[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.183' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 59.469799][ C1] [ 59.472142][ C1] ======================================================== [ 59.479304][ C1] WARNING: possible irq lock inversion dependency detected [ 59.486477][ C1] 5.6.0-syzkaller #0 Not tainted [ 59.491407][ C1] -------------------------------------------------------- [ 59.498573][ C1] ksoftirqd/1/16 just changed the state of lock: [ 59.504877][ C1] ffff888094a3dcd8 (&ctx->ctx_lock){..-.}-{2:2}, at: free_ioctx_users+0x2b/0x450 [ 59.513983][ C1] but this lock took another, SOFTIRQ-unsafe lock in the past: [ 59.521612][ C1] (&pid->wait_pidfd){+.+.}-{2:2} [ 59.521621][ C1] [ 59.521621][ C1] [ 59.521621][ C1] and interrupts could create inverse lock ordering between them. [ 59.521621][ C1] [ 59.543750][ C1] [ 59.543750][ C1] other info that might help us debug this: [ 59.551884][ C1] Possible interrupt unsafe locking scenario: [ 59.551884][ C1] [ 59.560181][ C1] CPU0 CPU1 [ 59.565530][ C1] ---- ---- [ 59.570866][ C1] lock(&pid->wait_pidfd); [ 59.575352][ C1] local_irq_disable(); [ 59.582087][ C1] lock(&ctx->ctx_lock); [ 59.589073][ C1] lock(&pid->wait_pidfd); [ 59.596273][ C1] [ 59.599712][ C1] lock(&ctx->ctx_lock); [ 59.604194][ C1] [ 59.604194][ C1] *** DEADLOCK *** [ 59.604194][ C1] [ 59.612325][ C1] 2 locks held by ksoftirqd/1/16: [ 59.617321][ C1] #0: ffffffff899bc060 (rcu_callback){....}-{0:0}, at: rcu_core+0x520/0x1370 [ 59.626151][ C1] #1: ffffffff899bc180 (rcu_read_lock){....}-{1:2}, at: percpu_ref_switch_to_atomic_rcu+0x209/0x540 [ 59.637073][ C1] [ 59.637073][ C1] the shortest dependencies between 2nd lock and 1st lock: [ 59.646421][ C1] -> (&pid->wait_pidfd){+.+.}-{2:2} { [ 59.651867][ C1] HARDIRQ-ON-W at: [ 59.655912][ C1] lock_acquire+0x1f2/0x8f0 [ 59.662221][ C1] _raw_spin_lock+0x2a/0x40 [ 59.668522][ C1] proc_pid_make_inode+0x1f9/0x3c0 [ 59.675434][ C1] proc_pid_instantiate+0x51/0x150 [ 59.682345][ C1] proc_pid_lookup+0x1da/0x340 [ 59.688903][ C1] proc_root_lookup+0x20/0x60 [ 59.695375][ C1] __lookup_slow+0x256/0x490 [ 59.701761][ C1] walk_component+0x418/0x6a0 [ 59.708237][ C1] link_path_walk.part.0+0x4f1/0xb50 [ 59.715318][ C1] path_openat+0x25a/0x27d0 [ 59.721627][ C1] do_filp_open+0x192/0x260 [ 59.727965][ C1] do_sys_openat2+0x585/0x7d0 [ 59.734443][ C1] do_sys_open+0xc3/0x140 [ 59.740585][ C1] do_syscall_64+0xf6/0x7d0 [ 59.746889][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 59.754578][ C1] SOFTIRQ-ON-W at: [ 59.758629][ C1] lock_acquire+0x1f2/0x8f0 [ 59.765022][ C1] _raw_spin_lock+0x2a/0x40 [ 59.771325][ C1] proc_pid_make_inode+0x1f9/0x3c0 [ 59.778664][ C1] proc_pid_instantiate+0x51/0x150 [ 59.785568][ C1] proc_pid_lookup+0x1da/0x340 [ 59.792126][ C1] proc_root_lookup+0x20/0x60 [ 59.798599][ C1] __lookup_slow+0x256/0x490 [ 59.804989][ C1] walk_component+0x418/0x6a0 [ 59.811471][ C1] link_path_walk.part.0+0x4f1/0xb50 [ 59.818547][ C1] path_openat+0x25a/0x27d0 [ 59.824845][ C1] do_filp_open+0x192/0x260 [ 59.831153][ C1] do_sys_openat2+0x585/0x7d0 [ 59.837620][ C1] do_sys_open+0xc3/0x140 [ 59.843758][ C1] do_syscall_64+0xf6/0x7d0 [ 59.850059][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 59.857751][ C1] INITIAL USE at: [ 59.861723][ C1] lock_acquire+0x1f2/0x8f0 [ 59.868059][ C1] _raw_spin_lock_irqsave+0x8c/0xbf [ 59.874987][ C1] __wake_up_common_lock+0xb4/0x130 [ 59.881908][ C1] do_notify_parent+0x19e/0xe60 [ 59.888495][ C1] do_exit+0x238f/0x2dd0 [ 59.894454][ C1] call_usermodehelper_exec_async+0x507/0x710 [ 59.902242][ C1] ret_from_fork+0x24/0x30 [ 59.908421][ C1] } [ 59.911042][ C1] ... key at: [] __key.53831+0x0/0x40 [ 59.918674][ C1] ... acquired at: [ 59.922546][ C1] _raw_spin_lock+0x2a/0x40 [ 59.927196][ C1] io_submit_one+0xc1b/0x2ec0 [ 59.932031][ C1] __ia32_compat_sys_io_submit+0x1bf/0x530 [ 59.938005][ C1] do_fast_syscall_32+0x270/0xe90 [ 59.943197][ C1] entry_SYSENTER_compat+0x70/0x7f [ 59.948479][ C1] [ 59.950781][ C1] -> (&ctx->ctx_lock){..