======================================================
WARNING: possible circular locking dependency detected
6.8.0-rc4-syzkaller-g7e90b5c295ec #0 Not tainted
------------------------------------------------------
kworker/1:2/1052 is trying to acquire lock:
ffff88807cdd1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88807cdd1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
ffff88807cdd1088 (&priv->active_session_list_lock){+.-.}-{2:2}, at: j1939_session_activate+0x51/0x3e0 net/can/j1939/transport.c:1564

but task is already holding lock:
ffff888073bf75b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888073bf75b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: j1939_sk_queue_activate_next+0x58/0x3f0 net/can/j1939/socket.c:207

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&jsk->sk_session_queue_lock){+.-.}-{2:2}:
       lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
       spin_lock_bh include/linux/spinlock.h:356 [inline]
       j1939_sk_queue_drop_all+0x3a/0x240 net/can/j1939/socket.c:139
       j1939_sk_netdev_event_netdown+0xed/0x160 net/can/j1939/socket.c:1282
       j1939_netdev_notify+0xe2/0x140 net/can/j1939/main.c:381
       notifier_call_chain+0x18f/0x3b0 kernel/notifier.c:93
       __dev_notify_flags+0x207/0x400
       dev_change_flags+0xf0/0x1a0 net/core/dev.c:8725
       do_setlink+0xcb0/0x41c0 net/core/rtnetlink.c:2903
       __rtnl_newlink net/core/rtnetlink.c:3701 [inline]
       rtnl_newlink+0x180b/0x20a0 net/core/rtnetlink.c:3748
       rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6615
       netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543
       netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
       netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367
       netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908
       sock_sendmsg_nosec net/socket.c:730 [inline]
       __sock_sendmsg+0x221/0x270 net/socket.c:745
       ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
       ___sys_sendmsg net/socket.c:2638 [inline]
       __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
       do_syscall_64+0xf9/0x240
       entry_SYSCALL_64_after_hwframe+0x6f/0x77

-> #1 (&priv->j1939_socks_lock){+.-.}-{2:2}:
       lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
       spin_lock_bh include/linux/spinlock.h:356 [inline]
       j1939_sk_errqueue+0x96/0x150 net/can/j1939/socket.c:1083
       __j1939_session_release net/can/j1939/transport.c:294 [inline]
       kref_put include/linux/kref.h:65 [inline]
       j1939_session_put+0x103/0x470 net/can/j1939/transport.c:299
       j1939_session_deactivate_locked net/can/j1939/transport.c:1086 [inline]
       j1939_cancel_active_session+0x354/0x490 net/can/j1939/transport.c:2194
       j1939_netdev_notify+0xda/0x140 net/can/j1939/main.c:380
       notifier_call_chain+0x18f/0x3b0 kernel/notifier.c:93
       __dev_notify_flags+0x207/0x400
       dev_change_flags+0xf0/0x1a0 net/core/dev.c:8725
       do_setlink+0xcb0/0x41c0 net/core/rtnetlink.c:2903
       __rtnl_newlink net/core/rtnetlink.c:3701 [inline]
       rtnl_newlink+0x180b/0x20a0 net/core/rtnetlink.c:3748
       rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6615
       netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543
       netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
       netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367
       netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908
       sock_sendmsg_nosec net/socket.c:730 [inline]
       __sock_sendmsg+0x221/0x270 net/socket.c:745
       ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
       ___sys_sendmsg net/socket.c:2638 [inline]
       __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
       do_syscall_64+0xf9/0x240
       entry_SYSCALL_64_after_hwframe+0x6f/0x77

-> #0 (&priv->active_session_list_lock){+.-.}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3134 [inline]
       check_prevs_add kernel/locking/lockdep.c:3253 [inline]
       validate_chain+0x18ca/0x58e0 kernel/locking/lockdep.c:3869
       __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
       lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
       spin_lock_bh include/linux/spinlock.h:356 [inline]
       j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
       j1939_session_activate+0x51/0x3e0 net/can/j1939/transport.c:1564
       j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
       j1939_sk_queue_activate_next+0x270/0x3f0 net/can/j1939/socket.c:208
       j1939_session_deactivate_activate_next net/can/j1939/transport.c:1108 [inline]
       j1939_session_completed net/can/j1939/transport.c:1222 [inline]
       j1939_xtp_rx_eoma_one net/can/j1939/transport.c:1395 [inline]
       j1939_xtp_rx_eoma+0x327/0x530 net/can/j1939/transport.c:1410
       j1939_tp_cmd_recv net/can/j1939/transport.c:2099 [inline]
       j1939_tp_recv+0x88e/0x1050 net/can/j1939/transport.c:2144
       j1939_can_recv+0x732/0xb20 net/can/j1939/main.c:112
       deliver net/can/af_can.c:572 [inline]
       can_rcv_filter+0x359/0x7f0 net/can/af_can.c:606
       can_receive+0x327/0x480 net/can/af_can.c:663
       can_rcv+0x144/0x260 net/can/af_can.c:687
       __netif_receive_skb_one_core net/core/dev.c:5534 [inline]
       __netif_receive_skb+0x2e0/0x6a0 net/core/dev.c:5648
       process_backlog+0x385/0x760 net/core/dev.c:5976
       __napi_poll+0xcb/0x490 net/core/dev.c:6576
       napi_poll net/core/dev.c:6645 [inline]
       net_rx_action+0x78b/0x1010 net/core/dev.c:6778
       __do_softirq+0x2bb/0x942 kernel/softirq.c:553
       do_softirq+0x11b/0x1e0 kernel/softirq.c:454
       __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:381
       addrconf_dad_work+0xa44/0x16f0 net/ipv6/addrconf.c:4213
       process_one_work kernel/workqueue.c:2633 [inline]
       process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706
       worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
       kthread+0x2ef/0x390 kernel/kthread.c:388
       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242

