./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1430938459 <...> forked to background, child pid 3182 no interfaces have a carrier [ 25.922156][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.924634][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.75' (ECDSA) to the list of known hosts. execve("./syz-executor1430938459", ["./syz-executor1430938459"], 0x7ffe46e93960 /* 10 vars */) = 0 brk(NULL) = 0x555555c66000 brk(0x555555c66c40) = 0x555555c66c40 arch_prctl(ARCH_SET_FS, 0x555555c66300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1430938459", 4096) = 28 brk(0x555555c87c40) = 0x555555c87c40 brk(0x555555c88000) = 0x555555c88000 mprotect(0x7fe42bc65000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3611 attached , child_tidptr=0x555555c665d0) = 3611 [pid 3611] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3611] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3611] setsid() = 1 [pid 3611] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3611] unshare(CLONE_NEWNS) = 0 [pid 3611] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3611] unshare(CLONE_NEWIPC) = 0 [pid 3611] unshare(CLONE_NEWCGROUP) = 0 [pid 3611] unshare(CLONE_NEWUTS) = 0 [pid 3611] unshare(CLONE_SYSVSEM) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "16777216", 8) = 8 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "536870912", 9) = 9 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "1024", 4) = 4 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "8192", 4) = 4 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "1024", 4) = 4 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "1024", 4) = 4 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3611] close(3) = 0 [pid 3611] getpid() = 1 [pid 3611] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<sk_session_queue_lock){+.-.}-{2:2}, at: j1939_sk_queue_drop_all+0x40/0x2f0 [ 53.475557][ T3611] [ 53.475557][ T3611] but task is already holding lock: [ 53.475560][ T3611] ffff888073ce10d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: j1939_sk_netdev_event_netdown+0x28/0x160 [ 53.475589][ T3611] [ 53.475589][ T3611] which lock already depends on the new lock. [ 53.475589][ T3611] [ 53.475592][ T3611] [ 53.475592][ T3611] the existing dependency chain (in reverse order) is: [ 53.475595][ T3611] [ 53.475595][ T3611] -> #2 (&priv->j1939_socks_lock){+.-.}-{2:2}: [ 53.475611][ T3611] _raw_spin_lock_bh+0x2f/0x40 [ 53.475625][ T3611] j1939_sk_errqueue+0x9f/0x1a0 [ 53.475637][ T3611] __j1939_session_cancel+0x3b9/0x460 [ 53.475650][ T3611] j1939_tp_rxtimer.cold+0x1f6/0x24f [ 53.475663][ T3611] __hrtimer_run_queues+0x609/0xe50 [ 53.475677][ T3611] hrtimer_run_softirq+0x17b/0x360 [ 53.475689][ T3611] __do_softirq+0x29b/0x9c2 [ 53.475702][ T3611] __irq_exit_rcu+0x123/0x180 [ 53.475713][ T3611] irq_exit_rcu+0x5/0x20 [ 53.475723][ T3611] sysvec_apic_timer_interrupt+0x93/0xc0 [ 53.475740][ T3611] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 53.475754][ T3611] acpi_idle_do_entry+0x1c6/0x250 [ 53.475767][ T3611] acpi_idle_enter+0x369/0x510 [ 53.475781][ T3611] cpuidle_enter_state+0x1b1/0xc80 [ 53.475796][ T3611] cpuidle_enter+0x4a/0xa0 [ 53.475810][ T3611] do_idle+0x3e8/0x590 [ 53.475821][ T3611] cpu_startup_entry+0x14/0x20 [ 53.475832][ T3611] start_secondary+0x21d/0x2b0 [ 53.475848][ T3611] secondary_startup_64_no_verify+0xce/0xdb [ 53.475863][ T3611] [ 53.475863][ T3611] -> #1 (&priv->active_session_list_lock){+.