-.}-{2:2} { [ 59.955954][ C1] IN-SOFTIRQ-W at: [ 59.959924][ C1] lock_acquire+0x1f2/0x8f0 [ 59.966147][ C1] _raw_spin_lock_irq+0x5b/0x80 [ 59.972635][ C1] free_ioctx_users+0x2b/0x450 [ 59.979110][ C1] percpu_ref_switch_to_atomic_rcu+0x494/0x540 [ 59.986888][ C1] rcu_core+0x59f/0x1370 [ 59.992770][ C1] __do_softirq+0x26c/0x9f7 [ 59.998895][ C1] run_ksoftirqd+0x89/0x100 [ 60.005058][ C1] smpboot_thread_fn+0x653/0x9e0 [ 60.011789][ C1] kthread+0x388/0x470 [ 60.017494][ C1] ret_from_fork+0x24/0x30 [ 60.023532][ C1] INITIAL USE at: [ 60.027409][ C1] lock_acquire+0x1f2/0x8f0 [ 60.033548][ C1] _raw_spin_lock_irq+0x5b/0x80 [ 60.040035][ C1] io_submit_one+0xbd6/0x2ec0 [ 60.046776][ C1] __ia32_compat_sys_io_submit+0x1bf/0x530 [ 60.054124][ C1] do_fast_syscall_32+0x270/0xe90 [ 60.060693][ C1] entry_SYSENTER_compat+0x70/0x7f [ 60.067342][ C1] } [ 60.069823][ C1] ... key at: [] __key.55314+0x0/0x40 [ 60.077426][ C1] ... acquired at: [ 60.081208][ C1] mark_lock+0x624/0xf10 [ 60.085594][ C1] __lock_acquire+0x1d28/0x4e00 [ 60.090589][ C1] lock_acquire+0x1f2/0x8f0 [ 60.095246][ C1] _raw_spin_lock_irq+0x5b/0x80 [ 60.100253][ C1] free_ioctx_users+0x2b/0x450 [ 60.105168][ C1] percpu_ref_switch_to_atomic_rcu+0x494/0x540 [ 60.111473][ C1] rcu_core+0x59f/0x1370 [ 60.115863][ C1] __do_softirq+0x26c/0x9f7 [ 60.121314][ C1] run_ksoftirqd+0x89/0x100 [ 60.125992][ C1] smpboot_thread_fn+0x653/0x9e0 [ 60.131112][ C1] kthread+0x388/0x470 [ 60.135457][ C1] ret_from_fork+0x24/0x30 [ 60.140021][ C1] [ 60.142342][ C1] [ 60.142342][ C1] stack backtrace: [ 60.148212][ C1] CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.6.0-syzkaller #0 [ 60.156193][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.166328][ C1] Call Trace: [ 60.169688][ C1] dump_stack+0x188/0x20d [ 60.173995][ C1] check_usage_forwards.cold+0x20/0x29 [ 60.179440][ C1] ? check_usage_backwards+0x4e0/0x4e0 [ 60.184880][ C1] ? stack_trace_consume_entry+0x160/0x160 [ 60.190669][ C1] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 60.197297][ C1] ? save_trace+0x42/0x9f0 [ 60.201782][ C1] mark_lock+0x624/0xf10 [ 60.206004][ C1] ? check_usage_backwards+0x4e0/0x4e0 [ 60.211549][ C1] ? print_usage_bug+0x240/0x240 [ 60.216553][ C1] ? print_usage_bug+0x240/0x240 [ 60.223018][ C1] ? mark_lock+0x12b/0xf10 [ 60.227445][ C1] __lock_acquire+0x1d28/0x4e00 [ 60.232477][ C1] ? mark_held_locks+0xe0/0xe0 [ 60.238441][ C1] ? __wake_up_common_lock+0xde/0x130 [ 60.244065][ C1] lock_acquire+0x1f2/0x8f0 [ 60.248818][ C1] ? free_ioctx_users+0x2b/0x450 [ 60.254305][ C1] ? lock_release+0x800/0x800 [ 60.259677][ C1] ? lock_acquire+0x1f2/0x8f0 [ 60.265282][ C1] ? percpu_ref_switch_to_atomic_rcu+0x209/0x540 [ 60.271620][ C1] ? lock_release+0x800/0x800 [ 60.276662][ C1] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 60.282455][ C1] _raw_spin_lock_irq+0x5b/0x80 [ 60.287285][ C1] ? free_ioctx_users+0x2b/0x450 [ 60.292213][ C1] free_ioctx_users+0x2b/0x450 [ 60.296985][ C1] percpu_ref_switch_to_atomic_rcu+0x494/0x540 [ 60.303154][ C1] rcu_core+0x59f/0x1370 [ 60.307377][ C1] ? __rcu_read_unlock+0x700/0x700 [ 60.312500][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 60.318043][ C1] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 60.324009][ C1] __do_softirq+0x26c/0x9f7 [ 60.328492][ C1] ? takeover_tasklets+0x810/0x810 [ 60.333596][ C1] run_ksoftirqd+0x89/0x100 [ 60.338094][ C1] smpboot_thread_fn+0x653/0x9e0 [ 60.343015][ C1] ? __smpboot_create_thread.part.0+0x340/0x340 [ 60.349238][ C1] ? __kthread_parkme+0x13f/0x1e0 [ 60.354253][ C1] ? __smpboot_create_thread.part.0+0x340/0x340 [ 60.360485][ C1] kthread+0x388/0x470 [ 60.364532][ C1] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 60.370225][ C1] ret_from_fork+0x24/0x3