00007f65c44629a3
RDX: 0000000000001eec RSI: 0000557c56e9a170 RDI: 0000000000000004
RBP: 0000557c56e6b8b0 R08: 0000000000000000 R09: 00007ffe4cf7d080
R10: 00007ffe4cf7d0f0 R11: 0000000000000246 R12: 0000000000000004
R13: 0000000000000001 R14: 00007ffe4cedbbd8 R15: 00007ffe4cedbc58
 </TASK>