Warning: Permanently added '[localhost]:51369' (ED25519) to the list of known hosts. [*] Starting reproducer for circular locking dependency in rds_trans_get_preferred... [*] Cleaning up stale network devices... [+] Veth pair (veth0 <-> veth1) created successfully. [+] Veth network interface pair created. [+] Interface veth0 configured with IP 172.20.20.170 and brought UP successfully. [+] Interface veth1 configured with IP 172.20.20.171 and brought UP successfully. [+] IP addresses configured and interfaces brought UP. [*] setup_rxe with name rxe0 returned -23 (Too many open files in system), trying next candidate... [ 69.864648][ T6037] rdma_rxe: rxe_newlink: failed to add veth0 [ 69.955612][ T6037] infiniband rxe1: set active [ 69.955676][ T6037] infiniband rxe1: added veth0 [ 69.961169][ T6037] smbdirect: ib_dev[rxe1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [+] RDMA device rxe1 configured on veth0 successfully. [+] Soft-RoCE device on veth0 verified. [ 69.961188][ T6037] smbdirect: ib_dev[rxe1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 69.961213][ T6037] smbdirect: ib_dev[rxe1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 69.974526][ T6037] RDS/IB: rxe1: added [ 69.974566][ T6037] smc: adding ib device rxe1 with port count 1 [ 69.974582][ T6037] smc: ib device rxe1 port 1 has no pnetid [+] Initialized RDS RDMA transport and verified module load. [+] Server AF_RDS socket bound to 172.20.20.170:2000 (established rds_trans_sem -> handler_mutex edge). [+] Client AF_RDS socket bound to 172.20.20.170:2001. [*] Transmitting datagrams to trigger incoming RDMA CM connect request... [+] Transmitted message iteration 1 (4 bytes sent). [ 70.409426][ T5905] [ 70.410289][ T5905] ====================================================== [ 70.412439][ T5905] WARNING: possible circular locking dependency detected [ 70.414842][ T5905] syzkaller #0 Not tainted [ 70.416332][ T5905] ------------------------------------------------------ [ 70.418492][ T5905] kworker/2:3/5905 is trying to acquire lock: [ 70.420407][ T5905] ffffffff9205e888 (rds_trans_sem){++++}-{4:4}, at: rds_trans_get_preferred+0xf7/0x2c0 [ 70.423759][ T5905] [ 70.423759][ T5905] but task is already holding lock: [ 70.426573][ T5905] ffff888014aed420 (&id_priv->handler_mutex/1){+.+.}-{4:4}, at: cma_ib_req_handler+0x16ff/0x5700 [ 70.430714][ T5905] [ 70.430714][ T5905] which lock already depends on the new lock. [ 70.430714][ T5905] [ 70.434541][ T5905] [ 70.434541][ T5905] the existing dependency chain (in reverse order) is: [ 70.437457][ T5905] [ 70.437457][ T5905] -> #2 (&id_priv->handler_mutex/1){+.+.}-{4:4}: [ 70.440532][ T5905] lock_acquire+0x1d1/0x380 [ 70.442274][ T5905] __mutex_lock+0x1a4/0x1bd0 [ 70.443938][ T5905] cma_ib_req_handler+0x16ff/0x5700 [ 70.446070][ T5905] cm_process_work+0x46/0x440 [ 70.447803][ T5905] cm_queue_work_unlock+0x5d/0x250 [ 70.449716][ T5905] cm_work_handler+0x638d/0xc860 [ 70.451714][ T5905] process_one_work+0xac7/0x1b10 [ 70.453588][ T5905] worker_thread+0x5ef/0xe50 [ 70.455601][ T5905] kthread+0x373/0x450 [ 70.457321][ T5905] ret_from_fork+0x730/0xd60 [ 70.459044][ T5905] ret_from_fork_asm+0x1a/0x30 [ 70.461019][ T5905] [ 70.461019][ T5905] -> #1 (&id_priv->handler_mutex){+.+.