syzbot

================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
syz.3.850/7703 [HC1[1]:SC0[0]:HE0:SE1] takes:
ffff88807dda89d0 (&htab->lockdep_key#5){....}-{2:2}, at: htab_lock_bucket+0x17d/0x300 kernel/bpf/hashtab.c:166
{INITIAL USE} state was registered at:
  lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
  htab_lock_bucket+0x17d/0x300 kernel/bpf/hashtab.c:166
  htab_lru_map_update_elem+0x2c6/0x990 kernel/bpf/hashtab.c:1259
  bpf_map_update_value+0x660/0x720 kernel/bpf/syscall.c:203
  generic_map_update_batch+0x5ec/0x810 kernel/bpf/syscall.c:1800
  bpf_map_do_batch+0x3d7/0x610 kernel/bpf/syscall.c:5010
  __sys_bpf+0x381/0x890 kernel/bpf/syscall.c:-1
  __do_sys_bpf kernel/bpf/syscall.c:5581 [inline]
  __se_sys_bpf kernel/bpf/syscall.c:5579 [inline]
  __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5579
  do_syscall_x64 arch/x86/entry/common.c:46 [inline]
  do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
  entry_SYSCALL_64_after_hwframe+0x68/0xd2
irq event stamp: 1104
hardirqs last  enabled at (1103): [<ffffffff8a91c546>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (1103): [<ffffffff8a91c546>] _raw_spin_unlock_irqrestore+0x86/0x120 kernel/locking/spinlock.c:194
hardirqs last disabled at (1104): [<ffffffff8a87e9a3>] exc_debug_kernel arch/x86/kernel/traps.c:1063 [inline]
hardirqs last disabled at (1104): [<ffffffff8a87e9a3>] exc_debug+0x73/0x140 arch/x86/kernel/traps.c:1199
softirqs last  enabled at (404): [<ffffffff815277e3>] __do_softirq kernel/softirq.c:612 [inline]
softirqs last  enabled at (404): [<ffffffff815277e3>] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last  enabled at (404): [<ffffffff815277e3>] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
softirqs last disabled at (297): [<ffffffff815277e3>] __do_softirq kernel/softirq.c:612 [inline]
softirqs last disabled at (297): [<ffffffff815277e3>] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last disabled at (297): [<ffffffff815277e3>] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&htab->lockdep_key#5);
  <Interrupt>
    lock(&htab->lockdep_key#5);

 *** DEADLOCK ***

no locks held by syz.3.850/7703.

stack backtrace:
CPU: 1 PID: 7703 Comm: syz.3.850 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <#DB>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 lock_acquire+0x2c2/0x420 kernel/locking/lockdep.c:5745
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
 htab_lock_bucket+0x17d/0x300 kernel/bpf/hashtab.c:166
 htab_lru_map_delete_elem+0x1a4/0x650 kernel/bpf/hashtab.c:1485
 bpf_prog_2c29ac5cdc6b1842+0x42/0x46
 bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline]
 __bpf_prog_run include/linux/filter.h:616 [inline]
 bpf_prog_run include/linux/filter.h:623 [inline]
 bpf_overflow_handler+0x1fc/0x510 kernel/events/core.c:10584
 __perf_event_overflow+0x447/0x630 kernel/events/core.c:9720
 perf_swevent_overflow kernel/events/core.c:9803 [inline]
 perf_swevent_event+0x319/0x570 kernel/events/core.c:9854
 perf_bp_event+0x319/0x430 kernel/events/core.c:10781
 hw_breakpoint_handler arch/x86/kernel/hw_breakpoint.c:555 [inline]
 hw_breakpoint_exceptions_notify+0x23e/0x670 arch/x86/kernel/hw_breakpoint.c:586
 notifier_call_chain+0x197/0x380 kernel/notifier.c:93
 atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:231
 notify_die+0x145/0x1a0 kernel/notifier.c:596
 notify_debug+0x2e/0x50 arch/x86/kernel/traps.c:1042
 exc_debug_kernel arch/x86/kernel/traps.c:1099 [inline]
 exc_debug+0xde/0x140 arch/x86/kernel/traps.c:1199
 asm_exc_debug+0x1e/0x40 arch/x86/include/asm/idtentry.h:644
RIP: 0010:rep_movs_alternative+0x15/0x90 arch/x86/lib/copy_user_64.S:44
Code: 8b 1c 24 4c 8b 64 24 08 48 83 c4 10 c3 cc cc cc cc cc cc cc cc f3 0f 1e fa 48 83 f9 40 73 40 83 f9 08 73 21 85 c9 74 0f 8a 06 <88> 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffc90004ebfbd0 EFLAGS: 00040202
RAX: ffffffff842a6100 RBX: 0000000000000006 RCX: 0000000000000004
RDX: 0000000000000001 RSI: 0000200000000300 RDI: ffff88802f756b92
RBP: ffffc90004ebfd20 R08: 0000000000000005 R09: 0000000000000006
R10: dffffc0000000000 R11: ffffed1005eead72 R12: 0000200000000304
R13: 1ffff920009d7fbd R14: ffff88802f756b90 R15: 00002000000002fe
 </#DB>
 <TASK>
 copy_user_generic arch/x86/include/asm/uaccess_64.h:112 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:127 [inline]
 _copy_from_user+0x8b/0xe0 lib/usercopy.c:23
 copy_from_user include/linux/uaccess.h:183 [inline]
 generic_map_update_batch+0x54b/0x810 kernel/bpf/syscall.c:1795
 bpf_map_do_batch+0x3d7/0x610 kernel/bpf/syscall.c:5010
 __sys_bpf+0x381/0x890 kernel/bpf/syscall.c:-1
 __do_sys_bpf kernel/bpf/syscall.c:5581 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5579 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5579
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc107f9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc108d8f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc108215fa0 RCX: 00007fc107f9ce59
RDX: 0000000000000038 RSI: 0000200000000380 RDI: 000000000000001a
RBP: 00007fc108032d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc108216038 R14: 00007fc108215fa0 R15: 00007ffdb82ec098
 </TASK>
----------------
Code disassembly (best guess):
   0:	8b 1c 24             	mov    (%rsp),%ebx
   3:	4c 8b 64 24 08       	mov    0x8(%rsp),%r12
   8:	48 83 c4 10          	add    $0x10,%rsp
   c:	c3                   	ret
   d:	cc                   	int3
   e:	cc                   	int3
   f:	cc                   	int3
  10:	cc                   	int3
  11:	cc                   	int3
  12:	cc                   	int3
  13:	cc                   	int3
  14:	cc                   	int3
  15:	f3 0f 1e fa          	endbr64
  19:	48 83 f9 40          	cmp    $0x40,%rcx
  1d:	73 40                	jae    0x5f
  1f:	83 f9 08             	cmp    $0x8,%ecx
  22:	73 21                	jae    0x45
  24:	85 c9                	test   %ecx,%ecx
  26:	74 0f                	je     0x37
  28:	8a 06                	mov    (%rsi),%al
* 2a:	88 07                	mov    %al,(%rdi) <-- trapping instruction
  2c:	48 ff c7             	inc    %rdi
  2f:	48 ff c6             	inc    %rsi
  32:	48 ff c9             	dec    %rcx
  35:	75 f1                	jne    0x28
  37:	c3                   	ret
  38:	66                   	data16
  39:	2e                   	cs
  3a:	0f                   	.byte 0xf
  3b:	1f                   	(bad)
  3c:	84 00                	test   %al,(%rax)