hrtimer: interrupt took 29945 ns
================================
WARNING: inconsistent lock state
4.14.306-syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz-executor.1/8004 [HC0[0]:SC1[1]:HE1:SE0] takes:
(&(&local->client_conns_lock)->rlock){+.?.}, at: [<ffffffff867de3a1>] spin_lock include/linux/spinlock.h:317 [inline]
(&(&local->client_conns_lock)->rlock){+.?.}, at: [<ffffffff867de3a1>] rxrpc_put_one_client_conn net/rxrpc/conn_client.c:905 [inline]
(&(&local->client_conns_lock)->rlock){+.?.}, at: [<ffffffff867de3a1>] rxrpc_put_client_conn+0x661/0xac0 net/rxrpc/conn_client.c:957
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
rxrpc_get_client_conn net/rxrpc/conn_client.c:306 [inline]
rxrpc_connect_call+0x2bb/0x3e10 net/rxrpc/conn_client.c:692
rxrpc_new_client_call+0x8f4/0x1a10 net/rxrpc/call_object.c:276
rxrpc_new_client_call_for_sendmsg net/rxrpc/sendmsg.c:531 [inline]
rxrpc_do_sendmsg+0x8dc/0xfb0 net/rxrpc/sendmsg.c:583
rxrpc_sendmsg+0x3cf/0x5f0 net/rxrpc/af_rxrpc.c:543
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xb5/0x100 net/socket.c:656
___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
__sys_sendmsg+0xa3/0x120 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x27/0x40 net/socket.c:2103
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
irq event stamp: 374708
hardirqs last enabled at (374708): [<ffffffff8724fcb9>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
hardirqs last enabled at (374708): [<ffffffff8724fcb9>] _raw_spin_unlock_irqrestore+0x79/0xe0 kernel/locking/spinlock.c:192
hardirqs last disabled at (374707): [<ffffffff8724f946>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (374707): [<ffffffff8724f946>] _raw_spin_lock_irqsave+0x66/0xc0 kernel/locking/spinlock.c:160
softirqs last enabled at (372750): [<ffffffff86121096>] tcp_close+0x7e6/0xed0 net/ipv4/tcp.c:2307
softirqs last disabled at (374683): [<ffffffff81322e33>] invoke_softirq kernel/softirq.c:368 [inline]
softirqs last disabled at (374683): [<ffffffff81322e33>] irq_exit+0x193/0x240 kernel/softirq.c:409
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&(&local->client_conns_lock)->rlock);
<Interrupt>
lock(&(&local->client_conns_lock)->rlock);
*** DEADLOCK ***
1 lock held by syz-executor.1/8004:
#0: (rcu_callback){....}, at: [<ffffffff8146ee1e>] __rcu_reclaim kernel/rcu/rcu.h:185 [inline]
#0: (rcu_callback){....}, at: [<ffffffff8146ee1e>] rcu_do_batch kernel/rcu/tree.c:2699 [inline]
#0: (rcu_callback){....}, at: [<ffffffff8146ee1e>] invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline]
#0: (rcu_callback){....}, at: [<ffffffff8146ee1e>] __rcu_process_callbacks kernel/rcu/tree.c:2929 [inline]
#0: (rcu_callback){....}, at: [<ffffffff8146ee1e>] rcu_process_callbacks+0x84e/0x1180 kernel/rcu/tree.c:2946
stack backtrace:
CPU: 1 PID: 8004 Comm: syz-executor.1 Not tainted 4.14.306-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
print_usage_bug.cold+0x42e/0x570 kernel/locking/lockdep.c:2589
valid_state kernel/locking/lockdep.c:2602 [inline]
mark_lock_irq kernel/locking/lockdep.c:2796 [inline]
mark_lock+0xb4d/0x1050 kernel/locking/lockdep.c:3194
mark_irqflags kernel/locking/lockdep.c:3072 [inline]
__lock_acquire+0xc81/0x3f20 kernel/locking/lockdep.c:3448
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
rxrpc_put_one_client_conn net/rxrpc/conn_client.c:905 [inline]
rxrpc_put_client_conn+0x661/0xac0 net/rxrpc/conn_client.c:957
rxrpc_put_connection net/rxrpc/ar-internal.h:862 [inline]
rxrpc_rcu_destroy_call+0x83/0x190 net/rxrpc/call_object.c:653
__rcu_reclaim kernel/rcu/rcu.h:195 [inline]
rcu_do_batch kernel/rcu/tree.c:2699 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2929 [inline]
rcu_process_callbacks+0x780/0x1180 kernel/rcu/tree.c:2946
__do_softirq+0x24d/0x9ff kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796
</IRQ>
RIP: 0010:__read_once_size include/linux/compiler.h:185 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x1d/0x50 kernel/kcov.c:67
