program syz.1.9205 is using a deprecated SCSI ioctl, please convert it to SG_IO ====================================================== WARNING: possible circular locking dependency detected 6.12.0-rc5-syzkaller-00308-g3e5e6c9900c3 #0 Not tainted ------------------------------------------------------ syz.1.9205/25328 is trying to acquire lock: ffff888068d6e200 (&trie->lock){....}-{2:2}, at: trie_delete_elem+0xb0/0x820 kernel/bpf/lpm_trie.c:462 but task is already holding lock: ffff88802b73ee98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&rq->__lock){-.-.}-{2:2}: _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378 raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598 raw_spin_rq_lock kernel/sched/sched.h:1505 [inline] task_rq_lock+0xcf/0x3b0 kernel/sched/core.c:700 cgroup_move_task+0x82/0x250 kernel/sched/psi.c:1161 css_set_move_task+0x288/0x5f0 kernel/cgroup/cgroup.c:898 cgroup_post_fork+0x1c6/0x910 kernel/cgroup/cgroup.c:6692 copy_process+0x5759/0x6ee0 kernel/fork.c:2598 kernel_clone+0xfd/0x960 kernel/fork.c:2784 user_mode_thread+0xb4/0xf0 kernel/fork.c:2862 rest_init+0x23/0x2b0 init/main.c:712 start_kernel+0x3e4/0x4d0 init/main.c:1105 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x148 -> #2 (&p->pi_lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0xa1/0x14f0 kernel/sched/core.c:4165 autoremove_wake_function+0x16/0x150 kernel/sched/wait.c:384 __wake_up_common+0x131/0x1e0 kernel/sched/wait.c:89 __wake_up_common_lock kernel/sched/wait.c:106 [inline] __wake_up+0x31/0x60 kernel/sched/wait.c:127 wakeup_kswapd+0x45e/0x640 mm/vmscan.c:7286 wake_all_kswapds+0x182/0x2e0 mm/page_alloc.c:3969 __alloc_pages_slowpath mm/page_alloc.c:4263 [inline] __alloc_pages_noprof+0x189c/0x25a0 mm/page_alloc.c:4746 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_slab_page mm/slub.c:2414 [inline] allocate_slab mm/slub.c:2578 [inline] new_slab+0xca/0x3f0 mm/slub.c:2631 ___slab_alloc+0xd1d/0x16f0 mm/slub.c:3818 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] kmem_cache_alloc_node_noprof+0xed/0x310 mm/slub.c:4186 init_kmem_cache_nodes mm/slub.c:5233 [inline] do_kmem_cache_create+0x1a8/0x700 mm/slub.c:6039 create_cache mm/slab_common.c:240 [inline] __kmem_cache_create_args+0x242/0x3c0 mm/slab_common.c:333 __kmem_cache_create include/linux/slab.h:327 [inline] can_init+0xa9/0x1a0 net/can/af_can.c:875 do_one_initcall+0x128/0x630 init/main.c:1269 do_initcall_level init/main.c:1331 [inline] do_initcalls init/main.c:1347 [inline] do_basic_setup init/main.c:1366 [inline] kernel_init_freeable+0x58f/0x8b0 init/main.c:1580 kernel_init+0x1c/0x2b0 init/main.c:1469 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #1 (&pgdat->kswapd_wait){....}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:105 [inline] __wake_up+0x1c/0x60 kernel/sched/wait.c:127 wakeup_kswapd+0x45e/0x640 mm/vmscan.c:7286 wake_all_kswapds+0x182/0x2e0 mm/page_alloc.c:3969 __alloc_pages_slowpath mm/page_alloc.c:4263 [inline] __alloc_pages_noprof+0x189c/0x25a0 mm/page_alloc.c:4746 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] ___kmalloc_large_node+0x84/0x1b0 mm/slub.c:4209 __kmalloc_large_node_noprof+0x1c/0x70 mm/slub.c:4236 __do_kmalloc_node mm/slub.c:4252 [inline] __kmalloc_node_noprof.cold+0x5/0x5f mm/slub.c:4270 kmalloc_node_noprof include/linux/slab.h:905 [inline] bpf_map_kmalloc_node+0x98/0x4a0 kernel/bpf/syscall.c:422 lpm_trie_node_alloc kernel/bpf/lpm_trie.c:299 [inline] trie_update_elem+0x1ef/0xdb0 kernel/bpf/lpm_trie.c:342 bpf_map_update_value+0x2c1/0x6c0 kernel/bpf/syscall.c:203 generic_map_update_batch+0x454/0x5f0 kernel/bpf/syscall.c:1849 bpf_map_do_batch+0x576/0x640 kernel/bpf/syscall.c:5162 __sys_bpf+0x1c9f/0x5780 kernel/bpf/syscall.c:5717 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __ia32_sys_bpf+0x76/0xe0 kernel/bpf/syscall.c:5758 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> #0 (&trie->lock){....