Hello, syzbot found the following issue on: HEAD commit: eff99d8edbed Add linux-next specific files for 20231117 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=1155289f680000 kernel config: https://syzkaller.appspot.com/x/.config?x=61991b2630c19677 dashboard link: https://syzkaller.appspot.com/bug?extid=db9ad150a8969744d703 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/727bd99b8512/disk-eff99d8e.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/4a535e264e50/vmlinux-eff99d8e.xz kernel image: https://storage.googleapis.com/syzbot-assets/23c31e53f4d8/bzImage-eff99d8e.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+db9ad150a8969744d703@xxxxxxxxxxxxxxxxxxxxxxxxx ===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 6.7.0-rc1-next-20231117-syzkaller #0 Not tainted ----------------------------------------------------- syz-executor.3/8448 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire: ffff888031a44a18 (&sighand->siglock){+.+.}-{2:2}, at: __lock_task_sighand+0xc2/0x340 kernel/signal.c:1422 and this task is already holding: ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4381 [inline] ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: __dev_direct_xmit+0x431/0x730 net/core/dev.c:4400 which would create a new lock dependency: (_xmit_NONE#2){+...}-{2:2} -> (&sighand->siglock){+.+.}-{2:2} but this new dependency connects a SOFTIRQ-irq-safe lock: (&dev->tx_global_lock){+.-.}-{2:2} ... which became SOFTIRQ-irq-safe at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] dev_watchdog+0x7f/0x8b0 net/sched/sch_generic.c:500 call_timer_fn+0x1a0/0x5a0 kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x769/0xb20 kernel/time/timer.c:2022 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035 __do_softirq+0x216/0x8d5 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0xb5/0x120 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:112 acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:707 cpuidle_enter_state+0x83/0x500 drivers/cpuidle/cpuidle.c:267 cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:388 cpuidle_idle_call kernel/sched/idle.c:215 [inline] do_idle+0x314/0x3f0 kernel/sched/idle.c:312 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:410 rest_init+0x16f/0x2b0 init/main.c:730 arch_call_rest_init+0x13/0x30 init/main.c:827 start_kernel+0x39e/0x480 init/main.c:1072 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:555 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:536 secondary_startup_64_no_verify+0x166/0x16b to a SOFTIRQ-irq-unsafe lock: (&sighand->siglock){+.+.}-{2:2} ... which became SOFTIRQ-irq-unsafe at: ... lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:530 [inline] ptrace_set_stopped kernel/ptrace.c:391 [inline] ptrace_attach+0x401/0x650 kernel/ptrace.c:478 __do_sys_ptrace+0x204/0x230 kernel/ptrace.c:1290 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a other info that might help us debug this: Chain exists of: &dev->tx_global_lock --> _xmit_NONE#2 --> &sighand->siglock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sighand->siglock); local_irq_disable(); lock(&dev->tx_global_lock); lock(_xmit_NONE#2); <Interrupt> lock(&dev->tx_global_lock); *** DEADLOCK *** 3 locks held by syz-executor.3/8448: #0: ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #0: ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4381 [inline] #0: ffff88802462ccd8 (_xmit_NONE#2){+...