syzbot

=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
5.2.0-rc6+ #7 Not tainted
-----------------------------------------------------
syz-executor.2/10610 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
000000003bd6c328 (&ctx->fault_pending_wqh){+.+.}, at: spin_lock include/linux/spinlock.h:338 [inline]
000000003bd6c328 (&ctx->fault_pending_wqh){+.+.}, at: userfaultfd_ctx_read+0x3e7/0x1430 fs/userfaultfd.c:1045

and this task is already holding:
0000000018ed49ab (&ctx->fd_wqh){....}, at: spin_lock_irq include/linux/spinlock.h:363 [inline]
0000000018ed49ab (&ctx->fd_wqh){....}, at: userfaultfd_ctx_read+0x198/0x1430 fs/userfaultfd.c:1041
which would create a new lock dependency:
 (&ctx->fd_wqh){....} -> (&ctx->fault_pending_wqh){+.+.}

but this new dependency connects a SOFTIRQ-irq-safe lock:
 (&(&ctx->ctx_lock)->rlock){..-.}

... which became SOFTIRQ-irq-safe at:
  __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
  _raw_spin_lock_irq+0x6a/0x80 kernel/locking/spinlock.c:167
  spin_lock_irq include/linux/spinlock.h:363 [inline]
  free_ioctx_users+0x33/0x1d0 fs/aio.c:620
  percpu_ref_put_many include/linux/percpu-refcount.h:285 [inline]
  percpu_ref_put+0x1c6/0x1d0 include/linux/percpu-refcount.h:301
  percpu_ref_call_confirm_rcu lib/percpu-refcount.c:124 [inline]
  percpu_ref_switch_to_atomic_rcu+0x260/0x310 lib/percpu-refcount.c:159
  __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
  rcu_do_batch kernel/rcu/tree.c:2092 [inline]
  invoke_rcu_callbacks kernel/rcu/tree.c:2310 [inline]
  rcu_core+0x8d6/0xf90 kernel/rcu/tree.c:2291
  __do_softirq+0x340/0x7b0 arch/x86/include/asm/paravirt.h:777
  invoke_softirq kernel/softirq.c:373 [inline]
  irq_exit+0x21a/0x230 kernel/softirq.c:413
  exiting_irq arch/x86/include/asm/apic.h:536 [inline]
  smp_apic_timer_interrupt+0xf8/0x260 arch/x86/kernel/apic/apic.c:1068
  apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806
  __read_once_size include/linux/compiler.h:194 [inline]
  check_kcov_mode kernel/kcov.c:70 [inline]
  __sanitizer_cov_trace_pc+0x22/0x50 kernel/kcov.c:102
  d_absolute_path+0x15e/0x240 fs/d_path.c:199
  tomoyo_get_absolute_path security/tomoyo/realpath.c:100 [inline]
  tomoyo_realpath_from_path+0x46b/0x7c0 security/tomoyo/realpath.c:304
  tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
  tomoyo_check_open_permission+0x1f2/0x9e0 security/tomoyo/file.c:771
  tomoyo_file_open+0x141/0x190 security/tomoyo/tomoyo.c:319
  security_file_open+0x65/0x2f0 security/security.c:1454
  do_dentry_open+0x397/0x1060 fs/open.c:765
  vfs_open+0x73/0x80 fs/open.c:887
  do_last fs/namei.c:3416 [inline]
  path_openat+0x136d/0x4400 fs/namei.c:3533
  do_filp_open+0x1f7/0x430 fs/namei.c:3563
  do_sys_open+0x343/0x620 fs/open.c:1070
  __do_sys_open fs/open.c:1088 [inline]
  __se_sys_open fs/open.c:1083 [inline]
  __x64_sys_open+0x87/0x90 fs/open.c:1083
  do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

to a SOFTIRQ-irq-unsafe lock:
 (&ctx->fault_pending_wqh){+.+.}

... which became SOFTIRQ-irq-unsafe at:
...
  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151
  spin_lock include/linux/spinlock.h:338 [inline]
  userfaultfd_release+0x4dc/0x620 fs/userfaultfd.c:921
  __fput+0x2e4/0x740 fs/file_table.c:280
  ____fput+0x15/0x20 fs/file_table.c:313
  task_work_run+0x17e/0x1b0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:185 [inline]
  exit_to_usermode_loop arch/x86/entry/common.c:168 [inline]
  prepare_exit_to_usermode+0x402/0x4f0 arch/x86/entry/common.c:199
  syscall_return_slowpath+0x110/0x440 arch/x86/entry/common.c:279
  do_syscall_64+0x126/0x140 arch/x86/entry/common.c:304
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:
  &(&ctx->ctx_lock)->rlock --> &ctx->fd_wqh --> &ctx->fault_pending_wqh

