======================================================
WARNING: possible circular locking dependency detected
4.13.0-rc6-next-20170825+ #9 Not tainted
------------------------------------------------------
syz-executor7/3508 is trying to acquire lock:
 (cpu_hotplug_lock.rw_sem){++++}, at: [<ffffffff8185325d>] static_key_slow_inc+0x9d/0x3c0 kernel/jump_label.c:123

but task is already holding lock:
 (rtnl_mutex){+.+.}, at: [<ffffffff83ed8cfc>] rtnl_lock net/core/rtnetlink.c:72 [inline]
 (rtnl_mutex){+.+.}, at: [<ffffffff83ed8cfc>] rtnetlink_rcv_msg+0x65c/0x1090 net/core/rtnetlink.c:4241

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (rtnl_mutex){+.+.}:
       check_prevs_add kernel/locking/lockdep.c:2020 [inline]
       validate_chain kernel/locking/lockdep.c:2469 [inline]
       __lock_acquire+0x3286/0x4620 kernel/locking/lockdep.c:3498
       lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
       __mutex_lock_common kernel/locking/mutex.c:756 [inline]
       __mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893
       mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
       rtnl_lock+0x17/0x20 net/core/rtnetlink.c:72
       addrconf_dad_work+0xbb/0xfc0 net/ipv6/addrconf.c:3890
       process_one_work+0xbfd/0x1be0 kernel/workqueue.c:2098
       worker_thread+0x223/0x1860 kernel/workqueue.c:2233
       kthread+0x39c/0x470 kernel/kthread.c:231
       ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

-> #2 ((&(&ifa->dad_work)->work)){+.+.}:
       process_one_work+0xba5/0x1be0 kernel/workqueue.c:2095
       worker_thread+0x223/0x1860 kernel/workqueue.c:2233
       kthread+0x39c/0x470 kernel/kthread.c:231
       ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
       0xffffffffffffffff

-> #1 ((complete)&rcu.completion){+.+.}:
       check_prevs_add kernel/locking/lockdep.c:2020 [inline]
       validate_chain kernel/locking/lockdep.c:2469 [inline]
       __lock_acquire+0x3286/0x4620 kernel/locking/lockdep.c:3498
       lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
       complete_acquire include/linux/completion.h:39 [inline]
       __wait_for_common kernel/sched/completion.c:108 [inline]
       wait_for_common kernel/sched/completion.c:122 [inline]
       wait_for_completion+0xc8/0x770 kernel/sched/completion.c:143
       __synchronize_srcu+0x1b5/0x250 kernel/rcu/srcutree.c:898
       synchronize_srcu_expedited kernel/rcu/srcutree.c:923 [inline]
       synchronize_srcu+0x1a3/0x560 kernel/rcu/srcutree.c:974
       quarantine_remove_cache+0xd7/0xf0 mm/kasan/quarantine.c:327
       kasan_cache_shrink+0x9/0x10 mm/kasan/kasan.c:380
       kmem_cache_shrink+0x15/0x30 mm/slab_common.c:857
       acpi_os_purge_cache+0x15/0x20 drivers/acpi/osl.c:1560
       acpi_purge_cached_objects+0x38/0xc9 drivers/acpi/acpica/utxface.c:271
       acpi_initialize_objects+0xc5/0x112 drivers/acpi/acpica/utxfinit.c:302
       acpi_bus_init drivers/acpi/bus.c:1131 [inline]
       acpi_init+0x23c/0x8e6 drivers/acpi/bus.c:1220
       do_one_initcall+0x9e/0x330 init/main.c:826
       do_initcall_level init/main.c:892 [inline]
       do_initcalls init/main.c:900 [inline]
       do_basic_setup init/main.c:918 [inline]
       kernel_init_freeable+0x469/0x521 init/main.c:1066
       kernel_init+0x13/0x172 init/main.c:993
       ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

