syzbot


possible deadlock in hrtimer_run_queues

Status: upstream: reported C repro on 2024/03/19 22:29
Subsystems: bpf net
[Documentation on labels]
Reported-by: syzbot+f311e026553fee3459a0@syzkaller.appspotmail.com
Fix commit: ff9105993240 bpf, sockmap: Prevent lock inversion deadlock in map delete elem
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-net-next-test-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64 ci-upstream-bpf-next-kasan-gce]
First crash: 42d, last: 1d08h
Cause bisection: failed (error log, bisect log)
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bpf?] [net?] possible deadlock in hrtimer_run_queues 3 (6) 2024/04/20 14:35
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 possible deadlock in hrtimer_run_queues C 20 17d 42d 0/3 upstream: reported C repro on 2024/03/15 12:42
linux-6.1 possible deadlock in hrtimer_run_queues C 19 17d 42d 0/3 upstream: reported C repro on 2024/03/15 23:12
Last patch testing requests (2)
Created Duration User Patch Repo Result
2024/03/20 22:49 24m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git ea80e3ed09ab OK log
2024/03/20 10:55 5h24m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git ea80e3ed09ab report log

Sample crash report:
=====================================================
WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
6.8.0-syzkaller-05236-g443574b03387 #0 Not tainted
-----------------------------------------------------
swapper/0/0 [HC0[0]:SC1[3]:HE0:SE0] is trying to acquire:
ffff8880182d8468 (&htab->buckets[i].lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff8880182d8468 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939

and this task is already holding:
ffff8880b943d8d8 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x6ec/0xec0
which would create a new lock dependency:
 (&pool->lock){-.-.}-{2:2} -> (&htab->buckets[i].lock){+.-.}-{2:2}

but this new dependency connects a HARDIRQ-irq-safe lock:
 (&pool->lock){-.-.}-{2:2}

... which became HARDIRQ-irq-safe at:
  lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
  __queue_work+0x6ec/0xec0
  queue_work_on+0x14f/0x250 kernel/workqueue.c:2435
  hrtimer_switch_to_hres kernel/time/hrtimer.c:750 [inline]
  hrtimer_run_queues+0x154/0x460 kernel/time/hrtimer.c:1918
  run_local_timers kernel/time/timer.c:2453 [inline]
  update_process_times+0x80/0x230 kernel/time/timer.c:2475
  tick_periodic+0x190/0x220 kernel/time/tick-common.c:100
  tick_handle_periodic+0x4a/0x160 kernel/time/tick-common.c:112
  local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
  __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049
  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
  sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043
  asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
  __kernel_text_address+0x12/0x40 kernel/extable.c:79
  unwind_get_return_address+0x5d/0xc0 arch/x86/kernel/unwind_orc.c:369
  arch_stack_walk+0x125/0x1b0 arch/x86/kernel/stacktrace.c:26
  stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
  kasan_save_stack mm/kasan/common.c:47 [inline]
  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
  unpoison_slab_object mm/kasan/common.c:312 [inline]
  __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
  kasan_slab_alloc include/linux/kasan.h:201 [inline]
  slab_post_alloc_hook mm/slub.c:3813 [inline]
  slab_alloc_node mm/slub.c:3860 [inline]
  kmem_cache_alloc_node+0x192/0x380 mm/slub.c:3903
  init_kmem_cache_nodes mm/slub.c:4917 [inline]
  kmem_cache_open mm/slub.c:5153 [inline]
  __kmem_cache_create+0x191/0x8b0 mm/slub.c:5716
  create_cache mm/slab_common.c:230 [inline]
  kmem_cache_create_usercopy+0x199/0x330 mm/slab_common.c:335
  kmem_cache_create+0x13/0x20 mm/slab_common.c:390
  eventpoll_init+0x14a/0x1d0 fs/eventpoll.c:2580
  do_one_initcall+0x238/0x830 init/main.c:1241
  do_initcall_level+0x157/0x210 init/main.c:1303
  do_initcalls+0x3f/0x80 init/main.c:1319
  kernel_init_freeable+0x435/0x5d0 init/main.c:1557
  kernel_init+0x1d/0x2a0 init/main.c:1446
  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

to a HARDIRQ-irq-unsafe lock:
 (&htab->buckets[i].lock){+.-.}-{2:2}

... which became HARDIRQ-irq-unsafe at:
...
  lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
  __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
  _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
  spin_lock_bh include/linux/spinlock.h:356 [inline]
  sock_hash_free+0x164/0x820 net/core/sock_map.c:1154
  bpf_map_free_deferred+0xe6/0x110 kernel/bpf/syscall.c:734
  process_one_work kernel/workqueue.c:3254 [inline]
  process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
  worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
  kthread+0x2f0/0x390 kernel/kthread.c:388
  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

other info that might help us debug this:

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&htab->buckets[i].lock);
                               local_irq_disable();
                               lock(&pool->lock);
                               lock(&htab->buckets[i].lock);
  <Interrupt>
    lock(&pool->lock);

 *** DEADLOCK ***

4 locks held by swapper/0/0:
 #0: ffffc90000007c00 ((&sdp->delay_work)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x600 kernel/time/timer.c:1789
 #1: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #1: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #1: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: __queue_work+0x198/0xec0 kernel/workqueue.c:2324
 #2: ffff8880b943d8d8 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x6ec/0xec0
 #3: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #3: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #3: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline]
 #3: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run3+0x14a/0x460 kernel/trace/bpf_trace.c:2421

the dependencies between HARDIRQ-irq-safe lock and the holding lock:
-> (&pool->lock){-.-.}-{2:2} {
   IN-HARDIRQ-W at:
                    lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
                    __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
                    _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
                    __queue_work+0x6ec/0xec0
                    queue_work_on+0x14f/0x250 kernel/workqueue.c:2435
                    hrtimer_switch_to_hres kernel/time/hrtimer.c:750 [inline]
                    hrtimer_run_queues+0x154/0x460 kernel/time/hrtimer.c:1918
                    run_local_timers kernel/time/timer.c:2453 [inline]
                    update_process_times+0x80/0x230 kernel/time/timer.c:2475
                    tick_periodic+0x190/0x220 kernel/time/tick-common.c:100
                    tick_handle_periodic+0x4a/0x160 kernel/time/tick-common.c:112
                    local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
                    __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049
                    instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
                    sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043
                    asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
                    __kernel_text_address+0x12/0x40 kernel/extable.c:79
                    unwind_get_return_address+0x5d/0xc0 arch/x86/kernel/unwind_orc.c:369
                    arch_stack_walk+0x125/0x1b0 arch/x86/kernel/stacktrace.c:26
                    stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
                    kasan_save_stack mm/kasan/common.c:47 [inline]
                    kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
                    unpoison_slab_object mm/kasan/common.c:312 [inline]
                    __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
                    kasan_slab_alloc include/linux/kasan.h:201 [inline]
                    slab_post_alloc_hook mm/slub.c:3813 [inline]
                    slab_alloc_node mm/slub.c:3860 [inline]
                    kmem_cache_alloc_node+0x192/0x380 mm/slub.c:3903
                    init_kmem_cache_nodes mm/slub.c:4917 [inline]
                    kmem_cache_open mm/slub.c:5153 [inline]
                    __kmem_cache_create+0x191/0x8b0 mm/slub.c:5716
                    create_cache mm/slab_common.c:230 [inline]
                    kmem_cache_create_usercopy+0x199/0x330 mm/slab_common.c:335
                    kmem_cache_create+0x13/0x20 mm/slab_common.c:390
                    eventpoll_init+0x14a/0x1d0 fs/eventpoll.c:2580
                    do_one_initcall+0x238/0x830 init/main.c:1241
                    do_initcall_level+0x157/0x210 init/main.c:1303
                    do_initcalls+0x3f/0x80 init/main.c:1319
                    kernel_init_freeable+0x435/0x5d0 init/main.c:1557
                    kernel_init+0x1d/0x2a0 init/main.c:1446
                    ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
                    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
   IN-SOFTIRQ-W
 at:
                    lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
                    __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
                    _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
                    __queue_work+0x6ec/0xec0
                    call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
                    expire_timers kernel/time/timer.c:1838 [inline]
                    __run_timers kernel/time/timer.c:2408 [inline]
                    __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2419
                    run_timer_base kernel/time/timer.c:2428 [inline]
                    run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
                    __do_softirq+0x2bc/0x943 kernel/softirq.c:554
                    invoke_softirq kernel/softirq.c:428 [inline]
                    __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
                    irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
                    instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
                    sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
                    asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
                    native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
                    arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline]
                    default_idle+0x13/0x20 arch/x86/kernel/process.c:742
                    default_idle_call+0x74/0xb0 kernel/sched/idle.c:117
                    cpuidle_idle_call kernel/sched/idle.c:191 [inline]
                    do_idle+0x22f/0x5d0 kernel/sched/idle.c:332
                    cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:430
                    rest_init+0x2e0/0x300 init/main.c:730
                    arch_call_rest_init+0xe/0x10 init/main.c:831
                    start_kernel+0x47a/0x500 init/main.c:1077
                    x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509
                    x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490
                    common_startup_64+0x13e/0x147
   INITIAL USE
 at:
                   lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
                   __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
                   _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
                   __queue_work+0x6ec/0xec0
                   queue_work_on+0x14f/0x250 kernel/workqueue.c:2435
                   queue_work include/linux/workqueue.h:605 [inline]
                   start_poll_synchronize_rcu_expedited+0xf7/0x150 kernel/rcu/tree_exp.h:1017
                   rcu_init+0xea/0x140 kernel/rcu/tree.c:5240
                   start_kernel+0x1f7/0x500 init/main.c:969
                   x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509
                   x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490
                   common_startup_64+0x13e/0x147
 }
 ... key      at: [<ffffffff926c0e60>] init_worker_pool.__key+0x0/0x20

the dependencies between the lock to be acquired
 and HARDIRQ-irq-unsafe lock:
->
 (
&htab->buckets[i].lock
){+.-.}-{2:2}
 {
   HARDIRQ-ON-W
 at:
                    lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
                    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                    _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
                    spin_lock_bh include/linux/spinlock.h:356 [inline]
                    sock_hash_free+0x164/0x820 net/core/sock_map.c:1154
                    bpf_map_free_deferred+0xe6/0x110 kernel/bpf/syscall.c:734
                    process_one_work kernel/workqueue.c:3254 [inline]
                    process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
                    worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
                    kthread+0x2f0/0x390 kernel/kthread.c:388
                    ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
                    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
   IN-SOFTIRQ-W
 at:
                    lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
                    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                    _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
                    spin_lock_bh include/linux/spinlock.h:356 [inline]
                    sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939
                    bpf_prog_bc4ba9860fbb0da4+0x46/0x4a
                    bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
                    __bpf_prog_run include/linux/filter.h:657 [inline]
                    bpf_prog_run include/linux/filter.h:664 [inline]
                    __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
                    bpf_trace_run3+0x238/0x460 kernel/trace/bpf_trace.c:2421
                    trace_workqueue_queue_work include/trace/events/workqueue.h:23 [inline]
                    __queue_work+0xe5b/0xec0 kernel/workqueue.c:2382
                    queue_work_on+0x14f/0x250 kernel/workqueue.c:2435
                    call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
                    expire_timers kernel/time/timer.c:1843 [inline]
                    __run_timers kernel/time/timer.c:2408 [inline]
                    __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
                    run_timer_base kernel/time/timer.c:2428 [inline]
                    run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
                    __do_softirq+0x2bc/0x943 kernel/softirq.c:554
                    invoke_softirq kernel/softirq.c:428 [inline]
                    __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
                    irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
                    instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
                    sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
                    asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
                    native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
                    arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline]
                    acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:112
                    acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707
                    cpuidle_enter_state+0x118/0x490 drivers/cpuidle/cpuidle.c:267
                    cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:388
                    call_cpuidle kernel/sched/idle.c:155 [inline]
                    cpuidle_idle_call kernel/sched/idle.c:236 [inline]
                    do_idle+0x375/0x5d0 kernel/sched/idle.c:332
                    cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:430
                    rest_init+0x2e0/0x300 init/main.c:730
                    arch_call_rest_init+0xe/0x10 init/main.c:831
                    start_kernel+0x47a/0x500 init/main.c:1077
                    x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509
                    x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490
                    common_startup_64+0x13e/0x147
   INITIAL USE at:
                   lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
                   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                   _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
                   spin_lock_bh include/linux/spinlock.h:356 [inline]
                   sock_hash_free+0x164/0x820 net/core/sock_map.c:1154
                   bpf_map_free_deferred+0xe6/0x110 kernel/bpf/syscall.c:734
                   process_one_work kernel/workqueue.c:3254 [inline]
                   process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
                   worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
                   kthread+0x2f0/0x390 kernel/kthread.c:388
                   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
                   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 }
 ... key      at: [<ffffffff94882300>] sock_hash_alloc.__key+0x0/0x20
 ... acquired at:
   lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
   _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
   spin_lock_bh include/linux/spinlock.h:356 [inline]
   sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939
   bpf_prog_bc4ba9860fbb0da4+0x46/0x4a
   bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
   __bpf_prog_run include/linux/filter.h:657 [inline]
   bpf_prog_run include/linux/filter.h:664 [inline]
   __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
   bpf_trace_run3+0x238/0x460 kernel/trace/bpf_trace.c:2421
   trace_workqueue_queue_work include/trace/events/workqueue.h:23 [inline]
   __queue_work+0xe5b/0xec0 kernel/workqueue.c:2382
   queue_work_on+0x14f/0x250 kernel/workqueue.c:2435
   call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
   expire_timers kernel/time/timer.c:1843 [inline]
   __run_timers kernel/time/timer.c:2408 [inline]
   __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
   run_timer_base kernel/time/timer.c:2428 [inline]
   run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
   __do_softirq+0x2bc/0x943 kernel/softirq.c:554
   invoke_softirq kernel/softirq.c:428 [inline]
   __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
   irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
   instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
   sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
   asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
   native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
   arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline]
   acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:112
   acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707
   cpuidle_enter_state+0x118/0x490 drivers/cpuidle/cpuidle.c:267
   cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:388
   call_cpuidle kernel/sched/idle.c:155 [inline]
   cpuidle_idle_call kernel/sched/idle.c:236 [inline]
   do_idle+0x375/0x5d0 kernel/sched/idle.c:332
   cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:430
   rest_init+0x2e0/0x300 init/main.c:730
   arch_call_rest_init+0xe/0x10 init/main.c:831
   start_kernel+0x47a/0x500 init/main.c:1077
   x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509
   x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490
   common_startup_64+0x13e/0x147


stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline]
 check_irq_usage kernel/locking/lockdep.c:2865 [inline]
 check_prev_add kernel/locking/lockdep.c:3138 [inline]
 check_prevs_add kernel/locking/lockdep.c:3253 [inline]
 validate_chain+0x4dc7/0x58e0 kernel/locking/lockdep.c:3869
 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
 _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:356 [inline]
 sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939
 bpf_prog_bc4ba9860fbb0da4+0x46/0x4a
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
 bpf_trace_run3+0x238/0x460 kernel/trace/bpf_trace.c:2421
 trace_workqueue_queue_work include/trace/events/workqueue.h:23 [inline]
 __queue_work+0xe5b/0xec0 kernel/workqueue.c:2382
 queue_work_on+0x14f/0x250 kernel/workqueue.c:2435
 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1843 [inline]
 __run_timers kernel/time/timer.c:2408 [inline]
 __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
 run_timer_base kernel/time/timer.c:2428 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
 __do_softirq+0x2bc/0x943 kernel/softirq.c:554
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:72 [inline]
RIP: 0010:acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:113
Code: 90 90 90 90 90 90 90 90 90 65 48 8b 04 25 80 ce 03 00 48 f7 00 08 00 00 00 75 10 66 90 0f 00 2d 15 3a 98 00 f3 0f 1e fa fb f4 <fa> c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90
RSP: 0018:ffffffff8de07ca8 EFLAGS: 00000246
RAX: ffffffff8de94680 RBX: ffff8880172ec064 RCX: 0000000000010f61
RDX: 0000000000000001 RSI: ffff8880172ec000 RDI: ffff8880172ec064
RBP: 0000000000039f18 R08: ffff8880b9437d0b R09: 1ffff11017286fa1
R10: dffffc0000000000 R11: ffffffff8b702580 R12: ffff88801a3a2800
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8e8a2ec0
 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707
 cpuidle_enter_state+0x118/0x490 drivers/cpuidle/cpuidle.c:267
 cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:388
 call_cpuidle kernel/sched/idle.c:155 [inline]
 cpuidle_idle_call kernel/sched/idle.c:236 [inline]
 do_idle+0x375/0x5d0 kernel/sched/idle.c:332
 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:430
 rest_init+0x2e0/0x300 init/main.c:730
 arch_call_rest_init+0xe/0x10 init/main.c:831
 start_kernel+0x47a/0x500 init/main.c:1077
 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509
 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490
 common_startup_64+0x13e/0x147
 </TASK>
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	65 48 8b 04 25 80 ce 	mov    %gs:0x3ce80,%rax
  10:	03 00
  12:	48 f7 00 08 00 00 00 	testq  $0x8,(%rax)
  19:	75 10                	jne    0x2b
  1b:	66 90                	xchg   %ax,%ax
  1d:	0f 00 2d 15 3a 98 00 	verw   0x983a15(%rip)        # 0x983a39
  24:	f3 0f 1e fa          	endbr64
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	fa                   	cli <-- trapping instruction
  2b:	c3                   	ret
  2c:	cc                   	int3
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	cc                   	int3
  30:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
  37:	00 00
  39:	90                   	nop
  3a:	90                   	nop
  3b:	90                   	nop
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop

Crashes (592):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/25 11:42 bpf 443574b03387 8bdc0f22 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 05:38 net f99c5f563c17 af24b050 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/19 20:08 bpf 443574b03387 af24b050 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/15 14:36 net f99c5f563c17 c8349e48 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/10 03:20 bpf 443574b03387 56086b24 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/31 22:02 bpf 443574b03387 6baf5069 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/31 19:16 net f99c5f563c17 6baf5069 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/31 05:33 bpf 443574b03387 6baf5069 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/29 01:19 bpf 443574b03387 120789fd .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/17 20:48 net ea80e3ed09ab d615901c .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/17 02:30 bpf 0740b6427e90 d615901c .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/15 22:21 bpf aae08491b943 d615901c .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/31 04:42 bpf-next 14bb1e8c8d4a 6baf5069 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/17 02:35 net-next 237bb5f7f7f5 d615901c .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/17 02:30 bpf-next 4c8644f86c85 d615901c .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/31 21:24 linux-next a6bd6c933339 6baf5069 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in hrtimer_run_queues
2024/03/31 04:16 linux-next a6bd6c933339 6baf5069 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in hrtimer_run_queues
2024/03/20 01:38 bpf f6e922365faf a485f239 .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/15 17:57 upstream fe46a7dd189e c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in hrtimer_run_queues
2024/04/15 11:30 upstream fe46a7dd189e c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root possible deadlock in hrtimer_run_queues
2024/04/15 00:08 upstream fe46a7dd189e c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in hrtimer_run_queues
2024/04/03 00:57 upstream b1e6ec0a0fd0 7925100d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream possible deadlock in hrtimer_run_queues
2024/04/26 00:47 bpf 443574b03387 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/25 22:48 bpf 443574b03387 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/25 20:17 bpf 443574b03387 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/25 08:46 bpf 443574b03387 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/25 00:35 bpf 443574b03387 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/24 22:53 bpf 443574b03387 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/24 21:12 bpf 443574b03387 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/23 22:18 bpf 443574b03387 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/23 09:52 bpf 443574b03387 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/23 08:17 bpf 443574b03387 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 22:30 bpf 443574b03387 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 16:03 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 13:56 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 12:53 bpf 443574b03387 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 11:34 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 10:30 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 09:13 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 04:52 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 03:43 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 03:11 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/22 01:34 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 23:50 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 21:30 bpf 443574b03387 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 19:42 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 18:32 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 16:14 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 14:53 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 13:43 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 12:16 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 07:36 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 06:02 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 04:01 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/21 01:30 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 23:56 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 22:06 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 21:48 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 20:07 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 17:18 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 15:55 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 14:43 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 07:11 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 05:45 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 05:16 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 04:15 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/20 01:08 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/19 23:42 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/19 22:31 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/19 20:07 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/19 18:47 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/19 17:47 bpf 443574b03387 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/19 16:36 net f99c5f563c17 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in hrtimer_run_queues
2024/04/08 10:17 bpf-next 14bb1e8c8d4a ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce possible deadlock in hrtimer_run_queues
2024/03/17 12:15 net-next 237bb5f7f7f5 d615901c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in hrtimer_run_queues
* Struck through repros no longer work on HEAD.