-.}-{2:2}: [ 53.475879][ T3611] _raw_spin_lock_bh+0x2f/0x40 [ 53.475890][ T3611] j1939_session_activate+0x43/0x4b0 [ 53.475903][ T3611] j1939_sk_queue_activate_next+0x29b/0x460 [ 53.475916][ T3611] j1939_session_completed+0x19a/0x1f0 [ 53.475929][ T3611] j1939_xtp_rx_eoma+0x2a6/0x5f0 [ 53.475941][ T3611] j1939_tp_recv+0x930/0xcb0 [ 53.475958][ T3611] j1939_can_recv+0x6ff/0x9a0 [ 53.475970][ T3611] can_rcv_filter+0x5d4/0x8d0 [ 53.475984][ T3611] can_receive+0x31d/0x580 [ 53.475996][ T3611] can_rcv+0x120/0x1c0 [ 53.476008][ T3611] __netif_receive_skb_one_core+0x114/0x180 [ 53.476024][ T3611] __netif_receive_skb+0x24/0x1b0 [ 53.476037][ T3611] process_backlog+0x3a0/0x7c0 [ 53.476050][ T3611] __napi_poll+0xb3/0x6e0 [ 53.476070][ T3611] net_rx_action+0x9c1/0xd90 [ 53.476090][ T3611] __do_softirq+0x29b/0x9c2 [ 53.476111][ T3611] run_ksoftirqd+0x2d/0x60 [ 53.476125][ T3611] smpboot_thread_fn+0x645/0x9c0 [ 53.476141][ T3611] kthread+0x2e9/0x3a0 [ 53.476151][ T3611] ret_from_fork+0x1f/0x30 [ 53.476163][ T3611] [ 53.476163][ T3611] -> #0 (&jsk->sk_session_queue_lock){+.-.}-{2:2}: [ 53.476180][ T3611] __lock_acquire+0x2abe/0x5660 [ 53.476195][ T3611] lock_acquire+0x1ab/0x570 [ 53.476209][ T3611] _raw_spin_lock_bh+0x2f/0x40 [ 53.476220][ T3611] j1939_sk_queue_drop_all+0x40/0x2f0 [ 53.476232][ T3611] j1939_sk_netdev_event_netdown+0x7b/0x160 [ 53.476246][ T3611] j1939_netdev_notify+0x199/0x1d0 [ 53.476257][ T3611] notifier_call_chain+0xb5/0x200 [ 53.476269][ T3611] call_netdevice_notifiers_info+0xb5/0x130 [ 53.476285][ T3611] __dev_notify_flags+0x1da/0x2b0 [ 53.476298][ T3611] dev_change_flags+0x112/0x170 [ 53.476311][ T3611] do_setlink+0x961/0x3bb0 [ 53.476325][ T3611] __rtnl_newlink+0xd6a/0x17e0 [ 53.476338][ T3611] rtnl_newlink+0x64/0xa0 [ 53.476351][ T3611] rtnetlink_rcv_msg+0x43a/0xc90 [ 53.476364][ T3611] netlink_rcv_skb+0x153/0x420 [ 53.476379][ T3611] netlink_unicast+0x543/0x7f0 [ 53.476392][ T3611] netlink_sendmsg+0x917/0xe10 [ 53.476406][ T3611] sock_sendmsg+0xcf/0x120 [ 53.476420][ T3611] ____sys_sendmsg+0x6eb/0x810 [ 53.476433][ T3611] ___sys_sendmsg+0xf3/0x170 [ 53.476443][ T3611] __x64_sys_sendmsg+0x132/0x220 [ 53.476453][ T3611] do_syscall_64+0x35/0xb0 [ 53.476466][ T3611] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 53.476479][ T3611] [ 53.476479][ T3611] other info that might help us debug this: [ 53.476479][ T3611] [ 53.476482][ T3611] Chain exists of: [ 53.476482][ T3611] &jsk->sk_session_queue_lock --> &priv->active_session_list_lock --> &priv->j1939_socks_lock [ 53.476482][ T3611] [ 53.476500][ T3611] Possible unsafe locking scenario: [ 53.476500][ T3611] [ 53.476503][ T3611] CPU0 CPU1 [ 53.476505][ T3611] ---- ---- [ 53.476507][ T3611] lock(&priv->j1939_socks_lock); [ 