syzbot

=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
6.12.0-rc7-syzkaller-00042-gf1b785f4c787 #0 Not tainted
-----------------------------------------------------
syz.2.5105/24457 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
ffffffff8e60a058 (tasklist_lock){.+.+}-{2:2}, at: send_sigio+0x108/0x390 fs/fcntl.c:924

and this task is already holding:
ffff88801e710720 (&f_owner->lock){....}-{2:2}, at: send_sigio+0x37/0x390 fs/fcntl.c:910
which would create a new lock dependency:
 (&f_owner->lock){....}-{2:2} -> (tasklist_lock){.+.+}-{2:2}

but this new dependency connects a SOFTIRQ-irq-safe lock:
 (&client->buffer_lock){..-.}-{2:2}

... which became SOFTIRQ-irq-safe at:
  lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
  spin_lock include/linux/spinlock.h:351 [inline]
  evdev_pass_values+0xf2/0xad0 drivers/input/evdev.c:261
  evdev_events+0x1c2/0x300 drivers/input/evdev.c:306
  input_pass_values+0x268/0x890 drivers/input/input.c:126
  input_event_dispose+0x3a4/0x600 drivers/input/input.c:352
  input_handle_event+0xa71/0xbe0 drivers/input/input.c:369
  input_event+0xa4/0xd0 drivers/input/input.c:398
  hidinput_hid_event+0x138c/0x1ca0 drivers/hid/hid-input.c:1719
  hid_process_event+0x439/0x590 drivers/hid/hid-core.c:1540
  hid_process_report drivers/hid/hid-core.c:1688 [inline]
  hid_report_raw_event+0x1002/0x18a0 drivers/hid/hid-core.c:2040
  __hid_input_report drivers/hid/hid-core.c:2110 [inline]
  hid_input_report+0x416/0x500 drivers/hid/hid-core.c:2132
  hid_irq_in+0x4a0/0x6d0 drivers/hid/usbhid/hid-core.c:285
  __usb_hcd_giveback_urb+0x42c/0x6e0 drivers/usb/core/hcd.c:1650
  dummy_timer+0x856/0x4620 drivers/usb/gadget/udc/dummy_hcd.c:1993
  __run_hrtimer kernel/time/hrtimer.c:1691 [inline]
  __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1755
  hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1772
  handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
  __do_softirq kernel/softirq.c:588 [inline]
  invoke_softirq kernel/softirq.c:428 [inline]
  __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
  irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
  asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
  arch_local_irq_enable arch/x86/include/asm/irqflags.h:97 [inline]
  raw_spin_rq_unlock_irq kernel/sched/sched.h:1518 [inline]
  sched_core_balance+0x152/0x1180 kernel/sched/core.c:6354
  do_balance_callbacks kernel/sched/core.c:4980 [inline]
  __balance_callbacks+0x188/0x280 kernel/sched/core.c:5034
  finish_lock_switch kernel/sched/core.c:5081 [inline]
  finish_task_switch+0x1d3/0x870 kernel/sched/core.c:5200
  context_switch kernel/sched/core.c:5331 [inline]
  __schedule+0x1802/0x4bd0 kernel/sched/core.c:6693
  schedule_idle+0x56/0x90 kernel/sched/core.c:6811
  do_idle+0x56a/0x5d0 kernel/sched/idle.c:354
  cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:424
  rest_init+0x2dc/0x300 init/main.c:747
  start_kernel+0x47f/0x500 init/main.c:1105
  x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507
  x86_64_start_kernel+0x9f/0xa0 arch/x86/kernel/head64.c:488
  common_startup_64+0x13e/0x147

to a SOFTIRQ-irq-unsafe lock:
 (tasklist_lock){.+.+}-{2:2}

... which became SOFTIRQ-irq-unsafe at:
...
  lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
  __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
  _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
  __do_wait+0x12d/0x850 kernel/exit.c:1648
  do_wait+0x1e9/0x560 kernel/exit.c:1692
  kernel_wait+0xe9/0x240 kernel/exit.c:1868
  call_usermodehelper_exec_sync kernel/umh.c:137 [inline]
  call_usermodehelper_exec_work+0xbd/0x230 kernel/umh.c:164
  process_one_work kernel/workqueue.c:3229 [inline]
  process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
  worker_thread+0x870/0xd30 kernel/workqueue.c:3391
  kthread+0x2f0/0x390 kernel/kthread.c:389
  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

other info that might help us debug this:

Chain exists of:
  &client->buffer_lock --> &f_owner->lock --> tasklist_lock

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(tasklist_lock);
                               local_irq_disable();
                               lock(&client->buffer_lock);
                               lock(&f_owner->lock);
  <Interrupt>
    lock(&client->buffer_lock);