}-{2:2}, at: __dev_direct_xmit+0x431/0x730 net/core/dev.c:4400 #1: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline] #1: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #1: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2310 [inline] #1: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xe4/0x410 kernel/trace/bpf_trace.c:2350 #2: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline] #2: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #2: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: __lock_task_sighand+0x3f/0x340 kernel/signal.c:1405 the dependencies between SOFTIRQ-irq-safe lock and the holding lock: -> (&dev->tx_global_lock){+.-.}-{2:2} { HARDIRQ-ON-W at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] netif_tx_lock net/sched/sch_generic.c:467 [inline] netif_tx_lock_bh include/linux/netdevice.h:4465 [inline] dev_watchdog_down net/sched/sch_generic.c:564 [inline] dev_deactivate_many+0x1c6/0xb30 net/sched/sch_generic.c:1350 dev_deactivate+0xed/0x1b0 net/sched/sch_generic.c:1384 linkwatch_do_dev+0x115/0x150 net/core/link_watch.c:180 __linkwatch_run_queue+0x233/0x680 net/core/link_watch.c:235 linkwatch_event+0x8f/0xc0 net/core/link_watch.c:278 process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2636 process_scheduled_works kernel/workqueue.c:2709 [inline] worker_thread+0x8b6/0x1290 kernel/workqueue.c:2790 kthread+0x2c1/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 IN-SOFTIRQ-W at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] dev_watchdog+0x7f/0x8b0 net/sched/sch_generic.c:500 call_timer_fn+0x1a0/0x5a0 kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x769/0xb20 kernel/time/timer.c:2022 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035 __do_softirq+0x216/0x8d5 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0xb5/0x120 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:112 acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:707 cpuidle_enter_state+0x83/0x500 drivers/cpuidle/cpuidle.c:267 cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:388 cpuidle_idle_call kernel/sched/idle.c:215 [inline] do_idle+0x314/0x3f0 kernel/sched/idle.c:312 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:410 rest_init+0x16f/0x2b0 init/main.c:730 arch_call_rest_init+0x13/0x30 init/main.c:827 start_kernel+0x39e/0x480 init/main.c:1072 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:555 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:536 secondary_startup_64_no_verify+0x166/0x16b INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] netif_tx_lock net/sched/sch_generic.c:467 [inline] netif_tx_lock_bh include/linux/netdevice.h:4465 [inline] dev_watchdog_down net/sched/sch_generic.c:564 [inline] dev_deactivate_many+0x1c6/0xb30 net/sched/sch_generic.c:1350 dev_deactivate+0xed/0x1b0 net/sched/sch_generic.c:1384 linkwatch_do_dev+0x115/0x150 net/core/link_watch.c:180 __linkwatch_run_queue+0x233/0x680 net/core/link_watch.c:235 linkwatch_event+0x8f/0xc0 net/core/link_watch.c:278 process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2636 process_scheduled_works kernel/workqueue.c:2709 [inline] worker_thread+0x8b6/0x1290 kernel/workqueue.c:2790 kthread+0x2c1/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 } ... key at: [<ffffffff92b3a960>] __key.7+0x0/0x40 -> (_xmit_NONE#2){+...