Warning: Permanently added '10.128.0.24' (ECDSA) to the list of known hosts. executing program [ 29.003240] [ 29.004918] ====================================================== [ 29.011210] WARNING: possible circular locking dependency detected [ 29.017507] 4.14.291-syzkaller #0 Not tainted [ 29.021977] ------------------------------------------------------ [ 29.028357] syz-executor402/7979 is trying to acquire lock: [ 29.034052] (event_mutex){+.+.}, at: [] perf_trace_destroy+0x23/0xf0 [ 29.042178] [ 29.042178] but task is already holding lock: [ 29.048122] (&event->child_mutex){+.+.}, at: [] perf_event_release_kernel+0x208/0x8a0 [ 29.057737] [ 29.057737] which lock already depends on the new lock. [ 29.057737] [ 29.066021] [ 29.066021] the existing dependency chain (in reverse order) is: [ 29.073610] [ 29.073610] -> #5 (&event->child_mutex){+.+.}: [ 29.079732] __mutex_lock+0xc4/0x1310 [ 29.084025] perf_event_for_each_child+0x82/0x140 [ 29.089359] _perf_ioctl+0x471/0x1a60 [ 29.093659] perf_ioctl+0x55/0x80 [ 29.097613] do_vfs_ioctl+0x75a/0xff0 [ 29.101908] SyS_ioctl+0x7f/0xb0 [ 29.105768] do_syscall_64+0x1d5/0x640 [ 29.110153] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.115925] [ 29.115925] -> #4 (&cpuctx_mutex){+.+.}: [ 29.121444] __mutex_lock+0xc4/0x1310 [ 29.125738] perf_event_init_cpu+0xb7/0x170 [ 29.130555] perf_event_init+0x2cc/0x308 [ 29.135117] start_kernel+0x45d/0x763 [ 29.139414] secondary_startup_64+0xa5/0xb0 [ 29.144240] [ 29.144240] -> #3 (pmus_lock){+.+.}: [ 29.149412] __mutex_lock+0xc4/0x1310 [ 29.153706] perf_event_init_cpu+0x2c/0x170 [ 29.158535] cpuhp_invoke_callback+0x1e6/0x1a80 [ 29.163696] _cpu_up+0x21e/0x520 [ 29.167562] do_cpu_up+0x9a/0x160 [ 29.171509] smp_init+0x197/0x1ac [ 29.175475] kernel_init_freeable+0x406/0x626 [ 29.180461] kernel_init+0xd/0x167 [ 29.184494] ret_from_fork+0x24/0x30 [ 29.188698] [ 29.188698] -> #2 (cpu_hotplug_lock.rw_sem){++++}: [ 29.195079] cpus_read_lock+0x39/0xc0 [ 29.199370] static_key_slow_inc+0xe/0x20 [ 29.204015] tracepoint_add_func+0x747/0xa40 [ 29.208989] tracepoint_probe_register+0x8c/0xc0 [ 29.214252] trace_event_reg+0x272/0x330 [ 29.218827] perf_trace_init+0x424/0xa30 [ 29.223384] perf_tp_event_init+0x79/0xf0 [ 29.228023] perf_try_init_event+0x15b/0x1f0 [ 29.232923] perf_event_alloc.part.0+0xe2d/0x2640 [ 29.238261] SyS_perf_event_open+0x683/0x2530 [ 29.243349] do_syscall_64+0x1d5/0x640 [ 29.247831] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.253513] [ 29.253513] -> #1 (tracepoints_mutex){+.+.}: [ 29.259419] __mutex_lock+0xc4/0x1310 [ 29.263735] tracepoint_probe_register+0x68/0xc0 [ 29.268988] trace_event_reg+0x272/0x330 [ 29.273551] perf_trace_init+0x424/0xa30 [ 29.278113] perf_tp_event_init+0x79/0xf0 [ 29.282755] perf_try_init_event+0x15b/0x1f0 [ 29.287654] perf_event_alloc.part.0+0xe2d/0x2640 [ 29.292990] SyS_perf_event_open+0x683/0x2530 [ 29.297978] do_syscall_64+0x1d5/0x640 [ 29.302361] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.308039] [ 29.308039] -> #0 (event_mutex){+.+.