Warning: Permanently added '10.128.0.107' (ECDSA) to the list of known hosts. executing program [ 28.857056] [ 28.858682] ====================================================== [ 28.864970] WARNING: possible circular locking dependency detected [ 28.871257] 4.14.292-syzkaller #0 Not tainted [ 28.875981] ------------------------------------------------------ [ 28.882268] syz-executor109/7952 is trying to acquire lock: [ 28.887946] (event_mutex){+.+.}, at: [] perf_trace_destroy+0x23/0xf0 [ 28.896196] [ 28.896196] but task is already holding lock: [ 28.902149] (&event->child_mutex){+.+.}, at: [] perf_event_release_kernel+0x208/0x8a0 [ 28.911764] [ 28.911764] which lock already depends on the new lock. [ 28.911764] [ 28.920049] [ 28.920049] the existing dependency chain (in reverse order) is: [ 28.927638] [ 28.927638] -> #5 (&event->child_mutex){+.+.}: [ 28.933675] __mutex_lock+0xc4/0x1310 [ 28.938404] perf_event_for_each_child+0x82/0x140 [ 28.943739] _perf_ioctl+0x471/0x1a60 [ 28.948031] perf_ioctl+0x55/0x80 [ 28.951977] do_vfs_ioctl+0x75a/0xff0 [ 28.956268] SyS_ioctl+0x7f/0xb0 [ 28.960130] do_syscall_64+0x1d5/0x640 [ 28.964595] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.970274] [ 28.970274] -> #4 (&cpuctx_mutex){+.+.}: [ 28.975786] __mutex_lock+0xc4/0x1310 [ 28.980083] perf_event_init_cpu+0xb7/0x170 [ 28.984910] perf_event_init+0x2cc/0x308 [ 28.989460] start_kernel+0x45d/0x763 [ 28.993752] secondary_startup_64+0xa5/0xb0 [ 28.998566] [ 28.998566] -> #3 (pmus_lock){+.+.}: [ 29.003733] __mutex_lock+0xc4/0x1310 [ 29.008024] perf_event_init_cpu+0x2c/0x170 [ 29.012841] cpuhp_invoke_callback+0x1e6/0x1a80 [ 29.018264] _cpu_up+0x21e/0x520 [ 29.022120] do_cpu_up+0x9a/0x160 [ 29.026063] smp_init+0x197/0x1ac [ 29.030006] kernel_init_freeable+0x406/0x626 [ 29.034991] kernel_init+0xd/0x161 [ 29.039036] ret_from_fork+0x24/0x30 [ 29.043250] [ 29.043250] -> #2 (cpu_hotplug_lock.rw_sem){++++}: [ 29.049633] cpus_read_lock+0x39/0xc0 [ 29.053944] static_key_slow_inc+0xe/0x20 [ 29.058583] tracepoint_add_func+0x747/0xa40 [ 29.063486] tracepoint_probe_register+0x8c/0xc0 [ 29.068734] trace_event_reg+0x272/0x330 [ 29.073285] perf_trace_init+0x424/0xa30 [ 29.077922] perf_tp_event_init+0x79/0xf0 [ 29.082572] perf_try_init_event+0x15b/0x1f0 [ 29.087471] perf_event_alloc.part.0+0xe2d/0x2640 [ 29.092809] SyS_perf_event_open+0x683/0x2530 [ 29.097795] do_syscall_64+0x1d5/0x640 [ 29.102187] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.107864] [ 29.107864] -> #1 (tracepoints_mutex){+.+.}: [ 29.113728] __mutex_lock+0xc4/0x1310 [ 29.118022] tracepoint_probe_register+0x68/0xc0 [ 29.123272] trace_event_reg+0x272/0x330 [ 29.127822] perf_trace_init+0x424/0xa30 [ 29.132462] perf_tp_event_init+0x79/0xf0 [ 29.137100] perf_try_init_event+0x15b/0x1f0 [ 29.142002] perf_event_alloc.part.0+0xe2d/0x2640 [ 29.147349] SyS_perf_event_open+0x683/0x2530 [ 29.152348] do_syscall_64+0x1d5/0x640 [ 29.156728] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.162419] [ 29.162419] -> #0 (event_mutex){+.+.