========================================================
WARNING: possible irq lock inversion dependency detected
6.1.112-syzkaller #0 Not tainted
--------------------------------------------------------
syz.0.85/4963 just changed the state of lock:
ffff0000d09fe1e0 (&pch->downl){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff0000d09fe1e0 (&pch->downl){+.+.}-{2:2}, at: ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
ffff0000d09fe1e0 (&pch->downl){+.+.}-{2:2}, at: ppp_input+0x168/0x840 drivers/net/ppp/ppp_generic.c:2304
but this lock was taken by another, SOFTIRQ-safe lock in the past:
 (&ppp->rlock){+.-.}-{2:2}


and interrupts could create inverse lock ordering between them.


other info that might help us debug this:
 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&pch->downl);
                               local_irq_disable();
                               lock(&ppp->rlock);
                               lock(&pch->downl);
  <Interrupt>
    lock(&ppp->rlock);

 *** DEADLOCK ***

2 locks held by syz.0.85/4963:
 #0: ffff0000d1c3e130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1748 [inline]
 #0: ffff0000d1c3e130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppoe_sendmsg+0x60/0x5d4 drivers/net/ppp/pppoe.c:849
 #1: ffff800015ba4f20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349

the shortest dependencies between 2nd lock and 1st lock:
 -> (&ppp->rlock){+.-.}-{2:2} {
    HARDIRQ-ON-W at:
                      lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
                      __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                      _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
                      spin_lock_bh include/linux/spinlock.h:356 [inline]
                      ppp_get_stats64+0x3c/0x268 drivers/net/ppp/ppp_generic.c:1534
                      dev_get_stats+0xa8/0x378 net/core/dev.c:10471
                      rtnl_fill_stats+0x50/0x7c0 net/core/rtnetlink.c:1244
                      rtnl_fill_ifinfo+0x14ec/0x1c00 net/core/rtnetlink.c:1825
                      rtmsg_ifinfo_build_skb+0xf8/0x1b4 net/core/rtnetlink.c:3938
                      rtmsg_ifinfo_event net/core/rtnetlink.c:3970 [inline]
                      rtmsg_ifinfo+0x8c/0x128 net/core/rtnetlink.c:3979
                      register_netdevice+0x1010/0x130c net/core/dev.c:10146
                      ppp_unit_register drivers/net/ppp/ppp_generic.c:1217 [inline]
                      ppp_dev_configure+0x704/0x97c drivers/net/ppp/ppp_generic.c:1273
                      ppp_create_interface drivers/net/ppp/ppp_generic.c:3348 [inline]
                      ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1058 [inline]
                      ppp_ioctl+0xacc/0x2590 drivers/net/ppp/ppp_generic.c:731
                      vfs_ioctl fs/ioctl.c:51 [inline]
                      __do_sys_ioctl fs/ioctl.c:870 [inline]
                      __se_sys_ioctl fs/ioctl.c:856 [inline]
                      __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
                      __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
                      invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
                      el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
                      do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
                      el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
                      el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
                      el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
    IN-SOFTIRQ-W at:
                      lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
                      __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                      _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
                      spin_lock_bh include/linux/spinlock.h:356 [inline]
                      ppp_do_recv+0x48/0x1f8c drivers/net/ppp/ppp_generic.c:2210
                      ppp_input+0x4b8/0x840 drivers/net/ppp/ppp_generic.c:2327
                      ppp_async_process+0x98/0x150 drivers/net/ppp/ppp_async.c:503
                      tasklet_action_common+0x354/0x3f0
                      tasklet_action+0x60/0x84 kernel/softirq.c:822
                      handle_softirqs+0x318/0xd58 kernel/softirq.c:571
                      __do_softirq+0x14/0x20 kernel/softirq.c:605
                      ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
                      call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:893
                      do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
                      invoke_softirq kernel/softirq.c:452 [inline]
                      __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:654
                      irq_exit_rcu+0x14/0x84 kernel/softirq.c:666
                      __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
                      el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486
                      el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
                      el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
                      arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
                      __tasklet_schedule_common+0x148/0x1c0 kernel/softirq.c:749
                      __tasklet_schedule+0x1c/0x28 kernel/softirq.c:754
                      tasklet_schedule include/linux/interrupt.h:712 [inline]
                      ppp_asynctty_receive+0x16b8/0x186c drivers/net/ppp/ppp_async.c:352
                      tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:461
                      tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:39
                      receive_buf drivers/tty/tty_buffer.c:515 [inline]
                      flush_to_ldisc+0x260/0x6f8 drivers/tty/tty_buffer.c:565
                      process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292
                      worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
                      kthread+0x250/0x2d8 kernel/kthread.c:376
                      ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
    INITIAL USE at:
                     lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
                     __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                     _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
                     spin_lock_bh include/linux/spinlock.h:356 [inline]
                     ppp_get_stats64+0x3c/0x268 drivers/net/ppp/ppp_generic.c:1534
                     dev_get_stats+0xa8/0x378 net/core/dev.c:10471
                     rtnl_fill_stats+0x50/0x7c0 net/core/rtnetlink.c:1244
                     rtnl_fill_ifinfo+0x14ec/0x1c00 net/core/rtnetlink.c:1825
                     rtmsg_ifinfo_build_skb+0xf8/0x1b4 net/core/rtnetlink.c:3938
                     rtmsg_ifinfo_event net/core/rtnetlink.c:3970 [inline]
                     rtmsg_ifinfo+0x8c/0x128 net/core/rtnetlink.c:3979
                     register_netdevice+0x1010/0x130c net/core/dev.c:10146
                     ppp_unit_register drivers/net/ppp/ppp_generic.c:1217 [inline]
                     ppp_dev_configure+0x704/0x97c drivers/net/ppp/ppp_generic.c:1273
                     ppp_create_interface drivers/net/ppp/ppp_generic.c:3348 [inline]
                     ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1058 [inline]
                     ppp_ioctl+0xacc/0x2590 drivers/net/ppp/ppp_generic.c:731
                     vfs_ioctl fs/ioctl.c:51 [inline]
                     __do_sys_ioctl fs/ioctl.c:870 [inline]
                     __se_sys_ioctl fs/ioctl.c:856 [inline]
                     __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
                     __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
                     invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
                     el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
