================================ WARNING: inconsistent lock state 6.10.0-rc1-syzkaller-00296-g89be4025b0db #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. syz-executor.1/5378 [HC1[1]:SC0[0]:HE0:SE1] takes: ffff88806b338ac0 (lock#11){?.+.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] ffff88806b338ac0 (lock#11){?.+.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x7f/0x790 mm/mmap_lock.c:237 {HARDIRQ-ON-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] stack_map_get_build_id_offset+0x5d9/0x7c0 kernel/bpf/stackmap.c:141 __bpf_get_stack+0x6bf/0x700 kernel/bpf/stackmap.c:449 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1994 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1984 ___bpf_prog_run+0x3e51/0xabd0 kernel/bpf/core.c:2012 __bpf_prog_run32+0xc1/0x100 kernel/bpf/core.c:2253 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2444 __bpf_trace_tlb_flush+0xd2/0x110 include/trace/events/tlb.h:38 trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38 native_flush_tlb_multi+0x6a/0xf0 arch/x86/mm/tlb.c:918 kvm_flush_tlb_multi+0x267/0x3b0 arch/x86/kernel/kvm.c:677 __flush_tlb_multi arch/x86/include/asm/paravirt.h:91 [inline] flush_tlb_multi arch/x86/mm/tlb.c:941 [inline] flush_tlb_mm_range+0x293/0x330 arch/x86/mm/tlb.c:1027 flush_tlb_page arch/x86/include/asm/tlbflush.h:254 [inline] ptep_clear_flush+0x136/0x180 mm/pgtable-generic.c:101 wp_page_copy mm/memory.c:3357 [inline] do_wp_page+0x1461/0x3380 mm/memory.c:3683 handle_pte_fault mm/memory.c:5396 [inline] __handle_mm_fault+0x2311/0x53f0 mm/memory.c:5523 handle_mm_fault+0x476/0xa00 mm/memory.c:5688 do_user_addr_fault+0x2e5/0xe50 arch/x86/mm/fault.c:1389 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:131 [inline] copy_to_user_iter lib/iov_iter.c:25 [inline] iterate_iovec include/linux/iov_iter.h:51 [inline] iterate_and_advance2 include/linux/iov_iter.h:247 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x4cd/0x1140 lib/iov_iter.c:185 copy_page_to_iter lib/iov_iter.c:362 [inline] copy_page_to_iter+0xf1/0x180 lib/iov_iter.c:349 process_vm_rw_pages mm/process_vm_access.c:45 [inline] process_vm_rw_single_vec mm/process_vm_access.c:118 [inline] process_vm_rw_core.constprop.0+0x5c9/0xa10 mm/process_vm_access.c:216 process_vm_rw+0x301/0x360 mm/process_vm_access.c:284 __do_sys_process_vm_readv mm/process_vm_access.c:296 [inline] __se_sys_process_vm_readv mm/process_vm_access.c:292 [inline] __x64_sys_process_vm_readv+0xe2/0x1c0 mm/process_vm_access.c:292 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f irq event stamp: 37060 hardirqs last enabled at (37059): [] seqcount_lockdep_reader_access include/linux/seqlock.h:74 [inline] hardirqs last enabled at (37059): [] read_seqbegin include/linux/seqlock.h:772 [inline] hardirqs last enabled at (37059): [] zone_span_seqbegin include/linux/memory_hotplug.h:151 [inline] hardirqs last enabled at (37059): [] page_outside_zone_boundaries mm/page_alloc.c:434 [inline] hardirqs last enabled at (37059): [] bad_range+0x264/0x440 mm/page_alloc.c:453 hardirqs last disabled at (37060): [] sysvec_call_function_single+0xe/0xb0 arch/x86/kernel/smp.c:266 softirqs last enabled at (36350): [] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (36350): [] handle_softirqs+0x5be/0x8f0 kernel/softirq.c:582 softirqs last disabled at (36027): [] __do_softirq kernel/softirq.c:588 [inline] softirqs last disabled at (36027): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last disabled at (36027): [] __irq_exit_rcu kernel/softirq.c:637 [inline] softirqs last disabled at (36027): [] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(lock#11); lock(lock#11); *** DEADLOCK *** 4 locks held by syz-executor.1/5378: #0: ffff888016684420 (sb_writers#6){.+.