 *** DEADLOCK ***

6 locks held by syz.2.5105/24457:
 #0: ffff888033aa6420 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515
 #1: ffffffff8eaa28b0 (file_rwsem){++++}-{0:0}, at: __break_lease+0x3b3/0x1820 fs/locks.c:1563
 #2: ffff88802e5269b8 (&ctx->flc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #2: ffff88802e5269b8 (&ctx->flc_lock){+.+.}-{2:2}, at: __break_lease+0x3c0/0x1820 fs/locks.c:1564
 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: kill_fasync+0x54/0x4f0 fs/fcntl.c:1150
 #4: ffff888033b230c0 (&new->fa_lock){....}-{2:2}, at: kill_fasync_rcu fs/fcntl.c:1127 [inline]
 #4: ffff888033b230c0 (&new->fa_lock){....}-{2:2}, at: kill_fasync+0x199/0x4f0 fs/fcntl.c:1151
 #5: ffff88801e710720 (&f_owner->lock){....}-{2:2}, at: send_sigio+0x37/0x390 fs/fcntl.c:910

the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
  -> (&client->buffer_lock){..-.}-{2:2} {
     IN-SOFTIRQ-W at:
                        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                        __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
                        _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
                        spin_lock include/linux/spinlock.h:351 [inline]
                        evdev_pass_values+0xf2/0xad0 drivers/input/evdev.c:261
                        evdev_events+0x1c2/0x300 drivers/input/evdev.c:306
                        input_pass_values+0x268/0x890 drivers/input/input.c:126
                        input_event_dispose+0x3a4/0x600 drivers/input/input.c:352
                        input_handle_event+0xa71/0xbe0 drivers/input/input.c:369
                        input_event+0xa4/0xd0 drivers/input/input.c:398
                        hidinput_hid_event+0x138c/0x1ca0 drivers/hid/hid-input.c:1719
                        hid_process_event+0x439/0x590 drivers/hid/hid-core.c:1540
                        hid_process_report drivers/hid/hid-core.c:1688 [inline]
                        hid_report_raw_event+0x1002/0x18a0 drivers/hid/hid-core.c:2040
                        __hid_input_report drivers/hid/hid-core.c:2110 [inline]
                        hid_input_report+0x416/0x500 drivers/hid/hid-core.c:2132
                        hid_irq_in+0x4a0/0x6d0 drivers/hid/usbhid/hid-core.c:285
                        __usb_hcd_giveback_urb+0x42c/0x6e0 drivers/usb/core/hcd.c:1650
                        dummy_timer+0x856/0x4620 drivers/usb/gadget/udc/dummy_hcd.c:1993
                        __run_hrtimer kernel/time/hrtimer.c:1691 [inline]
                        __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1755
                        hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1772
                        handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
                        __do_softirq kernel/softirq.c:588 [inline]
                        invoke_softirq kernel/softirq.c:428 [inline]
                        __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
                        irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
                        instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
                        sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
                        asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
                        arch_local_irq_enable arch/x86/include/asm/irqflags.h:97 [inline]
                        raw_spin_rq_unlock_irq kernel/sched/sched.h:1518 [inline]
                        sched_core_balance+0x152/0x1180 kernel/sched/core.c:6354
                        do_balance_callbacks kernel/sched/core.c:4980 [inline]
                        __balance_callbacks+0x188/0x280 kernel/sched/core.c:5034
                        finish_lock_switch kernel/sched/core.c:5081 [inline]
                        finish_task_switch+0x1d3/0x870 kernel/sched/core.c:5200
                        context_switch kernel/sched/core.c:5331 [inline]
                        __schedule+0x1802/0x4bd0 kernel/sched/core.c:6693
                        schedule_idle+0x56/0x90 kernel/sched/core.c:6811
                        do_idle+0x56a/0x5d0 kernel/sched/idle.c:354
                        cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:424
                        rest_init+0x2dc/0x300 init/main.c:747
                        start_kernel+0x47f/0x500 init/main.c:1105
                        x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507
                        x86_64_start_kernel+0x9f/0xa0 arch/x86/kernel/head64.c:488
                        common_startup_64+0x13e/0x147
     INITIAL USE at:
                       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
                       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
                       spin_lock include/linux/spinlock.h:351 [inline]
                       evdev_handle_get_val+0x67/0x820 drivers/input/evdev.c:898
                       evdev_ioctl_handler+0x1353/0x21b0 drivers/input/evdev.c:1270
                       vfs_ioctl fs/ioctl.c:51 [inline]
                       __do_sys_ioctl fs/ioctl.c:907 [inline]
                       __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
                       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
                       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
                       entry_SYSCALL_64_after_hwframe+0x77/0x7f
