program: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x4, 0x5, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r0}, &(0x7f00000004c0), &(0x7f0000000500)=r1}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x4, 0x2300, 0x20, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000016c0)={0x0, &(0x7f0000000600)=""/41, &(0x7f0000000640), &(0x7f00000006c0), 0x1, r3}, 0x38) [ 72.894758][ T4675] Bluetooth: hci0: command tx timeout [ 72.984036][ T5324] [ 72.985015][ T5324] ============================================ [ 72.987305][ T5324] WARNING: possible recursive locking detected [ 72.989675][ T5324] 6.12.0-rc7-syzkaller #0 Not tainted [ 72.991684][ T5324] -------------------------------------------- [ 72.993946][ T5324] syz.0.0/5324 is trying to acquire lock: [ 72.996134][ T5324] ffff88805000d200 (&trie->lock){....}-{2:2}, at: trie_delete_elem+0x96/0x6a0 [ 72.999571][ T5324] [ 72.999571][ T5324] but task is already holding lock: [ 73.002187][ T5324] ffff88805000d200 (&trie->lock){....}-{2:2}, at: trie_update_elem+0xc8/0xc00 [ 73.005154][ T5324] [ 73.005154][ T5324] other info that might help us debug this: [ 73.007917][ T5324] Possible unsafe locking scenario: [ 73.007917][ T5324] [ 73.010438][ T5324] CPU0 [ 73.011628][ T5324] ---- [ 73.012843][ T5324] lock(&trie->lock); [ 73.014350][ T5324] lock(&trie->lock); [ 73.015871][ T5324] [ 73.015871][ T5324] *** DEADLOCK *** [ 73.015871][ T5324] [ 73.018785][ T5324] May be due to missing lock nesting notation [ 73.018785][ T5324] [ 73.021935][ T5324] 3 locks held by syz.0.0/5324: [ 73.023801][ T5324] #0: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: bpf_map_update_value+0x3c4/0x540 [ 73.027506][ T5324] #1: ffff88805000d200 (&trie->lock){....}-{2:2}, at: trie_update_elem+0xc8/0xc00 [ 73.031105][ T5324] #2: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x244/0x590 [ 73.034326][ T5324] [ 73.034326][ T5324] stack backtrace: [ 73.036026][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0 [ 73.038928][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 73.042660][ T5324] Call Trace: [ 73.044176][ T5324] [ 73.045301][ T5324] dump_stack_lvl+0x241/0x360 [ 73.047145][ T5324] ? __pfx_dump_stack_lvl+0x10/0x10 [ 73.049218][ T5324] ? __pfx__printk+0x10/0x10 [ 73.050978][ T5324] ? lockdep_unlock+0x16a/0x300 [ 73.052863][ T5324] print_deadlock_bug+0x483/0x620 [ 73.054702][ T5324] validate_chain+0x15e2/0x5920 [ 73.056603][ T5324] ? __pfx_validate_chain+0x10/0x10 [ 73.058504][ T5324] ? __pfx_validate_chain+0x10/0x10 [ 73.060445][ T5324] ? mark_lock+0x9a/0x360 [ 73.062071][ T5324] ? page_ext_put+0x97/0xc0 [ 73.063733][ T5324] __lock_acquire+0x1384/0x2050 [ 73.065523][ T5324] lock_acquire+0x1ed/0x550 [ 73.067374][ T5324] ? trie_delete_elem+0x96/0x6a0 [ 73.069313][ T5324] ? __pfx_lock_acquire+0x10/0x10 [ 73.071153][ T5324] ? __lock_acquire+0x1384/0x2050 [ 73.073147][ T5324] _raw_spin_lock_irqsave+0xd5/0x120 [ 73.075235][ T5324] ? trie_delete_elem+0x96/0x6a0 [ 73.077338][ T5324] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 73.079545][ T5324] ? __pfx_lock_acquire+0x10/0x10 [ 73.081491][ T5324] trie_delete_elem+0x96/0x6a0 [ 73.083445][ T5324] ? __pfx___cant_migrate+0x10/0x10 [ 73.085550][ T5324] ? __alloc_pages_slowpath+0x414/0x1020 [ 73.087783][ T5324] ? bpf_trace_run4+0x244/0x590 [ 73.089708][ T5324] bpf_prog_1c0c44170264bb34+0x46/0x4a [ 73.091790][ T5324] bpf_trace_run4+0x334/0x590 [ 73.093821][ T5324] ? __pfx_bpf_trace_run4+0x10/0x10 [ 73.096183][ T5324] __alloc_pages_noprof+0x6dc/0x710 [ 73.098276][ T5324] ? __pfx___alloc_pages_noprof+0x10/0x10 [ 73.100499][ T5324] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 73.102830][ T5324] ? add_partial+0x6f/0xf0 [ 73.104580][ T5324] alloc_slab_page+0x59/0x140 [ 73.106505][ T5324] allocate_slab+0x5a/0x2f0 [ 73.108404][ T5324] ___slab_alloc+0xcd1/0x14b0 [ 73.110013][ T5324] ? bpf_map_kmalloc_node+0xd3/0x1c0 [ 73.112014][ T5324] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 73.114100][ T5324] ? bpf_map_kmalloc_node+0xd3/0x1c0 [ 73.116126][ T5324] __slab_alloc+0x58/0xa0 [ 73.117729][ T5324] __kmalloc_node_noprof+0x286/0x440 [ 73.119671][ T5324] ? bpf_map_kmalloc_node+0xd3/0x1c0 [ 73.121705][ T5324] bpf_map_kmalloc_node+0xd3/0x1c0 [ 73.123704][ T5324] trie_update_elem+0x1cd/0xc00 [ 73.125638][ T5324] ? __pfx___might_resched+0x10/0x10 [ 73.127778][ T5324] bpf_map_update_value+0x4d3/0x540 [ 73.129771][ T5324] map_update_elem+0x51a/0x6f0 [ 73.131621][ T5324] __sys_bpf+0x76f/0x810 [ 73.133199][ T5324] ? __pfx___sys_bpf+0x10/0x10 [ 73.135037][ T5324] ? __rseq_handle_notify_resume+0x34d/0x14d0 [ 73.137389][ T5324] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 73.139738][ T5324] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 73.142105][ T5324] ? do_syscall_64+0x100/0x230 [ 73.143948][ T5324] __x64_sys_bpf+0x7c/0x90 [ 73.145665][ T5324] do_syscall_64+0xf3/0x230 [ 73.147469][ T5324] ? clear_bhb_loop+0x35/0x90 [ 73.149332][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.151723][ T5324] RIP: 0033:0x7ff4e137e719 [ 73.153377][ T5324] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 73.160969][ T5324] RSP: 002b:00007ff4e0dfe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 73.164260][ T5324] RAX: ffffffffffffffda RBX: 00007ff4e1535f80 RCX: 00007ff4e137e719 [ 73.167460][ T5324] RDX: 0000000000000020 RSI: 0000000020000540 RDI: 0000000000000002 [ 73.170705][ T5324] RBP: 00007ff4e13f1616 R08: 0000000000000000 R09: 0000000000000000 [ 73.173739][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 73.176699][ T5324] R13: 0000000000000000 R14: 00007ff4e1535f80 R15: 00007ffd87044288 [ 73.179672][ T5324]