Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1260719 > unrolled thread

net: lockdep warning in ip_mc_msfget (net/ipv4/igmp.c:2400)

Started bySasha Levin <sasha.levin@oracle.com>
First post2015-11-02 16:30 +0100
Last post2015-11-03 12:30 +0100
Articles 4 — 3 participants

Back to article view | Back to linux.kernel

Contents

  net: lockdep warning in ip_mc_msfget (net/ipv4/igmp.c:2400) Sasha Levin <sasha.levin@oracle.com> - 2015-11-02 16:30 +0100
    Re: net: lockdep warning in ip_mc_msfget (net/ipv4/igmp.c:2400) Cong Wang <cwang@twopensource.com> - 2015-11-02 22:40 +0100
      Re: net: lockdep warning in ip_mc_msfget (net/ipv4/igmp.c:2400) Cong Wang <cwang@twopensource.com> - 2015-11-03 01:40 +0100
        Re: net: lockdep warning in ip_mc_msfget (net/ipv4/igmp.c:2400) Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2015-11-03 12:30 +0100

#1260719 — net: lockdep warning in ip_mc_msfget (net/ipv4/igmp.c:2400)

FromSasha Levin <sasha.levin@oracle.com>
Date2015-11-02 16:30 +0100
Subjectnet: lockdep warning in ip_mc_msfget (net/ipv4/igmp.c:2400)
Message-ID<qqpdv-6XC-3@gated-at.bofh.it>
Hi all,

While fuzzing with syzkaller inside a KVM tools guest running the latest -next, I saw
the following warning:

