======================================================== WARNING: possible irq lock inversion dependency detected 6.7.0-rc1-next-20231117-syzkaller #0 Not tainted -------------------------------------------------------- syz-executor.0/9721 just changed the state of lock: ffff88801a72a038 (&new_timer->it_lock){-...}-{2:2}, at: posix_timer_fn+0x2d/0x3d0 kernel/time/posix-timers.c:318 but this lock took another, HARDIRQ-unsafe lock in the past: (&sighand->siglock){+.+.}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sighand->siglock); local_irq_disable(); lock(&new_timer->it_lock); lock(&sighand->siglock); lock(&new_timer->it_lock); *** DEADLOCK *** no locks held by syz-executor.0/9721. the shortest dependencies between 2nd lock and 1st lock: -> (&sighand->siglock){+.+.}-{2:2} { HARDIRQ-ON-W at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:530 [inline] ptrace_set_stopped kernel/ptrace.c:391 [inline] ptrace_attach+0x401/0x650 kernel/ptrace.c:478 __do_sys_ptrace+0x204/0x230 kernel/ptrace.c:1290 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a SOFTIRQ-ON-W at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:530 [inline] ptrace_set_stopped kernel/ptrace.c:391 [inline] ptrace_attach+0x401/0x650 kernel/ptrace.c:478 __do_sys_ptrace+0x204/0x230 kernel/ptrace.c:1290 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0x36/0x50 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:376 [inline] calculate_sigpending+0x44/0xa0 kernel/signal.c:197 ret_from_fork+0x23/0x80 arch/x86/kernel/process.c:143 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 } ... key at: [] __key.341+0x0/0x40 ... acquired at: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __do_sys_timer_delete kernel/time/posix-timers.c:1023 [inline] __se_sys_timer_delete kernel/time/posix-timers.c:1006 [inline] __x64_sys_timer_delete+0x16a/0x3e0 kernel/time/posix-timers.c:1006 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a -> (&new_timer->it_lock){-...}-{2:2} { IN-HARDIRQ-W at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 posix_timer_fn+0x2d/0x3d0 kernel/time/posix-timers.c:318 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x20c/0xc20 kernel/time/hrtimer.c:1752 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1065 [inline] __sysvec_apic_timer_interrupt+0x10c/0x410 arch/x86/kernel/apic/apic.c:1082 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1076 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 mod_memcg_state include/linux/memcontrol.h:993 [inline] memcg_account_kmem+0x22/0x80 mm/memcontrol.c:3211 obj_cgroup_uncharge_pages mm/memcontrol.c:3233 [inline] refill_obj_stock+0x317/0x500 mm/memcontrol.c:3506 obj_cgroup_charge+0x21c/0x380 mm/memcontrol.c:3548 memcg_slab_pre_alloc_hook mm/slab.h:508 [inline] slab_pre_alloc_hook mm/slab.h:715 [inline] slab_alloc_node mm/slub.c:3434 [inline] slab_alloc mm/slub.c:3460 [inline] __kmem_cache_alloc_lru mm/slub.c:3467 [inline] kmem_cache_alloc_lru+0x169/0x6f0 mm/slub.c:3483 alloc_inode_sb include/linux/fs.h:2953 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:259 new_inode_pseudo+0x16/0x80 fs/inode.c:1004 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1533 sock_create net/socket.c:1620 [inline] __sys_socket_create net/socket.c:1657 [inline] __sys_socket+0x14b/0x260 net/socket.c:1704 __do_sys_socket net/socket.c:1718 [inline] __se_sys_socket net/socket.c:1716 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1716 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 __lock_timer+0x20d/0x4c0 kernel/time/posix-timers.c:595 do_timer_settime+0x197/0x2f0 kernel/time/posix-timers.c:916 __do_sys_timer_settime kernel/time/posix-timers.c:954 [inline] __se_sys_timer_settime kernel/time/posix-timers.c:940 [inline] __x64_sys_timer_settime+0x266/0x2c0 kernel/time/posix-timers.c:940 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a } ... key at: [] __key.0+0x0/0x40 ... acquired at: mark_usage kernel/locking/lockdep.c:4563 [inline] __lock_acquire+0x1347/0x3b10 kernel/locking/lockdep.c:5090 lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 posix_timer_fn+0x2d/0x3d0 kernel/time/posix-timers.c:318 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x20c/0xc20 kernel/time/hrtimer.c:1752 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1065 [inline] __sysvec_apic_timer_interrupt+0x10c/0x410 arch/x86/kernel/apic/apic.c:1082 