syzbot

================================
WARNING: inconsistent lock state
6.14.0-rc2-syzkaller #0 Not tainted
--------------------------------
inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
migration/1/23 [HC1[1]:SC0[0]:HE0:SE1] takes:
ffff8880b873e958 ((wq_completion)loop3){?.+.}-{0:0}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
{HARDIRQ-ON-W} state was registered at:
  lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
  process_one_work kernel/workqueue.c:3211 [inline]
  process_scheduled_works+0x950/0x1840 kernel/workqueue.c:3317
  worker_thread+0x870/0xd30 kernel/workqueue.c:3398
  kthread+0x7ab/0x920 kernel/kthread.c:464
  ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:148
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
irq event stamp: 1136
hardirqs last  enabled at (1135): [<ffffffff818e9ef5>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1533 [inline]
hardirqs last  enabled at (1135): [<ffffffff818e9ef5>] finish_lock_switch kernel/sched/core.c:5131 [inline]
hardirqs last  enabled at (1135): [<ffffffff818e9ef5>] finish_task_switch+0x1e5/0x870 kernel/sched/core.c:5249
hardirqs last disabled at (1136): [<ffffffff8bf5c41e>] sysvec_call_function_single+0xe/0xc0 arch/x86/kernel/smp.c:266
softirqs last  enabled at (0): [<ffffffff817f242a>] rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
softirqs last  enabled at (0): [<ffffffff817f242a>] rcu_read_lock include/linux/rcupdate.h:849 [inline]
softirqs last  enabled at (0): [<ffffffff817f242a>] copy_process+0x9fa/0x3d50 kernel/fork.c:2272
softirqs last disabled at (0): [<0000000000000000>] 0x0

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock((wq_completion)loop3);
  <Interrupt>
    lock((wq_completion)loop3);

 *** DEADLOCK ***

1 lock held by migration/1/23:
 #0: ffff8880b863e958 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598

stack backtrace:
CPU: 1 UID: 0 PID: 23 Comm: migration/1 Not tainted 6.14.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Stopper: 0x0 <- 0x0
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_usage_bug+0x62e/0x8b0 kernel/locking/lockdep.c:4040
 valid_state+0x13a/0x1c0 kernel/locking/lockdep.c:4054
 mark_lock_irq+0xbb/0xc20 kernel/locking/lockdep.c:4265
 mark_lock+0x223/0x360 kernel/locking/lockdep.c:4751
 mark_usage kernel/locking/lockdep.c:4637 [inline]
 __lock_acquire+0xbc3/0x2100 kernel/locking/lockdep.c:5182
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
 _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
 raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
 _double_lock_balance kernel/sched/sched.h:3006 [inline]
 double_lock_balance kernel/sched/sched.h:3051 [inline]
 find_lock_lowest_rq+0x1e1/0x670 kernel/sched/rt.c:1914
 push_rt_task+0x144/0x790 kernel/sched/rt.c:2048
 rto_push_irq_work_func+0x93/0x350 kernel/sched/rt.c:2249
 irq_work_single+0x136/0x240 kernel/irq_work.c:221
 __flush_smp_call_function_queue+0x9e4/0x1620 kernel/smp.c:574
 __sysvec_call_function_single+0xb8/0x430 arch/x86/kernel/smp.c:271
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0x9e/0xc0 arch/x86/kernel/smp.c:266
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:finish_task_switch+0x1ea/0x870 kernel/sched/core.c:5251
Code: c9 50 e8 49 0a 0c 00 48 83 c4 08 4c 89 f7 e8 fd 39 00 00 0f 1f 44 00 00 4c 89 f7 e8 80 fd 69 0a e8 7b 75 38 00 fb 48 8b 5d c0 <48> 8d bb 08 16 00 00 48 89 f8 48 c1 e8 03 49 be 00 00 00 00 00 fc
RSP: 0018:ffffc900001d7b08 EFLAGS: 00000286
RAX: 759e5ab9424d5800 RBX: ffff88801d685a00 RCX: ffffffff9a400903
RDX: dffffc0000000000 RSI: ffffffff8c0aa660 RDI: ffffffff8c608ac0
RBP: ffffc900001d7b50 R08: ffffffff901b5c77 R09: 1ffffffff2036b8e
R10: dffffc0000000000 R11: fffffbfff2036b8f R12: 1ffff110170e7eee
R13: dffffc0000000000 R14: ffff8880b873e940 R15: ffff8880b873f770
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x1916/0x4c90 kernel/sched/core.c:6764
 __schedule_loop kernel/sched/core.c:6841 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6856
 smpboot_thread_fn+0x61e/0xa30 kernel/smpboot.c:160
 kthread+0x7ab/0x920 kernel/kthread.c:464
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	c9                   	leave
   1:	50                   	push   %rax
   2:	e8 49 0a 0c 00       	call   0xc0a50
   7:	48 83 c4 08          	add    $0x8,%rsp
   b:	4c 89 f7             	mov    %r14,%rdi
   e:	e8 fd 39 00 00       	call   0x3a10
  13:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  18:	4c 89 f7             	mov    %r14,%rdi
  1b:	e8 80 fd 69 0a       	call   0xa69fda0
  20:	e8 7b 75 38 00       	call   0x3875a0
  25:	fb                   	sti
  26:	48 8b 5d c0          	mov    -0x40(%rbp),%rbx
* 2a:	48 8d bb 08 16 00 00 	lea    0x1608(%rbx),%rdi <-- trapping instruction
  31:	48 89 f8             	mov    %rdi,%rax
  34:	48 c1 e8 03          	shr    $0x3,%rax
  38:	49                   	rex.WB
  39:	be 00 00 00 00       	mov    $0x0,%esi
  3e:	00 fc                	add    %bh,%ah