IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 8021q: adding VLAN 0 to HW filter on device batadv0 audit: type=1400 audit(1559406269.108:38): avc: denied { associate } for pid=7781 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 ============================================ WARNING: possible recursive locking detected 4.19.47 #19 Not tainted -------------------------------------------- syz-executor.0/8271 is trying to acquire lock: 000000000277713c (_xmit_ETHER#2){+.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] 000000000277713c (_xmit_ETHER#2){+.-.}, at: __netif_tx_lock include/linux/netdevice.h:3798 [inline] 000000000277713c (_xmit_ETHER#2){+.-.}, at: sch_direct_xmit+0x2de/0xfa0 net/sched/sch_generic.c:325 but task is already holding lock: 000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] 000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: __netif_tx_lock include/linux/netdevice.h:3798 [inline] 000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: sch_direct_xmit+0x2de/0xfa0 net/sched/sch_generic.c:325 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(_xmit_ETHER#2); lock(_xmit_ETHER#2); *** DEADLOCK *** May be due to missing lock nesting notation 9 locks held by syz-executor.0/8271: #0: 00000000d16eb40f (rcu_read_lock_bh){....}, at: lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline] #0: 00000000d16eb40f (rcu_read_lock_bh){....}, at: ip_finish_output2+0x2b0/0x1760 net/ipv4/ip_output.c:213 #1: 00000000d16eb40f (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x214/0x3010 net/core/dev.c:3777 #2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at: spin_trylock include/linux/spinlock.h:339 [inline] #2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at: qdisc_run_begin include/net/sch_generic.h:130 [inline] #2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at: qdisc_run include/net/pkt_sched.h:119 [inline] #2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at: __dev_xmit_skb net/core/dev.c:3452 [inline] #2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at: __dev_queue_xmit+0x28cf/0x3010 net/core/dev.c:3811 #3: 00000000ff114ac1 (dev->qdisc_running_key ?: &qdisc_running_key){+...}, at: dev_queue_xmit+0x18/0x20 net/core/dev.c:3876 #4: 000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] #4: 000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: __netif_tx_lock include/linux/netdevice.h:3798 [inline] #4: 000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: sch_direct_xmit+0x2de/0xfa0 net/sched/sch_generic.c:325 #5: 00000000d16eb40f (rcu_read_lock_bh){....}, at: lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline] #5: 00000000d16eb40f (rcu_read_lock_bh){....}, at: ip_finish_output2+0x2b0/0x1760 net/ipv4/ip_output.c:213 #6: 00000000d16eb40f (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x214/0x3010 net/core/dev.c:3777 #7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at: spin_trylock include/linux/spinlock.h:339 [inline] #7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at: qdisc_run_begin include/net/sch_generic.h:130 [inline] #7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at: qdisc_run include/net/pkt_sched.h:119 [inline] #7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at: __dev_xmit_skb net/core/dev.c:3452 [inline] #7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at: __dev_queue_xmit+0x28cf/0x3010 net/core/dev.c:3811 #8: 000000002f6d49b4 (dev->qdisc_running_key ?: &qdisc_running_key){+...