linux-bluetooth.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* WARNING: bad unlock balance in __dev_queue_xmit
@ 2020-01-11 21:34 syzbot
  2020-01-11 23:38 ` Cong Wang
  0 siblings, 1 reply; 3+ messages in thread
From: syzbot @ 2020-01-11 21:34 UTC (permalink / raw)
  To: a, alex.aring, allison, andrew, andy, ap420073, ast, b.a.t.m.a.n,
	bridge, cleech, daniel, davem, dsa, f.fainelli, fw, gregkh,
	gustavo, haiyangz, info, j.vosburgh, j, jakub.kicinski, jhs,
	jiri, johan.hedberg, johannes.berg, john.hurley, jwi, kstewart,
	kuznet, kvalo, kys, linmiaohe, linux-bluetooth, linux-hams,
	linux-hyperv, linux-kernel, linux-ppp, linux-wireless,
	linux-wpan, liuhangbin, marcel, mareklindner, mkubecek, mmanning,
	netdev, nikolay, oss-drivers, pabeni, paulus

Hello,

syzbot found the following crash on:

HEAD commit:    ae608821 Merge tag 'trace-v5.5-rc5' of git://git.kernel.or..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12abc515e00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=18698c0c240ba616
dashboard link: https://syzkaller.appspot.com/bug?extid=ad4ea1dd5d26131a58a6
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=141051b9e00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=125e5876e00000

The bug was bisected to:

commit ab92d68fc22f9afab480153bd82a20f6e2533769
Author: Taehee Yoo <ap420073@gmail.com>
Date:   Mon Oct 21 18:47:51 2019 +0000

     net: core: add generic lockdep keys

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=107f969ee00000
final crash:    https://syzkaller.appspot.com/x/report.txt?x=127f969ee00000
console output: https://syzkaller.appspot.com/x/log.txt?x=147f969ee00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ad4ea1dd5d26131a58a6@syzkaller.appspotmail.com
Fixes: ab92d68fc22f ("net: core: add generic lockdep keys")

=====================================
WARNING: bad unlock balance detected!
5.5.0-rc5-syzkaller #0 Not tainted
-------------------------------------
swapper/0/0 is trying to release lock (&dev->qdisc_xmit_lock_key) at:
[<ffffffff8625890d>] spin_unlock include/linux/spinlock.h:378 [inline]
[<ffffffff8625890d>] __netif_tx_unlock include/linux/netdevice.h:3966  
[inline]
[<ffffffff8625890d>] __dev_queue_xmit+0x2bbd/0x35c0 net/core/dev.c:4016
but there are no more locks to release!

other info that might help us debug this:
4 locks held by swapper/0/0:
  #0: ffffc90000007d50 ((&ndev->rs_timer)){+.-.}, at: lockdep_copy_map  
include/linux/lockdep.h:172 [inline]
  #0: ffffc90000007d50 ((&ndev->rs_timer)){+.-.}, at:  
call_timer_fn+0xe0/0x780 kernel/time/timer.c:1394
  #1: ffffffff899a5340 (rcu_read_lock){....}, at: ip6_nd_hdr  
net/ipv6/ndisc.c:463 [inline]
  #1: ffffffff899a5340 (rcu_read_lock){....}, at:  
ndisc_send_skb+0x7fe/0x1490 net/ipv6/ndisc.c:499
  #2: ffffffff899a5300 (rcu_read_lock_bh){....}, at: lwtunnel_xmit_redirect  
include/net/lwtunnel.h:92 [inline]
  #2: ffffffff899a5300 (rcu_read_lock_bh){....}, at:  
ip6_finish_output2+0x214/0x25c0 net/ipv6/ip6_output.c:102
  #3: ffffffff899a5300 (rcu_read_lock_bh){....}, at:  
__dev_queue_xmit+0x20a/0x35c0 net/core/dev.c:3948

stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  <IRQ>
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x197/0x210 lib/dump_stack.c:118
  print_unlock_imbalance_bug kernel/locking/lockdep.c:4008 [inline]
  print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3984
  __lock_release kernel/locking/lockdep.c:4242 [inline]
  lock_release+0x5f2/0x960 kernel/locking/lockdep.c:4503
  __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
  _raw_spin_unlock+0x16/0x40 kernel/locking/spinlock.c:183
  spin_unlock include/linux/spinlock.h:378 [inline]
  __netif_tx_unlock include/linux/netdevice.h:3966 [inline]
  __dev_queue_xmit+0x2bbd/0x35c0 net/core/dev.c:4016
  dev_queue_xmit+0x18/0x20 net/core/dev.c:4046
  neigh_hh_output include/net/neighbour.h:499 [inline]
  neigh_output include/net/neighbour.h:508 [inline]
  ip6_finish_output2+0xfbe/0x25c0 net/ipv6/ip6_output.c:116
  __ip6_finish_output+0x444/0xaa0 net/ipv6/ip6_output.c:142
  ip6_finish_output+0x38/0x1f0 net/ipv6/ip6_output.c:152
  NF_HOOK_COND include/linux/netfilter.h:296 [inline]
  ip6_output+0x25e/0x880 net/ipv6/ip6_output.c:175
  dst_output include/net/dst.h:436 [inline]
  NF_HOOK include/linux/netfilter.h:307 [inline]
  ndisc_send_skb+0xf1f/0x1490 net/ipv6/ndisc.c:505
  ndisc_send_rs+0x134/0x720 net/ipv6/ndisc.c:699
  addrconf_rs_timer+0x30f/0x6e0 net/ipv6/addrconf.c:3879
  call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
  expire_timers kernel/time/timer.c:1449 [inline]
  __run_timers kernel/time/timer.c:1773 [inline]
  __run_timers kernel/time/timer.c:1740 [inline]
  run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
  __do_softirq+0x262/0x98c kernel/softirq.c:292
  invoke_softirq kernel/softirq.c:373 [inline]
  irq_exit+0x19b/0x1e0 kernel/softirq.c:413
  exiting_irq arch/x86/include/asm/apic.h:536 [inline]
  smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137
  apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
  </IRQ>
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
Code: 38 be db f9 eb 8a cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d c4 54 51  
00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d b4 54 51 00 fb f4 <c3> cc 55 48 89  
e5 41 57 41 56 41 55 41 54 53 e8 5e 92 8b f9 e8 c9
RSP: 0018:ffffffff89807ce8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff132669e RBX: ffffffff8987a140 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffffffff8987a9d4
RBP: ffffffff89807d18 R08: ffffffff8987a140 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffffff8a7b8600 R14: 0000000000000000 R15: 0000000000000000
  arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
  default_idle_call+0x84/0xb0 kernel/sched/idle.c:94
  cpuidle_idle_call kernel/sched/idle.c:154 [inline]
  do_idle+0x3c8/0x6e0 kernel/sched/idle.c:269
  cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
  rest_init+0x23b/0x371 init/main.c:451
  arch_call_rest_init+0xe/0x1b
  start_kernel+0x904/0x943 init/main.c:784
  x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
  x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:471
  secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242
kobject: 'brport' (0000000015306f5c): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (0000000015306f5c): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000f618ced7): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (00000000f618ced7): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (0000000090c32451): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (0000000090c32451): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (000000009b39b612): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (000000009b39b612): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000fa23c3a6): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (00000000fa23c3a6): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (0000000059be53cf): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (0000000059be53cf): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000afda9faa): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (00000000afda9faa): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (000000001b8d397b): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (000000001b8d397b): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000c95708c8): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (00000000c95708c8): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (0000000021fa4c47): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (0000000021fa4c47): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (00000000e55a6ea3): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (00000000e55a6ea3): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (000000005f707c44): kobject_cleanup, parent  
00000000835b0c7d
kobject: 'brport' (000000005f707c44): calling ktype release
kobject: 'brport': free name


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: WARNING: bad unlock balance in __dev_queue_xmit
  2020-01-11 21:34 WARNING: bad unlock balance in __dev_queue_xmit syzbot
@ 2020-01-11 23:38 ` Cong Wang
  2020-01-11 23:38   ` syzbot
  0 siblings, 1 reply; 3+ messages in thread
From: Cong Wang @ 2020-01-11 23:38 UTC (permalink / raw)
  To: syzbot
  Cc: a, Alexander Aring, allison, andrew, Andy Gospodarek, Taehee Yoo,
	ast, b.a.t.m.a.n, bridge, cleech, Daniel Borkmann, David Miller,
	David Ahern, Florian Fainelli, Florian Westphal, Greg KH,
	gustavo, haiyangz, info, Jay Vosburgh, j, Jakub Kicinski,
	Jamal Hadi Salim, Jiri Pirko, Johan Hedberg, Johannes Berg,
	John Hurley, jwi, Kate Stewart, Alexey Kuznetsov, Kalle Valo,
	kys, linmiaohe, linux-bluetooth, linux-hams, linux-hyperv, LKML,
	linux-ppp, linux-wireless, linux-wpan, Hangbin Liu,
	Marcel Holtmann, Marek Lindner, Michal Kubecek, mmanning,
	Linux Kernel Network Developers, Nikolay Aleksandrov,
	oss-drivers, Paolo Abeni, Paul Mackerras

#syz dup: WARNING: bad unlock balance in sch_direct_xmit

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: Re: WARNING: bad unlock balance in __dev_queue_xmit
  2020-01-11 23:38 ` Cong Wang
@ 2020-01-11 23:38   ` syzbot
  0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2020-01-11 23:38 UTC (permalink / raw)
  To: Cong Wang
  Cc: a, alex.aring, allison, andrew, andy, ap420073, ast, b.a.t.m.a.n,
	bridge, cleech, daniel, davem, dsa, f.fainelli, fw, gregkh,
	gustavo, haiyangz, info, j.vosburgh, j, jakub.kicinski, jhs,
	jiri, johan.hedberg, johannes.berg, john.hurley, jwi, kstewart,
	kuznet, kvalo, kys, linmiaohe, linux-bluetooth, linux-hams,
	linux-hyperv, linux-kernel, linux-ppp, linux-wireless,
	linux-wpan, liuhangbin, marcel, mareklindner, mkubecek, mmanning,
	netdev, nikolay, oss-drivers, pabeni, paulus, syzkaller-bugs

> #syz dup: WARNING: bad unlock balance in sch_direct_xmit

Your 'dup:' command is accepted, but please keep  
syzkaller-bugs@googlegroups.com mailing list in CC next time. It serves as  
a history of what happened with each bug report. Thank you.


^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-01-11 23:38 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-11 21:34 WARNING: bad unlock balance in __dev_queue_xmit syzbot
2020-01-11 23:38 ` Cong Wang
2020-01-11 23:38   ` syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).