}: [ 29.313381] lock_acquire+0x170/0x3f0 [ 29.317765] __mutex_lock+0xc4/0x1310 [ 29.322081] perf_trace_destroy+0x23/0xf0 [ 29.326722] _free_event+0x321/0xe20 [ 29.330945] free_event+0x32/0x40 [ 29.334901] perf_event_release_kernel+0x368/0x8a0 [ 29.340344] perf_release+0x33/0x40 [ 29.344481] __fput+0x25f/0x7a0 [ 29.348255] task_work_run+0x11f/0x190 [ 29.352656] do_exit+0xa44/0x2850 [ 29.356604] SyS_exit+0x1e/0x20 [ 29.360380] do_syscall_64+0x1d5/0x640 [ 29.364776] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.370470] [ 29.370470] other info that might help us debug this: [ 29.370470] [ 29.378671] Chain exists of: [ 29.378671] event_mutex --> &cpuctx_mutex --> &event->child_mutex [ 29.378671] [ 29.389657] Possible unsafe locking scenario: [ 29.389657] [ 29.395856] CPU0 CPU1 [ 29.400593] ---- ---- [ 29.405233] lock(&event->child_mutex); [ 29.409275] lock(&cpuctx_mutex); [ 29.415303] lock(&event->child_mutex); [ 29.421855] lock(event_mutex); [ 29.425200] [ 29.425200] *** DEADLOCK *** [ 29.425200] [ 29.431239] 2 locks held by syz-executor402/7979: [ 29.436050] #0: (&ctx->mutex){+.+.}, at: [] perf_event_release_kernel+0x1fe/0x8a0 [ 29.445567] #1: (&event->child_mutex){+.+.}, at: [] perf_event_release_kernel+0x208/0x8a0 [ 29.455600] [ 29.455600] stack backtrace: [ 29.460068] CPU: 1 PID: 7979 Comm: syz-executor402 Not tainted 4.14.291-syzkaller #0 [ 29.467917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 29.477262] Call Trace: [ 29.479829] dump_stack+0x1b2/0x281 [ 29.483433] print_circular_bug.constprop.0.cold+0x2d7/0x41e [ 29.489222] __lock_acquire+0x2e0e/0x3f20 [ 29.493344] ? trace_hardirqs_on+0x10/0x10 [ 29.497553] ? perf_group_detach+0x7f0/0x7f0 [ 29.501932] ? generic_exec_single+0x27e/0x420 [ 29.506485] ? smp_call_function_single+0x1b1/0x370 [ 29.511476] lock_acquire+0x170/0x3f0 [ 29.515248] ? perf_trace_destroy+0x23/0xf0 [ 29.519555] ? perf_trace_destroy+0x23/0xf0 [ 29.523852] __mutex_lock+0xc4/0x1310 [ 29.527626] ? perf_trace_destroy+0x23/0xf0 [ 29.532005] ? task_function_call+0xed/0x130 [ 29.536389] ? pmu_dev_release+0x20/0x20 [ 29.540423] ? perf_trace_destroy+0x23/0xf0 [ 29.544715] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 29.550138] ? event_function_call+0x1fa/0x3c0 [ 29.554694] ? event_sched_out+0x11b0/0x11b0 [ 29.559083] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 29.564502] ? perf_tp_event_init+0xf0/0xf0 [ 29.568795] perf_trace_destroy+0x23/0xf0 [ 29.572921] ? perf_tp_event_init+0xf0/0xf0 [ 29.577215] _free_event+0x321/0xe20 [ 29.580900] free_event+0x32/0x40 [ 29.584325] perf_event_release_kernel+0x368/0x8a0 [ 29.589243] ? perf_event_release_kernel+0x8a0/0x8a0 [ 29.594327] perf_release+0x33/0x40 [ 29.597931] __fput+0x25f/0x7a0 [ 29.601194] task_work_run+0x11f/0x190 [ 29.605064] do_exit+0xa44/0x2850 [ 29.608506] ? get_timespec64+0xb1/0xf0 [ 29.612470] ? timespec_trunc+0x120/0x120 [ 29.616594] ? mm_update_next_owner+0x5b0/0x5b0 [ 29.621241] ? SyS_clock_nanosleep+0x210/0x2d0 [ 29.625827] ? compat_SyS_clock_getres+0x180/0x180 [ 29.630742] ? __do_page_fault+0x159/0xad0 [ 29.634951] SyS_exit+0x1e/0x20 [ 29.638214] ? complete_and_exit+0x40/0x40 [ 29.642422] do_syscall_64+0x1d5/0x640 [ 29.646281] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.651454] RIP: 0033:0x7f8a5dbc92a9 [ 29.655