========================================================
WARNING: possible irq lock inversion dependency detected
6.11.0-syzkaller-11993-g3efc57369a0c #0 Not tainted
--------------------------------------------------------
kworker/u8:14/10134 just changed the state of lock:
ffff888053f56e10 (&ppp->rlock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888053f56e10 (&ppp->rlock){+.-.}-{2:2}, at: ppp_do_recv+0x38/0x26b0 drivers/net/ppp/ppp_generic.c:2210
but this lock took another, SOFTIRQ-unsafe lock in the past:
(&pch->downl){+.+.}-{2:2}
and interrupts could create inverse lock ordering between them.
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&pch->downl);
local_irq_disable();
lock(&ppp->rlock);
lock(&pch->downl);
<Interrupt>
lock(&ppp->rlock);
*** DEADLOCK ***
5 locks held by kworker/u8:14/10134:
#0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline]
#0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310
#1: ffffc90003d6fd00 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline]
#1: ffffc90003d6fd00 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310
#2: ffff8880666870b8 (&buf->lock){+.+.}-{3:3}, at: flush_to_ldisc+0x38/0x860 drivers/tty/tty_buffer.c:467
#3: ffff888066b4f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x1c/0x80 drivers/tty/tty_ldisc.c:263
#4: ffff888070927a48 (&pch->upl){++.-}-{2:2}, at: ppp_input+0x3dc/0xa10 drivers/net/ppp/ppp_generic.c:2307
the shortest dependencies between 2nd lock and 1st lock:
-> (&pch->downl){+.+.}-{2:2} {
HARDIRQ-ON-W at:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
ppp_unregister_channel+0x7c/0x300 drivers/net/ppp/ppp_generic.c:2992
pppox_unbind_sock+0x5c/0xb0 drivers/net/ppp/pppox.c:58
pppoe_release+0x16e/0x820 drivers/net/ppp/pppoe.c:584
__sock_release net/socket.c:658 [inline]
sock_close+0xbc/0x240 net/socket.c:1426
__fput+0x23f/0x880 fs/file_table.c:431
task_work_run+0x24f/0x310 kernel/task_work.c:228
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
SOFTIRQ-ON-W at:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
ppp_input+0x18b/0xa10 drivers/net/ppp/ppp_generic.c:2304
pppoe_rcv_core+0x117/0x310 drivers/net/ppp/pppoe.c:379
sk_backlog_rcv include/net/sock.h:1113 [inline]
__release_sock+0x243/0x350 net/core/sock.c:3072
release_sock+0x61/0x1f0 net/core/sock.c:3626
pppoe_sendmsg+0xd5/0x750 drivers/net/ppp/pppoe.c:903
sock_sendmsg_nosec net/socket.c:729 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:744
____sys_sendmsg+0x52a/0x7e0 net/socket.c:2602
___sys_sendmsg net/socket.c:2656 [inline]
__sys_sendmmsg+0x3ab/0x730 net/socket.c:2742
__do_sys_sendmmsg net/socket.c:2771 [inline]
__se_sys_sendmmsg net/socket.c:2768 [inline]
__x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2768
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
INITIAL USE at:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
ppp_unregister_channel+0x7c/0x300 drivers/net/ppp/ppp_generic.c:2992
pppox_unbind_sock+0x5c/0xb0 drivers/net/ppp/pppox.c:58
pppoe_release+0x16e/0x820 drivers/net/ppp/pppoe.c:584
__sock_release net/socket.c:658 [inline]
sock_close+0xbc/0x240 net/socket.c:1426
__fput+0x23f/0x880 fs/file_table.c:431
task_work_run+0x24f/0x310 kernel/task_work.c:228
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
}