}-{2:2} { HARDIRQ-ON-W at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __netif_tx_lock include/linux/netdevice.h:4381 [inline] netif_freeze_queues+0xdd/0x1e0 net/sched/sch_generic.c:459 netif_tx_lock net/sched/sch_generic.c:468 [inline] netif_tx_lock_bh include/linux/netdevice.h:4465 [inline] dev_watchdog_down net/sched/sch_generic.c:564 [inline] dev_deactivate_many+0x1ce/0xb30 net/sched/sch_generic.c:1350 __dev_close_many+0x133/0x2f0 net/core/dev.c:1518 __dev_close net/core/dev.c:1543 [inline] __dev_change_flags+0x4e5/0x730 net/core/dev.c:8603 dev_change_flags+0x9a/0x170 net/core/dev.c:8677 do_setlink+0x1a2f/0x3fa0 net/core/rtnetlink.c:2916 rtnl_group_changelink net/core/rtnetlink.c:3458 [inline] __rtnl_newlink+0xded/0x1930 net/core/rtnetlink.c:3717 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3754 rtnetlink_rcv_msg+0x3c7/0xe00 net/core/rtnetlink.c:6558 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x939/0xe40 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __netif_tx_lock include/linux/netdevice.h:4381 [inline] netif_freeze_queues+0xdd/0x1e0 net/sched/sch_generic.c:459 netif_tx_lock net/sched/sch_generic.c:468 [inline] netif_tx_lock_bh include/linux/netdevice.h:4465 [inline] dev_watchdog_down net/sched/sch_generic.c:564 [inline] dev_deactivate_many+0x1ce/0xb30 net/sched/sch_generic.c:1350 __dev_close_many+0x133/0x2f0 net/core/dev.c:1518 __dev_close net/core/dev.c:1543 [inline] __dev_change_flags+0x4e5/0x730 net/core/dev.c:8603 dev_change_flags+0x9a/0x170 net/core/dev.c:8677 do_setlink+0x1a2f/0x3fa0 net/core/rtnetlink.c:2916 rtnl_group_changelink net/core/rtnetlink.c:3458 [inline] __rtnl_newlink+0xded/0x1930 net/core/rtnetlink.c:3717 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3754 rtnetlink_rcv_msg+0x3c7/0xe00 net/core/rtnetlink.c:6558 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x939/0xe40 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a } ... key at: [<ffffffff92b3b360>] netdev_xmit_lock_key+0x380/0x3c0 ... acquired at: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __netif_tx_lock include/linux/netdevice.h:4381 [inline] netif_freeze_queues+0xdd/0x1e0 net/sched/sch_generic.c:459 netif_tx_lock net/sched/sch_generic.c:468 [inline] netif_tx_lock_bh include/linux/netdevice.h:4465 [inline] dev_watchdog_down net/sched/sch_generic.c:564 [inline] dev_deactivate_many+0x1ce/0xb30 net/sched/sch_generic.c:1350 __dev_close_many+0x133/0x2f0 net/core/dev.c:1518 __dev_close net/core/dev.c:1543 [inline] __dev_change_flags+0x4e5/0x730 net/core/dev.c:8603 dev_change_flags+0x9a/0x170 net/core/dev.c:8677 do_setlink+0x1a2f/0x3fa0 net/core/rtnetlink.c:2916 rtnl_group_changelink net/core/rtnetlink.c:3458 [inline] __rtnl_newlink+0xded/0x1930 net/core/rtnetlink.c:3717 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3754 rtnetlink_rcv_msg+0x3c7/0xe00 net/core/rtnetlink.c:6558 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x939/0xe40 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: -> (&sighand->siglock){+.+.}-{2:2} { HARDIRQ-ON-W at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:530 [inline] ptrace_set_stopped kernel/ptrace.c:391 [inline] ptrace_attach+0x401/0x650 kernel/ptrace.c:478 __do_sys_ptrace+0x204/0x230 kernel/ptrace.c:1290 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a SOFTIRQ-ON-W at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:530 [inline] ptrace_set_stopped kernel/ptrace.c:391 [inline] ptrace_attach+0x401/0x650 kernel/ptrace.c:478 __do_sys_ptrace+0x204/0x230 kernel/ptrace.c:1290 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0x36/0x50 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:376 [inline] calculate_sigpending+0x44/0xa0 kernel/signal.c:197 ret_from_fork+0x23/0x80 arch/x86/kernel/process.c:143 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 } ... key at: [<ffffffff90b4af80>] __key.341+0x0/0x40 ... acquired at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 __lock_task_sighand+0xc2/0x340 kernel/signal.c:1422 lock_task_sighand include/linux/sched/signal.h:748 [inline] do_send_sig_info kernel/signal.c:1309 [inline] group_send_sig_info+0x288/0x300 kernel/signal.c:1460 