[ 2391.993558] ======================================================
[ 2391.995441] [ INFO: possible circular locking dependency detected ]
[ 2391.995771] 4.3.0-rc6-next-20151022-sasha-00042-g2b253a1-dirty #2618 Not tainted
[ 2391.995771] -------------------------------------------------------
[ 2391.995771] syzkaller_execu/14105 is trying to acquire lock:
[ 2391.995771] (rtnl_mutex){+.+.+.}, at: rtnl_lock (net/core/rtnetlink.c:71)
[ 2391.995771] Mutex: counter: 1 owner: None
[ 2391.995771]
[ 2391.995771] but task is already holding lock:
[ 2391.995771] (sk_lock-AF_INET){+.+.+.}, at: do_ip_getsockopt (net/ipv4/ip_sockglue.c:1274)
[ 2391.995771]
[ 2391.995771] which lock already depends on the new lock.
[ 2391.995771]
[ 2391.995771]
[ 2391.995771] the existing dependency chain (in reverse order) is:
[ 2391.995771] -> #1 (sk_lock-AF_INET){+.+.+.}:
[ 2391.995771] lock_acquire (kernel/locking/lockdep.c:3620)
[ 2391.995771] lock_sock_nested (include/linux/bottom_half.h:31 net/core/sock.c:2411)
[ 2391.995771] do_ip_setsockopt.isra.9 (net/ipv4/ip_sockglue.c:623)
[ 2391.995771] ip_setsockopt (net/ipv4/ip_sockglue.c:1202)
[ 2391.995771]        ffffffffffffff, 0x0)
[ 2391.995771] sock_common_setsockopt (net/core/sock.c:2610)
[ 2391.995771] SyS_setsockopt (net/socket.c:1756 net/socket.c:1736)
[ 2391.995771] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
[ 2391.995771] -> #0 (rtnl_mutex){+.+.+.}:
[ 2391.995771] __lock_acquire (kernel/locking/lockdep.c:1877 kernel/locking/lockdep.c:1982 kernel/locking/lockdep.c:2168 kernel/locking/lockdep.c:3239)
[ 2391.995771] lock_acquire (kernel/locking/lockdep.c:3620)
[ 2391.995771] mutex_lock_nested (kernel/locking/mutex.c:526 kernel/locking/mutex.c:618)
[ 2391.995771] rtnl_lock (net/core/rtnetlink.c:71)
[ 2391.995771] ip_mc_msfget (net/ipv4/igmp.c:2400)
[ 2391.995771] do_ip_getsockopt (net/ipv4/ip_sockglue.c:1401)
[ 2391.995771] ip_getsockopt (net/ipv4/ip_sockglue.c:1498)
[ 2391.995771] raw_getsockopt (net/ipv4/raw.c:851)
[ 2391.995771] sock_common_getsockopt (net/core/sock.c:2569)
[ 2391.995771] SyS_getsockopt (net/socket.c:1787 net/socket.c:1770)
[ 2391.995771] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
[ 2391.995771]
[ 2391.995771] other info that might help us debug this:
[ 2391.995771]
[ 2391.995771]  Possible unsafe locking scenario:
[ 2391.995771]
[ 2391.995771]        CPU0                    CPU1
[ 2391.995771]        ----                    ----
[ 2391.995771]   lock(sk_lock-AF_INET);
[ 2391.995771]                                lock(rtnl_mutex);
[ 2391.995771]                                lock(sk_lock-AF_INET);
[ 2391.995771]   lock(rtnl_mutex);
[ 2391.995771]
[ 2391.995771]  *** DEADLOCK ***
[ 2391.995771]
[ 2391.995771] 1 lock held by syzkaller_execu/14105:
[ 2391.995771] #0: (sk_lock-AF_INET){+.+.+.}, at: do_ip_getsockopt (net/ipv4/ip_sockglue.c:1274)
[ 2391.995771]
[ 2391.995771] stack backtrace:
[ 2391.995771] CPU: 1 PID: 14105 Comm: syzkaller_execu Not tainted 4.3.0-rc6-next-20151022-sasha-00042-g2b253a1-dirty #2618
[ 2391.995771]  0000000000000001 00000000c179c8c9 ffff8800a403f550 ffffffffade32a2b
[ 2391.995771]  ffffffffbb7f5a50 ffffffffbb84a4a0 ffffffffbb7f5a50 ffff8800a403f5a0
[ 2391.995771]  ffffffffac43fca8 ffff8800a403f690 00000000a3e18000 ffff8800a3e18000
[ 2391.995771] Call Trace:
[ 2391.995771] dump_stack (lib/dump_stack.c:52)
[ 2391.995771] print_circular_bug (kernel/locking/lockdep.c:1250)
[ 2391.995771] __lock_acquire (kernel/locking/lockdep.c:1877 kernel/locking/lockdep.c:1982 kernel/locking/lockdep.c:2168 kernel/locking/lockdep.c:3239)
[ 2391.995771] lock_acquire (kernel/locking/lockdep.c:3620)
[ 2391.995771] mutex_lock_nested (kernel/locking/mutex.c:526 kernel/locking/mutex.c:618)
[ 2391.995771] rtnl_lock (net/core/rtnetlink.c:71)
[ 2391.995771] ip_mc_msfget (net/ipv4/igmp.c:2400)
[ 2391.995771] do_ip_getsockopt (net/ipv4/ip_sockglue.c:1401)
[ 2391.995771] ip_getsockopt (net/ipv4/ip_sockglue.c:1498)
[ 2391.995771] raw_getsockopt (net/ipv4/raw.c:851)
[ 2391.995771] sock_common_getsockopt (net/core/sock.c:2569)
[ 2391.995771] SyS_getsockopt (net/socket.c:1787 net/socket.c:1770)
[ 2391.995771] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)


Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1260995

FromCong Wang <cwang@twopensource.com>
Date2015-11-02 22:40 +0100
Message-ID<qquZB-250-23@gated-at.bofh.it>
In reply to#1260719
On Mon, Nov 2, 2015 at 7:22 AM, Sasha Levin <sasha.levin@oracle.com> wrote:
> Hi all,
>
> While fuzzing with syzkaller inside a KVM tools guest running the latest -next, I saw
> the following warning:
>
> [ 2391.993558] ======================================================
> [ 2391.995441] [ INFO: possible circular locking dependency detected ]
> [ 2391.995771] 4.3.0-rc6-next-20151022-sasha-00042-g2b253a1-dirty #2618 Not tainted
> [ 2391.995771] -------------------------------------------------------
> [ 2391.995771] syzkaller_execu/14105 is trying to acquire lock:
> [ 2391.995771] (rtnl_mutex){+.+.+.}, at: rtnl_lock (net/core/rtnetlink.c:71)
> [ 2391.995771] Mutex: counter: 1 owner: None
> [ 2391.995771]
> [ 2391.995771] but task is already holding lock:
> [ 2391.995771] (sk_lock-AF_INET){+.+.+.}, at: do_ip_getsockopt (net/ipv4/ip_sockglue.c:1274)
> [ 2391.995771]
> [ 2391.995771] which lock already depends on the new lock.
> [ 2391.995771]
> [ 2391.995771]
> [ 2391.995771] the existing dependency chain (in reverse order) is:
> [ 2391.995771] -> #1 (sk_lock-AF_INET){+.+.+.}:
> [ 2391.995771] lock_acquire (kernel/locking/lockdep.c:3620)
> [ 2391.995771] lock_sock_nested (include/linux/bottom_half.h:31 net/core/sock.c:2411)
> [ 2391.995771] do_ip_setsockopt.isra.9 (net/ipv4/ip_sockglue.c:623)
> [ 2391.995771] ip_setsockopt (net/ipv4/ip_sockglue.c:1202)
> [ 2391.995771]        ffffffffffffff, 0x0)
> [ 2391.995771] sock_common_setsockopt (net/core/sock.c:2610)
> [ 2391.995771] SyS_setsockopt (net/socket.c:1756 net/socket.c:1736)
> [ 2391.995771] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
> [ 2391.995771] -> #0 (rtnl_mutex){+.+.+.}:
> [ 2391.995771] __lock_acquire (kernel/locking/lockdep.c:1877 kernel/locking/lockdep.c:1982 kernel/locking/lockdep.c:2168 kernel/locking/lockdep.c:3239)
> [ 2391.995771] lock_acquire (kernel/locking/lockdep.c:3620)
> [ 2391.995771] mutex_lock_nested (kernel/locking/mutex.c:526 kernel/locking/mutex.c:618)
> [ 2391.995771] rtnl_lock (net/core/rtnetlink.c:71)
> [ 2391.995771] ip_mc_msfget (net/ipv4/igmp.c:2400)
> [ 2391.995771] do_ip_getsockopt (net/ipv4/ip_sockglue.c:1401)
> [ 2391.995771] ip_getsockopt (net/ipv4/ip_sockglue.c:1498)
> [ 2391.995771] raw_getsockopt (net/ipv4/raw.c:851)
> [ 2391.995771] sock_common_getsockopt (net/core/sock.c:2569)
> [ 2391.995771] SyS_getsockopt (net/socket.c:1787 net/socket.c:1770)
> [ 2391.995771] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
> [ 2391.995771]
> [ 2391.995771] other info that might help us debug this:
> [ 2391.995771]
> [ 2391.995771]  Possible unsafe locking scenario:
> [ 2391.995771]
> [ 2391.995771]        CPU0                    CPU1
> [ 2391.995771]        ----                    ----
> [ 2391.995771]   lock(sk_lock-AF_INET);
> [ 2391.995771]                                lock(rtnl_mutex);
> [ 2391.995771]                                lock(sk_lock-AF_INET);
> [ 2391.995771]   lock(rtnl_mutex);
> [ 2391.995771]
> [ 2391.995771]  *** DEADLOCK ***
> [ 2391.995771]
> [ 2391.995771] 1 lock held by syzkaller_execu/14105:
> [ 2391.995771] #0: (sk_lock-AF_INET){+.+.+.}, at: do_ip_getsockopt (net/ipv4/ip_sockglue.c:1274)
> [ 2391.995771]
> [ 2391.995771] stack backtrace:
> [ 2391.995771] CPU: 1 PID: 14105 Comm: syzkaller_execu Not tainted 4.3.0-rc6-next-20151022-sasha-00042-g2b253a1-dirty #2618
> [ 2391.995771]  0000000000000001 00000000c179c8c9 ffff8800a403f550 ffffffffade32a2b
> [ 2391.995771]  ffffffffbb7f5a50 ffffffffbb84a4a0 ffffffffbb7f5a50 ffff8800a403f5a0
> [ 2391.995771]  ffffffffac43fca8 ffff8800a403f690 00000000a3e18000 ffff8800a3e18000
> [ 2391.995771] Call Trace:
> [ 2391.995771] dump_stack (lib/dump_stack.c:52)
> [ 2391.995771] print_circular_bug (kernel/locking/lockdep.c:1250)
> [ 2391.995771] __lock_acquire (kernel/locking/lockdep.c:1877 kernel/locking/lockdep.c:1982 kernel/locking/lockdep.c:2168 kernel/locking/lockdep.c:3239)
> [ 2391.995771] lock_acquire (kernel/locking/lockdep.c:3620)
> [ 2391.995771] mutex_lock_nested (kernel/locking/mutex.c:526 kernel/locking/mutex.c:618)
> [ 2391.995771] rtnl_lock (net/core/rtnetlink.c:71)
> [ 2391.995771] ip_mc_msfget (net/ipv4/igmp.c:2400)
> [ 2391.995771] do_ip_getsockopt (net/ipv4/ip_sockglue.c:1401)
> [ 2391.995771] ip_getsockopt (net/ipv4/ip_sockglue.c:1498)
> [ 2391.995771] raw_getsockopt (net/ipv4/raw.c:851)
> [ 2391.995771] sock_common_getsockopt (net/core/sock.c:2569)
> [ 2391.995771] SyS_getsockopt (net/socket.c:1787 net/socket.c:1770)
> [ 2391.995771] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)

