binder: 12378:12383 transaction failed 29189/-22, size 0-0 line 3014 ====================================================== [ INFO: possible circular locking dependency detected ] 4.4.161+ #46 Not tainted ------------------------------------------------------- syz-executor1/12391 is trying to acquire lock: (rtnl_mutex){+.+.+.}, at: [ 212.585310] binder: undelivered TRANSACTION_ERROR: 29189 binder: 12378:12383 transaction failed 29189/-22, size 0-0 line 3014 binder: undelivered TRANSACTION_ERROR: 29189 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 but task is already holding lock: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1493 [inline] (sk_lock-AF_INET6){+.+.+.}, at: [] do_ipv6_setsockopt.isra.4+0x252/0x2d50 net/ipv6/ipv6_sockglue.c:166 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: input: syz1 as /devices/virtual/input/input4 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] lock_sock_nested+0xc6/0x120 net/core/sock.c:2459 [] lock_sock include/net/sock.h:1493 [inline] [] do_ipv6_setsockopt.isra.4+0x1d2/0x2d50 net/ipv6/ipv6_sockglue.c:166 input: syz1 as /devices/virtual/input/input5 [] ipv6_setsockopt+0x97/0x130 net/ipv6/ipv6_sockglue.c:904 [] compat_mc_setsockopt+0x278/0x6e0 net/compat.c:627 [] compat_ipv6_setsockopt+0x126/0x1d0 net/ipv6/ipv6_sockglue.c:932 [] compat_udpv6_setsockopt+0x4a/0x90 net/ipv6/udp.c:1446 [] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2670 [] C_SYSC_setsockopt net/compat.c:385 [inline] [] compat_SyS_setsockopt+0x169/0x700 net/compat.c:368 [] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline] [] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463 [] sysenter_flags_fixed+0xd/0x1a [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x3e6c/0x5f10 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 [] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288 [] do_ipv6_setsockopt.isra.4+0xd07/0x2d50 net/ipv6/ipv6_sockglue.c:202 [] compat_ipv6_setsockopt+0xe9/0x1d0 net/ipv6/ipv6_sockglue.c:935 [] compat_udpv6_setsockopt+0x4a/0x90 net/ipv6/udp.c:1446 [] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2670 [] C_SYSC_setsockopt net/compat.c:385 [inline] [] compat_SyS_setsockopt+0x169/0x700 net/compat.c:368 [] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline] [] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463 [] sysenter_flags_fixed+0xd/0x1a other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_INET6); lock(rtnl_mutex); lock(sk_lock-AF_INET6); lock(rtnl_mutex); *** DEADLOCK *** 1 lock held by syz-executor1/12391: #0: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1493 [inline] #0: (sk_lock-AF_INET6){+.+.+.}, at: [] do_ipv6_setsockopt.isra.4+0x252/0x2d50 net/ipv6/ipv6_sockglue.c:166 stack backtrace: CPU: 0 PID: 12391 Comm: syz-executor1 Not tainted 4.4.161+ #46 0000000000000000 402820ea18f92413 ffff88009888f538 ffffffff81a9969d ffffffff83a85b10 ffffffff83ac5650 ffffffff83a85b10 ffff880098e45028 ffff880098e44740 ffff88009888f580 ffffffff813a856a 0000000000000001 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_circular_bug.cold.34+0x2f7/0x432 kernel/locking/lockdep.c:1226 [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x3e6c/0x5f10 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 [] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288 [] do_ipv6_setsockopt.isra.4+0xd07/0x2d50 net/ipv6/ipv6_sockglue.c:202 [] compat_ipv6_setsockopt+0xe9/0x1d0 net/ipv6/ipv6_sockglue.c:935 [] compat_udpv6_setsockopt+0x4a/0x90 net/ipv6/udp.c:1446 [] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2670 [] C_SYSC_setsockopt net/compat.c:385 [inline] [] compat_SyS_setsockopt+0x169/0x700 net/compat.c:368 [] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline] [] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463 [] sysenter_flags_fixed+0xd/0x1a Dead loop on virtual device ip6tnl0, fix it urgently! binder: 12413:12417 transaction failed 29189/-22, size 0-0 line 3014 binder: undelivered TRANSACTION_ERROR: 29189 input: syz1 as /devices/virtual/input/input6 input: syz1 as /devices/virtual/input/input7 binder: 12437:12442 transaction failed 29189/-22, size 0-0 line 3014 binder: undelivered TRANSACTION_ERROR: 29189 binder: 12450:12458 transaction failed 29189/-22, size 0-0 line 3014 input: syz1 as /devices/virtual/input/input9 input: syz1 as /devices/virtual/input/input8 input: syz1 as /devices/virtual/input/input10 binder: undelivered TRANSACTION_ERROR: 29189 input: syz1 as /devices/virtual/input/input11 input: syz1 as /devices/virtual/input/input12 input: syz1 as /devices/virtual/input/input13 input: syz1 as /devices/virtual/input/input14 input: syz1 as /devices/virtual/input/input15 input: syz1 as /devices/virtual/input/input16 binder: 12511:12514 transaction failed 29189/-22, size 0-0 line 3014 binder: 12516:12518 transaction failed 29189/-22, size 0-0 line 3014 binder: undelivered TRANSACTION_ERROR: 29189 binder: 12523:12524 unknown command 536872576 binder: 12523:12527 BC_CLEAR_DEATH_NOTIFICATION death notification not active binder: undelivered TRANSACTION_ERROR: 29189 binder: 12523:12524 ioctl c0306201 20008fd0 returned -22 input: syz1 as /devices/virtual/input/input17 binder: 12530:12531 transaction failed 29189/-22, size 0-0 line 3014 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: 12536:12539 transaction failed 29189/-22, size 0-0 line 3014 binder: undelivered death notification, 0000000000000000 binder: 12540:12544 transaction failed 29189/-22, size 0-0 line 3014 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: 12554:12557 ioctl c0306201 2000dfd0 returned -11 binder: undelivered death notification, 0000000000000000 binder: 12561:12563 transaction failed 29189/-22, size 0-0 line 3014 binder: 12554:12557 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered TRANSACTION_ERROR: 29189 binder: 12568:12570 ioctl c0306201 2000dfd0 returned -11 binder: 12569:12571 ioctl c0306201 2000dfd0 returned -11 binder: 12569:12571 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: 12568:12570 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: 12660:12662 ioctl c0306201 2000dfd0 returned -11 binder: 12660:12662 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: 12671:12672 ioctl c0306201 2000dfd0 returned -11 binder: 12671:12672 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: BINDER_SET_CONTEXT_MGR already set binder: 12677:12680 ioctl 40046207 0 returned -16 binder: undelivered death notification, 0000000000000000 binder: 12677:12680 Acquire 1 refcount change on invalid ref 0 ret -22 binder: 12677:12680 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 12677:12680 ioctl c0306201 2000dfd0 returned -11 binder: 12687:12688 ioctl c0306201 2000dfd0 returned -11 binder: 12677:12680 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 12677:12680 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: 12687:12688 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: 12692:12693 ioctl c0306201 2000dfd0 returned -11 binder: 12692:12693 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000