... key at: [<ffffffff9a733f80>] ppp_register_net_channel.__key.1+0x0/0x20
... acquired at:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
ppp_connect_channel+0x194/0x650 drivers/net/ppp/ppp_generic.c:3485
ppp_ioctl+0xdd4/0x1cd0 drivers/net/ppp/ppp_generic.c:761
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> (&ppp->rlock){+.-.}-{2:2} {
HARDIRQ-ON-W at:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
ppp_get_stats64+0x33/0x290 drivers/net/ppp/ppp_generic.c:1534
dev_get_stats+0xad/0xa00 net/core/dev.c:10937
rtnl_fill_stats+0x47/0x880 net/core/rtnetlink.c:1268
rtnl_fill_ifinfo+0x18da/0x2270 net/core/rtnetlink.c:1909
rtmsg_ifinfo_build_skb+0x18a/0x260 net/core/rtnetlink.c:4079
rtmsg_ifinfo_event net/core/rtnetlink.c:4112 [inline]
rtmsg_ifinfo+0x91/0x1b0 net/core/rtnetlink.c:4121
register_netdevice+0x1774/0x1b00 net/core/dev.c:10534
ppp_unit_register drivers/net/ppp/ppp_generic.c:1219 [inline]
ppp_dev_configure+0x883/0xb10 drivers/net/ppp/ppp_generic.c:1275
ppp_create_interface drivers/net/ppp/ppp_generic.c:3348 [inline]
ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1060 [inline]
ppp_ioctl+0x797/0x1cd0 drivers/net/ppp/ppp_generic.c:733
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
IN-SOFTIRQ-W at:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
ppp_do_recv+0x38/0x26b0 drivers/net/ppp/ppp_generic.c:2210
ppp_input+0x5de/0xa10 drivers/net/ppp/ppp_generic.c:2327
ppp_async_process+0x7f/0x150 drivers/net/ppp/ppp_async.c:495
tasklet_action_common+0x321/0x4d0 kernel/softirq.c:784
handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1037
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
__tasklet_schedule_common+0x1fd/0x270 kernel/softirq.c:733
tasklet_schedule include/linux/interrupt.h:719 [inline]
ppp_asynctty_receive+0x1ea6/0x2000 drivers/net/ppp/ppp_async.c:345
tty_ldisc_receive_buf+0x11f/0x170 drivers/tty/tty_buffer.c:391
tty_port_default_receive_buf+0x6d/0xa0 drivers/tty/tty_port.c:37
receive_buf drivers/tty/tty_buffer.c:445 [inline]
flush_to_ldisc+0x328/0x860 drivers/tty/tty_buffer.c:495
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
INITIAL USE at:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
ppp_get_stats64+0x33/0x290 drivers/net/ppp/ppp_generic.c:1534
dev_get_stats+0xad/0xa00 net/core/dev.c:10937
rtnl_fill_stats+0x47/0x880 net/core/rtnetlink.c:1268
rtnl_fill_ifinfo+0x18da/0x2270 net/core/rtnetlink.c:1909
rtmsg_ifinfo_build_skb+0x18a/0x260 net/core/rtnetlink.c:4079
rtmsg_ifinfo_event net/core/rtnetlink.c:4112 [inline]
rtmsg_ifinfo+0x91/0x1b0 net/core/rtnetlink.c:4121
register_netdevice+0x1774/0x1b00 net/core/dev.c:10534
ppp_unit_register drivers/net/ppp/ppp_generic.c:1219 [inline]
ppp_dev_configure+0x883/0xb10 drivers/net/ppp/ppp_generic.c:1275
ppp_create_interface drivers/net/ppp/ppp_generic.c:3348 [inline]
ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1060 [inline]
ppp_ioctl+0x797/0x1cd0 drivers/net/ppp/ppp_generic.c:733
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
}
... key at: [<ffffffff9a7340a0>] ppp_dev_configure.__key+0x0/0x20
... acquired at:
mark_lock+0x223/0x360 kernel/locking/lockdep.c:4722
__lock_acquire+0xbf9/0x2050 kernel/locking/lockdep.c:5153
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
ppp_do_recv+0x38/0x26b0 drivers/net/ppp/ppp_generic.c:2210