Good catch!

This is probably introduced by:

commit baf606d9c9b12517e47e0d1370e8aa9f7323f210
Author: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Date:   Wed Mar 18 14:50:42 2015 -0300

    ipv4,ipv6: grab rtnl before locking the socket

I am thinking what is the right way to fix it...
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1261087

FromCong Wang <cwang@twopensource.com>
Date2015-11-03 01:40 +0100
Message-ID<qqxNM-3Pp-11@gated-at.bofh.it>
In reply to#1260995

[Multipart message — attachments visible in raw view] — view raw

On Mon, Nov 2, 2015 at 1:31 PM, Cong Wang <cwang@twopensource.com> wrote:
>
> Good catch!
>
> This is probably introduced by:
>
> commit baf606d9c9b12517e47e0d1370e8aa9f7323f210
> Author: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
> Date:   Wed Mar 18 14:50:42 2015 -0300
>
>     ipv4,ipv6: grab rtnl before locking the socket
>
> I am thinking what is the right way to fix it...

Please try the attached patch.

Thanks!

[toc] | [prev] | [next] | [standalone]

#1261421

FromMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Date2015-11-03 12:30 +0100
Message-ID<qqHWN-23s-1@gated-at.bofh.it>
In reply to#1261087
Em 02-11-2015 22:38, Cong Wang escreveu:
> On Mon, Nov 2, 2015 at 1:31 PM, Cong Wang <cwang@twopensource.com> wrote:
>>
>> Good catch!
>>
>> This is probably introduced by:
>>
>> commit baf606d9c9b12517e47e0d1370e8aa9f7323f210
>> Author: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
>> Date:   Wed Mar 18 14:50:42 2015 -0300
>>
>>      ipv4,ipv6: grab rtnl before locking the socket

Yes, that commit introduced this inverse order situation by not fixing 
the get path of it.

>> I am thinking what is the right way to fix it...
>
> Please try the attached patch.
>
> Thanks!

Patch LGTM, same design and covered all rtnl_lock()s I could find on get 
path now. Thanks!

   Marcelo

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web