syzbot

======================================================
WARNING: possible circular locking dependency detected
5.15.180-syzkaller #0 Not tainted
------------------------------------------------------
swapper/1/0 is trying to acquire lock:
ffff88807386f1b8 (&trie->lock){..-.}-{2:2}, at: trie_delete_elem+0x90/0x690 kernel/bpf/lpm_trie.c:467

but task is already holding lock:
ffff8880b8f28098 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x120/0x260 kernel/time/timer.c:946

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&base->lock){-.-.}-{2:2}:
       lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
       lock_timer_base+0x120/0x260 kernel/time/timer.c:946
       __mod_timer+0x1d6/0xeb0 kernel/time/timer.c:1019
       queue_delayed_work_on+0x156/0x250 kernel/workqueue.c:1715
       queue_delayed_work include/linux/workqueue.h:527 [inline]
       schedule_delayed_work include/linux/workqueue.h:631 [inline]
       kvfree_call_rcu+0x50e/0x8a0 kernel/rcu/tree.c:3625
       rtnl_register_internal+0x443/0x530 net/core/rtnetlink.c:223
       rtnl_register+0x32/0x70 net/core/rtnetlink.c:273
       ip_rt_init+0x2e6/0x3a0 net/ipv4/route.c:3791
       ip_init+0xa/0x20 net/ipv4/ip_output.c:1749
       inet_init+0x27c/0x390 net/ipv4/af_inet.c:2007
       do_one_initcall+0x22b/0x7a0 init/main.c:1302
       do_initcall_level+0x157/0x210 init/main.c:1375
       do_initcalls+0x49/0x90 init/main.c:1391
       kernel_init_freeable+0x425/0x5c0 init/main.c:1615
       kernel_init+0x19/0x290 init/main.c:1506
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

-> #1 (krc.lock){....}-{2:2}:
       lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
       __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
       _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
       krc_this_cpu_lock kernel/rcu/tree.c:3199 [inline]
       add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3506 [inline]
       kvfree_call_rcu+0x1b5/0x8a0 kernel/rcu/tree.c:3597
       trie_update_elem+0x8ad/0xca0 kernel/bpf/lpm_trie.c:396
       bpf_map_update_value+0x5d7/0x6c0 kernel/bpf/syscall.c:221
       generic_map_update_batch+0x54d/0x8b0 kernel/bpf/syscall.c:1421
       bpf_map_do_batch+0x4d0/0x620 kernel/bpf/syscall.c:-1
       __sys_bpf+0x55c/0x670 kernel/bpf/syscall.c:-1
       __do_sys_bpf kernel/bpf/syscall.c:4752 [inline]
       __se_sys_bpf kernel/bpf/syscall.c:4750 [inline]
       __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4750
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x66/0xd0

-> #0 (&trie->lock){..-.}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3053 [inline]
       check_prevs_add kernel/locking/lockdep.c:3172 [inline]
       validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
       __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
       lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
       trie_delete_elem+0x90/0x690 kernel/bpf/lpm_trie.c:467
       bpf_prog_2c29ac5cdc6b1842+0x3a/0x9ac
       bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
       __bpf_prog_run include/linux/filter.h:628 [inline]
       bpf_prog_run include/linux/filter.h:635 [inline]
       __bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
       bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1916
       trace_timer_start include/trace/events/timer.h:52 [inline]
       enqueue_timer+0x3ae/0x540 kernel/time/timer.c:586
       internal_add_timer kernel/time/timer.c:611 [inline]
       __mod_timer+0xa60/0xeb0 kernel/time/timer.c:1062
       lapb_start_t1timer net/lapb/lapb_timer.c:44 [inline]
       lapb_t1timer_expiry+0x779/0xae0 net/lapb/lapb_timer.c:202
       call_timer_fn+0x16d/0x560 kernel/time/timer.c:1451
       expire_timers kernel/time/timer.c:1496 [inline]
       __run_timers+0x67c/0x890 kernel/time/timer.c:1767
       run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
       handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
       __do_softirq kernel/softirq.c:592 [inline]
       invoke_softirq kernel/softirq.c:432 [inline]
       __irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
       irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
       instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
       sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
       asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
       native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
       arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
       default_idle+0xb/0x10 arch/x86/kernel/process.c:722
       default_idle_call+0x81/0xc0 kernel/sched/idle.c:112
       cpuidle_idle_call kernel/sched/idle.c:194 [inline]
       do_idle+0x271/0x670 kernel/sched/idle.c:306
       cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403
       start_secondary+0x371/0x500 arch/x86/kernel/smpboot.c:281
       secondary_startup_64_no_verify+0xb1/0xbb

other info that might help us debug this:

Chain exists of:
  &trie->lock --> krc.lock --> &base->lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&base->lock);
                               lock(krc.lock);
                               lock(&base->lock);
  lock(&trie->lock);

 *** DEADLOCK ***

4 locks held by swapper/1/0:
 #0: ffffc90000dd0be0 ((&lapb->t1timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
 #0: ffffc90000dd0be0 ((&lapb->t1timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x560 kernel/time/timer.c:1441
 #1: ffff88802c4ee9c0 (&lapb->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline]
 #1: ffff88802c4ee9c0 (&lapb->lock){+.-.}-{2:2}, at: lapb_t1timer_expiry+0x2f/0xae0 net/lapb/lapb_timer.c:99
 #2: ffff8880b8f28098 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x120/0x260 kernel/time/timer.c:946
 #3: ffffffff8cb1f4e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311

stack backtrace:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133
 check_prev_add kernel/locking/lockdep.c:3053 [inline]
 check_prevs_add kernel/locking/lockdep.c:3172 [inline]
 validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
 trie_delete_elem+0x90/0x690 kernel/bpf/lpm_trie.c:467
 bpf_prog_2c29ac5cdc6b1842+0x3a/0x9ac
 bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
 bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1916
 trace_timer_start include/trace/events/timer.h:52 [inline]
 enqueue_timer+0x3ae/0x540 kernel/time/timer.c:586
 internal_add_timer kernel/time/timer.c:611 [inline]
 __mod_timer+0xa60/0xeb0 kernel/time/timer.c:1062
 lapb_start_t1timer net/lapb/lapb_timer.c:44 [inline]
 lapb_t1timer_expiry+0x779/0xae0 net/lapb/lapb_timer.c:202
 call_timer_fn+0x16d/0x560 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x67c/0x890 kernel/time/timer.c:1767
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
 handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
 __do_softirq kernel/softirq.c:592 [inline]
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:723
Code: 07 80 c1 03 38 c1 7c b5 4c 89 e7 e8 af 84 81 f7 eb ab e8 88 80 f6 ff 00 00 cc cc 00 00 cc cc 66 90 0f 00 2d 07 1b 5d 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffc90000d67d28 EFLAGS: 000002c6
RAX: e8d9d32bc7fa1800 RBX: ffff88813ff68000 RCX: 00000000000056d6
RDX: 0000000000000001 RSI: ffffffff8aab18e0 RDI: ffffffff8af9e940
RBP: ffffc90000d67e80 R08: dffffc0000000000 R09: ffffed10171e765a
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920001acfbe
R13: 1ffff11027fed000 R14: 0000000000000001 R15: dffffc0000000000
 default_idle_call+0x81/0xc0 kernel/sched/idle.c:112
 cpuidle_idle_call kernel/sched/idle.c:194 [inline]
 do_idle+0x271/0x670 kernel/sched/idle.c:306
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403
 start_secondary+0x371/0x500 arch/x86/kernel/smpboot.c:281
 secondary_startup_64_no_verify+0xb1/0xbb
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	80 c1 03             	add    $0x3,%cl
   3:	38 c1                	cmp    %al,%cl
   5:	7c b5                	jl     0xffffffbc
   7:	4c 89 e7             	mov    %r12,%rdi
   a:	e8 af 84 81 f7       	call   0xf78184be
   f:	eb ab                	jmp    0xffffffbc
  11:	e8 88 80 f6 ff       	call   0xfff6809e
  16:	00 00                	add    %al,(%rax)
  18:	cc                   	int3
  19:	cc                   	int3
  1a:	00 00                	add    %al,(%rax)
  1c:	cc                   	int3
  1d:	cc                   	int3
  1e:	66 90                	xchg   %ax,%ax
  20:	0f 00 2d 07 1b 5d 00 	verw   0x5d1b07(%rip)        # 0x5d1b2e
  27:	fb                   	sti
  28:	f4                   	hlt
* 29:	c3                   	ret <-- trapping instruction
  2a:	0f 1f 40 00          	nopl   0x0(%rax)
  2e:	41 57                	push   %r15
  30:	41 56                	push   %r14
  32:	53                   	push   %rbx
  33:	49 be 00 00 00 00 00 	movabs $0xdffffc0000000000,%r14
  3a:	fc ff df
  3d:	65                   	gs
  3e:	48                   	rex.W