Extracting prog: 41.362785585s Minimizing prog: 22m5.420790624s Simplifying prog options: 0s Extracting C: 32.733255077s Simplifying C: 6m27.123957039s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-unshare-socket$inet6_mptcp-bind$inet6-listen-socket$inet_mptcp-connect$inet-sendto-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) unshare(0x800) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program crashed: possible deadlock in inet_sk_diag_fill single: successfully extracted reproducer found reproducer with 12 syscalls minimizing guilty program testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-unshare-socket$inet6_mptcp-bind$inet6-listen-socket$inet_mptcp-connect$inet-sendto-socket$netlink detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) unshare(0x800) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-unshare-socket$inet6_mptcp-bind$inet6-listen-socket$inet_mptcp-connect$inet-sendto-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) unshare(0x800) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-unshare-socket$inet6_mptcp-bind$inet6-listen-socket$inet_mptcp-connect$inet-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) unshare(0x800) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program crashed: possible deadlock in inet_sk_diag_fill testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-unshare-socket$inet6_mptcp-bind$inet6-listen-socket$inet_mptcp-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) unshare(0x800) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program crashed: possible deadlock in inet_sk_diag_fill testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-unshare-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) unshare(0x800) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program crashed: possible deadlock in inet_sk_diag_fill testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-unshare-socket$inet6_mptcp-bind$inet6-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) unshare(0x800) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-unshare-socket$inet6_mptcp-listen-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) unshare(0x800) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-unshare-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) unshare(0x800) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program crashed: possible deadlock in inet_sk_diag_fill testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_tcp-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: socket$kcm(0x2, 0x3, 0x2) close(0xffffffffffffffff) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program crashed: possible deadlock in inet_sk_diag_fill testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, 0x0, 0x0) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, 0x0, 0x0) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{0x0}], 0x1) program did not crash testing program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)}], 0x1) program did not crash extracting C reproducer testing compiled C program (duration=52.974941316s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev program crashed: possible deadlock in inet_sk_diag_fill simplifying C reproducer testing compiled C program (duration=52.974941316s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev program crashed: possible deadlock in inet_sk_diag_fill testing compiled C program (duration=52.974941316s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev program crashed: possible deadlock in inet_sk_diag_fill testing compiled C program (duration=52.974941316s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev program crashed: possible deadlock in inet_sk_diag_fill testing compiled C program (duration=52.974941316s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev program crashed: possible deadlock in inet_sk_diag_fill testing compiled C program (duration=52.974941316s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev program crashed: possible deadlock in inet_sk_diag_fill testing compiled C program (duration=52.974941316s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev program crashed: possible deadlock in inet_sk_diag_fill testing compiled C program (duration=52.974941316s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$netlink-writev program crashed: possible deadlock in inet_sk_diag_fill reproducing took 29m46.640808435s repro crashed as (corrupted=false): ====================================================== WARNING: possible circular locking dependency detected 5.15.175-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor342/4162 is trying to acquire lock: ffff88802a8b8120 (sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_sk_diag_fill+0xf6a/0x1cb0 net/ipv4/inet_diag.c:342 but task is already holding lock: ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline] ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:95 [inline] ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump+0x869/0x1330 net/mptcp/mptcp_diag.c:194 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&h->lhash2[i].lock){+.