bpf_send_signal_common+0x2e4/0x3a0 kernel/trace/bpf_trace.c:877 ____bpf_send_signal kernel/trace/bpf_trace.c:882 [inline] bpf_send_signal+0x19/0x20 kernel/trace/bpf_trace.c:880 bpf_prog_a7bf4e27797d188e+0x22/0x24 bpf_dispatcher_nop_func include/linux/bpf.h:1196 [inline] __bpf_prog_run include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2311 [inline] bpf_trace_run2+0x14e/0x410 kernel/trace/bpf_trace.c:2350 trace_kfree include/trace/events/kmem.h:94 [inline] kfree+0xf6/0x150 mm/slab_common.c:1043 skb_kfree_head net/core/skbuff.c:950 [inline] skb_free_head+0x110/0x1b0 net/core/skbuff.c:962 skb_release_data+0x5ba/0x870 net/core/skbuff.c:992 skb_release_all net/core/skbuff.c:1058 [inline] __kfree_skb net/core/skbuff.c:1072 [inline] kfree_skb_reason+0x12d/0x210 net/core/skbuff.c:1108 kfree_skb include/linux/skbuff.h:1234 [inline] can_dropped_invalid_skb+0x9e/0x7c0 drivers/net/can/dev/skb.c:370 vcan_tx+0x77/0xa90 drivers/net/can/vcan.c:92 __netdev_start_xmit include/linux/netdevice.h:4918 [inline] netdev_start_xmit include/linux/netdevice.h:4932 [inline] __dev_direct_xmit+0x59a/0x730 net/core/dev.c:4402 dev_direct_xmit include/linux/netdevice.h:3125 [inline] packet_xmit+0x201/0x380 net/packet/af_packet.c:285 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a stack backtrace: CPU: 1 PID: 8448 Comm: syz-executor.3 Not tainted 6.7.0-rc1-next-20231117-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline] check_irq_usage+0xe18/0x1470 kernel/locking/lockdep.c:2865 check_prev_add kernel/locking/lockdep.c:3138 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x247c/0x3b10 kernel/locking/lockdep.c:5136 lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 __lock_task_sighand+0xc2/0x340 kernel/signal.c:1422 lock_task_sighand include/linux/sched/signal.h:748 [inline] do_send_sig_info kernel/signal.c:1309 [inline] group_send_sig_info+0x288/0x300 kernel/signal.c:1460 bpf_send_signal_common+0x2e4/0x3a0 kernel/trace/bpf_trace.c:877 ____bpf_send_signal kernel/trace/bpf_trace.c:882 [inline] bpf_send_signal+0x19/0x20 kernel/trace/bpf_trace.c:880 bpf_prog_a7bf4e27797d188e+0x22/0x24 bpf_dispatcher_nop_func include/linux/bpf.h:1196 [inline] __bpf_prog_run include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2311 [inline] bpf_trace_run2+0x14e/0x410 kernel/trace/bpf_trace.c:2350 trace_kfree include/trace/events/kmem.h:94 [inline] kfree+0xf6/0x150 mm/slab_common.c:1043 skb_kfree_head net/core/skbuff.c:950 [inline] skb_free_head+0x110/0x1b0 net/core/skbuff.c:962 skb_release_data+0x5ba/0x870 net/core/skbuff.c:992 skb_release_all net/core/skbuff.c:1058 [inline] __kfree_skb net/core/skbuff.c:1072 [inline] kfree_skb_reason+0x12d/0x210 net/core/skbuff.c:1108 kfree_skb include/linux/skbuff.h:1234 [inline] can_dropped_invalid_skb+0x9e/0x7c0 drivers/net/can/dev/skb.c:370 vcan_tx+0x77/0xa90 drivers/net/can/vcan.c:92 __netdev_start_xmit include/linux/netdevice.h:4918 [inline] netdev_start_xmit include/linux/netdevice.h:4932 [inline] __dev_direct_xmit+0x59a/0x730 net/core/dev.c:4402 dev_direct_xmit include/linux/netdevice.h:3125 [inline] packet_xmit+0x201/0x380 net/packet/af_packet.c:285 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a RIP: 0033:0x7f36a647cae9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f36a71eb0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f36a659bf80 RCX: 00007f36a647cae9 RDX: 000000000000fc13 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f36a64c847a R08: 0000000000000000 R09: 000000000000002f R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f36a659bf80 R15: 00007fff7fb05d78 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup
