syzbot

=====================================================
WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
5.15.153-syzkaller #0 Not tainted
-----------------------------------------------------
syz-executor.3/3888 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire:
ffff88807d1a9820 (&htab->buckets[i].lock){+...}-{2:2}, at: sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:937

and this task is already holding:
ffff888023808018 (&sighand->siglock){-...}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:388 [inline]
ffff888023808018 (&sighand->siglock){-...}-{2:2}, at: get_signal+0x20e/0x14e0 kernel/signal.c:2686
which would create a new lock dependency:
 (&sighand->siglock){-...}-{2:2} -> (&htab->buckets[i].lock){+...}-{2:2}

but this new dependency connects a HARDIRQ-irq-safe lock:
 (&sighand->siglock){-...}-{2:2}

... which became HARDIRQ-irq-safe at:
  lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
  __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
  _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
  __lock_task_sighand+0x11a/0x290 kernel/signal.c:1404
  lock_task_sighand include/linux/sched/signal.h:704 [inline]
  do_send_sig_info kernel/signal.c:1293 [inline]
  group_send_sig_info+0x23f/0x2d0 kernel/signal.c:1442
  do_bpf_send_signal+0x81/0x150 kernel/trace/bpf_trace.c:779
  irq_work_single kernel/irq_work.c:155 [inline]
  irq_work_run_list+0x20b/0x370 kernel/irq_work.c:177
  irq_work_run+0x63/0xe0 kernel/irq_work.c:186
  __sysvec_irq_work+0x9a/0x250 arch/x86/kernel/irq_work.c:22
  sysvec_irq_work+0x89/0xb0 arch/x86/kernel/irq_work.c:17
  asm_sysvec_irq_work+0x16/0x20 arch/x86/include/asm/idtentry.h:664
  __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
  _raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:202
  spin_unlock_irq include/linux/spinlock.h:413 [inline]
  get_signal+0x13ee/0x14e0 kernel/signal.c:2892
  arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
  handle_signal_work kernel/entry/common.c:148 [inline]
  exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:172
  exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:208
  irqentry_exit_to_user_mode+0x5/0x40 kernel/entry/common.c:314
  exc_general_protection+0x358/0x4f0 arch/x86/kernel/traps.c:562
  asm_exc_general_protection+0x22/0x30 arch/x86/include/asm/idtentry.h:562

to a HARDIRQ-irq-unsafe lock:
 (&htab->buckets[i].lock){+...}-{2:2}

... which became HARDIRQ-irq-unsafe at:
...
  lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
  __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
  _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
  sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:937
  0xffffffffa002c672
  bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
  __bpf_prog_run include/linux/filter.h:628 [inline]
  bpf_prog_run include/linux/filter.h:635 [inline]
  __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
  bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
  __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
  trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
  kmem_cache_free+0x1ce/0x1f0 mm/slub.c:3516
  adjust_va_to_fit_type mm/vmalloc.c:1336 [inline]
  __alloc_vmap_area mm/vmalloc.c:1452 [inline]
  alloc_vmap_area+0x16ae/0x19a0 mm/vmalloc.c:1543
  __get_vm_area_node+0x16e/0x2f0 mm/vmalloc.c:2423
  __vmalloc_node_range+0xe3/0x8c0 mm/vmalloc.c:3019
  __vmalloc_node mm/vmalloc.c:3079 [inline]
  __vmalloc+0x75/0x80 mm/vmalloc.c:3093
  bpf_prog_alloc_no_stats+0x33/0x2f0 kernel/bpf/core.c:90
  bpf_prog_alloc+0x18/0x1d0 kernel/bpf/core.c:124
  bpf_prog_load+0x800/0x1b60 kernel/bpf/syscall.c:2300
  __sys_bpf+0x343/0x670 kernel/bpf/syscall.c:4651
  __do_sys_bpf kernel/bpf/syscall.c:4755 [inline]
  __se_sys_bpf kernel/bpf/syscall.c:4753 [inline]
  __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4753
  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
  entry_SYSCALL_64_after_hwframe+0x61/0xcb

other info that might help us debug this:

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&htab->buckets[i].lock);
                               local_irq_disable();
                               lock(&sighand->siglock);
                               lock(&htab->buckets[i].lock);
  <Interrupt>
    lock(&sighand->siglock);

