syzbot


possible deadlock in __queue_map_get

Status: upstream: reported C repro on 2024/04/08 00:56
Bug presence: origin:upstream
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+74e452172ac5a1e20d64@syzkaller.appspotmail.com
First crash: 440d, last: 2d09h
Bug presence (3)
Date Name Commit Repro Result
2025/01/29 linux-6.1.y (ToT) 75cefdf153f5 C [report] possible deadlock in __queue_map_get
2024/04/29 upstream (ToT) b947cc5bf6d7 C [report] possible deadlock in __queue_map_get
2025/01/29 upstream (ToT) 05dbaf8dd8bf C Didn't crash
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in __queue_map_get bpf C error 180 76d 435d 28/29 fixed on 2025/06/10 16:19
Fix bisection attempts (6)
Created Duration User Patch Repo Result
2025/05/21 02:49 1h37m bisect fix linux-6.1.y OK (0) job log log
2025/04/17 19:17 2h06m bisect fix linux-6.1.y OK (0) job log log
2025/02/12 20:23 1h50m fix candidate upstream OK (0) job log log
2024/10/15 01:55 0m bisect fix linux-6.1.y error job log
2024/09/08 03:18 1h06m bisect fix linux-6.1.y OK (0) job log log
2024/08/04 03:22 1h44m bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
============================================
WARNING: possible recursive locking detected
6.1.141-syzkaller #0 Not tainted
--------------------------------------------
syz-executor151/4260 is trying to acquire lock:
ffff88807a5fa218 (&qs->lock){-.-.}-{2:2}, at: __queue_map_get+0x118/0x4a0 kernel/bpf/queue_stack_maps.c:109

but task is already holding lock:
ffff888030b29218 (&qs->lock){-.-.}-{2:2}, at: __queue_map_get+0x118/0x4a0 kernel/bpf/queue_stack_maps.c:109

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&qs->lock);
  lock(&qs->lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

4 locks held by syz-executor151/4260:
 #0: ffff888075f7cf78 (&tsk->futex_exit_mutex){+.+.}-{3:3}, at: futex_cleanup_begin kernel/futex/core.c:1076 [inline]
 #0: ffff888075f7cf78 (&tsk->futex_exit_mutex){+.+.}-{3:3}, at: futex_exit_release+0x2f/0x1c0 kernel/futex/core.c:1128
 #1: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #1: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #1: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2284 [inline]
 #1: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xda/0x3b0 kernel/trace/bpf_trace.c:2324
 #2: ffff888030b29218 (&qs->lock){-.-.}-{2:2}, at: __queue_map_get+0x118/0x4a0 kernel/bpf/queue_stack_maps.c:109
 #3: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #3: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #3: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2284 [inline]
 #3: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xda/0x3b0 kernel/trace/bpf_trace.c:2324