}: [ 29.167759] lock_acquire+0x170/0x3f0 [ 29.172060] __mutex_lock+0xc4/0x1310 [ 29.176353] perf_trace_destroy+0x23/0xf0 [ 29.180992] _free_event+0x321/0xe20 [ 29.185197] free_event+0x32/0x40 [ 29.189145] perf_event_release_kernel+0x368/0x8a0 [ 29.194577] perf_release+0x33/0x40 [ 29.198694] __fput+0x25f/0x7a0 [ 29.202481] task_work_run+0x11f/0x190 [ 29.206859] do_exit+0xa44/0x2850 [ 29.210810] SyS_exit+0x1e/0x20 [ 29.214593] do_syscall_64+0x1d5/0x640 [ 29.218974] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.224651] [ 29.224651] other info that might help us debug this: [ 29.224651] [ 29.232761] Chain exists of: [ 29.232761] event_mutex --> &cpuctx_mutex --> &event->child_mutex [ 29.232761] [ 29.243494] Possible unsafe locking scenario: [ 29.243494] [ 29.249518] CPU0 CPU1 [ 29.254152] ---- ---- [ 29.258790] lock(&event->child_mutex); [ 29.262825] lock(&cpuctx_mutex); [ 29.268851] lock(&event->child_mutex); [ 29.275401] lock(event_mutex); [ 29.278739] [ 29.278739] *** DEADLOCK *** [ 29.278739] [ 29.284770] 2 locks held by syz-executor109/7952: [ 29.289928] #0: (&ctx->mutex){+.+.}, at: [] perf_event_release_kernel+0x1fe/0x8a0 [ 29.299360] #1: (&event->child_mutex){+.+.}, at: [] perf_event_release_kernel+0x208/0x8a0 [ 29.309396] [ 29.309396] stack backtrace: [ 29.313865] CPU: 1 PID: 7952 Comm: syz-executor109 Not tainted 4.14.292-syzkaller #0 [ 29.321728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 29.331059] Call Trace: [ 29.333621] dump_stack+0x1b2/0x281 [ 29.337238] print_circular_bug.constprop.0.cold+0x2d7/0x41e [ 29.343021] __lock_acquire+0x2e0e/0x3f20 [ 29.347161] ? trace_hardirqs_on+0x10/0x10 [ 29.351374] ? perf_group_detach+0x7f0/0x7f0 [ 29.355757] ? generic_exec_single+0x27e/0x420 [ 29.360326] ? smp_call_function_single+0x1b1/0x370 [ 29.365327] lock_acquire+0x170/0x3f0 [ 29.369099] ? perf_trace_destroy+0x23/0xf0 [ 29.373425] ? perf_trace_destroy+0x23/0xf0 [ 29.377742] __mutex_lock+0xc4/0x1310 [ 29.381516] ? perf_trace_destroy+0x23/0xf0 [ 29.385817] ? task_function_call+0xed/0x130 [ 29.390197] ? pmu_dev_release+0x20/0x20 [ 29.394262] ? perf_trace_destroy+0x23/0xf0 [ 29.398654] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 29.404078] ? event_function_call+0x1fa/0x3c0 [ 29.408722] ? event_sched_out+0x11b0/0x11b0 [ 29.413116] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 29.418560] ? perf_tp_event_init+0xf0/0xf0 [ 29.422855] perf_trace_destroy+0x23/0xf0 [ 29.426976] ? perf_tp_event_init+0xf0/0xf0 [ 29.431279] _free_event+0x321/0xe20 [ 29.434965] free_event+0x32/0x40 [ 29.438392] perf_event_release_kernel+0x368/0x8a0 [ 29.443293] ? perf_event_release_kernel+0x8a0/0x8a0 [ 29.448366] perf_release+0x33/0x40 [ 29.451968] __fput+0x25f/0x7a0 [ 29.455220] task_work_run+0x11f/0x190 [ 29.459081] do_exit+0xa44/0x2850 [ 29.462504] ? get_timespec64+0xb1/0xf0 [ 29.466448] ? timespec_trunc+0x120/0x120 [ 29.470581] ? mm_update_next_owner+0x5b0/0x5b0 [ 29.475225] ? SyS_clock_nanosleep+0x210/0x2d0 [ 29.479875] ? compat_SyS_clock_getres+0x180/0x180 [ 29.484776] ? __do_page_fault+0x159/0xad0 [ 29.488982] SyS_exit+0x1e/0x20 [ 29.492234] ? complete_and_exit+0x40/0x40 [ 29.496442] do_syscall_64+0x1d5/0x640 [ 29.500313] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.505481] RIP: 0033:0x7fe8010b42a9 [ 29.50