Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.137' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 59.794389][ C1] [ 59.796897][ C1] ======================================================== [ 59.804078][ C1] WARNING: possible irq lock inversion dependency detected [ 59.811264][ C1] 5.6.0-syzkaller #0 Not tainted [ 59.816697][ C1] -------------------------------------------------------- [ 59.823864][ C1] swapper/1/0 just changed the state of lock: [ 59.829903][ C1] ffff8880a8f19cd8 (&ctx->ctx_lock){..-.}-{2:2}, at: free_ioctx_users+0x2b/0x450 [ 59.839284][ C1] but this lock took another, SOFTIRQ-unsafe lock in the past: [ 59.846799][ C1] (&pid->wait_pidfd){+.+.}-{2:2} [ 59.846808][ C1] [ 59.846808][ C1] [ 59.846808][ C1] and interrupts could create inverse lock ordering between them. [ 59.846808][ C1] [ 59.866161][ C1] [ 59.866161][ C1] other info that might help us debug this: [ 59.874235][ C1] Possible interrupt unsafe locking scenario: [ 59.874235][ C1] [ 59.882524][ C1] CPU0 CPU1 [ 59.887994][ C1] ---- ---- [ 59.893847][ C1] lock(&pid->wait_pidfd); [ 59.898325][ C1] local_irq_disable(); [ 59.905057][ C1] lock(&ctx->ctx_lock); [ 59.911878][ C1] lock(&pid->wait_pidfd); [ 59.918981][ C1] [ 59.922416][ C1] lock(&ctx->ctx_lock); [ 59.926901][ C1] [ 59.926901][ C1] *** DEADLOCK *** [ 59.926901][ C1] [ 59.935027][ C1] 2 locks held by swapper/1/0: [ 59.939768][ C1] #0: ffffffff899baba0 (rcu_callback){....}-{0:0}, at: rcu_core+0x520/0x1370 [ 59.948612][ C1] #1: ffffffff899bacc0 (rcu_read_lock){....}-{1:2}, at: percpu_ref_switch_to_atomic_rcu+0x209/0x540 [ 59.959505][ C1] [ 59.959505][ C1] the shortest dependencies between 2nd lock and 1st lock: [ 59.968936][ C1] -> (&pid->wait_pidfd){+.+.}-{2:2} { [ 59.974394][ C1] HARDIRQ-ON-W at: [ 59.978449][ C1] lock_acquire+0x1f2/0x8f0 [ 59.984889][ C1] _raw_spin_lock+0x2a/0x40 [ 59.991194][ C1] proc_pid_make_inode+0x1f9/0x3c0 [ 59.998116][ C1] proc_pid_instantiate+0x51/0x150 [ 60.005089][ C1] proc_pid_lookup+0x1da/0x340 [ 60.011691][ C1] proc_root_lookup+0x20/0x60 [ 60.018381][ C1] __lookup_slow+0x256/0x490 [ 60.024974][ C1] walk_component+0x418/0x6a0 [ 60.031480][ C1] link_path_walk.part.0+0x4f1/0xb50 [ 60.038658][ C1] path_openat+0x25a/0x27b0 [ 60.044979][ C1] do_filp_open+0x203/0x260 [ 60.051295][ C1] do_sys_openat2+0x585/0x770 [ 60.057781][ C1] do_sys_open+0xc3/0x140 [ 60.063931][ C1] do_syscall_64+0xf6/0x7d0 [ 60.070269][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.078118][ C1] SOFTIRQ-ON-W at: [ 60.082194][ C1] lock_acquire+0x1f2/0x8f0 [ 60.088559][ C1] _raw_spin_lock+0x2a/0x40 [ 60.094891][ C1] proc_pid_make_inode+0x1f9/0x3c0 [ 60.101804][ C1] proc_pid_instantiate+0x51/0x150 [ 60.108865][ C1] proc_pid_lookup+0x1da/0x340 [ 60.115876][ C1] proc_root_lookup+0x20/0x60 [ 60.122366][ C1] __lookup_slow+0x256/0x490 [ 60.129020][ C1] walk_component+0x418/0x6a0 [ 60.135570][ C1] link_path_walk.part.0+0x4f1/0xb50 [ 60.142824][ C1] path_openat+0x25a/0x27b0 [ 60.149140][ C1] do_filp_open+0x203/0x260 [ 60.155447][ C1] do_sys_openat2+0x585/0x770 [ 60.161920][ C1] do_sys_open+0xc3/0x140 [ 60.168050][ C1] do_syscall_64+0xf6/0x7d0 [ 60.174354][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.182049][ C1] INITIAL USE at: [ 60.186008][ C1] lock_acquire+0x1f2/0x8f0 [ 60.192220][ C1] _raw_spin_lock_irqsave+0x8c/0xbf [ 60.199127][ C1] __wake_up_common_lock+0xb4/0x130 [ 60.206047][ C1] do_notify_parent+0x19e/0xe60 [ 60.212607][ C1] do_exit+0x238f/0x2dd0 [ 60.218560][ C1] call_usermodehelper_exec_async+0x507/0x710 [ 60.226353][ C1] ret_from_fork+0x24/0x30 [ 60.232645][ C1] } [ 60.235232][ C1] ... key at: [] __key.53714+0x0/0x40 [ 60.242742][ C1] ... acquired at: [ 60.246609][ C1] _raw_spin_lock+0x2a/0x40 [ 60.251260][ C1] io_submit_one+0xc1b/0x2ec0 [ 60.256094][ C1] __ia32_compat_sys_io_submit+0x1bf/0x530 [ 60.262056][ C1] do_fast_syscall_32+0x270/0xe90 [ 60.267230][ C1] entry_SYSENTER_compat+0x70/0x7f [ 60.273525][ C1] [ 60.275824][ C1] -> (&ctx->ctx_lock){..-.}-{2:2} { [ 60.280994][ C1] IN-SOFTIRQ-W at: [ 60.284966][ C1] lock_acquire+0x1f2/0x8f0 [ 60.291093][ C1] _raw_spin_lock_irq+0x5b/0x80 [ 60.297629][ C1] free_ioctx_users+0x2b/0x450 [ 60.304027][ C1] percpu_ref_switch_to_atomic_rcu+0x494/0x540 [ 60.312069][ C1] rcu_core+0x59f/0x1370 [ 60.317940][ C1] __do_softirq+0x26c/0x9f7 [ 60.324129][ C1] irq_exit+0x192/0x1d0 [ 60.329910][ C1] smp_apic_timer_interrupt+0x19e/0x600 [ 60.337081][ C1] apic_timer_interrupt+0xf/0x20 [ 60.343640][ C1] native_safe_halt+0xe/0x10 [ 60.349874][ C1] default_idle+0x49/0x350 [ 60.355924][ C1] do_idle+0x393/0x690 [ 60.361637][ C1] cpu_startup_entry+0x14/0x20 [ 60.368087][ C1] start_secondary+0x2f3/0x400 [ 60.374483][ C1] secondary_startup_64+0xa4/0xb0 [ 60.381126][ C1] INITIAL USE at: [ 60.385009][ C1] lock_acquire+0x1f2/0x8f0 [ 60.391050][ C1] _raw_spin_lock_irq+0x5b/0x80 [ 60.397452][ C1] io_submit_one+0xbd6/0x2ec0 [ 60.403672][ C1] __ia32_compat_sys_io_submit+0x1bf/0x530 [ 60.411023][ C1] do_fast_syscall_32+0x270/0xe90 [ 60.417604][ C1] entry_SYSENTER_compat+0x70/0x7f [ 60.424246][ C1] } [ 60.426729][ C1] ... key at: [] __key.55192+0x0/0x40 [ 60.434150][ C1] ... acquired at: [ 60.437952][ C1] mark_lock+0x624/0xf10 [ 60.442354][ C1] __lock_acquire+0x1d28/0x4e00 [ 60.447370][ C1] lock_acquire+0x1f2/0x8f0 [ 60.452151][ C1] _raw_spin_lock_irq+0x5b/0x80 [ 60.457157][ C1] free_ioctx_users+0x2b/0x450 [ 60.462072][ C1] percpu_ref_switch_to_atomic_rcu+0x494/0x540 [ 60.468371][ C1] rcu_core+0x59f/0x1370 [ 60.472762][ C1] __do_softirq+0x26c/0x9f7 [ 60.477431][ C1] irq_exit+0x192/0x1d0 [ 60.481732][ C1] smp_apic_timer_interrupt+0x19e/0x600 [ 60.487438][ C1] apic_timer_interrupt+0xf/0x20 [ 60.492575][ C1] native_safe_halt+0xe/0x10 [ 60.497409][ C1] default_idle+0x49/0x350 [ 60.502005][ C1] do_idle+0x393/0x690 [ 60.506226][ C1] cpu_startup_entry+0x14/0x20 [ 60.511156][ C1] start_secondary+0x2f3/0x400 [ 60.516076][ C1] secondary_startup_64+0xa4/0xb0 [ 60.521255][ C1] [ 60.523567][ C1] [ 60.523567][ C1] stack backtrace: [ 60.529451][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-syzkaller #0 [ 60.536974][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.547006][ C1] Call Trace: [ 60.550290][ C1] [ 60.553128][ C1] dump_stack+0x188/0x20d [ 60.557436][ C1] check_usage_forwards.cold+0x20/0x29 [ 60.562868][ C1] ? check_usage_backwards+0x4e0/0x4e0 [ 60.568303][ C1] ? stack_trace_consume_entry+0x160/0x160 [ 60.574081][ C1] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 60.580643][ C1] ? get_stack_info+0x32/0x13e [ 60.585400][ C1] ? save_trace+0x42/0x9f0 [ 60.589804][ C1] mark_lock+0x624/0xf10 [ 60.594025][ C1] ? check_usage_backwards+0x4e0/0x4e0 [ 60.599465][ C1] ? print_usage_bug+0x240/0x240 [ 60.604375][ C1] ? print_usage_bug+0x240/0x240 [ 60.609282][ C1] ? mark_lock+0x12b/0xf10 [ 60.613682][ C1] __lock_acquire+0x1d28/0x4e00 [ 60.618523][ C1] ? mark_held_locks+0xe0/0xe0 [ 60.623275][ C1] ? __wake_up_common_lock+0xde/0x130 [ 60.628625][ C1] lock_acquire+0x1f2/0x8f0 [ 60.633107][ C1] ? free_ioctx_users+0x2b/0x450 [ 60.638021][ C1] ? lock_release+0x800/0x800 [ 60.642667][ C1] ? lock_acquire+0x1f2/0x8f0 [ 60.647333][ C1] ? percpu_ref_switch_to_atomic_rcu+0x209/0x540 [ 60.653808][ C1] ? lock_release+0x800/0x800 [ 60.658512][ C1] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 60.664301][ C1] _raw_spin_lock_irq+0x5b/0x80 [ 60.669131][ C1] ? free_ioctx_users+0x2b/0x450 [ 60.674064][ C1] free_ioctx_users+0x2b/0x450 [ 60.678820][ C1] percpu_ref_switch_to_atomic_rcu+0x494/0x540 [ 60.684966][ C1] rcu_core+0x59f/0x1370 [ 60.689205][ C1] ? __rcu_read_unlock+0x700/0x700 [ 60.694297][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 60.699820][ C1] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 60.705782][ C1] ? run_rebalance_domains+0x202/0x2c0 [ 60.711230][ C1] __do_softirq+0x26c/0x9f7 [ 60.715711][ C1] irq_exit+0x192/0x1d0 [ 60.719841][ C1] smp_apic_timer_interrupt+0x19e/0x600 [ 60.725376][ C1] apic_timer_interrupt+0xf/0x20 [ 60.730285][ C1] [ 60.733212][ C1] RIP: 0010:native_safe_halt+0xe/0x10 [ 60.738560][ C1] Code: cc cc cc cc cc cc cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d 44 ae 5e 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 34 ae 5e 00 fb f4 cc 41 56 41 55 41 54 55 53 e8 c3 07 97 f9 e8 9e 72 cb fb 0f 1f [ 60.758812][ C1] RSP: 0018:ffffc90000d3fdb8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 60.767319][ C1] RAX: 1ffffffff13291af RBX: ffff8880a95f2340 RCX: 0000000000000000 [ 60.775283][ C1] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffff8880a95f2c04 [ 60.783233][ C1] RBP: dffffc0000000000 R08: ffff8880a95f2340 R09: 0000000000000000 [ 60.791179][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffffed10152be468 [ 60.799733][ C1] R13: 0000000000000001 R14: ffffffff8a883540 R15: 0000000000000000 [ 60.808738][ C1] default_idle+0x49/0x350 [ 60.813130][ C1] do_idle+0x393/0x690 [ 60.817172][ C1] ? arch_cpu_idle_exit+0x70/0x70 [ 60.822169][ C1] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 60.827950][ C1] ? lockdep_hardirqs_on+0x463/0x620 [ 60.833209][ C1] cpu_startup_entry+0x14/0x20 [ 60.837957][ C1] start_secondary+0x2f3/0x400 [ 60.842693][ C1] ? set_cpu_sibling_map+0x1ed0/0x1ed0 [ 60.848162][ C1] secondary_startup_64+0xa4/0xb0