Re: [syzbot] [net?] possible deadlock in ipv6_sock_ac_close (4)

[Kuniyuki Iwashima]

From: syzbot <syzbot+be6f4b383534d88989f7@xxxxxxxxxxxxxxxxxxxxxxxxx>
Date: Fri, 04 Apr 2025 18:52:23 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    e48e99b6edf4 Merge tag 'pull-fixes' of git://git.kernel.or..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12afa7cf980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f2054704dd53fb80
> dashboard link: https://syzkaller.appspot.com/bug?extid=be6f4b383534d88989f7
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=140a294c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1486994c580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/b03407c4ab24/disk-e48e99b6.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/03f6746c0414/vmlinux-e48e99b6.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/4b3909ad8728/bzImage-e48e99b6.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+be6f4b383534d88989f7@xxxxxxxxxxxxxxxxxxxxxxxxx
[...]
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash

#syz test

diff --git a/net/core/sock.c b/net/core/sock.c
index 323892066def..87e7d8043322 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -235,7 +235,7 @@ static struct lock_class_key af_family_kern_slock_keys[AF_MAX];
   x "AF_RXRPC" ,	x "AF_ISDN"     ,	x "AF_PHONET"   , \
   x "AF_IEEE802154",	x "AF_CAIF"	,	x "AF_ALG"      , \
   x "AF_NFC"   ,	x "AF_VSOCK"    ,	x "AF_KCM"      , \
-  x "AF_QIPCRTR",	x "AF_SMC"	,	x "AF_XDP"	, \
+  x "AF_QIPCRTR",	x "43"		,	x "AF_XDP"	, \
   x "AF_MCTP"  , \
   x "AF_MAX"
 
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 3e6cb35baf25..3760131f1484 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -362,6 +362,9 @@ static void smc_destruct(struct sock *sk)
 		return;
 }
 
+static struct lock_class_key smc_key;
+static struct lock_class_key smc_slock_key;
+
 void smc_sk_init(struct net *net, struct sock *sk, int protocol)
 {
 	struct smc_sock *smc = smc_sk(sk);
@@ -375,6 +378,8 @@ void smc_sk_init(struct net *net, struct sock *sk, int protocol)
 	INIT_WORK(&smc->connect_work, smc_connect_work);
 	INIT_DELAYED_WORK(&smc->conn.tx_work, smc_tx_work);
 	INIT_LIST_HEAD(&smc->accept_q);
+	sock_lock_init_class_and_name(sk, "slock-AF_SMC", &smc_slock_key,
+				      "sk_lock-AF_SMC", &smc_key);
 	spin_lock_init(&smc->accept_q_lock);
 	spin_lock_init(&smc->conn.send_lock);
 	sk->sk_prot->hash(sk);