   }
   ... key      at: [<ffffffff9a720960>] evdev_open.__key.24+0x0/0x20
 -> (&new->fa_lock){....}-{2:2} {
    INITIAL USE at:
                     lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                     __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline]
                     _raw_write_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:326
                     fasync_remove_entry+0xff/0x1d0 fs/fcntl.c:1004
                     pipe_fasync+0xaf/0x1f0 fs/pipe.c:754
                     __fput+0x71b/0x880 fs/file_table.c:428
                     task_work_run+0x24f/0x310 kernel/task_work.c:239
                     resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
                     exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
                     exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
                     __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
                     syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
                     do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
                     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    INITIAL READ USE at:
                          lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                          __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
                          _raw_read_lock_irqsave+0xdd/0x130 kernel/locking/spinlock.c:236
                          kill_fasync_rcu fs/fcntl.c:1127 [inline]
                          kill_fasync+0x199/0x4f0 fs/fcntl.c:1151
                          wakeup_pipe_readers fs/splice.c:183 [inline]
                          splice_file_to_pipe+0x35a/0x500 fs/splice.c:1298
                          do_splice+0xf1b/0x18e0 fs/splice.c:1379
                          __do_splice fs/splice.c:1436 [inline]
                          __do_sys_splice fs/splice.c:1652 [inline]
                          __se_sys_splice+0x331/0x4a0 fs/splice.c:1634
                          do_syscall_x64 arch/x86/entry/common.c:52 [inline]
                          do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
                          entry_SYSCALL_64_after_hwframe+0x77/0x7f
  }
  ... key      at: [<ffffffff9a410ec0>] fasync_insert_entry.__key+0x0/0x20
  ... acquired at:
   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
   __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
   _raw_read_lock_irqsave+0xdd/0x130 kernel/locking/spinlock.c:236
   kill_fasync_rcu fs/fcntl.c:1127 [inline]
   kill_fasync+0x199/0x4f0 fs/fcntl.c:1151
   __pass_event drivers/input/evdev.c:240 [inline]
   evdev_pass_values+0x58a/0xad0 drivers/input/evdev.c:278
   evdev_events+0x1c2/0x300 drivers/input/evdev.c:306
   input_pass_values+0x268/0x890 drivers/input/input.c:126
   input_event_dispose+0x30f/0x600 drivers/input/input.c:341
   input_handle_event+0xa71/0xbe0 drivers/input/input.c:369
   input_inject_event+0x22f/0x340 drivers/input/input.c:428
   evdev_write+0x5fd/0x790 drivers/input/evdev.c:528
   vfs_write+0x2a3/0xd30 fs/read_write.c:681
   ksys_write+0x183/0x2b0 fs/read_write.c:736
   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> (&f_owner->lock){....}-{2:2} {
   INITIAL USE at:
                   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                   __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline]
                   _raw_write_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:326
                   __f_setown+0x6b/0x380 fs/fcntl.c:137
                   f_setown+0x243/0x310 fs/fcntl.c:184
                   do_fcntl+0x115/0x1a60 fs/fcntl.c:510
                   __do_sys_fcntl fs/fcntl.c:586 [inline]
                   __se_sys_fcntl+0xd2/0x1e0 fs/fcntl.c:571
                   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
                   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
                   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   INITIAL READ USE at:
                        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                        __raw_read_lock_irq include/linux/rwlock_api_smp.h:169 [inline]
                        _raw_read_lock_irq+0xda/0x120 kernel/locking/spinlock.c:244
                        f_getown_ex fs/fcntl.c:271 [inline]
                        do_fcntl+0x85f/0x1a60 fs/fcntl.c:513
                        __do_sys_fcntl fs/fcntl.c:586 [inline]
                        __se_sys_fcntl+0xd2/0x1e0 fs/fcntl.c:571
                        do_syscall_x64 arch/x86/entry/common.c:52 [inline]
                        do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
                        entry_SYSCALL_64_after_hwframe+0x77/0x7f
 }
 ... key      at: [<ffffffff9a410ea0>] file_f_owner_allocate.__key+0x0/0x20
 ... acquired at:
   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
   __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
   _raw_read_lock_irqsave+0xdd/0x130 kernel/locking/spinlock.c:236
   send_sigio+0x37/0x390 fs/fcntl.c:910
   kill_fasync_rcu fs/fcntl.c:1136 [inline]
   kill_fasync+0x256/0x4f0 fs/fcntl.c:1151
   lease_break_callback+0x26/0x30 fs/locks.c:558
   __break_lease+0x6d5/0x1820 fs/locks.c:1592
   vfs_truncate+0x26b/0x3b0 fs/open.c:105
   do_sys_truncate+0xdb/0x190 fs/open.c:134
   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
   entry_SYSCALL_64_after_hwframe+0x77/0x7f