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&ctx->fault_pending_wqh);
                               local_irq_disable();
                               lock(&(&ctx->ctx_lock)->rlock);
                               lock(&ctx->fd_wqh);
  <Interrupt>
    lock(&(&ctx->ctx_lock)->rlock);

 *** DEADLOCK ***

1 lock held by syz-executor.2/10610:
 #0: 0000000018ed49ab (&ctx->fd_wqh){....}, at: spin_lock_irq include/linux/spinlock.h:363 [inline]
 #0: 0000000018ed49ab (&ctx->fd_wqh){....}, at: userfaultfd_ctx_read+0x198/0x1430 fs/userfaultfd.c:1041

the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
 -> (&(&ctx->ctx_lock)->rlock){..-.} {
    IN-SOFTIRQ-W at:
                      __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                      _raw_spin_lock_irq+0x6a/0x80 kernel/locking/spinlock.c:167
                      spin_lock_irq include/linux/spinlock.h:363 [inline]
                      free_ioctx_users+0x33/0x1d0 fs/aio.c:620
                      percpu_ref_put_many include/linux/percpu-refcount.h:285 [inline]
                      percpu_ref_put+0x1c6/0x1d0 include/linux/percpu-refcount.h:301
                      percpu_ref_call_confirm_rcu lib/percpu-refcount.c:124 [inline]
                      percpu_ref_switch_to_atomic_rcu+0x260/0x310 lib/percpu-refcount.c:159
                      __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
                      rcu_do_batch kernel/rcu/tree.c:2092 [inline]
                      invoke_rcu_callbacks kernel/rcu/tree.c:2310 [inline]
                      rcu_core+0x8d6/0xf90 kernel/rcu/tree.c:2291
                      __do_softirq+0x340/0x7b0 arch/x86/include/asm/paravirt.h:777
                      invoke_softirq kernel/softirq.c:373 [inline]
                      irq_exit+0x21a/0x230 kernel/softirq.c:413
                      exiting_irq arch/x86/include/asm/apic.h:536 [inline]
                      smp_apic_timer_interrupt+0xf8/0x260 arch/x86/kernel/apic/apic.c:1068
                      apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806
                      __read_once_size include/linux/compiler.h:194 [inline]
                      check_kcov_mode kernel/kcov.c:70 [inline]
                      __sanitizer_cov_trace_pc+0x22/0x50 kernel/kcov.c:102
                      d_absolute_path+0x15e/0x240 fs/d_path.c:199
                      tomoyo_get_absolute_path security/tomoyo/realpath.c:100 [inline]
                      tomoyo_realpath_from_path+0x46b/0x7c0 security/tomoyo/realpath.c:304
                      tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
                      tomoyo_check_open_permission+0x1f2/0x9e0 security/tomoyo/file.c:771
                      tomoyo_file_open+0x141/0x190 security/tomoyo/tomoyo.c:319
                      security_file_open+0x65/0x2f0 security/security.c:1454
                      do_dentry_open+0x397/0x1060 fs/open.c:765
                      vfs_open+0x73/0x80 fs/open.c:887
                      do_last fs/namei.c:3416 [inline]
                      path_openat+0x136d/0x4400 fs/namei.c:3533
                      do_filp_open+0x1f7/0x430 fs/namei.c:3563