stack backtrace:
CPU: 0 PID: 4260 Comm: syz-executor151 Not tainted 6.1.141-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
 __lock_acquire+0x122f/0x7c50 kernel/locking/lockdep.c:-1
 lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162
 __queue_map_get+0x118/0x4a0 kernel/bpf/queue_stack_maps.c:109
 bpf_prog_00798911c748094f+0x3a/0x3e
 bpf_dispatcher_nop_func include/linux/bpf.h:1001 [inline]
 __bpf_prog_run include/linux/filter.h:603 [inline]
 bpf_prog_run include/linux/filter.h:610 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline]
 bpf_trace_run2+0x1cd/0x3b0 kernel/trace/bpf_trace.c:2324
 __traceiter_contention_end+0x74/0xa0 include/trace/events/lock.h:122
 trace_contention_end+0x13f/0x190 include/trace/events/lock.h:122
 __pv_queued_spin_lock_slowpath+0x7e8/0x9c0 kernel/locking/qspinlock.c:560
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline]
 queued_spin_lock_slowpath+0x43/0x50 arch/x86/include/asm/qspinlock.h:51
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x217/0x280 kernel/locking/spinlock_debug.c:115
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
 _raw_spin_lock_irqsave+0xb0/0xf0 kernel/locking/spinlock.c:162
 __queue_map_get+0x118/0x4a0 kernel/bpf/queue_stack_maps.c:109
 bpf_prog_00798911c748094f+0x3a/0x3e
 bpf_dispatcher_nop_func include/linux/bpf.h:1001 [inline]
 __bpf_prog_run include/linux/filter.h:603 [inline]
 bpf_prog_run include/linux/filter.h:610 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline]
 bpf_trace_run2+0x1cd/0x3b0 kernel/trace/bpf_trace.c:2324
 __traceiter_contention_end+0x74/0xa0 include/trace/events/lock.h:122
 trace_contention_end+0x123/0x170 include/trace/events/lock.h:122
 __mutex_lock_common kernel/locking/mutex.c:612 [inline]
 __mutex_lock+0x194/0xaf0 kernel/locking/mutex.c:747
 futex_cleanup_begin kernel/futex/core.c:1076 [inline]
 futex_exit_release+0x2f/0x1c0 kernel/futex/core.c:1128
 exit_mm_release+0x16/0x30 kernel/fork.c:1506
 exit_mm+0xa4/0x2c0 kernel/exit.c:537
 do_exit+0x8b9/0x2400 kernel/exit.c:858
 do_group_exit+0x217/0x2d0 kernel/exit.c:1021
 __do_sys_exit_group kernel/exit.c:1032 [inline]
 __se_sys_exit_group kernel/exit.c:1030 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1030
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa7b30be079
Code: 90 49 c7 c0 b8 ff ff ff be e7 00 00 00 ba 3c 00 00 00 eb 12 0f 1f 44 00 00 89 d0 0f 05 48 3d 00 f0 ff ff 77 1c f4 89 f0 0f 05 <48> 3d 00 f0 ff ff 76 e7 f7 d8 64 41 89 00 eb df 0f 1f 80 00 00 00
RSP: 002b:00007fff7e6ed7d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa7b30be079
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007fa7b31392b0 R08: ffffffffffffffb8 R09: 00000000000000a0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa7b31392b0
R13: 0000000000000000 R14: 00007fa7b3139d20 R15: 00007fa7b308f210
 </TASK>

Crashes (25):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/20 00:16 linux-6.1.y 58485ff1a74f ed3e87f7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2025/01/07 00:27 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/12/16 01:12 linux-6.1.y 52f863f820fd 7cbfbb3a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/05/08 23:37 linux-6.1.y 909ba1f1b414 20bf80e1 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/04/15 02:16 linux-6.1.y cd5d98c0556c c8349e48 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2025/06/19 22:50 linux-6.1.y 58485ff1a74f ed3e87f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2025/03/14 20:28 linux-6.1.y 344a09659766 e2826670 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2025/03/14 20:26 linux-6.1.y 344a09659766 e2826670 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2025/02/26 03:42 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2025/02/26 03:33 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __queue_map_get
2025/01/19 13:25 linux-6.1.y f4f677285b38 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2025/01/18 04:18 linux-6.1.y 60ceadf9247e f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2025/01/18 04:16 linux-6.1.y 60ceadf9247e f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2025/01/18 04:13 linux-6.1.y 60ceadf9247e f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/09/12 22:50 linux-6.1.y 5f55cad62cc9 60e1a995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/06/24 08:27 linux-6.1.y eb44d83053d6 edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/06/24 07:46 linux-6.1.y eb44d83053d6 edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/05/27 08:27 linux-6.1.y 88690811da69 a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __queue_map_get
2024/05/26 02:59 linux-6.1.y 88690811da69 a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/05/26 01:15 linux-6.1.y 88690811da69 a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/05/13 14:25 linux-6.1.y 909ba1f1b414 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/05/07 18:35 linux-6.1.y 909ba1f1b414 cb2dcc0e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/04/19 00:11 linux-6.1.y 6741e066ec76 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/04/15 01:19 linux-6.1.y cd5d98c0556c c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in __queue_map_get
2024/04/08 00:55 linux-6.1.y 347385861c50 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __queue_map_get
* Struck through repros no longer work on HEAD.