the dependencies between the lock to be acquired
 and SOFTIRQ-irq-unsafe lock:
-> (tasklist_lock){.+.+}-{2:2} {
   HARDIRQ-ON-R at:
                    lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                    __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                    _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
                    __do_wait+0x12d/0x850 kernel/exit.c:1648
                    do_wait+0x1e9/0x560 kernel/exit.c:1692
                    kernel_wait+0xe9/0x240 kernel/exit.c:1868
                    call_usermodehelper_exec_sync kernel/umh.c:137 [inline]
                    call_usermodehelper_exec_work+0xbd/0x230 kernel/umh.c:164
                    process_one_work kernel/workqueue.c:3229 [inline]
                    process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
                    worker_thread+0x870/0xd30 kernel/workqueue.c:3391
                    kthread+0x2f0/0x390 kernel/kthread.c:389
                    ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
                    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
   SOFTIRQ-ON-R at:
                    lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                    __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                    _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
                    __do_wait+0x12d/0x850 kernel/exit.c:1648
                    do_wait+0x1e9/0x560 kernel/exit.c:1692
                    kernel_wait+0xe9/0x240 kernel/exit.c:1868
                    call_usermodehelper_exec_sync kernel/umh.c:137 [inline]
                    call_usermodehelper_exec_work+0xbd/0x230 kernel/umh.c:164
                    process_one_work kernel/workqueue.c:3229 [inline]
                    process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
                    worker_thread+0x870/0xd30 kernel/workqueue.c:3391
                    kthread+0x2f0/0x390 kernel/kthread.c:389
                    ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
                    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
   INITIAL USE at:
                   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                   __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline]
                   _raw_write_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:326
                   copy_process+0x2267/0x3d50 kernel/fork.c:2502
                   kernel_clone+0x223/0x880 kernel/fork.c:2786
                   user_mode_thread+0x132/0x1a0 kernel/fork.c:2864
                   rest_init+0x23/0x300 init/main.c:712
                   start_kernel+0x47f/0x500 init/main.c:1105
                   x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507
                   x86_64_start_kernel+0x9f/0xa0 arch/x86/kernel/head64.c:488
                   common_startup_64+0x13e/0x147
   INITIAL READ USE at:
                        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
                        __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                        _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
                        __do_wait+0x12d/0x850 kernel/exit.c:1648
                        do_wait+0x1e9/0x560 kernel/exit.c:1692
                        kernel_wait+0xe9/0x240 kernel/exit.c:1868
                        call_usermodehelper_exec_sync kernel/umh.c:137 [inline]
                        call_usermodehelper_exec_work+0xbd/0x230 kernel/umh.c:164
                        process_one_work kernel/workqueue.c:3229 [inline]
                        process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
                        worker_thread+0x870/0xd30 kernel/workqueue.c:3391
                        kthread+0x2f0/0x390 kernel/kthread.c:389
                        ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
                        ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 }
 ... key      at: [<ffffffff8e60a058>] tasklist_lock+0x18/0x40
 ... acquired at:
   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
   __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
   _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
   send_sigio+0x108/0x390 fs/fcntl.c:924
   kill_fasync_rcu fs/fcntl.c:1136 [inline]
   kill_fasync+0x256/0x4f0 fs/fcntl.c:1151
   lease_break_callback+0x26/0x30 fs/locks.c:558
   __break_lease+0x6d5/0x1820 fs/locks.c:1592
   vfs_truncate+0x26b/0x3b0 fs/open.c:105
   do_sys_truncate+0xdb/0x190 fs/open.c:134
   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
   entry_SYSCALL_64_after_hwframe+0x77/0x7f


stack backtrace:
CPU: 1 UID: 0 PID: 24457 Comm: syz.2.5105 Not tainted 6.12.0-rc7-syzkaller-00042-gf1b785f4c787 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_bad_irq_dependency kernel/locking/lockdep.c:2647 [inline]
 check_irq_usage kernel/locking/lockdep.c:2888 [inline]
 check_prev_add kernel/locking/lockdep.c:3165 [inline]
 check_prevs_add kernel/locking/lockdep.c:3280 [inline]
 validate_chain+0x4ebd/0x5920 kernel/locking/lockdep.c:3904
 __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
 _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
 send_sigio+0x108/0x390 fs/fcntl.c:924
 kill_fasync_rcu fs/fcntl.c:1136 [inline]
 kill_fasync+0x256/0x4f0 fs/fcntl.c:1151
 lease_break_callback+0x26/0x30 fs/locks.c:558
 __break_lease+0x6d5/0x1820 fs/locks.c:1592
 vfs_truncate+0x26b/0x3b0 fs/open.c:105
 do_sys_truncate+0xdb/0x190 fs/open.c:134
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f071d57e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f071e3b0038 EFLAGS: 00000246 ORIG_RAX: 000000000000004c
RAX: ffffffffffffffda RBX: 00007f071d736130 RCX: 00007f071d57e719
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000020000280
RBP: 00007f071d5f175e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f071d736130 R15: 00007ffc06a0ab08
 </TASK>