ppp_input+0x5de/0xa10 drivers/net/ppp/ppp_generic.c:2327
ppp_async_process+0x7f/0x150 drivers/net/ppp/ppp_async.c:495
tasklet_action_common+0x321/0x4d0 kernel/softirq.c:784
handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1037
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
__tasklet_schedule_common+0x1fd/0x270 kernel/softirq.c:733
tasklet_schedule include/linux/interrupt.h:719 [inline]
ppp_asynctty_receive+0x1ea6/0x2000 drivers/net/ppp/ppp_async.c:345
tty_ldisc_receive_buf+0x11f/0x170 drivers/tty/tty_buffer.c:391
tty_port_default_receive_buf+0x6d/0xa0 drivers/tty/tty_port.c:37
receive_buf drivers/tty/tty_buffer.c:445 [inline]
flush_to_ldisc+0x328/0x860 drivers/tty/tty_buffer.c:495
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
stack backtrace:
CPU: 0 UID: 0 PID: 10134 Comm: kworker/u8:14 Not tainted 6.11.0-syzkaller-11993-g3efc57369a0c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events_unbound flush_to_ldisc
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_irq_inversion_bug+0x33d/0x390 kernel/locking/lockdep.c:4118
mark_lock_irq+0x80c/0xc20 kernel/locking/lockdep.c:4287
mark_lock+0x223/0x360 kernel/locking/lockdep.c:4722
__lock_acquire+0xbf9/0x2050 kernel/locking/lockdep.c:5153
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
ppp_do_recv+0x38/0x26b0 drivers/net/ppp/ppp_generic.c:2210
ppp_input+0x5de/0xa10 drivers/net/ppp/ppp_generic.c:2327
ppp_async_process+0x7f/0x150 drivers/net/ppp/ppp_async.c:495
tasklet_action_common+0x321/0x4d0 kernel/softirq.c:784
handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1037
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__tasklet_schedule_common+0x1fd/0x270 kernel/softirq.c:733
Code: 40 42 80 3c 33 00 74 08 4c 89 ff e8 0d fe a6 00 f6 44 24 41 02 75 4f 41 f7 c5 00 02 00 00 74 01 fb 48 c7 44 24 20 0e 36 e0 45 <4b> c7 04 26 00 00 00 00 66 43 c7 44 26 09 00 00 43 c6 44 26 0b 00
RSP: 0018:ffffc90003d6f8c0 EFLAGS: 00000206
RAX: 24de9ee1c534af00 RBX: 1ffff920007adf20 RCX: ffffffff8170b7ea
RDX: dffffc0000000000 RSI: ffffffff8c0acac0 RDI: ffffffff8c60f5a0
RBP: ffffc90003d6f998 R08: ffffffff9427585f R09: 1ffffffff284eb0b
R10: dffffc0000000000 R11: fffffbfff284eb0c R12: 1ffff920007adf1c
R13: 0000000000000246 R14: dffffc0000000000 R15: ffffc90003d6f900
tasklet_schedule include/linux/interrupt.h:719 [inline]
ppp_asynctty_receive+0x1ea6/0x2000 drivers/net/ppp/ppp_async.c:345
tty_ldisc_receive_buf+0x11f/0x170 drivers/tty/tty_buffer.c:391
tty_port_default_receive_buf+0x6d/0xa0 drivers/tty/tty_port.c:37
receive_buf drivers/tty/tty_buffer.c:445 [inline]
flush_to_ldisc+0x328/0x860 drivers/tty/tty_buffer.c:495
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
----------------
Code disassembly (best guess):
0: 40 rex
1: 42 80 3c 33 00 cmpb $0x0,(%rbx,%r14,1)
6: 74 08 je 0x10
8: 4c 89 ff mov %r15,%rdi
b: e8 0d fe a6 00 call 0xa6fe1d
10: f6 44 24 41 02 testb $0x2,0x41(%rsp)
15: 75 4f jne 0x66
17: 41 f7 c5 00 02 00 00 test $0x200,%r13d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 20 0e 36 movq $0x45e0360e,0x20(%rsp)
28: e0 45
* 2a: 4b c7 04 26 00 00 00 movq $0x0,(%r14,%r12,1) <-- trapping instruction
31: 00
32: 66 43 c7 44 26 09 00 movw $0x0,0x9(%r14,%r12,1)
39: 00
3a: 43 c6 44 26 0b 00 movb $0x0,0xb(%r14,%r12,1)