======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc7-syzkaller-00095-gb8e7cd09ae54 #0 Not tainted
------------------------------------------------------
kworker/0:7/5835 is trying to acquire lock:
ffff8880b883dd18 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x26b/0x1070 kernel/workqueue.c:2301
but task is already holding lock:
ffff8880b88397e0 (stock_lock){..-.}-{2:2}, at: local_lock_acquire+0x10/0x150 include/linux/local_lock_internal.h:29
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (stock_lock){..-.}-{2:2}:
local_lock_acquire+0x23/0x150 include/linux/local_lock_internal.h:29
consume_obj_stock mm/memcontrol.c:2789 [inline]
obj_cgroup_charge+0x7e/0x4d0 mm/memcontrol.c:2919
__memcg_slab_post_alloc_hook+0x1b6/0x9c0 mm/memcontrol.c:3012
memcg_slab_post_alloc_hook mm/slub.c:2164 [inline]
slab_post_alloc_hook mm/slub.c:4002 [inline]
slab_alloc_node mm/slub.c:4041 [inline]
__do_kmalloc_node mm/slub.c:4161 [inline]
__kmalloc_node_noprof+0x3b0/0x430 mm/slub.c:4168
kmalloc_node_noprof include/linux/slab.h:708 [inline]
bpf_map_kmalloc_node+0x98/0x4a0 kernel/bpf/syscall.c:422
lpm_trie_node_alloc kernel/bpf/lpm_trie.c:299 [inline]
trie_update_elem+0x1ef/0xe00 kernel/bpf/lpm_trie.c:342
bpf_map_update_value+0x2c4/0x6c0 kernel/bpf/syscall.c:203
map_update_elem+0x623/0x910 kernel/bpf/syscall.c:1654
__sys_bpf+0x90c/0x4a00 kernel/bpf/syscall.c:5698
__do_sys_bpf kernel/bpf/syscall.c:5817 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5815 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5815
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #3 (&trie->lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
trie_delete_elem+0xb0/0x820 kernel/bpf/lpm_trie.c:462
0xffffffffa000085b
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:691 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
bpf_trace_run2+0x234/0x590 kernel/trace/bpf_trace.c:2447
__bpf_trace_tlb_flush+0xd2/0x110 include/trace/events/tlb.h:38
trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38
switch_mm_irqs_off+0x697/0xbb0 arch/x86/mm/tlb.c:642
context_switch kernel/sched/core.c:5172 [inline]
__schedule+0xc4d/0x5490 kernel/sched/core.c:6529
__schedule_loop kernel/sched/core.c:6606 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6621
futex_wait_queue+0xfc/0x1f0 kernel/futex/waitwake.c:370
__futex_wait+0x291/0x3c0 kernel/futex/waitwake.c:669
futex_wait+0xe9/0x380 kernel/futex/waitwake.c:697
do_futex+0x22b/0x350 kernel/futex/syscalls.c:102
__do_sys_futex kernel/futex/syscalls.c:179 [inline]
__se_sys_futex kernel/futex/syscalls.c:160 [inline]
__x64_sys_futex+0x1e1/0x4c0 kernel/futex/syscalls.c:160
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&rq->__lock){-.-.}-{2:2}:
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:560
raw_spin_rq_lock kernel/sched/sched.h:1415 [inline]
rq_lock kernel/sched/sched.h:1714 [inline]
task_fork_fair+0x73/0x250 kernel/sched/fair.c:12710
sched_cgroup_fork+0x3d2/0x510 kernel/sched/core.c:4633
copy_process+0x43a1/0x8de0 kernel/fork.c:2483
kernel_clone+0xfd/0x960 kernel/fork.c:2781
user_mode_thread+0xb4/0xf0 kernel/fork.c:2859
rest_init+0x23/0x2b0 init/main.c:712
start_kernel+0x3df/0x4c0 init/main.c:1103
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #1 (&p->pi_lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4051
create_worker+0x333/0x800 kernel/workqueue.c:2827
workqueue_init+0x4b4/0xb70 kernel/workqueue.c:7845
kernel_init_freeable+0x32f/0xca0 init/main.c:1562
kernel_init+0x1c/0x2b0 init/main.c:1467
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 (&pool->lock){-.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
__queue_work+0x26b/0x1070 kernel/workqueue.c:2301
queue_work_on+0x11a/0x140 kernel/workqueue.c:2392
percpu_ref_put_many include/linux/percpu-refcount.h:335 [inline]
percpu_ref_put include/linux/percpu-refcount.h:351 [inline]
css_put include/linux/cgroup_refcnt.h:79 [inline]
css_put include/linux/cgroup_refcnt.h:76 [inline]
drain_stock+0x287/0x2e0 mm/memcontrol.c:1774
__refill_stock+0x80/0x270 mm/memcontrol.c:1811
drain_obj_stock+0x2ab/0x3b0 mm/memcontrol.c:2820
drain_local_stock+0xb0/0x330 mm/memcontrol.c:1792
process_one_work+0x9c8/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3393
kthread+0x2c4/0x3a0 kernel/kthread.c:389
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
other info that might help us debug this:
Chain exists of:
&pool->lock --> &trie->lock --> stock_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(stock_lock);
lock(&trie->lock);
lock(stock_lock);
lock(&pool->lock);
*** DEADLOCK ***
5 locks held by kworker/0:7/5835:
#0: ffff88801ac78948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc90002dbfd80 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((&memcg_stock) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((typeof(*((&memcg_stock))) *)((&memcg_stock)))); (typeof((typeof(*((&memcg_stock))) *)((&memcg_stock)))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff8880b88397e0 (stock_lock){..-.}-{2:2}, at: local_lock_acquire+0x10/0x150 include/linux/local_lock_internal.h:29
#3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
#3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: percpu_ref_put_many include/linux/percpu-refcount.h:330 [inline]
#3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: percpu_ref_put include/linux/percpu-refcount.h:351 [inline]
#3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: css_put include/linux/cgroup_refcnt.h:79 [inline]
#3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: css_put include/linux/cgroup_refcnt.h:76 [inline]
#3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: drain_stock+0x13c/0x2e0 mm/memcontrol.c:1774
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: __queue_work+0xf2/0x1070 kernel/workqueue.c:2261
stack backtrace:
CPU: 0 UID: 0 PID: 5835 Comm: kworker/0:7 Not tainted 6.11.0-rc7-syzkaller-00095-gb8e7cd09ae54 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: events drain_local_stock
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
__queue_work+0x26b/0x1070 kernel/workqueue.c:2301
queue_work_on+0x11a/0x140 kernel/workqueue.c:2392
percpu_ref_put_many include/linux/percpu-refcount.h:335 [inline]
percpu_ref_put include/linux/percpu-refcount.h:351 [inline]
css_put include/linux/cgroup_refcnt.h:79 [inline]
css_put include/linux/cgroup_refcnt.h:76 [inline]
drain_stock+0x287/0x2e0 mm/memcontrol.c:1774
__refill_stock+0x80/0x270 mm/memcontrol.c:1811
drain_obj_stock+0x2ab/0x3b0 mm/memcontrol.c:2820
drain_local_stock+0xb0/0x330 mm/memcontrol.c:1792
process_one_work+0x9c8/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3393
kthread+0x2c4/0x3a0 kernel/kthread.c:389
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>