                      do_sys_open+0x343/0x620 fs/open.c:1070
                      __do_sys_open fs/open.c:1088 [inline]
                      __se_sys_open fs/open.c:1083 [inline]
                      __x64_sys_open+0x87/0x90 fs/open.c:1083
                      do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
                      entry_SYSCALL_64_after_hwframe+0x49/0xbe
    INITIAL USE at:
                     __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                     _raw_spin_lock_irq+0x6a/0x80 kernel/locking/spinlock.c:167
                     spin_lock_irq include/linux/spinlock.h:363 [inline]
                     __do_sys_io_cancel fs/aio.c:2004 [inline]
                     __se_sys_io_cancel+0x9a/0x320 fs/aio.c:1986
                     __x64_sys_io_cancel+0x7b/0x90 fs/aio.c:1986
                     do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
  }
  ... key      at: [<ffffffff89c314b0>] ioctx_alloc.__key+0x0/0x10
  ... acquired at:
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151
   spin_lock include/linux/spinlock.h:338 [inline]
   aio_poll fs/aio.c:1752 [inline]
   __io_submit_one fs/aio.c:1826 [inline]
   io_submit_one+0x1167/0x1ac0 fs/aio.c:1863
   __do_sys_io_submit fs/aio.c:1922 [inline]
   __se_sys_io_submit+0x18f/0x2d0 fs/aio.c:1892
   __x64_sys_io_submit+0x7b/0x90 fs/aio.c:1892
   do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
   entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> (&ctx->fd_wqh){....} {
   INITIAL USE at:
                   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                   _raw_spin_lock_irqsave+0xa1/0xc0 kernel/locking/spinlock.c:159
                   add_wait_queue+0x41/0x150 kernel/sched/wait.c:23
                   aio_poll_queue_proc+0xdf/0x160 fs/aio.c:1715
                   poll_wait include/linux/poll.h:51 [inline]
                   userfaultfd_poll+0x84/0x1d0 fs/userfaultfd.c:970
                   vfs_poll include/linux/poll.h:90 [inline]
                   aio_poll fs/aio.c:1749 [inline]
                   __io_submit_one fs/aio.c:1826 [inline]
                   io_submit_one+0x1102/0x1ac0 fs/aio.c:1863
                   __do_sys_io_submit fs/aio.c:1922 [inline]
                   __se_sys_io_submit+0x18f/0x2d0 fs/aio.c:1892
                   __x64_sys_io_submit+0x7b/0x90 fs/aio.c:1892
                   do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
                   entry_SYSCALL_64_after_hwframe+0x49/0xbe
 }
 ... key      at: [<ffffffff89c31460>] init_once_userfaultfd_ctx.__key.15+0x0/0x10
 ... acquired at:
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151
   spin_lock include/linux/spinlock.h:338 [inline]
   userfaultfd_ctx_read+0x3e7/0x1430 fs/userfaultfd.c:1045
   userfaultfd_read+0x15d/0x2b0 fs/userfaultfd.c:1203
   __vfs_read+0xf9/0x7c0 fs/read_write.c:425
   vfs_read+0x195/0x3c0 fs/read_write.c:461
   ksys_read+0x16b/0x2a0 fs/read_write.c:587
   __do_sys_read fs/read_write.c:597 [inline]
   __se_sys_read fs/read_write.c:595 [inline]
   __x64_sys_read+0x7b/0x90 fs/read_write.c:595
   do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
   entry_SYSCALL_64_after_hwframe+0x49/0xbe