+.}-{2:2}: lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:363 [inline] __inet_hash+0xe4/0x8e0 net/ipv4/inet_hashtables.c:613 inet_csk_listen_start+0x231/0x310 net/ipv4/inet_connection_sock.c:1115 inet_listen+0x2c9/0x7c0 net/ipv4/af_inet.c:231 __sys_listen+0x1a7/0x220 net/socket.c:1754 __do_sys_listen net/socket.c:1763 [inline] __se_sys_listen net/socket.c:1761 [inline] __x64_sys_listen+0x56/0x60 net/socket.c:1761 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #0 (sk_lock-AF_INET6){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623 lock_sock_fast include/net/sock.h:1710 [inline] mptcp_diag_get_info+0x276/0xa10 net/mptcp/mptcp_diag.c:224 inet_sk_diag_fill+0xf6a/0x1cb0 net/ipv4/inet_diag.c:342 sk_diag_dump net/mptcp/mptcp_diag.c:24 [inline] mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:122 [inline] mptcp_diag_dump+0xd1d/0x1330 net/mptcp/mptcp_diag.c:194 __inet_diag_dump+0x20e/0x3a0 net/ipv4/inet_diag.c:1179 netlink_dump+0x5a4/0xca0 net/netlink/af_netlink.c:2265 __netlink_dump_start+0x50f/0x6d0 net/netlink/af_netlink.c:2368 netlink_dump_start include/linux/netlink.h:258 [inline] inet_diag_handler_cmd+0x1d7/0x2a0 net/ipv4/inet_diag.c:1344 sock_diag_rcv_msg+0xd5/0x400 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2489 sock_diag_rcv+0x26/0x40 net/core/sock_diag.c:276 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1337 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] sock_write_iter+0x39b/0x530 net/socket.c:1079 do_iter_readv_writev+0x594/0x7a0 do_iter_write+0x1e6/0x760 fs/read_write.c:855 vfs_writev fs/read_write.c:928 [inline] do_writev+0x281/0x470 fs/read_write.c:971 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&h->lhash2[i].lock); lock(sk_lock-AF_INET6); lock(&h->lhash2[i].lock); lock(sk_lock-AF_INET6); *** DEADLOCK *** 6 locks held by syz-executor342/4162: #0: ffffffff8dc4b748 (sock_diag_mutex){+.+.}-{3:3}, at: sock_diag_rcv+0x17/0x40 net/core/sock_diag.c:275 #1: ffffffff8dc4b5a8 (sock_diag_table_mutex){+.+.}-{3:3}, at: __sock_diag_cmd net/core/sock_diag.c:229 [inline] #1: ffffffff8dc4b5a8 (sock_diag_table_mutex){+.+.}-{3:3}, at: sock_diag_rcv_msg+0x206/0x400 net/core/sock_diag.c:265 #2: ffff88814c582690 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{3:3}, at: __netlink_dump_start+0x12e/0x6d0 net/netlink/af_netlink.c:2334 #3: ffffffff8dd27f28 (inet_diag_table_mutex){+.+.}-{3:3}, at: inet_diag_lock_handler net/ipv4/inet_diag.c:63 [inline] #3: ffffffff8dd27f28 (inet_diag_table_mutex){+.+.}-{3:3}, at: __inet_diag_dump+0x191/0x3a0 net/ipv4/inet_diag.c:1177 #4: ffffffff8cb1fd20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311 #5: ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline] #5: ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:95 [inline] #5: ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump+0x869/0x1330 net/mptcp/mptcp_diag.c:194 stack backtrace: CPU: 1 PID: 4162 Comm: syz-executor342 Not tainted 5.15.175-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133 check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623 lock_sock_fast include/net/sock.h:1710 [inline] mptcp_diag_get_info+0x276/0xa10 net/mptcp/mptcp_diag.c:224 inet_sk_diag_fill+0xf6a/0x1cb0 net/ipv4/inet_diag.c:342 sk_diag_dump net/mptcp/mptcp_diag.c:24 [inline] mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:122 [inline] mptcp_diag_dump+0xd1d/0x1330 net/mptcp/mptcp_diag.c:194 __inet_diag_dump+0x20e/0x3a0 net/ipv4/inet_diag.c:1179 netlink_dump+0x5a4/0xca0 net/netlink/af_netlink.c:2265 __netlink_dump_start+0x50f/0x6d0 net/netlink/af_netlink.c:2368 netlink_dump_start include/linux/netlink.h:258 [inline] inet_diag_handler_cmd+0x1d7/0x2a0 net/ipv4/inet_diag.c:1344 sock_diag_rcv_msg+0xd5/0x400 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2489 sock_diag_rcv+0x26/0x40 net/core/sock_diag.c:276 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1337 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] sock_write_iter+0x39b/0x530 net/socket.c:1079 do_iter_readv_writev+0x594/0x7a0 do_iter_write+0x1e6/0x760 fs/read_write.c:855 vfs_writev fs/read_write.c:928 [inline] do_writev+0x281/0x470 fs/read_write.c:971 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc28fe06429 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc7bf910d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007ffc7bf912a8 RCX: 00007fc28fe06429 RDX: 0000000000000001 RSI: 0000000020000280 RDI: 0000000000000004 RBP: 00007fc28fe79610 R08: 00007ffc7bf912a8 R09: 00007ffc7bf912a8 R10: 00007ffc7bf912a8 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc7bf91298 R14: 0000000000000001 R15: 0000000000000001 BUG: sleeping function called from invalid context at net/core/sock.c:3282 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4162, name: syz-executor342 INFO: lockdep is turned off. Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 PID: 4162 Comm: syz-executor342 Not tainted 5.15.175-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 ___might_sleep+0x547/0x6a0 kernel/sched/core.c:9636 __lock_sock_fast+0x2f/0xe0 net/core/sock.c:3282 lock_sock_fast include/net/sock.h:1712 [inline] mptcp_diag_get_info+0x282/0xa10 net/mptcp/mptcp_diag.c:224 inet_sk_diag_fill+0xf6a/0x1cb0 net/ipv4/inet_diag.c:342 sk_diag_dump net/mptcp/mptcp_diag.c:24 [inline] mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:122 [inline] mptcp_diag_dump+0xd1d/0x1330 net/mptcp/mptcp_diag.c:194 __inet_diag_dump+0x20e/0x3a0 net/ipv4/inet_diag.c:1179 netlink_dump+0x5a4/0xca0 net/netlink/af_netlink.c:2265 __netlink_dump_start+0x50f/0x6d0 net/netlink/af_netlink.c:2368 netlink_dump_start include/linux/netlink.h:258 [inline] inet_diag_handler_cmd+0x1d7/0x2a0 net/ipv4/inet_diag.c:1344 sock_diag_rcv_msg+0xd5/0x400 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2489 sock_diag_rcv+0x26/0x40 net/core/sock_diag.c:276 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1337 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] sock_write_iter+0x39b/0x530 net/socket.c:1079 do_iter_readv_writev+0x594/0x7a0 do_iter_write+0x1e6/0x760 fs/read_write.c:855 vfs_writev fs/read_write.c:928 [inline] do_writev+0x281/0x470 fs/read_write.c:971 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc28fe06429 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc7bf910d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007ffc7bf912a8 RCX: 00007fc28fe06429 final repro crashed as (corrupted=false): ====================================================== WARNING: possible circular locking dependency detected 5.15.175-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor342/4162 is trying to acquire lock: ffff88802a8b8120 (sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_sk_diag_fill+0xf6a/0x1cb0 net/ipv4/inet_diag.c:342 but task is already holding lock: ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline] ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:95 [inline] ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump+0x869/0x1330 net/mptcp/mptcp_diag.c:194 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&h->lhash2[i].lock){+.+.}-{2:2}: lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:363 [inline] __inet_hash+0xe4/0x8e0 net/ipv4/inet_hashtables.c:613 inet_csk_listen_start+0x231/0x310 net/ipv4/inet_connection_sock.c:1115 inet_listen+0x2c9/0x7c0 net/ipv4/af_inet.c:231 __sys_listen+0x1a7/0x220 net/socket.c:1754 __do_sys_listen net/socket.c:1763 [inline] __se_sys_listen net/socket.c:1761 [inline] __x64_sys_listen+0x56/0x60 net/socket.c:1761 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #0 (sk_lock-AF_INET6){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623 lock_sock_fast include/net/sock.h:1710 [inline] mptcp_diag_get_info+0x276/0xa10 net/mptcp/mptcp_diag.c:224 inet_sk_diag_fill+0xf6a/0x1cb0 net/ipv4/inet_diag.c:342 sk_diag_dump net/mptcp/mptcp_diag.c:24 [inline] mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:122 [inline] mptcp_diag_dump+0xd1d/0x1330 net/mptcp/mptcp_diag.c:194 __inet_diag_dump+0x20e/0x3a0 net/ipv4/inet_diag.c:1179 netlink_dump+0x5a4/0xca0 net/netlink/af_netlink.c:2265 __netlink_dump_start+0x50f/0x6d0 net/netlink/af_netlink.c:2368 netlink_dump_start include/linux/netlink.h:258 [inline] inet_diag_handler_cmd+0x1d7/0x2a0 net/ipv4/inet_diag.c:1344 sock_diag_rcv_msg+0xd5/0x400 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2489 sock_diag_rcv+0x26/0x40 net/core/sock_diag.c:276 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1337 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] sock_write_iter+0x39b/0x530 net/socket.c:1079 do_iter_readv_writev+0x594/0x7a0 do_iter_write+0x1e6/0x760 fs/read_write.c:855 vfs_writev fs/read_write.c:928 [inline] do_writev+0x281/0x470 fs/read_write.c:971 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&h->lhash2[i].lock); lock(sk_lock-AF_INET6); lock(&h->lhash2[i].lock); lock(sk_lock-AF_INET6); *** DEADLOCK *** 6 locks held by syz-executor342/4162: #0: ffffffff8dc4b748 (sock_diag_mutex){+.