./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3755820227 <...> [ 97.468442][ T923] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.181' (ED25519) to the list of known hosts. execve("./syz-executor3755820227", ["./syz-executor3755820227"], 0x7ffda0e831a0 /* 10 vars */) = 0 brk(NULL) = 0x555555e34000 brk(0x555555e34d00) = 0x555555e34d00 arch_prctl(ARCH_SET_FS, 0x555555e34380) = 0 set_tid_address(0x555555e34650) = 5063 set_robust_list(0x555555e34660, 24) = 0 rseq(0x555555e34ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3755820227", 4096) = 28 getrandom("\x88\x64\x10\xe3\x01\xcc\x88\xe0", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555e34d00 brk(0x555555e55d00) = 0x555555e55d00 brk(0x555555e56000) = 0x555555e56000 mprotect(0x7ff613998000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 connect(3, {sa_family=0x78 /* AF_??? */, sa_data="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"}, 16) = -1 EAFNOSUPPORT (Address family not supported by protocol) getsockname(3, {sa_family=AF_INET, sa_data="\xd8\x16\x00\x00\x00\x00"}, [8 => 16]) = 0 socket(AF_SMC, SOCK_STREAM, SMCPROTO_SMC) = 4 bind(4, {sa_family=AF_INET, sin_port=htons(55318), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 dup(4) = 5 listen(5, 0) = 0 socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 6 connect(6, {sa_family=AF_INET, sin_port=htons(55318), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 exit_group(0) = ? [ 100.296379][ C0] TCP: request_sock_TCP: Possible SYN flooding on port 0.0.0.0:55318. Sending cookies. [ 100.326614][ T5063] [ 100.328981][ T5063] ====================================================== [ 100.335998][ T5063] WARNING: possible circular locking dependency detected [ 100.343024][ T5063] 6.8.0-rc2-syzkaller #0 Not tainted [ 100.348360][ T5063] ------------------------------------------------------ [ 100.355397][ T5063] syz-executor375/5063 is trying to acquire lock: [ 100.361830][ T5063] ffff88807c7d13f8 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0xfa/0xa10 [ 100.373294][ T5063] [ 100.373294][ T5063] but task is already holding lock: [ 100.380659][ T5063] ffff88807c7d0130 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x3a3/0x640 [ 100.389650][ T5063] [ 100.389650][ T5063] which lock already depends on the new lock. [ 100.389650][ T5063] [ 100.400065][ T5063] [ 100.400065][ T5063] the existing dependency chain (in reverse order) is: [ 100.409223][ T5063] [ 100.409223][ T5063] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 100.416989][ T5063] lock_sock_nested+0x3a/0xf0 [ 100.422219][ T5063] smc_listen_out+0x1e7/0x4b0 [ 100.427426][ T5063] smc_listen_work+0x56e/0x5190 [ 100.432803][ T5063] process_one_work+0x886/0x15d0 [ 100.438278][ T5063] worker_thread+0x8b9/0x1290 [ 100.443491][ T5063] kthread+0x2c6/0x3a0 [ 100.448091][ T5063] ret_from_fork+0x45/0x80 [ 100.453043][ T5063] ret_from_fork_asm+0x11/0x20 [ 100.458356][ T5063] [ 100.458356][ T5063] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 100.468534][ T5063] __lock_acquire+0x2445/0x3b30 [ 100.473942][ T5063] lock_acquire+0x1ae/0x520 [ 100.478990][ T5063] __flush_work+0x103/0xa10 [ 100.484042][ T5063] __cancel_work_timer+0x3ef/0x590 [ 100.489709][ T5063] smc_clcsock_release+0x5f/0xe0 [ 100.495205][ T5063] __smc_release+0x5b9/0x890 [ 100.500357][ T5063] smc_close_non_accepted+0xda/0x230 [ 100.506235][ T5063] smc_close_active+0xc2d/0x1070 [ 100.511707][ T5063] __smc_release+0x62b/0x890 [ 100.517091][ T5063] smc_release+0x209/0x640 [ 100.522043][ T5063] __sock_release+0xae/0x260 [ 100.527175][ T5063] sock_close+0x1c/0x20 [ 100.531878][ T5063] __fput+0x270/0xb70 [ 100.536409][ T5063] task_work_run+0x14d/0x240 [ 100.541544][ T5063] do_exit+0xa8a/0x2ad0 [ 100.546249][ T5063] do_group_exit+0xd4/0x2a0 [ 100.551303][ T5063] __x64_sys_exit_group+0x3e/0x50 [ 100.556868][ T5063] do_syscall_64+0xd3/0x250 [ 100.561919][ T5063] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 