Hello,
syzbot has tested the proposed patch but the reproducer still triggered crash:
possible deadlock in pppol2tp_session_free
============================================
WARNING: possible recursive locking detected
4.15.0+ #37 Not tainted
--------------------------------------------
syzkaller163597/27635 is trying to acquire lock:
(sk_lock-AF_PPPOX){+.+.}, at: [<0000000011240b7f>] lock_sock include/net/sock.h:1463 [inline]
(sk_lock-AF_PPPOX){+.+.}, at: [<0000000011240b7f>] pppol2tp_session_free+0x88/0x1d0 net/l2tp/l2tp_ppp.c:469
but task is already holding lock:
(sk_lock-AF_PPPOX){+.+.}, at: [<000000009bf8de9a>] lock_sock include/net/sock.h:1463 [inline]
(sk_lock-AF_PPPOX){+.+.}, at: [<000000009bf8de9a>] pppol2tp_connect+0x14e/0x1550 net/l2tp/l2tp_ppp.c:786
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_PPPOX);
lock(sk_lock-AF_PPPOX);
*** DEADLOCK ***
May be due to missing lock nesting notation
1 lock held by syzkaller163597/27635:
#0: (sk_lock-AF_PPPOX){+.+.}, at: [<000000009bf8de9a>] lock_sock include/net/sock.h:1463 [inline]
#0: (sk_lock-AF_PPPOX){+.+.}, at: [<000000009bf8de9a>] pppol2tp_connect+0x14e/0x1550 net/l2tp/l2tp_ppp.c:786
stack backtrace:
CPU: 1 PID: 27635 Comm: syzkaller163597 Not tainted 4.15.0+ #37
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
print_deadlock_bug kernel/locking/lockdep.c:1761 [inline]
check_deadlock kernel/locking/lockdep.c:1805 [inline]
validate_chain kernel/locking/lockdep.c:2401 [inline]
__lock_acquire+0xe8f/0x3e00 kernel/locking/lockdep.c:3431
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
lock_sock_nested+0xc2/0x110 net/core/sock.c:2777
lock_sock include/net/sock.h:1463 [inline]
pppol2tp_session_free+0x88/0x1d0 net/l2tp/l2tp_ppp.c:469
l2tp_session_free+0x151/0x2b0 net/l2tp/l2tp_core.c:1627
l2tp_session_dec_refcount net/l2tp/l2tp_core.h:281 [inline]
pppol2tp_connect+0xfb5/0x1550 net/l2tp/l2tp_ppp.c:892
SYSC_connect+0x213/0x4a0 net/socket.c:1639
SyS_connect+0x24/0x30 net/socket.c:1620
entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x440ca9
RSP: 002b:00007ffe501872e8 EFLAGS: 00000206 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440ca9
RDX: 000000000000002e RSI: 0000000020e77000 RDI: 0000000000000004
RBP: 0000000000074be3 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000003 R14: 00000000006cf050 R15: 00000000004a25db
Tested on https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master commit
617aebe6a97efa539cc4b8a52adccd89596e6be0 (Sun Feb 4 00:25:42 2018 +0000)
Merge tag 'usercopy-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
compiler: gcc (GCC) 7.1.1 20170620
Patch is attached.
Kernel config is attached.
Raw console output is attached.