 *** DEADLOCK ***

2 locks held by syz-executor.3/3888:
 #0: ffff888023808018 (&sighand->siglock){-...}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:388 [inline]
 #0: ffff888023808018 (&sighand->siglock){-...}-{2:2}, at: get_signal+0x20e/0x14e0 kernel/signal.c:2686
 #1: ffffffff8c91f720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311

the dependencies between HARDIRQ-irq-safe lock and the holding lock:
-> (&sighand->siglock){-...}-{2:2} {
   IN-HARDIRQ-W at:
                    lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                    __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                    _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
                    __lock_task_sighand+0x11a/0x290 kernel/signal.c:1404
                    lock_task_sighand include/linux/sched/signal.h:704 [inline]
                    do_send_sig_info kernel/signal.c:1293 [inline]
                    group_send_sig_info+0x23f/0x2d0 kernel/signal.c:1442
                    do_bpf_send_signal+0x81/0x150 kernel/trace/bpf_trace.c:779
                    irq_work_single kernel/irq_work.c:155 [inline]
                    irq_work_run_list+0x20b/0x370 kernel/irq_work.c:177
                    irq_work_run+0x63/0xe0 kernel/irq_work.c:186
                    __sysvec_irq_work+0x9a/0x250 arch/x86/kernel/irq_work.c:22
                    sysvec_irq_work+0x89/0xb0 arch/x86/kernel/irq_work.c:17
                    asm_sysvec_irq_work+0x16/0x20 arch/x86/include/asm/idtentry.h:664
                    __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
                    _raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:202
                    spin_unlock_irq include/linux/spinlock.h:413 [inline]
                    get_signal+0x13ee/0x14e0 kernel/signal.c:2892
                    arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
                    handle_signal_work kernel/entry/common.c:148 [inline]
                    exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:172
                    exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:208
                    irqentry_exit_to_user_mode+0x5/0x40 kernel/entry/common.c:314
                    exc_general_protection+0x358/0x4f0 arch/x86/kernel/traps.c:562
                    asm_exc_general_protection+0x22/0x30 arch/x86/include/asm/idtentry.h:562
   INITIAL USE at:
                   lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                   __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                   _raw_spin_lock_irq+0xcf/0x110 kernel/locking/spinlock.c:170
                   spin_lock_irq include/linux/spinlock.h:388 [inline]
                   calculate_sigpending+0x4a/0x80 kernel/signal.c:195
                   ret_from_fork+0x8/0x30 arch/x86/entry/entry_64.S:283
 }
 ... key      at: [<ffffffff8f5d8620>] sighand_ctor.__key+0x0/0x20