100.568385][ T5063] [ 100.568385][ T5063] other info that might help us debug this: [ 100.568385][ T5063] [ 100.578616][ T5063] Possible unsafe locking scenario: [ 100.578616][ T5063] [ 100.586072][ T5063] CPU0 CPU1 [ 100.591435][ T5063] ---- ---- [ 100.596797][ T5063] lock(sk_lock-AF_SMC/1); [ 100.601316][ T5063] lock((work_completion)(&new_smc->smc_listen_work)); [ 100.610777][ T5063] lock(sk_lock-AF_SMC/1); [ 100.617813][ T5063] lock((work_completion)(&new_smc->smc_listen_work)); [ 100.624757][ T5063] [ 100.624757][ T5063] *** DEADLOCK *** [ 100.624757][ T5063] [ 100.632901][ T5063] 2 locks held by syz-executor375/5063: [ 100.638454][ T5063] #0: ffff888077826210 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: __sock_release+0x86/0x260 [ 100.649060][ T5063] #1: ffff88807c7d0130 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x3a3/0x640 [ 100.658508][ T5063] [ 100.658508][ T5063] stack backtrace: [ 100.664394][ T5063] CPU: 1 PID: 5063 Comm: syz-executor375 Not tainted 6.8.0-rc2-syzkaller #0 [ 100.673077][ T5063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 100.683161][ T5063] Call Trace: [ 100.686470][ T5063] [ 100.689446][ T5063] dump_stack_lvl+0xd9/0x1b0 [ 100.694094][ T5063] check_noncircular+0x317/0x400 [ 100.699108][ T5063] ? print_circular_bug+0x5c0/0x5c0 [ 100.704336][ T5063] ? register_lock_class+0xb1/0x1230 [ 100.709661][ T5063] ? lockdep_lock+0xc6/0x200 [ 100.714273][ T5063] ? print_bfs_bug+0x30/0x30 [ 100.718883][ T5063] ? static_obj+0xc0/0xc0 [ 100.723238][ T5063] __lock_acquire+0x2445/0x3b30 [ 100.728194][ T5063] ? lockdep_hardirqs_on_prepare+0x420/0x420 [ 100.734185][ T5063] ? hlock_conflict+0x58/0x200 [ 100.738975][ T5063] lock_acquire+0x1ae/0x520 [ 100.743488][ T5063] ? __flush_work+0xfa/0xa10 [ 100.748103][ T5063] ? lock_sync+0x190/0x190 [ 100.752534][ T5063] ? __flush_work+0xfa/0xa10 [ 100.757144][ T5063] __flush_work+0x103/0xa10 [ 100.761689][ T5063] ? __flush_work+0xfa/0xa10 [ 100.766295][ T5063] ? __lock_acquire+0x1502/0x3b30 [ 100.771341][ T5063] ? cancel_delayed_work+0x20/0x20 [ 100.776492][ T5063] ? print_usage_bug.part.0+0x550/0x550 [ 100.782073][ T5063] ? mark_held_locks+0x9f/0xe0 [ 100.786861][ T5063] __cancel_work_timer+0x3ef/0x590 [ 100.791999][ T5063] ? work_on_cpu_safe_key+0xb0/0xb0 [ 100.797335][ T5063] ? __smc_release+0x5b1/0x890 [ 100.802137][ T5063] ? reacquire_held_locks+0x4c0/0x4c0 [ 100.807543][ T5063] ? mark_held_locks+0x9f/0xe0 [ 100.812362][ T5063] smc_clcsock_release+0x5f/0xe0 [ 100.817335][ T5063] __smc_release+0x5b9/0x890 [ 100.821966][ T5063] ? sk_alloc+0xb80/0xb80 [ 100.826319][ T5063] smc_close_non_accepted+0xda/0x230 [ 100.831628][ T5063] smc_close_active+0xc2d/0x1070 [ 100.836599][ T5063] __smc_release+0x62b/0x890 [ 100.841202][ T5063] smc_release+0x209/0x640 [ 100.845629][ T5063] ? __sock_release+0x260/0x260 [ 100.850503][ T5063] __sock_release+0xae/0x260 [ 100.855116][ T5063] sock_close+0x1c/0x20 [ 100.859301][ T5063] __fput+0x270/0xb70 [ 100.863308][ T5063] task_work_run+0x14d/0x240 [ 100.867923][ T5063] ? task_work_cancel+0x30/0x30 [ 100.872790][ T5063] ? do_raw_spin_unlock+0x173/0x230 [ 100.878046][ T5063] do_exit+0xa8a/0x2ad0 [ 100.882225][ T5063] ? do_group_exit+0x1c5/0x2a0 [ 100.887050][ T5063] ? reacquire_held_locks+0x4c0/0x4c0 [ 100.892465][ T5063] ? do_raw_spin_lock+0x12e/0x2b0 [ 100.897505][ T5063] ? mm_update_next_owner+0x840/0x840 [ 100.902896][ T5063] ? spin_bug+0x1d0/0x1d0 [ 100.907260][ T5063] do_group_exit+0xd4/0x2a0 [ 100.911803][ T5063] __x64_sys_exit_group+0x3e/0x50 [ 100.916843][ T5063] do_syscall_64+0xd3/0x250 [ 100.921374][ T5063] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 100.927308][ T5063] RIP: 0033:0x7ff613923cf9 [ 100.931747][ T5063] Code: Unable to access opcode bytes at 0x7ff613923ccf. [ 100.938816][ T5063] RSP: 002b:00007ffd1efcec48 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 +++ exited with 0 +++ [ 100.947253][ T5063] RAX