======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
udevd/5797 is trying to acquire lock:
ffff88807dc80a38 (&trie->lock){-.-.}-{2:2}, at: trie_delete_elem+0x94/0x630 kernel/bpf/lpm_trie.c:466

but task is already holding lock:
ffff8880b8e37de8 (stock_lock){..-.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
ffff8880b8e37de8 (stock_lock){..-.}-{2:2}, at: mod_objcg_state+0x101/0x8c0 mm/memcontrol.c:3203

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (stock_lock){..-.}-{2:2}:
       local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
       consume_obj_stock mm/memcontrol.c:3267 [inline]
       obj_cgroup_charge+0x10a/0x630 mm/memcontrol.c:3397
       memcg_slab_pre_alloc_hook mm/slab.h:508 [inline]
       slab_pre_alloc_hook+0x2e2/0x300 mm/slab.h:719
       slab_alloc_node mm/slub.c:3477 [inline]
       __kmem_cache_alloc_node+0x53/0x250 mm/slub.c:3534
       __do_kmalloc_node mm/slab_common.c:1006 [inline]
       __kmalloc_node+0xa6/0x240 mm/slab_common.c:1014
       kmalloc_node include/linux/slab.h:620 [inline]
       bpf_map_kmalloc_node+0xbc/0x1b0 kernel/bpf/syscall.c:424
       lpm_trie_node_alloc kernel/bpf/lpm_trie.c:291 [inline]
       trie_update_elem+0x172/0xd60 kernel/bpf/lpm_trie.c:338
       bpf_map_update_value+0x64b/0x710 kernel/bpf/syscall.c:203
       map_update_elem+0x586/0x710 kernel/bpf/syscall.c:1567
       __sys_bpf+0x6b5/0x890 kernel/bpf/syscall.c:5466
       __do_sys_bpf kernel/bpf/syscall.c:5582 [inline]
       __se_sys_bpf kernel/bpf/syscall.c:5580 [inline]
       __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5580
       do_syscall_x64 arch/x86/entry/common.c:46 [inline]
       do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
       entry_SYSCALL_64_after_hwframe+0x68/0xd2

-> #0 (&trie->lock){-.-.}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3134 [inline]
       check_prevs_add kernel/locking/lockdep.c:3253 [inline]
       validate_chain kernel/locking/lockdep.c:3869 [inline]
       __lock_acquire+0x37ef/0x7d80 kernel/locking/lockdep.c:5137
       lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xb4/0x100 kernel/locking/spinlock.c:162
       trie_delete_elem+0x94/0x630 kernel/bpf/lpm_trie.c:466
       bpf_prog_18dbf0bb98c5951f+0x45/0x49
       bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline]
       __bpf_prog_run include/linux/filter.h:617 [inline]
       bpf_prog_run include/linux/filter.h:624 [inline]
       bpf_prog_run_array include/linux/bpf.h:1994 [inline]
       trace_call_bpf+0x333/0x6c0 kernel/trace/bpf_trace.c:143
       perf_trace_run_bpf_submit+0x7a/0x1c0 kernel/events/core.c:10287
       perf_trace_lock_acquire+0x342/0x400 include/trace/events/lock.h:24
       trace_lock_acquire include/trace/events/lock.h:24 [inline]
       lock_acquire+0x3ef/0x420 kernel/locking/lockdep.c:5725
       rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
       rcu_read_lock include/linux/rcupdate.h:786 [inline]
       mod_objcg_mlstate+0xad/0x320 mm/memcontrol.c:2913
       mod_objcg_state+0x44b/0x8c0 mm/memcontrol.c:3254
       memcg_slab_free_hook+0x167/0x200 mm/slab.h:577
       slab_free mm/slub.c:3825 [inline]
       kmem_cache_free+0xe1/0x290 mm/slub.c:3852
       rcu_do_batch kernel/rcu/tree.c:2194 [inline]
       rcu_core+0x9c1/0x17f0 kernel/rcu/tree.c:2467
       handle_softirqs+0x27d/0x820 kernel/softirq.c:578
       __do_softirq kernel/softirq.c:612 [inline]
       invoke_softirq kernel/softirq.c:452 [inline]
       __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
       irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
       instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
       sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
       asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
       security_inode_need_killpriv+0x3d/0x90 security/security.c:2405
       dentry_needs_remove_privs+0x89/0xf0 fs/inode.c:2088
       do_truncate+0x11d/0x240 fs/open.c:58
       handle_truncate fs/namei.c:3342 [inline]
       do_open fs/namei.c:3687 [inline]
       path_openat+0x2a7e/0x3270 fs/namei.c:3844
       do_filp_open+0x1f2/0x430 fs/namei.c:3871
       do_sys_openat2+0x134/0x1d0 fs/open.c:1422
       do_sys_open fs/open.c:1437 [inline]
       __do_sys_openat fs/open.c:1453 [inline]
       __se_sys_openat fs/open.c:1448 [inline]
       __x64_sys_openat+0x139/0x160 fs/open.c:1448
       do_syscall_x64 arch/x86/entry/common.c:46 [inline]
       do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
       entry_SYSCALL_64_after_hwframe+0x68/0xd2

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(stock_lock);
                               lock(&trie->lock);
                               lock(stock_lock);
  lock(&trie->lock);

