Warning: Permanently added '10.128.1.174' (ED25519) to the list of known hosts. executing program [ 50.119346][ T3538] [ 50.121710][ T3538] ====================================================== [ 50.128728][ T3538] WARNING: possible circular locking dependency detected [ 50.135756][ T3538] 6.1.83-syzkaller #0 Not tainted [ 50.140772][ T3538] ------------------------------------------------------ [ 50.147792][ T3538] sshd/3538 is trying to acquire lock: [ 50.153254][ T3538] ffff888079f22a38 (&trie->lock){....}-{2:2}, at: trie_delete_elem+0x90/0x690 [ 50.162176][ T3538] [ 50.162176][ T3538] but task is already holding lock: [ 50.169545][ T3538] ffff8880b982a4d8 (hrtimer_bases.lock){-.-.}-{2:2}, at: hrtimer_start_range_ns+0xd8/0xc50 [ 50.179574][ T3538] [ 50.179574][ T3538] which lock already depends on the new lock. [ 50.179574][ T3538] [ 50.189974][ T3538] [ 50.189974][ T3538] the existing dependency chain (in reverse order) is: [ 50.198973][ T3538] [ 50.198973][ T3538] -> #2 (hrtimer_bases.lock){-.-.}-{2:2}: [ 50.206866][ T3538] lock_acquire+0x1f8/0x5a0 [ 50.211889][ T3538] _raw_spin_lock_irqsave+0xd1/0x120 [ 50.217701][ T3538] hrtimer_start_range_ns+0xd8/0xc50 [ 50.223497][ T3538] kvfree_call_rcu+0x72b/0x8c0 [ 50.228779][ T3538] rtnl_register_internal+0x489/0x580 [ 50.234668][ T3538] rtnl_register+0x32/0x70 [ 50.239594][ T3538] ip_rt_init+0x335/0x3c7 [ 50.244435][ T3538] ip_init+0xa/0x14 [ 50.248757][ T3538] inet_init+0x2ae/0x3c0 [ 50.253512][ T3538] do_one_initcall+0x265/0x8f0 [ 50.258795][ T3538] do_initcall_level+0x157/0x207 [ 50.264245][ T3538] do_initcalls+0x49/0x86 [ 50.269081][ T3538] kernel_init_freeable+0x45c/0x60f [ 50.274789][ T3538] kernel_init+0x19/0x290 [ 50.279627][ T3538] ret_from_fork+0x1f/0x30 [ 50.284552][ T3538] [ 50.284552][ T3538] -> #1 (krc.lock){....}-{2:2}: [ 50.291574][ T3538] lock_acquire+0x1f8/0x5a0 [ 50.296589][ T3538] _raw_spin_lock+0x2a/0x40 [ 50.301597][ T3538] kvfree_call_rcu+0x1b2/0x8c0 [ 50.306865][ T3538] trie_update_elem+0x808/0xc00 [ 50.312227][ T3538] bpf_map_update_value+0x5cf/0x6f0 [ 50.317933][ T3538] generic_map_update_batch+0x579/0x920 [ 50.323987][ T3538] bpf_map_do_batch+0x4d0/0x620 [ 50.329364][ T3538] __sys_bpf+0x658/0x6c0 [ 50.334138][ T3538] __x64_sys_bpf+0x78/0x90 [ 50.339083][ T3538] do_syscall_64+0x3d/0xb0 [ 50.344029][ T3538] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.350445][ T3538] [ 50.350445][ T3538] -> #0 (&trie->lock){....