                     do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
                     el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
                     el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
                     el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
  }
  ... key      at: [<ffff80001cf475a0>] ppp_dev_configure.__key+0x0/0x20
  ... acquired at:
   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
   _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
   spin_lock_bh include/linux/spinlock.h:356 [inline]
   ppp_connect_channel+0x160/0x570 drivers/net/ppp/ppp_generic.c:3485
   ppp_ioctl+0x1408/0x2590 drivers/net/ppp/ppp_generic.c:759
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:870 [inline]
   __se_sys_ioctl fs/ioctl.c:856 [inline]
   __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
   __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
   invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
   el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
   do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
   el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
   el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
   el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> (&pch->downl){+.+.}-{2:2} {
   HARDIRQ-ON-W at:
                    lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
                    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                    _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
                    spin_lock_bh include/linux/spinlock.h:356 [inline]
                    ppp_unregister_channel+0x78/0x2ac drivers/net/ppp/ppp_generic.c:2992
                    ppp_sync_close+0xe8/0x164 drivers/net/ppp/ppp_synctty.c:236
                    tty_ldisc_close drivers/tty/tty_ldisc.c:456 [inline]
                    tty_ldisc_kill+0x1b0/0x300 drivers/tty/tty_ldisc.c:614
                    tty_ldisc_release+0x190/0x23c drivers/tty/tty_ldisc.c:782
                    tty_release_struct+0x34/0xd4 drivers/tty/tty_io.c:1689
                    tty_release+0xb64/0x1014 drivers/tty/tty_io.c:1860
                    __fput+0x1c8/0x7c8 fs/file_table.c:320
                    ____fput+0x20/0x30 fs/file_table.c:348
                    task_work_run+0x240/0x2f0 kernel/task_work.c:203
                    resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
                    do_notify_resume+0x2148/0x3474 arch/arm64/kernel/signal.c:1132
                    prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
                    exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
                    el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638
                    el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
                    el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
   SOFTIRQ-ON-W at:
                    lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
                    __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
                    _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
                    spin_lock include/linux/spinlock.h:351 [inline]
                    ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
                    ppp_input+0x168/0x840 drivers/net/ppp/ppp_generic.c:2304
                    pppoe_rcv_core+0xfc/0x310 drivers/net/ppp/pppoe.c:379
                    sk_backlog_rcv include/net/sock.h:1117 [inline]
                    __release_sock+0x1a8/0x408 net/core/sock.c:2936
                    release_sock+0x68/0x1cc net/core/sock.c:3500
                    pppoe_sendmsg+0xc8/0x5d4 drivers/net/ppp/pppoe.c:903
                    sock_sendmsg_nosec net/socket.c:718 [inline]
                    __sock_sendmsg net/socket.c:730 [inline]
                    ____sys_sendmsg+0x55c/0x848 net/socket.c:2514
                    ___sys_sendmsg net/socket.c:2568 [inline]
                    __sys_sendmmsg+0x318/0x7d8 net/socket.c:2654
                    __do_sys_sendmmsg net/socket.c:2683 [inline]
                    __se_sys_sendmmsg net/socket.c:2680 [inline]
                    __arm64_sys_sendmmsg+0xa0/0xbc net/socket.c:2680
                    __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
                    invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
                    el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
                    do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
                    el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
                    el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
                    el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
   INITIAL USE at:
                   lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
                   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                   _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
                   spin_lock_bh include/linux/spinlock.h:356 [inline]
                   ppp_unregister_channel+0x78/0x2ac drivers/net/ppp/ppp_generic.c:2992
                   ppp_sync_close+0xe8/0x164 drivers/net/ppp/ppp_synctty.c:236
                   tty_ldisc_close drivers/tty/tty_ldisc.c:456 [inline]
                   tty_ldisc_kill+0x1b0/0x300 drivers/tty/tty_ldisc.c:614
                   tty_ldisc_release+0x190/0x23c drivers/tty/tty_ldisc.c:782
                   tty_release_struct+0x34/0xd4 drivers/tty/tty_io.c:1689
                   tty_release+0xb64/0x1014 drivers/tty/tty_io.c:1860
                   __fput+0x1c8/0x7c8 fs/file_table.c:320
                   ____fput+0x20/0x30 fs/file_table.c:348
                   task_work_run+0x240/0x2f0 kernel/task_work.c:203
                   resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
                   do_notify_resume+0x2148/0x3474 arch/arm64/kernel/signal.c:1132
                   prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
                   exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
                   el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638
                   el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
                   el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
 }
 ... key      at: [<ffff80001cf47460>] ppp_register_net_channel.__key.1+0x0/0x20
 ... acquired at:
   mark_lock+0x258/0x360 kernel/locking/lockdep.c:4628
   mark_usage kernel/locking/lockdep.c:4541 [inline]
   __lock_acquire+0xc2c/0x7680 kernel/locking/lockdep.c:5003
   lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
   __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
   _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
   spin_lock include/linux/spinlock.h:351 [inline]
   ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
   ppp_input+0x168/0x840 drivers/net/ppp/ppp_generic.c:2304
   pppoe_rcv_core+0xfc/0x310 drivers/net/ppp/pppoe.c:379
   sk_backlog_rcv include/net/sock.h:1117 [inline]
   __release_sock+0x1a8/0x408 net/core/sock.c:2936
   release_sock+0x68/0x1cc net/core/sock.c:3500
   pppoe_sendmsg+0xc8/0x5d4 drivers/net/ppp/pppoe.c:903
   sock_sendmsg_nosec net/socket.c:718 [inline]
   __sock_sendmsg net/socket.c:730 [inline]
   ____sys_sendmsg+0x55c/0x848 net/socket.c:2514
   ___sys_sendmsg net/socket.c:2568 [inline]
   __sys_sendmmsg+0x318/0x7d8 net/socket.c:2654
   __do_sys_sendmmsg net/socket.c:2683 [inline]
   __se_sys_sendmmsg net/socket.c:2680 [inline]
   __arm64_sys_sendmmsg+0xa0/0xbc net/socket.c:2680
   __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
   invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
   el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
   do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
   el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
   el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
   el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585