+.}-{3:3}, at: sock_diag_rcv+0x17/0x40 net/core/sock_diag.c:275 #1: ffffffff8dc4b5a8 (sock_diag_table_mutex){+.+.}-{3:3}, at: __sock_diag_cmd net/core/sock_diag.c:229 [inline] #1: ffffffff8dc4b5a8 (sock_diag_table_mutex){+.+.}-{3:3}, at: sock_diag_rcv_msg+0x206/0x400 net/core/sock_diag.c:265 #2: ffff88814c582690 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{3:3}, at: __netlink_dump_start+0x12e/0x6d0 net/netlink/af_netlink.c:2334 #3: ffffffff8dd27f28 (inet_diag_table_mutex){+.+.}-{3:3}, at: inet_diag_lock_handler net/ipv4/inet_diag.c:63 [inline] #3: ffffffff8dd27f28 (inet_diag_table_mutex){+.+.}-{3:3}, at: __inet_diag_dump+0x191/0x3a0 net/ipv4/inet_diag.c:1177 #4: ffffffff8cb1fd20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311 #5: ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline] #5: ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:95 [inline] #5: ffffc900018751a8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump+0x869/0x1330 net/mptcp/mptcp_diag.c:194 stack backtrace: CPU: 1 PID: 4162 Comm: syz-executor342 Not tainted 5.15.175-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133 check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623 lock_sock_fast include/net/sock.h:1710 [inline] mptcp_diag_get_info+0x276/0xa10 net/mptcp/mptcp_diag.c:224 inet_sk_diag_fill+0xf6a/0x1cb0 net/ipv4/inet_diag.c:342 sk_diag_dump net/mptcp/mptcp_diag.c:24 [inline] mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:122 [inline] mptcp_diag_dump+0xd1d/0x1330 net/mptcp/mptcp_diag.c:194 __inet_diag_dump+0x20e/0x3a0 net/ipv4/inet_diag.c:1179 netlink_dump+0x5a4/0xca0 net/netlink/af_netlink.c:2265 __netlink_dump_start+0x50f/0x6d0 net/netlink/af_netlink.c:2368 netlink_dump_start include/linux/netlink.h:258 [inline] inet_diag_handler_cmd+0x1d7/0x2a0 net/ipv4/inet_diag.c:1344 sock_diag_rcv_msg+0xd5/0x400 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2489 sock_diag_rcv+0x26/0x40 net/core/sock_diag.c:276 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1337 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] sock_write_iter+0x39b/0x530 net/socket.c:1079 do_iter_readv_writev+0x594/0x7a0 do_iter_write+0x1e6/0x760 fs/read_write.c:855 vfs_writev fs/read_write.c:928 [inline] do_writev+0x281/0x470 fs/read_write.c:971 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc28fe06429 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc7bf910d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007ffc7bf912a8 RCX: 00007fc28fe06429 RDX: 0000000000000001 RSI: 0000000020000280 RDI: 0000000000000004 RBP: 00007fc28fe79610 R08: 00007ffc7bf912a8 R09: 00007ffc7bf912a8 R10: 00007ffc7bf912a8 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc7bf91298 R14: 0000000000000001 R15: 0000000000000001 BUG: sleeping function called from invalid context at net/core/sock.c:3282 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4162, name: syz-executor342 INFO: lockdep is turned off. Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 PID: 4162 Comm: syz-executor342 Not tainted 5.15.175-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 ___might_sleep+0x547/0x6a0 kernel/sched/core.c:9636 __lock_sock_fast+0x2f/0xe0 net/core/sock.c:3282 lock_sock_fast include/net/sock.h:1712 [inline] mptcp_diag_get_info+0x282/0xa10 net/mptcp/mptcp_diag.c:224 inet_sk_diag_fill+0xf6a/0x1cb0 net/ipv4/inet_diag.c:342 sk_diag_dump net/mptcp/mptcp_diag.c:24 [inline] mptcp_diag_dump_listeners net/mptcp/mptcp_diag.c:122 [inline] mptcp_diag_dump+0xd1d/0x1330 net/mptcp/mptcp_diag.c:194 __inet_diag_dump+0x20e/0x3a0 net/ipv4/inet_diag.c:1179 netlink_dump+0x5a4/0xca0 net/netlink/af_netlink.c:2265 __netlink_dump_start+0x50f/0x6d0 net/netlink/af_netlink.c:2368 netlink_dump_start include/linux/netlink.h:258 [inline] inet_diag_handler_cmd+0x1d7/0x2a0 net/ipv4/inet_diag.c:1344 sock_diag_rcv_msg+0xd5/0x400 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2489 sock_diag_rcv+0x26/0x40 net/core/sock_diag.c:276 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1337 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] sock_write_iter+0x39b/0x530 net/socket.c:1079 do_iter_readv_writev+0x594/0x7a0 do_iter_write+0x1e6/0x760 fs/read_write.c:855 vfs_writev fs/read_write.c:928 [inline] do_writev+0x281/0x470 fs/read_write.c:971 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc28fe06429 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc7bf910d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007ffc7bf912a8 RCX: 00007fc28fe06429