============================================
WARNING: possible recursive locking detected
5.16.0-rc2-syzkaller #0 Not tainted
--------------------------------------------
syz-executor.5/6808 is trying to acquire lock:
ffff88808356d130 (&runtime->sleep){..-.}-{2:2}, at: io_poll_double_wake+0x2be/0x820 fs/io_uring.c:5423
but task is already holding lock:
ffff88807303b130 (&runtime->sleep){..-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:137
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&runtime->sleep);
lock(&runtime->sleep);
*** DEADLOCK ***
May be due to missing lock nesting notation
7 locks held by syz-executor.5/6808:
#0: ffffffff8bc53710 (dup_mmap_sem){++++}-{0:0}, at: dup_mmap kernel/fork.c:497 [inline]
#0: ffffffff8bc53710 (dup_mmap_sem){++++}-{0:0}, at: dup_mm+0x108/0x13e0 kernel/fork.c:1450
#1: ffff88803e8b3828 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline]
#1: ffff88803e8b3828 (&mm->mmap_lock#2){++++}-{3:3}, at: dup_mmap kernel/fork.c:498 [inline]
#1: ffff88803e8b3828 (&mm->mmap_lock#2){++++}-{3:3}, at: dup_mm+0x12e/0x13e0 kernel/fork.c:1450
#2: ffff88807d80a9e8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:78 [inline]
#2: ffff88807d80a9e8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap kernel/fork.c:507 [inline]
#2: ffff88807d80a9e8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mm+0x18a/0x13e0 kernel/fork.c:1450
#3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
#3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pte_range mm/memory.c:1024 [inline]
#3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pmd_range mm/memory.c:1159 [inline]
#3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pud_range mm/memory.c:1196 [inline]
#3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_p4d_range mm/memory.c:1220 [inline]
#3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_page_range+0xc16/0x42c0 mm/memory.c:1293
#4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pte_range mm/memory.c:1031 [inline]
#4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pmd_range mm/memory.c:1159 [inline]
#4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pud_range mm/memory.c:1196 [inline]
#4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_p4d_range mm/memory.c:1220 [inline]
#4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_page_range+0xceb/0x42c0 mm/memory.c:1293
#5: ffff88802440a910 (&group->lock){..-.}-{2:2}, at: _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170
#6: ffff88807303b130 (&runtime->sleep){..-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:137
stack backtrace:
CPU: 1 PID: 6808 Comm: syz-executor.5 Not tainted 5.16.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_deadlock_bug kernel/locking/lockdep.c:2956 [inline]
check_deadlock kernel/locking/lockdep.c:2999 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire.cold+0x149/0x3ab kernel/locking/lockdep.c:5027
lock_acquire kernel/locking/lockdep.c:5637 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
io_poll_double_wake+0x2be/0x820 fs/io_uring.c:5423
__wake_up_common+0x147/0x650 kernel/sched/wait.c:108
__wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:138
snd_pcm_update_state+0x46a/0x540 sound/core/pcm_lib.c:204
snd_pcm_update_hw_ptr0+0xa75/0x1a50 sound/core/pcm_lib.c:465
snd_pcm_period_elapsed_under_stream_lock+0x15a/0x230 sound/core/pcm_lib.c:1817
snd_pcm_period_elapsed+0x28/0x50 sound/core/pcm_lib.c:1849
dummy_hrtimer_callback+0x94/0x1b0 sound/drivers/dummy.c:377
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__kasan_check_read+0x0/0x10 mm/kasan/shadow.c:31
Code: 8b e8 fd 11 44 07 48 85 db 0f 85 7f 65 45 07 48 83 c4 60 5b 5d 41 5c 41 5d c3 c3 e9 7f 66 45 07 cc cc cc cc cc cc cc cc cc cc <48> 8b 0c 24 89 f6 31 d2 e9 f3 f9 ff ff 0f 1f 00 48 8b 0c 24 89 f6
RSP: 0018:ffffc90002af77f8 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 8000000019d43007 RCX: 0000000000000000
RDX: ffff88803e4202c0 RSI: 0000000000000008 RDI: ffffea00006750c0
RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff81acd396 R11: 0000000000000000 R12: ffffea00006750c0
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
instrument_atomic_read include/linux/instrumented.h:71 [inline]
test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
PageSwapBacked include/linux/page-flags.h:446 [inline]
mm_counter_file include/linux/mm.h:2068 [inline]
mm_counter include/linux/mm.h:2077 [inline]
copy_present_pte mm/memory.c:959 [inline]
copy_pte_range mm/memory.c:1073 [inline]
copy_pmd_range mm/memory.c:1159 [inline]
copy_pud_range mm/memory.c:1196 [inline]
copy_p4d_range mm/memory.c:1220 [inline]
copy_page_range+0x1806/0x42c0 mm/memory.c:1293
dup_mmap kernel/fork.c:609 [inline]
dup_mm+0xa4e/0x13e0 kernel/fork.c:1450
copy_mm kernel/fork.c:1502 [inline]
copy_process+0x6fed/0x75a0 kernel/fork.c:2191
kernel_clone+0xe7/0xab0 kernel/fork.c:2582
__do_sys_clone+0xc8/0x110 kernel/fork.c:2699
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fbc5a27b0db
Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00
RSP: 002b:00007fff5d4ad4d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbc5a27b0db
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 00005555558e0400
R10: 00005555558e06d0 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000001 R15: 00007fff5d4ad5b0
----------------
Code disassembly (best guess):
0: 8b e8 mov %eax,%ebp
2: fd std
3: 11 44 07 48 adc %eax,0x48(%rdi,%rax,1)
7: 85 db test %ebx,%ebx
9: 0f 85 7f 65 45 07 jne 0x745658e
f: 48 83 c4 60 add $0x60,%rsp
13: 5b pop %rbx
14: 5d pop %rbp
15: 41 5c pop %r12
17: 41 5d pop %r13
19: c3 retq
1a: c3 retq
1b: e9 7f 66 45 07 jmpq 0x745669f
20: cc int3
21: cc int3
22: cc int3
23: cc int3
24: cc int3
25: cc int3
26: cc int3
27: cc int3
28: cc int3
29: cc int3
* 2a: 48 8b 0c 24 mov (%rsp),%rcx <-- trapping instruction
2e: 89 f6 mov %esi,%esi
30: 31 d2 xor %edx,%edx
32: e9 f3 f9 ff ff jmpq 0xfffffa2a
37: 0f 1f 00 nopl (%rax)
3a: 48 8b 0c 24 mov (%rsp),%rcx
3e: 89 f6 mov %esi,%esi