}-{2:2}: check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain kernel/locking/lockdep.c:3904 [inline] __lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 trie_delete_elem+0xb0/0x820 kernel/bpf/lpm_trie.c:462 bpf_prog_3ffd2c70e20892c6+0x43/0x4c bpf_dispatcher_nop_func include/linux/bpf.h:1265 [inline] __bpf_prog_run include/linux/filter.h:701 [inline] bpf_prog_run include/linux/filter.h:708 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2316 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2357 trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38 switch_mm_irqs_off+0x395/0xb10 arch/x86/mm/tlb.c:637 context_switch kernel/sched/core.c:5312 [inline] __schedule+0xc6c/0x5730 kernel/sched/core.c:6690 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6869 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 vprintk_emit+0x44f/0x6f0 kernel/printk/printk.c:2408 vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:68 _printk+0xc8/0x100 kernel/printk/printk.c:2432 scsi_ioctl+0x560/0x1840 drivers/scsi/scsi_ioctl.c:878 sg_ioctl_common drivers/scsi/sg.c:1109 [inline] sg_ioctl+0xaca/0x26b0 drivers/scsi/sg.c:1163 compat_ptr_ioctl+0x6b/0xa0 fs/ioctl.c:946 __do_compat_sys_ioctl+0x259/0x2b0 fs/ioctl.c:1007 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e other info that might help us debug this: Chain exists of: &trie->lock --> &p->pi_lock --> &rq->__lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rq->__lock); lock(&p->pi_lock); lock(&rq->__lock); lock(&trie->lock); *** DEADLOCK *** 2 locks held by syz.1.9205/25328: #0: ffff88802b73ee98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598 #1: ffffffff8ddb7800 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #1: ffffffff8ddb7800 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ddb7800 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2315 [inline] #1: ffffffff8ddb7800 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1c2/0x590 kernel/trace/bpf_trace.c:2357 stack backtrace: CPU: 3 UID: 0 PID: 25328 Comm: syz.1.9205 Not tainted 6.12.0-rc5-syzkaller-00308-g3e5e6c9900c3 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_circular_bug+0x419/0x5d0 kernel/locking/lockdep.c:2074 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2206 check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain kernel/locking/lockdep.c:3904 [inline] __lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 trie_delete_elem+0xb0/0x820 kernel/bpf/lpm_trie.c:462 bpf_prog_3ffd2c70e20892c6+0x43/0x4c bpf_dispatcher_nop_func include/linux/bpf.h:1265 [inline] __bpf_prog_run include/linux/filter.h:701 [inline] bpf_prog_run include/linux/filter.h:708 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2316 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2357 trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38 switch_mm_irqs_off+0x395/0xb10 arch/x86/mm/tlb.c:637 context_switch kernel/sched/core.c:5312 [inline] __schedule+0xc6c/0x5730 kernel/sched/core.c:6690 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6869 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 vprintk_emit+0x44f/0x6f0 kernel/printk/printk.c:2408 vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:68 _printk+0xc8/0x100 kernel/printk/printk.c:2432 scsi_ioctl+0x560/0x1840 drivers/scsi/scsi_ioctl.c:878 sg_ioctl_common drivers/scsi/sg.c:1109 [inline] sg_ioctl+0xaca/0x26b0 drivers/scsi/sg.c:1163 compat_ptr_ioctl+0x6b/0xa0 fs/ioctl.c:946 __do_compat_sys_ioctl+0x259/0x2b0 fs/ioctl.c:1007 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7fe1579 Code: Unable to access opcode bytes at 0xf7fe154f. RSP: 002b:00000000f576655c EFLAGS: 00000296 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000001 RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000