the dependencies between the lock to be acquired
 and HARDIRQ-irq-unsafe lock:
-> (&htab->buckets[i].lock){+...}-{2:2} {
   HARDIRQ-ON-W at:
                    lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                    _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                    sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:937
                    0xffffffffa002c672
                    bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
                    __bpf_prog_run include/linux/filter.h:628 [inline]
                    bpf_prog_run include/linux/filter.h:635 [inline]
                    __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
                    bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
                    __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
                    trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
                    kmem_cache_free+0x1ce/0x1f0 mm/slub.c:3516
                    adjust_va_to_fit_type mm/vmalloc.c:1336 [inline]
                    __alloc_vmap_area mm/vmalloc.c:1452 [inline]
                    alloc_vmap_area+0x16ae/0x19a0 mm/vmalloc.c:1543
                    __get_vm_area_node+0x16e/0x2f0 mm/vmalloc.c:2423
                    __vmalloc_node_range+0xe3/0x8c0 mm/vmalloc.c:3019
                    __vmalloc_node mm/vmalloc.c:3079 [inline]
                    __vmalloc+0x75/0x80 mm/vmalloc.c:3093
                    bpf_prog_alloc_no_stats+0x33/0x2f0 kernel/bpf/core.c:90
                    bpf_prog_alloc+0x18/0x1d0 kernel/bpf/core.c:124
                    bpf_prog_load+0x800/0x1b60 kernel/bpf/syscall.c:2300
                    __sys_bpf+0x343/0x670 kernel/bpf/syscall.c:4651
                    __do_sys_bpf kernel/bpf/syscall.c:4755 [inline]
                    __se_sys_bpf kernel/bpf/syscall.c:4753 [inline]
                    __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4753
                    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
                    do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
                    entry_SYSCALL_64_after_hwframe+0x61/0xcb
   INITIAL USE at:
                   lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
                   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                   _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                   sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:937
                   0xffffffffa002c672
                   bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
                   __bpf_prog_run include/linux/filter.h:628 [inline]
                   bpf_prog_run include/linux/filter.h:635 [inline]
                   __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
                   bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
                   __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
                   trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
                   kmem_cache_free+0x1ce/0x1f0 mm/slub.c:3516
                   kfree_skb include/linux/skbuff.h:1123 [inline]
                   __tipc_shutdown+0x821/0x1640 net/tipc/socket.c:572
                   tipc_release+0x178/0x16d0 net/tipc/socket.c:642
                   __sock_release net/socket.c:649 [inline]
                   sock_close+0xcd/0x230 net/socket.c:1336
                   __fput+0x3bf/0x890 fs/file_table.c:280
                   task_work_run+0x129/0x1a0 kernel/task_work.c:164
                   tracehook_notify_resume include/linux/tracehook.h:189 [inline]
                   exit_to_user_mode_loop+0x106/0x130 kernel/entry/common.c:175
                   exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:208
                   __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
                   syscall_exit_to_user_mode+0x5d/0x250 kernel/entry/common.c:301
                   do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
                   entry_SYSCALL_64_after_hwframe+0x61/0xcb
 }
 ... key      at: [<ffffffff9178a740>] sock_hash_alloc.__key+0x0/0x20
 ... acquired at:
   lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
   _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
   sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:937
   bpf_prog_2c29ac5cdc6b1842+0x3a/0x810
   bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
   __bpf_prog_run include/linux/filter.h:628 [inline]
   bpf_prog_run include/linux/filter.h:635 [inline]
   __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
   bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
   __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
   trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
   kmem_cache_free+0x1ce/0x1f0 mm/slub.c:3516
   __sigqueue_free kernel/signal.c:458 [inline]
   collect_signal kernel/signal.c:597 [inline]
   __dequeue_signal+0x4ac/0x5c0 kernel/signal.c:619
   dequeue_signal+0xab/0x520 kernel/signal.c:637
   get_signal+0x52e/0x14e0 kernel/signal.c:2770
   arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
   handle_signal_work kernel/entry/common.c:148 [inline]
   exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:172
   exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:208
   __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
   syscall_exit_to_user_mode+0x5d/0x250 kernel/entry/common.c:301
   do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
   entry_SYSCALL_64_after_hwframe+0x61/0xcb


stack backtrace:
CPU: 0 PID: 3888 Comm: syz-executor.3 Not tainted 5.15.153-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_bad_irq_dependency kernel/locking/lockdep.c:2567 [inline]
 check_irq_usage kernel/locking/lockdep.c:2806 [inline]
 check_prev_add kernel/locking/lockdep.c:3057 [inline]
 check_prevs_add kernel/locking/lockdep.c:3172 [inline]
 validate_chain+0x4d01/0x5930 kernel/locking/lockdep.c:3788
 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
 _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
 sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:937
 bpf_prog_2c29ac5cdc6b1842+0x3a/0x810
 bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
 bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
 __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
 trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
 kmem_cache_free+0x1ce/0x1f0 mm/slub.c:3516
 __sigqueue_free kernel/signal.c:458 [inline]
 collect_signal kernel/signal.c:597 [inline]
 __dequeue_signal+0x4ac/0x5c0 kernel/signal.c:619
 dequeue_signal+0xab/0x520 kernel/signal.c:637
 get_signal+0x52e/0x14e0 kernel/signal.c:2770
 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x5d/0x250 kernel/entry/common.c:301
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fb37a61e770
Code: 5b 5d c3 48 8d 3d 8d 0a 0a 00 e8 3b fb ff ff 48 8d 3d 8f 0a 0a 00 e8 2f fb ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 <53> 89 fb 48 83 ec 10 64 8b 04 25 ac ff ff ff 85 c0 74 2a 89 fe 31
RSP: 002b:00007fb378be52b8 EFLAGS: 00000283
RAX: 0000000000000000 RBX: 00007fb378be5dc0 RCX: 00007fb37a76bbc0
RDX: 00007fb378be52c0 RSI: 00007fb378be53f0 RDI: 000000000000000b
RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000000073
R13: 00007fb378be5f40 R14: 9999999999999999 R15: 0000000000000000
 </TASK>