RSP: 0018:ffff8880b4c07c30 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: ffff8880ae9325c0 RBX: ffff88805266aedc RCX: 000000000000002e
RDX: 0000000000000000 RSI: 0000000000000fe4 RDI: ffff88805266aedc
RBP: ffff8880d266aedc R08: 0000000000000001 R09: ffffed100a4cd7d7
R10: ffff88805266bebf R11: 0000000000000000 R12: 000000005266aedc
R13: ffff88805266aedc R14: ffff88805266bec0 R15: ffff88805266aedc
__phys_addr+0x73/0xe0 arch/x86/mm/physaddr.c:30
kmap_to_page include/linux/highmem.h:51 [inline]
check_heap_object mm/usercopy.c:212 [inline]
__check_object_size mm/usercopy.c:242 [inline]
__check_object_size+0x6b/0x230 mm/usercopy.c:228
check_object_size include/linux/thread_info.h:121 [inline]
strncpy_from_user+0x89/0x2c0 lib/strncpy_from_user.c:117
getname_flags+0x10d/0x550 fs/namei.c:149
user_path_at_empty+0x2a/0x50 fs/namei.c:2631
user_path_at include/linux/namei.h:57 [inline]
vfs_statx+0xd1/0x180 fs/stat.c:185
vfs_lstat include/linux/fs.h:3072 [inline]
SYSC_newlstat fs/stat.c:349 [inline]
SyS_newlstat+0x83/0xe0 fs/stat.c:343
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f39f2ec20a6
RSP: 002b:00007fff5a9c3638 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 0000000000000043 RCX: 00007f39f2ec20a6
RDX: 00007fff5a9c3670 RSI: 00007fff5a9c3670 RDI: 00007fff5a9c3700
RBP: 00007fff5a9c3700 R08: 0000000000000001 R09: 00007fff5a9c34d0
R10: 0000555557157853 R11: 0000000000000246 R12: 00007f39f2f1db24
R13: 00007fff5a9c47c0 R14: 0000555557157810 R15: 00007fff5a9c4800
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
XFS (loop2): Mounting V4 Filesystem
XFS (loop2): Ending clean mount
overlayfs: fs on 'file0' does not support file handles, falling back to index=off.
overlayfs: fs on './file0' does not support file handles, falling back to index=off.
syz-executor.2 (10104) used greatest stack depth: 24520 bytes left
XFS (loop2): Unmounting Filesystem
netlink: 36 bytes leftover after parsing attributes in process `syz-executor.3'.
tc_ctl_action: received NO action attribs
XFS (loop2): Mounting V4 Filesystem
XFS (loop2): Ending clean mount
XFS (loop2): Unmounting Filesystem
XFS (loop2): Mounting V4 Filesystem
XFS (loop2): Ending clean mount
overlayfs: fs on 'file0' does not support file handles, falling back to index=off.
overlayfs: fs on './file0' does not support file handles, falling back to index=off.
overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.
XFS (loop2): Unmounting Filesystem
mmap: syz-executor.5 (10454) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt.
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'.
unregister_netdevice: waiting for ip6gre0 to become free. Usage count = -1
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'.
PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex
PF_BRIDGE: RTM_SETLINK with unknown ifindex
x_tables: ip_tables: rpfilter match: used from hooks PREROUTING/OUTPUT, but only valid from PREROUTING
x_tables: ip_tables: rpfilter match: used from hooks PREROUTING/OUTPUT, but only valid from PREROUTING
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
x_tables: ip_tables: rpfilter match: used from hooks PREROUTING/OUTPUT, but only valid from PREROUTING
======================================================
WARNING: the mand mount option is being deprecated and
will be removed in v5.15!
======================================================
x_tables: ip_tables: rpfilter match: used from hooks PREROUTING/OUTPUT, but only valid from PREROUTING
kauditd_printk_skb: 11 callbacks suppressed
audit: type=1800 audit(1677121182.483:23): pid=11025 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.4" name="file2" dev="sda1" ino=13961 res=0
audit: type=1804 audit(1677121183.062:24): pid=11053 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir4269513493/syzkaller.XS0A5d/82/bus" dev="sda1" ino=14156 res=1
audit: type=1804 audit(1677121183.082:25): pid=11053 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.1" name="/root/syzkaller-testdir4269513493/syzkaller.XS0A5d/82/bus" dev="sda1" ino=14156 res=1