On Sun, Nov 23, 2025 at 10:43:59PM +0100, Michal Luczaj wrote:
syzkaller reported a lockdep lock order inversion warning[1] due to
commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU"). This was fixed in
commit f7c877e75352 ("vsock: fix lock inversion in
vsock_assign_transport()").
Redo syzkaller's repro by piggybacking on a somewhat related test
implemented in commit 3a764d93385c ("vsock/test: Add test for null ptr
deref when transport changes").
[1]: https://lore.kernel.org/netdev/[email protected]/
Signed-off-by: Michal Luczaj <[email protected]>
---
tools/testing/vsock/vsock_test.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
Reviewed-by: Stefano Garzarella <[email protected]>
diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c
index d4517386e551..9e1250790f33 100644
--- a/tools/testing/vsock/vsock_test.c
+++ b/tools/testing/vsock/vsock_test.c
@@ -2015,6 +2015,11 @@ static void test_stream_transport_change_client(const
struct test_opts *opts)
exit(EXIT_FAILURE);
}
+ /* Although setting SO_LINGER does not affect the original test
+ * for null-ptr-deref, it may trigger a lockdep warning.
+ */
+ enable_so_linger(s, 1);
+
ret = connect(s, (struct sockaddr *)&sa, sizeof(sa));
/* The connect can fail due to signals coming from the thread,
* or because the receiver connection queue is full.
@@ -2352,7 +2357,7 @@ static struct test_case test_cases[] = {
.run_server = test_stream_nolinger_server,
},
{
- .name = "SOCK_STREAM transport change null-ptr-deref",
+ .name = "SOCK_STREAM transport change null-ptr-deref, lockdep
warn",
.run_client = test_stream_transport_change_client,
.run_server = test_stream_transport_change_server,
},
---
base-commit: 73138ebe792b9af2954292cc5cfa780a5e796d97
change-id: 20251121-vsock_test-linger-lockdep-warn-e4c5b8dea5e0
Best regards,
--
Michal Luczaj <[email protected]>