}-{2:2}: [ 50.357818][ T3538] validate_chain+0x1661/0x5950 [ 50.363187][ T3538] __lock_acquire+0x125b/0x1f80 [ 50.368555][ T3538] lock_acquire+0x1f8/0x5a0 [ 50.373571][ T3538] _raw_spin_lock_irqsave+0xd1/0x120 [ 50.379363][ T3538] trie_delete_elem+0x90/0x690 [ 50.384639][ T3538] bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e [ 50.390604][ T3538] bpf_trace_run2+0x1fd/0x410 [ 50.395789][ T3538] enqueue_hrtimer+0x382/0x410 [ 50.401059][ T3538] hrtimer_start_range_ns+0xa9c/0xc50 [ 50.407021][ T3538] schedule_hrtimeout_range_clock+0x272/0x480 [ 50.413592][ T3538] do_sys_poll+0xe1c/0x1330 [ 50.418601][ T3538] __se_sys_ppoll+0x29c/0x330 [ 50.423783][ T3538] do_syscall_64+0x3d/0xb0 [ 50.428706][ T3538] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.435105][ T3538] [ 50.435105][ T3538] other info that might help us debug this: [ 50.435105][ T3538] [ 50.445316][ T3538] Chain exists of: [ 50.445316][ T3538] &trie->lock --> krc.lock --> hrtimer_bases.lock [ 50.445316][ T3538] [ 50.457637][ T3538] Possible unsafe locking scenario: [ 50.457637][ T3538] [ 50.465067][ T3538] CPU0 CPU1 [ 50.470420][ T3538] ---- ---- [ 50.475767][ T3538] lock(hrtimer_bases.lock); [ 50.480432][ T3538] lock(krc.lock); [ 50.486743][ T3538] lock(hrtimer_bases.lock); [ 50.493923][ T3538] lock(&trie->lock); [ 50.497975][ T3538] [ 50.497975][ T3538] *** DEADLOCK *** [ 50.497975][ T3538] [ 50.506099][ T3538] 2 locks held by sshd/3538: [ 50.510670][ T3538] #0: ffff8880b982a4d8 (hrtimer_bases.lock){-.-.}-{2:2}, at: hrtimer_start_range_ns+0xd8/0xc50 [ 50.521092][ T3538] #1: ffffffff8d12a940 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x110/0x410 [ 50.530467][ T3538] [ 50.530467][ T3538] stack backtrace: [ 50.536336][ T3538] CPU: 0 PID: 3538 Comm: sshd Not tainted 6.1.83-syzkaller #0 [ 50.543778][ T3538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 50.553815][ T3538] Call Trace: [ 50.557081][ T3538] [ 50.559998][ T3538] dump_stack_lvl+0x1e3/0x2cb [ 50.564670][ T3538] ? nf_tcp_handle_invalid+0x642/0x642 [ 50.570122][ T3538] ? print_circular_bug+0x12b/0x1a0 [ 50.575312][ T3538] check_noncircular+0x2fa/0x3b0 [ 50.580242][ T3538] ? add_chain_block+0x850/0x850 [ 50.585169][ T3538] ? queued_spin_lock_slowpath+0x42/0x50 [ 50.590818][ T3538] ? lockdep_lock+0x1a7/0x2a0 [ 50.595489][ T3538] ? _find_first_zero_bit+0xd0/0x100 [ 50.600762][ T3538] validate_chain+0x1661/0x5950 [ 50.605609][ T3538] ? __dev_queue_xmit+0x1790/0x3cf0 [ 50.610797][ T3538] ? reacquire_held_locks+0x660/0x660 [ 50.616176][ T3538] ? validate_chain+0x112/0x5950 [ 50.621133][ T3538] ? __dev_queue_xmit+0x2d6/0x3cf0 [ 50.626258][ T3538] ? look_up_lock_class+0x77/0x140 [ 50.631462][ T3538] ? register_lock_class+0x100/0x990 [ 50.636745][ T3538] ? is_dynamic_key+0x260/0x260 [ 50.641608][ T3538] ? mark_lock+0x9a/0x340 [ 50.645940][ T3538] __lock_acquire+0x125b/0x1f80 [ 50.650790][ T3538] lock_acquire+0x1f8/0x5a0 [ 50.655288][ T3538] ? trie_delete_elem+0x90/0x690 [ 50.660243][ T3538] ? read_lock_is_recursive+0x10/0x10 [ 50.665631][ T3538] ? __lock_acquire+0x125b/0x1f80 [ 50.670659][ T3538] _raw_spin_lock_irqsave+0xd1/0x120 [ 50.675941][ T3538] ? trie_delete_elem+0x90/0x690 [ 50.680878][ T3538] ? _raw_spin_lock+0x40/0x40 [ 50.685556][ T3538] ? read_lock_is_recursive+0x10/0x10 [ 50.690925][ T3538] trie_delete_elem+0x90/0x690 [ 50.695694][ T3538] ? __cant_sleep+0x270/0x270 [ 50.700536][ T3538] ? do_raw_spin_unlock+0x137/0x8a0 [ 50.705726][ T3538] bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e [ 50.711174][ T3538] bpf_trace_run2+0x1fd/0x410 [ 50.715839][ T3538] ? bpf_trace_run2+0x110/0x410 [ 50.720673][ T3538] ? bpf_trace_run1+0x3d0/0x3d0 [ 50.725512][ T3538] ? debug_object_activate+0x2f9/0x4e0 [ 50.730978][ T3538] enqueue_hrtimer+0x382/0x410 [ 50.735730][ T3538] hrtimer_start_range_ns+0xa9c/0xc50 [ 50.741095][ T3538] schedule_hrtimeout_range_clock+0x272/0x480 [ 50.747151][ T3538] ? hrtimer_nanosleep_restart+0x420/0x420 [ 50.752940][ T3538] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 50.758826][ T3538] ? __remove_hrtimer+0x4b0/0x4b0 [ 50.763843][ T3538] ? poll_initwait+0x150/0x150 [ 50.768607][ T3538] ? pipe_poll+0x2d6/0x4a0 [ 50.773024][ T3538] ? do_sys_poll+0xd95/0x1330 [ 50.777697][ T3538] do_sys_poll+0xe1c/0x1330 [ 50.782204][ T3538] ? poll_select_finish+0x7b0/0x7b0 [ 50.787398][ T3538] ? __x64_compat_sys_ppoll_time64+0xc0/0xc0 [ 50.793368][ T3538] ? __x64_compat_sys_ppoll_time64+0xc0/0xc0 [ 50.799339][ T3538] ? __x64_compat_sys_ppoll_time64+0xc0/0xc0 [ 50.805311][ T3538] ? __x64_compat_sys_ppoll_time64+0xc0/0xc0 [ 50.811291][ T3538] ? do_raw_spin_unlock+0x137/0x8a0 [ 50.816479][ T3538] ? _raw_spin_unlock_irq+0x1f/0x40 [ 50.821675][ T3538] ? lockdep_hardirqs_on+0x94/0x130 [ 50.826877][ T3538] ? _raw_spin_unlock_irq+0x2a/0x40 [ 50.832096][ T3538] ? sigprocmask+0x280/0x280 [ 50.836697][ T3538] ? __might_fault+0xbd/0x110 [ 50.841374][ T3538] __se_sys_ppoll+0x29c/0x330 [ 50.846052][ T3538] ? __x64_sys_ppoll+0xc0/0xc0 [ 50.850823][ T3538] ? syscall_enter_from_user_mode+0x2e/0x220 [ 50.856792][ T3538] ? lockdep_hardirqs_on+0x94/0x130 [ 50.861975][ T3538] ? __x64_sys_ppoll+0x1c/0xc0 [ 50.866724][ T3538] do_syscall_64+0x3d/0xb0 [ 50.871131][ T3538] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.877015][ T3538] RIP: 0033:0x7fceb9f19ad5 [ 50.881422][ T3538] Code: 85 d2 74 0d 0f 10 02 48 8d 54 24 20 0f 11 44 24 20 64 8b 04 25 18 00 00 00 85 c0 75 27 41 b8 08 00 00 00 b8 0f 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 75 48 8b 15 24 73 0d 00 f7 d8 64 89 02 48 83 [ 50.901028][ T3538] RSP: 002b:00007ffd74b1ee20 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 50.909448][ T3538] RAX: ffffffffffffffda RBX: 00000000000668a0 RCX: 00007fceb9f19ad5 [ 50.917430][ T3538] RDX: 00007ffd74b1ee40 RSI: 0000000000000004 RDI: 000055f8df344ab0 [ 50.925403][ T3538] RBP: 000055f8df343570 R08: 0000000000000008 R09: 0000000000000000 [ 50.933363][ T3538] R10: 00007ffd74b1ef28 R11: 0000000000000246 R12: 000055f8ddf84aa4 [ 50.941413][ T3538] R13: 0000000000000001 R14: 000055f8ddf853e8 R15: 00007ffd74b1eea8 [ 50.949377][ T3538]