+}-{0:0}, at: ksys_write+0x12f/0x260 fs/read_write.c:643 #1: ffff8880486e30c0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:791 [inline] #1: ffff8880486e30c0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: shmem_file_write_iter+0x8c/0x140 mm/shmem.c:2909 #2: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #2: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #2: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2402 [inline] #2: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1c2/0x590 kernel/trace/bpf_trace.c:2444 #3: ffff888023011e18 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #3: ffff888023011e18 (&mm->mmap_lock){++++}-{3:3}, at: stack_map_get_build_id_offset+0x1e8/0x7c0 kernel/bpf/stackmap.c:141 stack backtrace: CPU: 3 PID: 5378 Comm: syz-executor.1 Not tainted 6.10.0-rc1-syzkaller-00296-g89be4025b0db #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_usage_bug kernel/locking/lockdep.c:3971 [inline] valid_state kernel/locking/lockdep.c:4013 [inline] mark_lock_irq kernel/locking/lockdep.c:4216 [inline] mark_lock+0x923/0xc60 kernel/locking/lockdep.c:4678 mark_usage kernel/locking/lockdep.c:4564 [inline] __lock_acquire+0x1359/0x3b30 kernel/locking/lockdep.c:5091 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] stack_map_get_build_id_offset+0x5d9/0x7c0 kernel/bpf/stackmap.c:141 __bpf_get_stack+0x6bf/0x700 kernel/bpf/stackmap.c:449 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1994 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1984 ___bpf_prog_run+0x3e51/0xabd0 kernel/bpf/core.c:2012 __bpf_prog_run32+0xc1/0x100 kernel/bpf/core.c:2253 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2444 __bpf_trace_tlb_flush+0xd2/0x110 include/trace/events/tlb.h:38 trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38 csd_do_func kernel/smp.c:133 [inline] __flush_smp_call_function_queue+0x27a/0x8c0 kernel/smp.c:511 __sysvec_call_function_single+0x8c/0x410 arch/x86/kernel/smp.c:271 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0x90/0xb0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 RIP: 0010:__sanitizer_cov_trace_pc+0x48/0x60 kernel/kcov.c:212 Code: f6 c4 01 74 35 8b 82 1c 16 00 00 85 c0 74 2b 8b 82 f8 15 00 00 83 f8 02 75 20 48 8b 8a 00 16 00 00 8b 92 fc 15 00 00 48 8b 01 <48> 83 c0 01 48 39 d0 73 07 48 89 01 48 89 34 c1 c3 cc cc cc cc 0f RSP: 0018:ffffc9000388f150 EFLAGS: 00000246 RAX: 000000000003ffff RBX: ffffc9000388f1d8 RCX: ffffc90006876000 RDX: 0000000000040000 RSI: ffffffff813cd459 RDI: 0000000000000001 RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: dffffc0000000000 R12: ffffffff908082cc R13: ffffc9000388ff28 R14: ffffffff908082d0 R15: 0000000000000001 deref_stack_reg arch/x86/kernel/unwind_orc.c:406 [inline] unwind_next_frame+0xdb9/0x23a0 arch/x86/kernel/unwind_orc.c:585 arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 save_stack+0x162/0x1f0 mm/page_owner.c:156 __set_page_owner+0x8b/0x560 mm/page_owner.c:320 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1468 prep_new_page mm/page_alloc.c:1476 [inline] get_page_from_freelist+0x136a/0x2df0 mm/page_alloc.c:3402 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4660 alloc_pages_mpol_noprof+0x275/0x610 mm/mempolicy.c:2265 shmem_alloc_folio+0x114/0x150 mm/shmem.c:1628 shmem_alloc_and_add_folio+0x14f/0x790 mm/shmem.c:1668 shmem_get_folio_gfp+0x687/0x13d0 mm/shmem.c:2055 shmem_get_folio mm/shmem.c:2160 [inline] shmem_write_begin+0x15a/0x360 mm/shmem.c:2743 generic_perform_write+0x272/0x620 mm/filemap.c:4015 shmem_file_write_iter+0x114/0x140 mm/shmem.c:2919 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x6b6/0x1140 fs/read_write.c:590 ksys_write+0x12f/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f394d87bc2f Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 b9 80 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c 81 02 00 48 RSP: 002b:00007f394e687e80 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000001000000 RCX: 00007f394d87bc2f RDX: 0000000001000000 RSI: 00007f3943600000 RDI: 0000000000000008 RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000964f R10: 000000002001c302 R11: 0000000000000293 R12: 0000000000000008 R13: 00007f394e687f80 R14: 00007f394e687f40 R15: 00007f3943600000 ---------------- Code disassembly (best guess): 0: f6 c4 01 test $0x1,%ah 3: 74 35 je 0x3a 5: 8b 82 1c 16 00 00 mov 0x161c(%rdx),%eax b: 85 c0 test %eax,%eax d: 74 2b je 0x3a f: 8b 82 f8 15 00 00 mov 0x15f8(%rdx),%eax 15: 83 f8 02 cmp $0x2,%eax 18: 75 20 jne 0x3a 1a: 48 8b 8a 00 16 00 00 mov 0x1600(%rdx),%rcx 21: 8b 92 fc 15 00 00 mov 0x15fc(%rdx),%edx 27: 48 8b 01 mov (%rcx),%rax * 2a: 48 83 c0 01 add $0x1,%rax <-- trapping instruction 2e: 48 39 d0 cmp %rdx,%rax 31: 73 07 jae 0x3a 33: 48 89 01 mov %rax,(%rcx) 36: 48 89 34 c1 mov %rsi,(%rcx,%rax,8) 3a: c3 ret 3b: cc int3 3c: cc int3 3d: cc int3 3e: cc int3 3f: 0f .byte 0xf