syzbot

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/4482 is trying to acquire lock:
ffff888020b90a38 (&trie->lock){..-.}-{2:2}, at: trie_delete_elem+0x90/0x710 kernel/bpf/lpm_trie.c:467

but task is already holding lock:
ffffffff8c9375d8 (depot_lock){-.-.}-{2:2}, at: stack_depot_save+0x1d2/0x440 lib/stackdepot.c:307

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (depot_lock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xb0/0x100 kernel/locking/spinlock.c:162
       stack_depot_save+0x1d2/0x440 lib/stackdepot.c:307
       kasan_save_stack mm/kasan/common.c:40 [inline]
       kasan_set_track mm/kasan/common.c:46 [inline]
       set_alloc_info mm/kasan/common.c:434 [inline]
       ____kasan_kmalloc mm/kasan/common.c:513 [inline]
       __kasan_kmalloc+0xcc/0xf0 mm/kasan/common.c:522
       kmalloc_node include/linux/slab.h:630 [inline]
       bpf_map_kmalloc_node+0xba/0x140 kernel/bpf/syscall.c:432
       lpm_trie_node_alloc kernel/bpf/lpm_trie.c:290 [inline]
       trie_update_elem+0x1cc/0xc50 kernel/bpf/lpm_trie.c:332
       bpf_map_update_value+0x57d/0x650 kernel/bpf/syscall.c:223
       generic_map_update_batch+0x52d/0x7d0 kernel/bpf/syscall.c:1430
       bpf_map_do_batch+0x466/0x600 kernel/bpf/syscall.c:-1
       __sys_bpf+0x671/0x6f0 kernel/bpf/syscall.c:-1
       __do_sys_bpf kernel/bpf/syscall.c:4761 [inline]
       __se_sys_bpf kernel/bpf/syscall.c:4759 [inline]
       __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4759
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x66/0xd0

-> #0 (&trie->lock){..-.}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3053 [inline]
       check_prevs_add kernel/locking/lockdep.c:3172 [inline]
       validate_chain kernel/locking/lockdep.c:3788 [inline]
       __lock_acquire+0x2c42/0x7d10 kernel/locking/lockdep.c:5012
       lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xb0/0x100 kernel/locking/spinlock.c:162
       trie_delete_elem+0x90/0x710 kernel/bpf/lpm_trie.c:467
       bpf_prog_2c29ac5cdc6b1842+0x3a/0x1e8
       bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
       __bpf_prog_run include/linux/filter.h:628 [inline]
       bpf_prog_run include/linux/filter.h:635 [inline]
       BPF_PROG_RUN_ARRAY include/linux/bpf.h:1439 [inline]
       trace_call_bpf+0x2b1/0x5b0 kernel/trace/bpf_trace.c:127
       perf_trace_run_bpf_submit+0x79/0x1c0 kernel/events/core.c:10016
       perf_trace_lock+0x301/0x390 include/trace/events/lock.h:39
       trace_lock_release include/trace/events/lock.h:58 [inline]
       lock_release+0x84a/0x8a0 kernel/locking/lockdep.c:5634
       __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:158 [inline]
       _raw_spin_unlock_irqrestore+0x6d/0x120 kernel/locking/spinlock.c:194
       stack_depot_save+0x404/0x440 lib/stackdepot.c:331
       kasan_save_stack+0x4b/0x60 mm/kasan/common.c:40
       kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
       task_work_add+0x2f/0x1d0 kernel/task_work.c:38
       fput_many+0xde/0x1a0 fs/file_table.c:367
       filp_close+0x10e/0x150 fs/open.c:1371
       __range_close fs/file.c:692 [inline]
       __close_range+0x24f/0x510 fs/file.c:747
       __do_sys_close_range fs/open.c:1410 [inline]
       __se_sys_close_range fs/open.c:1407 [inline]
       __x64_sys_close_range+0x76/0x80 fs/open.c:1407
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x66/0xd0

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(depot_lock);
                               lock(&trie->lock);
                               lock(depot_lock);
  lock(&trie->lock);

 *** DEADLOCK ***

2 locks held by syz.0.17/4482:
 #0: ffffffff8c9375d8 (depot_lock){-.-.}-{2:2}, at: stack_depot_save+0x1d2/0x440 lib/stackdepot.c:307
 #1: ffffffff8c31f320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312

stack backtrace:
CPU: 1 PID: 4482 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 check_noncircular+0x296/0x330 kernel/locking/lockdep.c:2133
 check_prev_add kernel/locking/lockdep.c:3053 [inline]
 check_prevs_add kernel/locking/lockdep.c:3172 [inline]
 validate_chain kernel/locking/lockdep.c:3788 [inline]
 __lock_acquire+0x2c42/0x7d10 kernel/locking/lockdep.c:5012
 lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xb0/0x100 kernel/locking/spinlock.c:162
 trie_delete_elem+0x90/0x710 kernel/bpf/lpm_trie.c:467
 bpf_prog_2c29ac5cdc6b1842+0x3a/0x1e8
 bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 BPF_PROG_RUN_ARRAY include/linux/bpf.h:1439 [inline]
 trace_call_bpf+0x2b1/0x5b0 kernel/trace/bpf_trace.c:127
 perf_trace_run_bpf_submit+0x79/0x1c0 kernel/events/core.c:10016
 perf_trace_lock+0x301/0x390 include/trace/events/lock.h:39
 trace_lock_release include/trace/events/lock.h:58 [inline]
 lock_release+0x84a/0x8a0 kernel/locking/lockdep.c:5634
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:158 [inline]
 _raw_spin_unlock_irqrestore+0x6d/0x120 kernel/locking/spinlock.c:194
 stack_depot_save+0x404/0x440 lib/stackdepot.c:331
 kasan_save_stack+0x4b/0x60 mm/kasan/common.c:40
 kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
 task_work_add+0x2f/0x1d0 kernel/task_work.c:38
 fput_many+0xde/0x1a0 fs/file_table.c:367
 filp_close+0x10e/0x150 fs/open.c:1371
 __range_close fs/file.c:692 [inline]
 __close_range+0x24f/0x510 fs/file.c:747
 __do_sys_close_range fs/open.c:1410 [inline]
 __se_sys_close_range fs/open.c:1407 [inline]
 __x64_sys_close_range+0x76/0x80 fs/open.c:1407
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5dda21ee59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc69253eb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: ffffffffffffffda RBX: 00007ffc69253fa0 RCX: 00007f5dda21ee59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000012de4 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2cd20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5dda497fac R14: 00007f5dda497fa8 R15: 00007f5dda497fa0
 </TASK>