======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/u4:0/11 is trying to acquire lock:
ffff888144e724e0 (kn->active#5){++++}-{0:0}, at: __kernfs_remove+0x426/0x830 fs/kernfs/dir.c:1486

but task is already holding lock:
ffffffff8ddcd450 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_remove+0x1cf/0x360 drivers/acpi/acpi_processor.c:503

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (cpu_hotplug_lock){++++}-{0:0}:
       percpu_down_write+0x54/0x2f0 kernel/locking/percpu-rwsem.c:227
       cpus_write_lock kernel/cpu.c:507 [inline]
       _cpu_up+0x77/0xad0 kernel/cpu.c:1672
       cpu_up+0x1d2/0x220 kernel/cpu.c:1760
       cpuhp_bringup_mask+0xe3/0x240 kernel/cpu.c:1826
       cpuhp_bringup_cpus_parallel+0xb6/0x160 kernel/cpu.c:1888
       bringup_nonboot_cpus+0x27/0x50 kernel/cpu.c:1914
       smp_init+0x3e/0x140 kernel/smp.c:979
       kernel_init_freeable+0x3c0/0x560 init/main.c:1518
       kernel_init+0x1d/0x1c0 init/main.c:1415
       ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
       ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

-> #2 (cpu_add_remove_lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:603 [inline]
       __mutex_lock+0x135/0xc80 kernel/locking/mutex.c:747
       cpu_maps_update_begin kernel/cpu.c:469 [inline]
       cpu_down+0x7f/0x1f0 kernel/cpu.c:1540
       device_offline+0x25d/0x3b0 drivers/base/core.c:4319
       acpi_bus_offline+0x242/0x410 drivers/acpi/scan.c:162
       acpi_scan_try_to_offline drivers/acpi/scan.c:225 [inline]
       acpi_scan_hot_remove drivers/acpi/scan.c:257 [inline]
       acpi_generic_hotplug_event drivers/acpi/scan.c:367 [inline]
       acpi_device_hotplug+0x5a8/0xce0 drivers/acpi/scan.c:391
       acpi_hotplug_work_fn+0x55/0x80 drivers/acpi/osl.c:1162
       process_one_work kernel/workqueue.c:2657 [inline]
       process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
       worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
       kthread+0x2fa/0x390 kernel/kthread.c:388
       ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
       ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

-> #1 (&device->physical_node_lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:603 [inline]
       __mutex_lock+0x135/0xc80 kernel/locking/mutex.c:747
       acpi_get_first_physical_node drivers/acpi/bus.c:717 [inline]
       acpi_primary_dev_companion drivers/acpi/bus.c:736 [inline]
       acpi_companion_match+0x8a/0x110 drivers/acpi/bus.c:790
       acpi_device_uevent_modalias+0x1a/0x30 drivers/acpi/device_sysfs.c:284
       platform_uevent+0x3c/0xb0 drivers/base/platform.c:1342
       dev_uevent+0x433/0x7c0 drivers/base/core.c:2709
       kobject_uevent_env+0x45f/0x890 lib/kobject_uevent.c:572
       kobject_synth_uevent+0x45b/0x940 lib/kobject_uevent.c:208
       uevent_store+0x26/0x60 drivers/base/core.c:2790
       kernfs_fop_write_iter+0x3a4/0x520 fs/kernfs/file.c:352
       call_write_iter include/linux/fs.h:2018 [inline]
       new_sync_write fs/read_write.c:491 [inline]
       vfs_write+0x474/0x9a0 fs/read_write.c:584
       ksys_write+0x151/0x260 fs/read_write.c:637
       do_syscall_x64 arch/x86/entry/common.c:46 [inline]
       do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
       entry_SYSCALL_64_after_hwframe+0x68/0xd2