}-{4:4}: [ 70.463945][ T5905] lock_acquire+0x1d1/0x380 [ 70.465661][ T5905] __mutex_lock+0x1a4/0x1bd0 [ 70.467286][ T5905] rdma_destroy_id+0x1b/0x30 [ 70.468895][ T5905] rds_ib_laddr_check+0x38b/0x730 [ 70.470654][ T5905] rds_trans_get_preferred+0x15f/0x2c0 [ 70.472528][ T5905] rds_bind+0x1a4a/0x2420 [ 70.474104][ T5905] __sys_bind+0x1a9/0x260 [ 70.475716][ T5905] __ia32_compat_sys_socketcall+0x4c7/0x770 [ 70.478026][ T5905] __do_fast_syscall_32+0x13a/0x8b0 [ 70.479829][ T5905] do_fast_syscall_32+0x32/0x70 [ 70.481750][ T5905] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 70.484048][ T5905] [ 70.484048][ T5905] -> #0 (rds_trans_sem){++++}-{4:4}: [ 70.486627][ T5905] check_prev_add+0xeb/0xe60 [ 70.488212][ T5905] __lock_acquire+0x1528/0x1f40 [ 70.489944][ T5905] lock_acquire+0x1d1/0x380 [ 70.491732][ T5905] down_read+0x99/0x4c0 [ 70.493590][ T5905] rds_trans_get_preferred+0xf7/0x2c0 [ 70.495822][ T5905] __rds_conn_create+0xad5/0x2650 [ 70.498060][ T5905] rds_conn_create+0x44/0x60 [ 70.499650][ T5905] rds_ib_cm_handle_connect+0x62b/0x1220 [ 70.501889][ T5905] rds_rdma_cm_event_handler_cmn+0x59f/0x9b0 [ 70.503958][ T5905] cma_listen_handler+0x11a/0x180 [ 70.505717][ T5905] cma_cm_event_handler+0x99/0x300 [ 70.507459][ T5905] cma_ib_req_handler+0x1be2/0x5700 [ 70.509240][ T5905] cm_process_work+0x46/0x440 [ 70.510902][ T5905] cm_queue_work_unlock+0x5d/0x250 [ 70.512656][ T5905] cm_work_handler+0x638d/0xc860 [ 70.514620][ T5905] process_one_work+0xac7/0x1b10 [ 70.516522][ T5905] worker_thread+0x5ef/0xe50 [ 70.518132][ T5905] kthread+0x373/0x450 [ 70.519581][ T5905] ret_from_fork+0x730/0xd60 [ 70.521182][ T5905] ret_from_fork_asm+0x1a/0x30 [ 70.522829][ T5905] [ 70.522829][ T5905] other info that might help us debug this: [ 70.522829][ T5905] [ 70.526276][ T5905] Chain exists of: [ 70.526276][ T5905] rds_trans_sem --> &id_priv->handler_mutex --> &id_priv->handler_mutex/1 [ 70.526276][ T5905] [ 70.530660][ T5905] Possible unsafe locking scenario: [ 70.530660][ T5905] [ 70.532942][ T5905] CPU0 CPU1 [ 70.534648][ T5905] ---- ---- [ 70.536342][ T5905] lock(&id_priv->handler_mutex/1); [ 70.537993][ T5905] lock(&id_priv->handler_mutex); [ 70.540363][ T5905] lock(&id_priv->handler_mutex/1); [ 70.542763][ T5905] rlock(rds_trans_sem); [ 70.544157][ T5905] [ 70.544157][ T5905] *** DEADLOCK *** [ 70.544157][ T5905] [ 70.546671][ T5905] locks held by kworker/2:3/5905: 4, last CPU#2: [ 70.548621][ T5905] #0: ffff88804c131140 ((wq_completion)ib_cm){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 70.551802][ T5905] #1: ffffc900030dfd08 ((work_completion)(&(&work->work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 70.555705][ T5905] #2: ffff88802a6fc420 (&id_priv->handler_mutex){+.+.}-{4:4}, at: cma_ib_req_handler+0xef1/0x5700 [ 70.559045][ T5905] #3: ffff888014aed420 (&id_priv->handler_mutex/1){+.+.}-{4:4}, at: cma_ib_req_handler+0x16ff/0x5700 [ 70.562443][ T5905] [ 70.562443][ T5905] stack backtrace: [ 70.564273][ T5905] CPU: 2 UID: 0 PID: 5905 Comm: kworker/2:3 Not tainted syzkaller #0 PREEMPT(full) [ 70.567534][ T5905] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.570661][ T5905] Workqueue: ib_cm cm_work_handler [ 70.572262][ T5905] Call Trace: [ 70.573311][ T5905] [ 70.574254][ T5905] dump_stack_lvl+0x100/0x190 [ 70.575932][ T5905] print_circular_bug.cold+0x178/0x1be [ 70.577651][ T5905] check_noncircular+0x146/0x160 [ 70.579202][ T5905] ? __kasan_slab_free+0x5f/0x80 [ 70.580793][ T5905] check_prev_add+0xeb/0xe60 [ 70.582260][ T5905] ? ret_from_fork+0x730/0xd60 [ 70.583985][ T5905] ? ret_from_fork_asm+0x1a/0x30 [ 70.585581][ T5905] __lock_acquire+0x1528/0x1f40 [ 70.587110][ T5905] lock_acquire+0x1d1/0x380 [ 70.588536][ T5905] ? rds_trans_get_preferred+0xf7/0x2c0 [ 70.590274][ T5905] ? __pfx___might_resched+0x10/0x10 [ 70.591921][ T5905] down_read+0x99/0x4c0 [ 70.593237][ T5905] ? rds_trans_get_preferred+0xf7/0x2c0 [ 70.595195][ T5905] ? __pfx_down_read+0x10/0x10 [ 70.596762][ T5905] rds_trans_get_preferred+0xf7/0x2c0 [ 70.598897][ T5905] __rds_conn_create+0xad5/0x2650 [ 70.600846][ T5905] ? __pfx___rds_conn_create+0x10/0x10 [ 70.602557][ T5905] rds_conn_create+0x44/0x60 [ 70.604267][ T5905] rds_ib_cm_handle_connect+0x62b/0x1220 [ 70.606127][ T5905] ? xas_store+0x409/0x1a30 [ 70.607522][ T5905] ? __pfx_rds_ib_cm_handle_connect+0x10/0x10 [ 70.609400][ T5905] ? xas_clear_mark+0x2f0/0x3a0 [ 70.610951][ T5905] ? __xa_alloc+0x280/0x390 [ 70.612393][ T5905] ? rds_rdma_cm_event_handler_cmn+0x59f/0x9b0 [ 70.614262][ T5905] rds_rdma_cm_event_handler_cmn+0x59f/0x9b0 [ 70.616137][ T5905] ? __xa_alloc_cyclic+0x1f2/0x330 [ 70.617741][ T5905] ? __pfx_rds_rdma_cm_event_handler_cmn+0x10/0x10 [ 70.619755][ T5905] ? print_kernel_ident+0x10/0x40 [ 70.621345][ T5905] ? rdma_restrack_add+0x1d1/0x760 [ 70.622959][ T5905] ? rcu_is_watching+0x13/0xc0 [ 70.624773][ T5905] ? __pfx_rds_rdma_cm_event_handler+0x10/0x10 [ 70.627223][ T5905] cma_listen_handler+0x11a/0x180 [ 70.629030][ T5905] cma_cm_event_handler+0x99/0x300 [ 70.630653][ T5905] cma_ib_req_handler+0x1be2/0x5700 [ 70.632271][ T5905] ? __pfx_cma_ib_req_handler+0x10/0x10 [ 70.634041][ T5905] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 70.636033][ T5905] ? __xa_store+0x1de/0x2c0 [ 70.637458][ T5905] ? cm_process_work+0x46/0x440 [ 70.638998][ T5905] cm_process_work+0x46/0x440 [ 70.640512][ T5905] ? mark_held_locks+0x40/0x70 [ 70.642027][ T5905] ? _raw_spin_unlock_irq+0x23/0x50 [ 70.643799][ T5905] cm_queue_work_unlock+0x5d/0x250 [ 70.645842][ T5905] ? _raw_spin_unlock+0x28/0x50 [ 70.647371][ T5905] cm_work_handler+0x638d/0xc860 [ 70.648921][ T5905] ? lock_acquire+0x1d1/0x380 [ 70.650427][ T5905] ? __pfx_cm_work_handler+0x10/0x10 [ 70.652272][ T5905] ? process_one_work+0x906/0x1b10 [ 70.654007][ T5905] ? process_one_work+0x906/0x1b10 [ 70.655694][ T5905] process_one_work+0xac7/0x1b10 [ 70.657252][ T5905] ? __pfx_process_one_work+0x10/0x10 [ 70.658924][ T5905] ? lock_acquire+0x1d1/0x380 [ 70.660412][ T5905] ? __pfx_cm_work_handler+0x10/0x10 [ 70.662133][ T5905] worker_thread+0x5ef/0xe50 [ 70.663682][ T5905] ? __pfx_worker_thread+0x10/0x10 [ 70.665376][ T5905] ? kthread+0x13a/0x450 [ 70.666703][ T5905] ? __pfx_worker_thread+0x10/0x10 [ 70.668330][ T5905] kthread+0x373/0x450 [ 70.669971][ T5905] ? __pfx_kthread+0x10/0x10 [ 70.671796][ T5905] ret_from_fork+0x730/0xd60 [ 70.673619][ T5905] ? __pfx_ret_from_fork+0x10/0x10 [ 70.675401][ T5905] ? __switch_to+0x800/0x10f0 [ 70.676896][ T5905] ? __pfx_kthread+0x10/0x10 [ 70.678335][ T5905] ret_from_fork_asm+0x1a/0x30 [ 70.679853][ T5905] [+] Transmitted message iteration 2 (4 bytes sent). [ 70.687590][ T5905] RDS/IB: Active conn connected <::ffff:172.20.20.170,::ffff:172.20.20.170,0> version 3.1 [ 70.687749][ T35] RDS/IB: Passive conn connected <::ffff:172.20.20.170,::ffff:172.20.20.170,0> version 3.1 [+] Transmitted message iteration 3 (4 bytes sent). [+] Transmitted message iteration 4 (4 bytes sent). [+] Transmitted message iteration 5 (4 bytes sent). [*] Sleeping 3 seconds to allow asynchronous kernel workers (ib_cm cm_work_handler) to run... [ 71.091907][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.092005][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [+] Reproducer completed successfully. [ 76.211117][ T30] cfg80211: failed to load regulatory.db