the dependencies between the lock to be acquired
 and SOFTIRQ-irq-unsafe lock:
-> (&ctx->fault_pending_wqh){+.+.} {
   HARDIRQ-ON-W at:
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151
                    spin_lock include/linux/spinlock.h:338 [inline]
                    userfaultfd_release+0x4dc/0x620 fs/userfaultfd.c:921
                    __fput+0x2e4/0x740 fs/file_table.c:280
                    ____fput+0x15/0x20 fs/file_table.c:313
                    task_work_run+0x17e/0x1b0 kernel/task_work.c:113
                    tracehook_notify_resume include/linux/tracehook.h:185 [inline]
                    exit_to_usermode_loop arch/x86/entry/common.c:168 [inline]
                    prepare_exit_to_usermode+0x402/0x4f0 arch/x86/entry/common.c:199
                    syscall_return_slowpath+0x110/0x440 arch/x86/entry/common.c:279
                    do_syscall_64+0x126/0x140 arch/x86/entry/common.c:304
                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
   SOFTIRQ-ON-W at:
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151
                    spin_lock include/linux/spinlock.h:338 [inline]
                    userfaultfd_release+0x4dc/0x620 fs/userfaultfd.c:921
                    __fput+0x2e4/0x740 fs/file_table.c:280
                    ____fput+0x15/0x20 fs/file_table.c:313
                    task_work_run+0x17e/0x1b0 kernel/task_work.c:113
                    tracehook_notify_resume include/linux/tracehook.h:185 [inline]
                    exit_to_usermode_loop arch/x86/entry/common.c:168 [inline]
                    prepare_exit_to_usermode+0x402/0x4f0 arch/x86/entry/common.c:199
                    syscall_return_slowpath+0x110/0x440 arch/x86/entry/common.c:279
                    do_syscall_64+0x126/0x140 arch/x86/entry/common.c:304
                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
   INITIAL USE at:
                   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                   _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151
                   spin_lock include/linux/spinlock.h:338 [inline]
                   userfaultfd_release+0x4dc/0x620 fs/userfaultfd.c:921
                   __fput+0x2e4/0x740 fs/file_table.c:280
                   ____fput+0x15/0x20 fs/file_table.c:313
                   task_work_run+0x17e/0x1b0 kernel/task_work.c:113
                   tracehook_notify_resume include/linux/tracehook.h:185 [inline]
                   exit_to_usermode_loop arch/x86/entry/common.c:168 [inline]
                   prepare_exit_to_usermode+0x402/0x4f0 arch/x86/entry/common.c:199
                   syscall_return_slowpath+0x110/0x440 arch/x86/entry/common.c:279
                   do_syscall_64+0x126/0x140 arch/x86/entry/common.c:304
                   entry_SYSCALL_64_after_hwframe+0x49/0xbe
 }
 ... key      at: [<ffffffff89c31430>] init_once_userfaultfd_ctx.__key+0x0/0x10
 ... acquired at:
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151
   spin_lock include/linux/spinlock.h:338 [inline]
   userfaultfd_ctx_read+0x3e7/0x1430 fs/userfaultfd.c:1045
   userfaultfd_read+0x15d/0x2b0 fs/userfaultfd.c:1203
   __vfs_read+0xf9/0x7c0 fs/read_write.c:425
   vfs_read+0x195/0x3c0 fs/read_write.c:461
   ksys_read+0x16b/0x2a0 fs/read_write.c:587
   __do_sys_read fs/read_write.c:597 [inline]
   __se_sys_read fs/read_write.c:595 [inline]
   __x64_sys_read+0x7b/0x90 fs/read_write.c:595
   do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
   entry_SYSCALL_64_after_hwframe+0x49/0xbe


stack backtrace:
CPU: 0 PID: 10610 Comm: syz-executor.2 Not tainted 5.2.0-rc6+ #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x2f8 lib/dump_stack.c:113
 print_bad_irq_dependency kernel/locking/lockdep.c:1920 [inline]
 check_irq_usage kernel/locking/lockdep.c:2114 [inline]
 check_prev_add kernel/locking/lockdep.c:2315 [inline]
 check_prevs_add kernel/locking/lockdep.c:2418 [inline]
 validate_chain+0x829b/0x84f0 kernel/locking/lockdep.c:2800
 __lock_acquire+0xcf7/0x1a40 kernel/locking/lockdep.c:3793
 lock_acquire+0x158/0x250 kernel/locking/lockdep.c:4303
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:338 [inline]
 userfaultfd_ctx_read+0x3e7/0x1430 fs/userfaultfd.c:1045
 userfaultfd_read+0x15d/0x2b0 fs/userfaultfd.c:1203
 __vfs_read+0xf9/0x7c0 fs/read_write.c:425
 vfs_read+0x195/0x3c0 fs/read_write.c:461
 ksys_read+0x16b/0x2a0 fs/read_write.c:587
 __do_sys_read fs/read_write.c:597 [inline]
 __se_sys_read fs/read_write.c:595 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:595
 do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459519
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fe299228c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459519
RDX: 0000000000000064 RSI: 0000000020009f9c RDI: 0000000000000004
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe2992296d4
R13: 00000000004c55fd R14: 00000000004db678 R15: 00000000ffffffff