-> #0 (kn->active#5){++++}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3162 [inline]
       check_prevs_add kernel/locking/lockdep.c:3281 [inline]
       validate_chain kernel/locking/lockdep.c:3897 [inline]
       __lock_acquire+0x3a07/0x7eb0 kernel/locking/lockdep.c:5171
       lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5790
       kernfs_drain+0x31e/0x6d0 fs/kernfs/dir.c:500
       __kernfs_remove+0x426/0x830 fs/kernfs/dir.c:1486
       kernfs_remove_by_name_ns+0xdc/0x150 fs/kernfs/dir.c:1695
       sysfs_remove_file include/linux/sysfs.h:629 [inline]
       device_remove_file drivers/base/core.c:3133 [inline]
       device_del+0x4fe/0x910 drivers/base/core.c:3954
       device_unregister+0x20/0xc0 drivers/base/core.c:3997
       unregister_cpu+0x51/0xf0 drivers/base/cpu.c:100
       acpi_processor_remove+0x1e4/0x360 drivers/acpi/acpi_processor.c:506
       acpi_bus_trim_one drivers/acpi/scan.c:2526 [inline]
       acpi_bus_trim drivers/acpi/scan.c:2551 [inline]
       acpi_scan_hot_remove drivers/acpi/scan.c:264 [inline]
       acpi_generic_hotplug_event drivers/acpi/scan.c:367 [inline]
       acpi_device_hotplug+0x92e/0xce0 drivers/acpi/scan.c:391
       acpi_hotplug_work_fn+0x55/0x80 drivers/acpi/osl.c:1162
       process_one_work kernel/workqueue.c:2657 [inline]
       process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
       worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
       kthread+0x2fa/0x390 kernel/kthread.c:388
       ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
       ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

other info that might help us debug this:

Chain exists of:
  kn->active#5 --> cpu_add_remove_lock --> cpu_hotplug_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(cpu_hotplug_lock);
                               lock(cpu_add_remove_lock);
                               lock(cpu_hotplug_lock);
  lock(kn->active#5);

 *** DEADLOCK ***

6 locks held by kworker/u4:0/11:
 #0: ffff888140070938 ((wq_completion)kacpi_hotplug){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888140070938 ((wq_completion)kacpi_hotplug){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc90000107d00 ((work_completion)(&hpw->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc90000107d00 ((work_completion)(&hpw->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8e8117a8 (device_hotplug_lock){+.+.}-{3:3}, at: acpi_device_hotplug+0x88/0xce0 drivers/acpi/scan.c:377
 #3: ffffffff8e64cca8 (acpi_scan_lock){+.+.}-{3:3}, at: acpi_device_hotplug+0x96/0xce0 drivers/acpi/scan.c:378
 #4: ffffffff8ddcd328 (cpu_add_remove_lock){+.+.}-{3:3}, at: acpi_processor_remove+0x1ca/0x360 drivers/acpi/acpi_processor.c:502
 #5: ffffffff8ddcd450 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_remove+0x1cf/0x360 drivers/acpi/acpi_processor.c:503

stack backtrace:
CPU: 0 PID: 11 Comm: kworker/u4:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: kacpi_hotplug acpi_hotplug_work_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 check_noncircular+0x2fc/0x400 kernel/locking/lockdep.c:2215
 check_prev_add kernel/locking/lockdep.c:3162 [inline]
 check_prevs_add kernel/locking/lockdep.c:3281 [inline]
 validate_chain kernel/locking/lockdep.c:3897 [inline]
 __lock_acquire+0x3a07/0x7eb0 kernel/locking/lockdep.c:5171
 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5790
 kernfs_drain+0x31e/0x6d0 fs/kernfs/dir.c:500
 __kernfs_remove+0x426/0x830 fs/kernfs/dir.c:1486
 kernfs_remove_by_name_ns+0xdc/0x150 fs/kernfs/dir.c:1695
 sysfs_remove_file include/linux/sysfs.h:629 [inline]
 device_remove_file drivers/base/core.c:3133 [inline]
 device_del+0x4fe/0x910 drivers/base/core.c:3954
 device_unregister+0x20/0xc0 drivers/base/core.c:3997
 unregister_cpu+0x51/0xf0 drivers/base/cpu.c:100
 acpi_processor_remove+0x1e4/0x360 drivers/acpi/acpi_processor.c:506
 acpi_bus_trim_one drivers/acpi/scan.c:2526 [inline]
 acpi_bus_trim drivers/acpi/scan.c:2551 [inline]
 acpi_scan_hot_remove drivers/acpi/scan.c:264 [inline]
 acpi_generic_hotplug_event drivers/acpi/scan.c:367 [inline]
 acpi_device_hotplug+0x92e/0xce0 drivers/acpi/scan.c:391
 acpi_hotplug_work_fn+0x55/0x80 drivers/acpi/osl.c:1162
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
ACPI: \_SB_.C001: Eject incomplete - status 0xf