}, at: dev_queue_xmit+0x18/0x20 net/core/dev.c:3876 stack backtrace: CPU: 0 PID: 8271 Comm: syz-executor.0 Not tainted 4.19.47 #19 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_deadlock_bug kernel/locking/lockdep.c:1759 [inline] check_deadlock kernel/locking/lockdep.c:1803 [inline] validate_chain kernel/locking/lockdep.c:2399 [inline] __lock_acquire.cold+0x135/0x4a1 kernel/locking/lockdep.c:3411 lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] __netif_tx_lock include/linux/netdevice.h:3798 [inline] sch_direct_xmit+0x2de/0xfa0 net/sched/sch_generic.c:325 qdisc_restart net/sched/sch_generic.c:390 [inline] __qdisc_run+0x57f/0x1960 net/sched/sch_generic.c:398 qdisc_run include/net/pkt_sched.h:120 [inline] qdisc_run include/net/pkt_sched.h:117 [inline] __dev_xmit_skb net/core/dev.c:3452 [inline] __dev_queue_xmit+0x228d/0x3010 net/core/dev.c:3811 dev_queue_xmit+0x18/0x20 net/core/dev.c:3876 neigh_resolve_output net/core/neighbour.c:1366 [inline] neigh_resolve_output+0x5b7/0x980 net/core/neighbour.c:1346 neigh_output include/net/neighbour.h:501 [inline] ip_finish_output2+0x93d/0x1760 net/ipv4/ip_output.c:229 ip_do_fragment+0x933/0x2570 net/ipv4/ip_output.c:814 ip_fragment.constprop.0+0x176/0x240 net/ipv4/ip_output.c:550 ip_finish_output+0x5f8/0xd20 net/ipv4/ip_output.c:315 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip_mc_output+0x298/0xf70 net/ipv4/ip_output.c:390 dst_output include/net/dst.h:444 [inline] ip_local_out+0xbb/0x1b0 net/ipv4/ip_output.c:124 iptunnel_xmit+0x5c5/0x9b0 net/ipv4/ip_tunnel_core.c:91 ip_tunnel_xmit+0x1250/0x36ce net/ipv4/ip_tunnel.c:778 __gre_xmit+0x5e1/0x9a0 net/ipv4/ip_gre.c:450 erspan_xmit+0xa26/0x2b50 net/ipv4/ip_gre.c:759 __netdev_start_xmit include/linux/netdevice.h:4303 [inline] netdev_start_xmit include/linux/netdevice.h:4312 [inline] xmit_one net/core/dev.c:3257 [inline] dev_hard_start_xmit+0x1a5/0x980 net/core/dev.c:3273 sch_direct_xmit+0x370/0xfa0 net/sched/sch_generic.c:327 qdisc_restart net/sched/sch_generic.c:390 [inline] __qdisc_run+0x57f/0x1960 net/sched/sch_generic.c:398 qdisc_run include/net/pkt_sched.h:120 [inline] qdisc_run include/net/pkt_sched.h:117 [inline] __dev_xmit_skb net/core/dev.c:3452 [inline] __dev_queue_xmit+0x228d/0x3010 net/core/dev.c:3811 dev_queue_xmit+0x18/0x20 net/core/dev.c:3876 neigh_resolve_output net/core/neighbour.c:1366 [inline] neigh_resolve_output+0x5b7/0x980 net/core/neighbour.c:1346 neigh_output include/net/neighbour.h:501 [inline] ip_finish_output2+0x93d/0x1760 net/ipv4/ip_output.c:229 ip_do_fragment+0x1d8c/0x2570 net/ipv4/ip_output.c:679 ip_fragment.constprop.0+0x176/0x240 net/ipv4/ip_output.c:550 ip_finish_output+0x5f8/0xd20 net/ipv4/ip_output.c:315 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip_mc_output+0x298/0xf70 net/ipv4/ip_output.c:390 dst_output include/net/dst.h:444 [inline] ip_local_out+0xbb/0x1b0 net/ipv4/ip_output.c:124 ip_send_skb+0x42/0xf0 net/ipv4/ip_output.c:1442 udp_send_skb.isra.0+0x6bb/0x11f0 net/ipv4/udp.c:837 udp_sendmsg+0x1e07/0x25f0 net/ipv4/udp.c:1124 inet_sendmsg+0x141/0x5d0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:632 __sys_sendto+0x262/0x380 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1795 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459279 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f73bba6cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459279 RDX: 00000000000005aa RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000120 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f73bba6d6d4 R13: 00000000004c6d91 R14: 00000000004dbc28 R15: 00000000ffffffff syz-executor.0 (8271) used greatest stack depth: 22432 bytes left kobject: 'loop0' (0000000021632b4c): kobject_uevent_env kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop0' (0000000021632b4c): kobject_uevent_env kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop0' (0000000021632b4c): kobject_uevent_env kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path = '/devices/virtual/block/loop0' IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 NET: Registered protocol family 30 Failed to register TIPC socket type IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 list_add double add: new=ffffffff892e7630, prev=ffffffff890f3140, next=ffffffff892e7630. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:29! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8445 Comm: syz-executor.3 Not tainted 4.19.47 #19 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 kobject: 'loop0' (0000000021632b4c): kobject_uevent_env RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29 Code: 56 ff ff ff 4c 89 e1 48 c7 c7 a0 ae 81 87 e8 d0 f3 30 fe 0f 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 e0 af 81 87 e8 b9 f3 30 fe <0f> 0b 48 89 f1 48 c7 c7 60 af 81 87 4c 89 e6 e8 a5 f3 30 fe 0f 0b RSP: 0018:ffff88808791fb88 EFLAGS: 00010282 RAX: 0000000000000058 RBX: ffffffff892e74a0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81559f66 RDI: ffffed1010f23f63 RBP: ffff88808791fba0 R08: 0000000000000058 R09: ffffed1015d03ee3 kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path = '/devices/virtual/block/loop0' R10: ffffed1015d03ee2 R11: ffff8880ae81f717 R12: ffffffff892e7630 R13: ffffffff892e7630 R14: ffffffff892e7630 R15: ffffffff892e75d0 FS: 0000000001c8f940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000a75e58 CR3: 000000007f673000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_add include/linux/list.h:60 [inline] list_add include/linux/list.h:79 [inline] proto_register+0x459/0x8e0 net/core/sock.c:3299 tipc_socket_init+0x1c/0x70 net/tipc/socket.c:3157 tipc_init_net+0x2ed/0x570 net/tipc/core.c:69 ops_init+0xb3/0x410 net/core/net_namespace.c:129 setup_net+0x2d3/0x740 net/core/net_namespace.c:315 copy_net_ns+0x1df/0x340 net/core/net_namespace.c:438 create_new_namespaces+0x400/0x7b0 kernel/nsproxy.c:107 unshare_nsproxy_namespaces+0xc2/0x200 kernel/nsproxy.c:206 ksys_unshare+0x440/0x980 kernel/fork.c:2525 __do_sys_unshare kernel/fork.c:2593 [inline] __se_sys_unshare kernel/fork.c:2591 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:2591 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45bd47 Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 1d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 fd 8c fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffcc3d777f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 000000000075c9a8 RCX: 000000000045bd47 RDX: 0000000000000000 RSI: 00007ffcc3d777a0 RDI: 0000000040000000 RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000005 R10: 0000000000000000 R11: 0000000000000206 R12: 000000000075c9a8 R13: 00007ffcc3d77a68 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace a22065e820f89287 ]--- RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29 Code: 56 ff ff ff 4c 89 e1 48 c7 c7 a0 ae 81 87 e8 d0 f3 30 fe 0f 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 e0 af 81 87 e8 b9 f3 30 fe <0f> 0b 48 89 f1 48 c7 c7 60 af 81 87 4c 89 e6 e8 a5 f3 30 fe 0f 0b RSP: 0018:ffff88808791fb88 EFLAGS: 00010282 kobject: 'loop0' (0000000021632b4c): kobject_uevent_env RAX: 0000000000000058 RBX: ffffffff892e74a0 RCX: 0000000000000000 kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path = '/devices/virtual/block/loop0' RDX: 0000000000000000 RSI: ffffffff81559f66 RDI: ffffed1010f23f63 RBP: ffff88808791fba0 R08: 0000000000000058 R09: ffffed1015d03ee3 R10: ffffed1015d03ee2 R11: ffff8880ae81f717 R12: ffffffff892e7630 kobject: 'loop0' (0000000021632b4c): kobject_uevent_env R13: ffffffff892e7630 R14: ffffffff892e7630 R15: ffffffff892e75d0 kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path = '/devices/virtual/block/loop0' FS: 0000000001c8f940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffefcaf3f8c CR3: 000000007f673000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400