 *** DEADLOCK ***

4 locks held by udevd/5797:
 #0: ffff88807e1ca418 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412
 #1: ffffffff8d131ec0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #1: ffffffff8d131ec0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2188 [inline]
 #1: ffffffff8d131ec0 (rcu_callback){....}-{0:0}, at: rcu_core+0x951/0x17f0 kernel/rcu/tree.c:2467
 #2: ffff8880b8e37de8 (stock_lock){..-.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
 #2: ffff8880b8e37de8 (stock_lock){..-.}-{2:2}, at: mod_objcg_state+0x101/0x8c0 mm/memcontrol.c:3203
 #3: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #3: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #3: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xc3/0x6c0 kernel/trace/bpf_trace.c:142

stack backtrace:
CPU: 0 PID: 5797 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 check_noncircular+0x2fc/0x400 kernel/locking/lockdep.c:2187
 check_prev_add kernel/locking/lockdep.c:3134 [inline]
 check_prevs_add kernel/locking/lockdep.c:3253 [inline]
 validate_chain kernel/locking/lockdep.c:3869 [inline]
 __lock_acquire+0x37ef/0x7d80 kernel/locking/lockdep.c:5137
 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xb4/0x100 kernel/locking/spinlock.c:162
 trie_delete_elem+0x94/0x630 kernel/bpf/lpm_trie.c:466
 bpf_prog_18dbf0bb98c5951f+0x45/0x49
 bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline]
 __bpf_prog_run include/linux/filter.h:617 [inline]
 bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_prog_run_array include/linux/bpf.h:1994 [inline]
 trace_call_bpf+0x333/0x6c0 kernel/trace/bpf_trace.c:143
 perf_trace_run_bpf_submit+0x7a/0x1c0 kernel/events/core.c:10287
 perf_trace_lock_acquire+0x342/0x400 include/trace/events/lock.h:24
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0x3ef/0x420 kernel/locking/lockdep.c:5725
 rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 rcu_read_lock include/linux/rcupdate.h:786 [inline]
 mod_objcg_mlstate+0xad/0x320 mm/memcontrol.c:2913
 mod_objcg_state+0x44b/0x8c0 mm/memcontrol.c:3254
 memcg_slab_free_hook+0x167/0x200 mm/slab.h:577
 slab_free mm/slub.c:3825 [inline]
 kmem_cache_free+0xe1/0x290 mm/slub.c:3852
 rcu_do_batch kernel/rcu/tree.c:2194 [inline]
 rcu_core+0x9c1/0x17f0 kernel/rcu/tree.c:2467
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:security_inode_need_killpriv+0x3d/0x90 security/security.c:2405
Code: 00 00 fc ff df e8 e3 63 9c fd 49 c7 c6 58 3b a9 8c 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 36 e6 f4 fd 4d 8b 36 <4d> 85 f6 74 2b 4d 8d 7e 18 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74
RSP: 0018:ffffc9000476f820 EFLAGS: 00000246
RAX: 1ffffffff1952bbd RBX: ffff8880300331a0 RCX: ffff888028a63c00
RDX: 0000000000000000 RSI: 00000000ffffffc3 RDI: ffff8880300331a0
RBP: 0000000000000000 R08: ffff88807a1c79cb R09: 1ffff1100f438f39
R10: dffffc0000000000 R11: ffffed100f438f3a R12: dffffc0000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffffffff8ca95e00
 dentry_needs_remove_privs+0x89/0xf0 fs/inode.c:2088
 do_truncate+0x11d/0x240 fs/open.c:58
 handle_truncate fs/namei.c:3342 [inline]
 do_open fs/namei.c:3687 [inline]
 path_openat+0x2a7e/0x3270 fs/namei.c:3844
 do_filp_open+0x1f2/0x430 fs/namei.c:3871
 do_sys_openat2+0x134/0x1d0 fs/open.c:1422
 do_sys_open fs/open.c:1437 [inline]
 __do_sys_openat fs/open.c:1453 [inline]
 __se_sys_openat fs/open.c:1448 [inline]
 __x64_sys_openat+0x139/0x160 fs/open.c:1448
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9ec36a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffe3749e660 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f9ec3df0880 RCX: 00007f9ec36a7407
RDX: 00000000000a0241 RSI: 00007ffe3749f320 RDI: ffffffffffffff9c
RBP: 0000564270e2b000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000124 R11: 0000000000000202 R12: 000056427102c5e0
R13: 00007ffe3749f320 R14: 00007ffe3749ef20 R15: 00007ffe3749eb20
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	fc                   	cld
   3:	ff                   	lcall  (bad)
   4:	df e8                	fucomip %st(0),%st
   6:	e3 63                	jrcxz  0x6b
   8:	9c                   	pushf
   9:	fd                   	std
   a:	49 c7 c6 58 3b a9 8c 	mov    $0xffffffff8ca93b58,%r14
  11:	4c 89 f0             	mov    %r14,%rax
  14:	48 c1 e8 03          	shr    $0x3,%rax
  18:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  1d:	74 08                	je     0x27
  1f:	4c 89 f7             	mov    %r14,%rdi
  22:	e8 36 e6 f4 fd       	call   0xfdf4e65d
  27:	4d 8b 36             	mov    (%r14),%r14
* 2a:	4d 85 f6             	test   %r14,%r14 <-- trapping instruction
  2d:	74 2b                	je     0x5a
  2f:	4d 8d 7e 18          	lea    0x18(%r14),%r15
  33:	4c 89 f8             	mov    %r15,%rax
  36:	48 c1 e8 03          	shr    $0x3,%rax
  3a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  3f:	74                   	.byte 0x74