./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor821321329 <...> Warning: Permanently added '10.128.1.34' (ED25519) to the list of known hosts. execve("./syz-executor821321329", ["./syz-executor821321329"], 0x7ffcfb968270 /* 10 vars */) = 0 brk(NULL) = 0x555572a80000 brk(0x555572a80d00) = 0x555572a80d00 arch_prctl(ARCH_SET_FS, 0x555572a80380) = 0 set_tid_address(0x555572a80650) = 5066 set_robust_list(0x555572a80660, 24) = 0 rseq(0x555572a80ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor821321329", 4096) = 27 getrandom("\x4c\xd5\x69\x5b\xb4\xef\x38\xde", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555572a80d00 brk(0x555572aa1d00) = 0x555572aa1d00 brk(0x555572aa2000) = 0x555572aa2000 mprotect(0x7fece62ad000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/sys/kernel/debug/sync/sw_sync", O_RDONLY) = 3 ioctl(3, _IOC(_IOC_READ|_IOC_WRITE, 0x57, 0, 0x28), 0x200001c0) = 0 fcntl(4, F_DUPFD, 3) = 5 ioctl(3, _IOC(_IOC_READ|_IOC_WRITE, 0x57, 0, 0x28), 0x20000080) = 0 openat(AT_FDCWD, "/sys/kernel/debug/sync/sw_sync", O_RDWR|O_LARGEFILE|O_CLOEXEC|FASYNC) = 7 ioctl(7, _IOC(_IOC_READ|_IOC_WRITE, 0x57, 0, 0x28), 0x20000140) = 0 ioctl(6, SYNC_IOC_MERGE, 0x200000c0) = 0 poll([{fd=9, events=0}], 1, 1) = 0 (Timeout) close_range(5, 4294967295, 0) = 0 openat(AT_FDCWD, "/sys/kernel/debug/sync/info", O_RDONLY) = 5 read(5, "objs:\n--------------\nsyz-executor821: 0\n fence active: 2 / 0\n\nsyz-executor821: 0\n fence error@57.3"..., 8224) = 140 exit_group(0) = ? [ 57.428349][ C1] [ 57.430706][ C1] ================================ [ 57.435965][ C1] WARNING: inconsistent lock state [ 57.441050][ C1] 6.8.0-syzkaller-08073-g480e035fc4c7 #0 Not tainted [ 57.447698][ C1] -------------------------------- [ 57.452797][ C1] inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. [ 57.459617][ C1] syz-executor821/5066 [HC1[1]:SC0[0]:HE0:SE1] takes: [ 57.466358][ C1] ffffffff8ea9c5d8 (sync_timeline_list_lock){?.+.}-{2:2}, at: sync_timeline_debug_remove+0x2c/0x150 [ 57.477142][ C1] {HARDIRQ-ON-W} state was registered at: [ 57.482833][ C1] trace_hardirqs_on+0x28/0x40 [ 57.487665][ C1] _raw_spin_unlock_irq+0x23/0x50 [ 57.492765][ C1] sync_info_debugfs_show+0x158/0x4d0 [ 57.498223][ C1] seq_read_iter+0x445/0xd60 [ 57.502882][ C1] seq_read+0x3a4/0x4f0 [ 57.507100][ C1] vfs_read+0x204/0xb70 [ 57.511322][ C1] ksys_read+0x1a0/0x2c0 [ 57.515629][ C1] do_syscall_64+0xfb/0x240 [ 57.520219][ C1] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 57.526175][ C1] irq event stamp: 4750 [ 57.530305][ C1] hardirqs last enabled at (4749): [] _raw_spin_unlock_irq+0x23/0x50 [ 57.540036][ C1] hardirqs last disabled at (4750): [] sysvec_irq_work+0xe/0xc0 [ 57.549214][ C1] softirqs last enabled at (4372): [] __irq_exit_rcu+0xf2/0x1c0 [ 57.558509][ C1] softirqs last disabled at (4341): [] __irq_exit_rcu+0xf2/0x1c0 [ 57.567767][ C1] [ 57.567767][ C1] other info that might help us debug this: [ 57.575820][ C1] Possible unsafe locking scenario: [ 57.575820][ C1] [ 57.583246][ C1] CPU0 [ 57.586517][ C1] ---- [ 57.589773][ C1] lock(sync_timeline_list_lock); [ 57.594863][ C1] [ 57.598298][ C1] lock(sync_timeline_list_lock); [ 57.603579][ C1] [ 57.603579][ C1] *** DEADLOCK *** [ 57.603579][ C1] [ 57.611702][ C1] no locks held by syz-executor821/5066. [ 57.617305][ C1] [ 57.617305][ C1] stack backtrace: [ 57.623169][ C1] CPU: 1 PID: 5066 Comm: syz-executor821 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0 [ 57.633204][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 57.643236][ C1] Call Trace: [ 57.646499][ C1] [ 57.649325][ C1] dump_stack_lvl+0x241/0x360 [ 57.653988][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 57.659165][ C1] ? print_usage_bug+0x61a/0x8a0 [ 57.664083][ C1] ? is_bpf_text_address+0x28d/0x2b0 [ 57.669349][ C1] valid_state+0x13a/0x1c0 [ 57.673753][ C1] mark_lock_irq+0xbb/0xc20 [ 57.678233][ C1] ? arch_stack_walk+0x16d/0x1b0 [ 57.683151][ C1] ? __pfx_mark_lock_irq+0x10/0x10 [ 57.688243][ C1] ? stack_trace_save+0x118/0x1d0 [ 57.693249][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 57.698609][ C1] ? lockdep_lock+0x123/0x2b0 [ 57.703267][ C1] ? save_trace+0x5a/0xb40 [ 57.707660][ C1] ? lockdep_unlock+0x16a/0x300 [ 57.712507][ C1] ? stack_trace_save+0x118/0x1d0 [ 57.717515][ C1] mark_lock+0x223/0x350 [ 57.721752][ C1] __lock_acquire+0xb8e/0x1fd0 [ 57.726497][ C1] lock_acquire+0x1e4/0x530 [ 57.730976][ C1] ? sync_timeline_debug_remove+0x2c/0x150 [ 57.736770][ C1] ? __pfx_lock_acquire+0x10/0x10 [ 57.741781][ C1] ? timeline_fence_release+0x1ce/0x250 [ 57.747301][ C1] ? do_raw_spin_lock+0x14f/0x370 [ 57.752306][ C1] ? __pfx_lock_release+0x10/0x10 [ 57.757310][ C1] ? do_raw_spin_unlock+0x13c/0x8b0 [ 57.762488][ C1] _raw_spin_lock_irqsave+0xd5/0x120 [ 57.767752][ C1] ? sync_timeline_debug_remove+0x2c/0x150 [ 57.773586][ C1] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 57.779493][ C1] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 57.785383][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 57.791691][ C1] ? kvfree_call_rcu+0x48c/0x790 [ 57.796616][ C1] sync_timeline_debug_remove+0x2c/0x150 [ 57.802229][ C1] timeline_fence_release+0x204/0x250 [ 57.807580][ C1] dma_fence_array_release+0x13e/0x240 [ 57.813036][ C1] irq_work_single+0xe2/0x240 [ 57.817699][ C1] irq_work_run+0x18b/0x350 [ 57.822179][ C1] ? __pfx_irq_work_run+0x10/0x10 [ 57.827180][ C1] ? __irq_exit_rcu+0xfe/0x1c0 [ 57.831923][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 57.837098][ C1] __sysvec_irq_work+0xa8/0x3e0 [ 57.841945][ C1] sysvec_irq_work+0x9e/0xc0 [ 57.846534][ C1] [ 57.849462][ C1] [ 57.852374][ C1] asm_sysvec_irq_work+0x1a/0x20 [ 57.857376][ C1] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 [ 57.863178][ C1] Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 ba c4 f2 f5 48 89 df e8 72 04 f4 f5 e8 cd 29 1d f6 fb bf 01 00 00 00 02 f1 e5 f5 65 8b 05 53 d5 84 74 85 c0 74 06 5b c3 cc cc cc cc [ 57.882764][ C1] RSP: 0018:ffffc900039e7b70 EFLAGS: 00000282 [ 57.888832][ C1] RAX: 3f4b20b95d93e000 RBX: ffff88801cea0450 RCX: ffffffff944d9603 [ 57.896804][ C1] RDX: dffffc0000000000 RSI: ffffffff8baac1e0 RDI: 0000000000000001 [ 57.904843][ C1] RBP: ffff88801e053a3c R08: ffffffff8f872cef R09: 1ffffffff1f0e59d [ 57.912795][ C1] R10: dffffc0000000000 R11: fffffbfff1f0e59e R12: ffff88801cea0440 [ 57.920767][ C1] R13: ffff88801e053a00 R14: dffffc0000000000 R15: ffff88801cea0400 [ 57.928779][ C1] sw_sync_debugfs_release+0x14b/0x1d0 [ 57.934265][ C1] ? __pfx_sw_sync_debugfs_release+0x10/0x10 [ 57.940228][ C1] __fput+0x429/0x8a0 [ 57.944195][ C1] task_work_run+0x24f/0x310 [ 57.948770][ C1] ? __pfx_task_work_run+0x10/0x10 [ 57.953881][ C1] ? switch_task_namespaces+0xe1/0x110 [ 57.959340][ C1] do_exit+0xa1b/0x27e0 [ 57.963489][ C1] ? __pfx_do_exit+0x10/0x10 [ 57.968090][ C1] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 57.974056][ C1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 57.980393][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 57.985581][ C1] ? lockdep_hardirqs_on+0x99/0x150 [ 57.990788][ C1] do_group_exit+0x207/0x2c0 [ 57.995372][ C1] __x64_sys_exit_group+0x3f/0x40 [ 58.000382][ C1] do_syscall_64+0xfb/0x240 [ 58.004881][ C1] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 58.010765][ C1] RIP: 0033:0x7fece6238ef9 [ 58.015162][ C1] Code: Unable to access opcode bytes at 0x7fece6238ecf. [ 58.022158][ C1] RSP: 002b:00007ffe7337bc48 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 +++ exited with 0 +++ [ 58.