-> #0 (cpu_hotplug_lock.rw_sem){++++}:
       check_prev_add+0x865/0x1520 kernel/locking/lockdep.c:1894
       check_prevs_add kernel/locking/lockdep.c:2020 [inline]
       validate_chain kernel/locking/lockdep.c:2469 [inline]
       __lock_acquire+0x3286/0x4620 kernel/locking/lockdep.c:3498
       lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
       percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:35 [inline]
       percpu_down_read include/linux/percpu-rwsem.h:58 [inline]
       cpus_read_lock+0x42/0x90 kernel/cpu.c:218
       static_key_slow_inc+0x9d/0x3c0 kernel/jump_label.c:123
       ip_tunnel_need_metadata+0x15/0x20 net/ipv4/ip_tunnel_core.c:431
       fib_nl_newrule+0x192f/0x2b80 net/core/fib_rules.c:610
       rtnetlink_rcv_msg+0x733/0x1090 net/core/rtnetlink.c:4246
       netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397
       rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4258
       netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]
       netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291
       netlink_sendmsg+0xa4a/0xe70 net/netlink/af_netlink.c:1854
       sock_sendmsg_nosec net/socket.c:633 [inline]
       sock_sendmsg+0xca/0x110 net/socket.c:643
       sock_write_iter+0x320/0x5e0 net/socket.c:912
       call_write_iter include/linux/fs.h:1744 [inline]
       do_iter_readv_writev+0x531/0x7f0 fs/read_write.c:650
       do_iter_write+0x15a/0x540 fs/read_write.c:929
       vfs_writev+0x18a/0x340 fs/read_write.c:975
       do_writev+0xfc/0x2a0 fs/read_write.c:1011
       SYSC_writev fs/read_write.c:1084 [inline]
       SyS_writev+0x27/0x30 fs/read_write.c:1081
       entry_SYSCALL_64_fastpath+0x1f/0xbe

other info that might help us debug this:

Chain exists of:
  cpu_hotplug_lock.rw_sem --> (&(&ifa->dad_work)->work) --> rtnl_mutex

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(rtnl_mutex);
                               lock((&(&ifa->dad_work)->work));
                               lock(rtnl_mutex);
  lock(cpu_hotplug_lock.rw_sem);

 *** DEADLOCK ***

1 lock held by syz-executor7/3508:
 #0:  (rtnl_mutex){+.+.}, at: [<ffffffff83ed8cfc>] rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0:  (rtnl_mutex){+.+.}, at: [<ffffffff83ed8cfc>] rtnetlink_rcv_msg+0x65c/0x1090 net/core/rtnetlink.c:4241

stack backtrace:
CPU: 0 PID: 3508 Comm: syz-executor7 Not tainted 4.13.0-rc6-next-20170825+ #9
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 print_circular_bug+0x503/0x710 kernel/locking/lockdep.c:1259
 check_prev_add+0x865/0x1520 kernel/locking/lockdep.c:1894
 check_prevs_add kernel/locking/lockdep.c:2020 [inline]
 validate_chain kernel/locking/lockdep.c:2469 [inline]
 __lock_acquire+0x3286/0x4620 kernel/locking/lockdep.c:3498
 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002
 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:35 [inline]
 percpu_down_read include/linux/percpu-rwsem.h:58 [inline]
 cpus_read_lock+0x42/0x90 kernel/cpu.c:218
 static_key_slow_inc+0x9d/0x3c0 kernel/jump_label.c:123
 ip_tunnel_need_metadata+0x15/0x20 net/ipv4/ip_tunnel_core.c:431
 fib_nl_newrule+0x192f/0x2b80 net/core/fib_rules.c:610
 rtnetlink_rcv_msg+0x733/0x1090 net/core/rtnetlink.c:4246
 netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4258
 netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]
 netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291
 netlink_sendmsg+0xa4a/0xe70 net/netlink/af_netlink.c:1854
 sock_sendmsg_nosec net/socket.c:633 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:643
 sock_write_iter+0x320/0x5e0 net/socket.c:912
 call_write_iter include/linux/fs.h:1744 [inline]
 do_iter_readv_writev+0x531/0x7f0 fs/read_write.c:650
 do_iter_write+0x15a/0x540 fs/read_write.c:929
 vfs_writev+0x18a/0x340 fs/read_write.c:975
 do_writev+0xfc/0x2a0 fs/read_write.c:1011
 SYSC_writev fs/read_write.c:1084 [inline]
 SyS_writev+0x27/0x30 fs/read_write.c:1081
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x446749
RSP: 002b:00007fdd5d17dc08 EFLAGS: 00000296 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000000446749
RDX: 0000000000000001 RSI: 0000000020917ff0 RDI: 000000000000001a
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 00000000ffffffff
R13: 00000000000057d0 R14: 00000000006e7890 R15: 0000000000000000
netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20013. Sending cookies.  Check SNMP counters.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'.
netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'.
semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant.
The task syz-executor2 (3629) triggered the difference, watch for misbehavior.