other info that might help us debug this:

Chain exists of:
  &priv->active_session_list_lock --> &priv->j1939_socks_lock --> &jsk->sk_session_queue_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&jsk->sk_session_queue_lock);
                               lock(&priv->j1939_socks_lock);
                               lock(&jsk->sk_session_queue_lock);
  lock(&priv->active_session_list_lock);

 *** DEADLOCK ***

6 locks held by kworker/1:2/1052:
 #0: ffff88802aa82938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2608 [inline]
 #0: ffff88802aa82938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x825/0x1420 kernel/workqueue.c:2706
 #1: ffffc90004cefd20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2608 [inline]
 #1: ffffc90004cefd20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x825/0x1420 kernel/workqueue.c:2706
 #2: ffffffff8f374f48 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xd0/0x16f0 net/ipv6/addrconf.c:4129
 #3: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #3: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #3: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: process_backlog+0x2cd/0x760 net/core/dev.c:5975
 #4: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #4: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #4: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: can_receive+0x1c9/0x480 net/can/af_can.c:656
 #5: ffff888073bf75b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
 #5: ffff888073bf75b8 (&jsk->sk_session_queue_lock){+.-.}-{2:2}, at: j1939_sk_queue_activate_next+0x58/0x3f0 net/can/j1939/socket.c:207

stack backtrace:
CPU: 1 PID: 1052 Comm: kworker/1:2 Not tainted 6.8.0-rc4-syzkaller-g7e90b5c295ec #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187
 check_prev_add kernel/locking/lockdep.c:3134 [inline]
 check_prevs_add kernel/locking/lockdep.c:3253 [inline]
 validate_chain+0x18ca/0x58e0 kernel/locking/lockdep.c:3869
 __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
 lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
 _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:356 [inline]
 j1939_session_list_lock net/can/j1939/transport.c:238 [inline]
 j1939_session_activate+0x51/0x3e0 net/can/j1939/transport.c:1564
 j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
 j1939_sk_queue_activate_next+0x270/0x3f0 net/can/j1939/socket.c:208
 j1939_session_deactivate_activate_next net/can/j1939/transport.c:1108 [inline]
 j1939_session_completed net/can/j1939/transport.c:1222 [inline]
 j1939_xtp_rx_eoma_one net/can/j1939/transport.c:1395 [inline]
 j1939_xtp_rx_eoma+0x327/0x530 net/can/j1939/transport.c:1410
 j1939_tp_cmd_recv net/can/j1939/transport.c:2099 [inline]
 j1939_tp_recv+0x88e/0x1050 net/can/j1939/transport.c:2144
 j1939_can_recv+0x732/0xb20 net/can/j1939/main.c:112
 deliver net/can/af_can.c:572 [inline]
 can_rcv_filter+0x359/0x7f0 net/can/af_can.c:606
 can_receive+0x327/0x480 net/can/af_can.c:663
 can_rcv+0x144/0x260 net/can/af_can.c:687
 __netif_receive_skb_one_core net/core/dev.c:5534 [inline]
 __netif_receive_skb+0x2e0/0x6a0 net/core/dev.c:5648
 process_backlog+0x385/0x760 net/core/dev.c:5976
 __napi_poll+0xcb/0x490 net/core/dev.c:6576
 napi_poll net/core/dev.c:6645 [inline]
 net_rx_action+0x78b/0x1010 net/core/dev.c:6778
 __do_softirq+0x2bb/0x942 kernel/softirq.c:553
 do_softirq+0x11b/0x1e0 kernel/softirq.c:454
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:381
 addrconf_dad_work+0xa44/0x16f0 net/ipv6/addrconf.c:4213
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706
 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
 kthread+0x2ef/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
 </TASK>