53.476514][ T3611] lock(&priv->active_session_list_lock); [ 53.476522][ T3611] lock(&priv->j1939_socks_lock); [ 53.476529][ T3611] lock(&jsk->sk_session_queue_lock); [ 53.476536][ T3611] [ 53.476536][ T3611] *** DEADLOCK *** [ 53.476536][ T3611] [ 53.476538][ T3611] 2 locks held by syz-executor143/3611: [ 53.476545][ T3611] #0: ffffffff8d5937e8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3e5/0xc90 [ 53.476576][ T3611] #1: ffff888073ce10d0 (&priv->j1939_socks_lock){+.-.}-{2:2}, at: j1939_sk_netdev_event_netdown+0x28/0x160 [ 53.476606][ T3611] [ 53.476606][ T3611] stack backtrace: [ 53.476610][ T3611] CPU: 1 PID: 3611 Comm: syz-executor143 Not tainted 5.18.0-syzkaller-12234-g50fd82b3a9a9 #0 [ 53.476624][ T3611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 53.476631][ T3611] Call Trace: [ 53.476635][ T3611] [ 53.476640][ T3611] dump_stack_lvl+0xcd/0x134 [ 53.476654][ T3611] check_noncircular+0x25f/0x2e0 [ 53.476670][ T3611] ? print_circular_bug+0x1e0/0x1e0 [ 53.476690][ T3611] __lock_acquire+0x2abe/0x5660 [ 53.476708][ T3611] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 53.476727][ T3611] lock_acquire+0x1ab/0x570 [ 53.476742][ T3611] ? j1939_sk_queue_drop_all+0x40/0x2f0 [ 53.476756][ T3611] ? lock_release+0x780/0x780 [ 53.476770][ T3611] ? find_held_lock+0x2d/0x110 [ 53.476786][ T3611] ? sock_def_error_report+0x15c/0x4e0 [ 53.476800][ T3611] ? lock_downgrade+0x6e0/0x6e0 [ 53.476816][ T3611] _raw_spin_lock_bh+0x2f/0x40 [ 53.476828][ T3611] ? j1939_sk_queue_drop_all+0x40/0x2f0 [ 53.476841][ T3611] j1939_sk_queue_drop_all+0x40/0x2f0 [ 53.476856][ T3611] j1939_sk_netdev_event_netdown+0x7b/0x160 [ 53.476870][ T3611] j1939_netdev_notify+0x199/0x1d0 [ 53.476883][ T3611] notifier_call_chain+0xb5/0x200 [ 53.476898][ T3611] call_netdevice_notifiers_info+0xb5/0x130 [ 53.476915][ T3611] __dev_notify_flags+0x1da/0x2b0 [ 53.476929][ T3611] ? dev_change_name+0x820/0x820 [ 53.476944][ T3611] ? dev_set_allmulti+0x30/0x30 [ 53.476964][ T3611] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 53.476985][ T3611] dev_change_flags+0x112/0x170 [ 53.477000][ T3611] do_setlink+0x961/0x3bb0 [ 53.477015][ T3611] ? is_bpf_text_address+0x77/0x170 [ 53.477030][ T3611] ? if_nlmsg_stats_size+0x680/0x680 [ 53.477045][ T3611] ? unwind_next_frame+0xfa9/0x1cc0 [ 53.477061][ T3611] ? is_bpf_text_address+0x99/0x170 [ 53.477074][ T3611] ? kernel_text_address+0x39/0x80 [ 53.477090][ T3611] ? __sanitizer_cov_trace_switch+0x50/0x90 [ 53.477105][ T3611] ? __nla_validate_parse+0x2df/0x2410 [ 53.477124][ T3611] ? nla_get_range_signed+0x520/0x520 [ 53.477140][ T3611] ? stack_trace_save+0x8c/0xc0 [ 53.477154][ T3611] ? __stack_depot_save+0x35/0x500 [ 53.477172][ T3611] __rtnl_newlink+0xd6a/0x17e0 [ 53.477189][ T3611] ? rtnl_link_unregister+0x250/0x250 [ 53.477203][ T3611] ? find_held_lock+0x2d/0x110 [ 53.477222][ T3611] ? rcu_read_lock_sched_held+0x3a/0x70 [ 53.477238][ T3611] ? trace_kmalloc+0x32/0xf0 [ 53.477254][ T3611] rtnl_newlink+0x64/0xa0 [ 53.477268][ T3611] ? __rtnl_newlink+0x17e0/0x17e0 [ 53.477282][ T3611] rtnetlink_rcv_msg+0x43a/0xc90 [ 53.477297][ T3611] ? rtnl_fdb_dump+0x9a0/0x9a0 [ 53.477311][ T3611] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 53.477325][ T3611] ? ref_tracker_free+0x370/0x6b0 [ 53.477339][ T3611] ? ref_tracker_dir_exit+0x3e0/0x3e0 [ 53.477354][ T3611] netlink_rcv_skb+0x153/0x420 [ 53.477369][ T3611] ? rtnl_fdb_dump+0x9a0/0x9a0 [ 53.477383][ T3611] ? netlink_ack+0xa80/0xa80 [ 53.477397][ T3611] ? netlink_deliver_tap+0x1a2/0xc40 [ 53.477413][ T3611] ? netlink_deliver_tap+0x1b1/0xc40 [ 53.477430][ T3611] netlink_unicast+0x543/0x7f0 [ 53.477445][ T3611] ? netlink_attachskb+0x880/0x880 [ 53.477460][ T3611] ? __phys_addr+0xc4/0x140 [ 53.477475][ T3611] ? __phys_addr_symbol+0x2c/0x70 [ 53.477490][ T3611] ? __check_object_size+0x353/0x7a0 [ 53.477504][ T3611] netlink_sendmsg+0x917/0xe10 [ 53.477520][ T3611] ? netlink_unicast+0x7f0/0x7f0 [ 53.477536][ T3611] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 53.477549][ T3611] ? netlink_unicast+0x7f0/0x7f0 [ 53.477564][ T3611] sock_sendmsg+0xcf/0x120 [ 53.477578][ T3611] ____sys_sendmsg+0x6eb/0x810 [ 53.477600][ T3611] ? kernel_sendmsg+0x50/0x50 [ 53.477615][ T3611] ? do_recvmmsg+0x6d0/0x6d0 [ 53.477627][ T3611] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 53.477643][ T3611] ? lockdep_hardirqs_on+0x79/0x100 [ 53.477655][ T3611] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 53.477672][ T3611] ___sys_sendmsg+0xf3/0x170 [ 53.477684][ T3611] ? sendmsg_copy_msghdr+0x160/0x160 [ 53.477698][ T3611] ? lock_release+0x780/0x780 [ 53.477712][ T3611] ? ptrace_stop+0x590/0xb30 [ 53.477724][ T3611] ? do_raw_spin_lock+0x120/0x2a0 [ 53.477737][ T3611] ? rwlock_bug.part.0+0x90/0x90 [ 53.477748][ T3611] ? _raw_spin_lock_irq+0x41/0x50 [ 53.477762][ T3611] ? __fget_light+0x20f/0x270 [ 53.477778][ T3611] __x64_sys_sendmsg+0x132/0x220 [ 53.477791][ T3611] ? __sys_sendmsg+0x1b0/0x1b0 [ 53.477805][ T3611] ? _raw_spin_unlock_irq+0x2a/0x40 [ 53.477817][ T3611] ? ptrace_notify+0xfa/0x140 [ 53.477830][ T3611] do_syscall_64+0x35/0xb0 [ 53.477843][ T3611] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 53.477858][ T3611] RIP: 0033:0x7fe42bbf0e89 [ 53.477869][ T3611] Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 53.477882][ T3611] RSP: 002b:00007ffd26802168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 53.477894][ T3611] RAX: ffffffffffffffda RBX: 00007ffd26802178 RCX: 00007fe42bbf0e89 [ 53.477903][ T3611] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 [ 53.477911][ T3611] RBP: 0000000000000003 R08: bb1414ac00000000 R09: bb1414ac00000000 [ 53.477919][ T3611] R10: bb1414ac00000000 R11: 0000000000000246 R12: 00007ffd26802180 [ 53.477928][ T3611] R13: 00007ffd26802174 R14: 0000000000000003 R15: 0000000000000000 [ 53.477939][ T3611] [ 53.491485][ T3611] A link change request failed with some changes committed already. Interface vxcan0 may have been left with an inconsistent configuration, please check. [pid 3611] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3611, si_uid=0, si_status=1, si_utime=0, si_stime=57} --- exit_group(0) = ? +++ exited with 0 +++