stack backtrace:
CPU: 0 PID: 4963 Comm: syz.0.85 Not tainted 6.1.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 print_irq_inversion_bug+0x330/0x388 kernel/locking/lockdep.c:4036
 mark_lock_irq+0x8b0/0xd2c
 mark_lock+0x258/0x360 kernel/locking/lockdep.c:4628
 mark_usage kernel/locking/lockdep.c:4541 [inline]
 __lock_acquire+0xc2c/0x7680 kernel/locking/lockdep.c:5003
 lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]
 ppp_input+0x168/0x840 drivers/net/ppp/ppp_generic.c:2304
 pppoe_rcv_core+0xfc/0x310 drivers/net/ppp/pppoe.c:379
 sk_backlog_rcv include/net/sock.h:1117 [inline]
 __release_sock+0x1a8/0x408 net/core/sock.c:2936
 release_sock+0x68/0x1cc net/core/sock.c:3500
 pppoe_sendmsg+0xc8/0x5d4 drivers/net/ppp/pppoe.c:903
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x55c/0x848 net/socket.c:2514
 ___sys_sendmsg net/socket.c:2568 [inline]
 __sys_sendmmsg+0x318/0x7d8 net/socket.c:2654
 __do_sys_sendmmsg net/socket.c:2683 [inline]
 __se_sys_sendmmsg net/socket.c:2680 [inline]
 __arm64_sys_sendmmsg+0xa0/0xbc net/socket.c:2680
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585