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1076 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 mod_memcg_state include/linux/memcontrol.h:993 [inline] memcg_account_kmem+0x22/0x80 mm/memcontrol.c:3211 obj_cgroup_uncharge_pages mm/memcontrol.c:3233 [inline] refill_obj_stock+0x317/0x500 mm/memcontrol.c:3506 obj_cgroup_charge+0x21c/0x380 mm/memcontrol.c:3548 memcg_slab_pre_alloc_hook mm/slab.h:508 [inline] slab_pre_alloc_hook mm/slab.h:715 [inline] slab_alloc_node mm/slub.c:3434 [inline] slab_alloc mm/slub.c:3460 [inline] __kmem_cache_alloc_lru mm/slub.c:3467 [inline] kmem_cache_alloc_lru+0x169/0x6f0 mm/slub.c:3483 alloc_inode_sb include/linux/fs.h:2953 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:259 new_inode_pseudo+0x16/0x80 fs/inode.c:1004 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1533 sock_create net/socket.c:1620 [inline] __sys_socket_create net/socket.c:1657 [inline] __sys_socket+0x14b/0x260 net/socket.c:1704 __do_sys_socket net/socket.c:1718 [inline] __se_sys_socket net/socket.c:1716 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1716 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a stack backtrace: CPU: 1 PID: 9721 Comm: syz-executor.0 Not tainted 6.7.0-rc1-next-20231117-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_irq_inversion_bug.part.0+0x3e1/0x590 kernel/locking/lockdep.c:4079 print_irq_inversion_bug kernel/locking/lockdep.c:4032 [inline] check_usage_forwards kernel/locking/lockdep.c:4110 [inline] mark_lock_irq kernel/locking/lockdep.c:4242 [inline] mark_lock+0x570/0xc50 kernel/locking/lockdep.c:4677 mark_usage kernel/locking/lockdep.c:4563 [inline] __lock_acquire+0x1347/0x3b10 kernel/locking/lockdep.c:5090 lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 posix_timer_fn+0x2d/0x3d0 kernel/time/posix-timers.c:318 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x20c/0xc20 kernel/time/hrtimer.c:1752 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1065 [inline] __sysvec_apic_timer_interrupt+0x10c/0x410 arch/x86/kernel/apic/apic.c:1082 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1076 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline] RIP: 0010:memcg_account_kmem+0x22/0x80 mm/memcontrol.c:3212 Code: 00 00 00 00 0f 1f 40 00 55 89 f5 53 48 89 fb 9c 58 fa f6 c4 02 75 2d 89 f2 be 32 00 00 00 e8 85 fd ff ff 9c 58 f6 c4 02 75 50 03 5b 5d c3 48 8d bb c0 02 00 00 85 ed 7e 2d 5b 48 63 f5 5d e9 RSP: 0018:ffffc900032efc90 EFLAGS: 00000246 RAX: 0000000000000002 RBX: ffff88803b4cc000 RCX: 1ffffffff1e31619 RDX: 0000000000000000 RSI: ffffffff8accbfe0 RDI: ffffffff8b2f1520 RBP: 00000000ffffffff R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff8f18e357 R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000200 R14: ffff8880b99380a0 R15: 0000000000000001 obj_cgroup_uncharge_pages mm/memcontrol.c:3233 [inline] refill_obj_stock+0x317/0x500 mm/memcontrol.c:3506 obj_cgroup_charge+0x21c/0x380 mm/memcontrol.c:3548 memcg_slab_pre_alloc_hook mm/slab.h:508 [inline] slab_pre_alloc_hook mm/slab.h:715 [inline] slab_alloc_node mm/slub.c:3434 [inline] slab_alloc mm/slub.c:3460 [inline] __kmem_cache_alloc_lru mm/slub.c:3467 [inline] kmem_cache_alloc_lru+0x169/0x6f0 mm/slub.c:3483 alloc_inode_sb include/linux/fs.h:2953 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:259 new_inode_pseudo+0x16/0x80 fs/inode.c:1004 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1533 sock_create net/socket.c:1620 [inline] __sys_socket_create net/socket.c:1657 [inline] __sys_socket+0x14b/0x260 net/socket.c:1704 __do_sys_socket net/socket.c:1718 [inline] __se_sys_socket net/socket.c:1716 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1716 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a RIP: 0033:0x7feb0a87cae9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007feb0b5890c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 00007feb0a99c050 RCX: 00007feb0a87cae9 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000000a RBP: 00007feb0a8c847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007feb0a99c050 R15: 00007ffcaa281368 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 0f 1f 40 00 nopl 0x0(%rax) 8: 55 push %rbp 9: 89 f5 mov %esi,%ebp b: 53 push %rbx c: 48 89 fb mov %rdi,%rbx f: 9c pushf 10: 58 pop %rax 11: fa cli 12: f6 c4 02 test $0x2,%ah 15: 75 2d jne 0x44 17: 89 f2 mov %esi,%edx 19: be 32 00 00 00 mov $0x32,%esi 1e: e8 85 fd ff ff call 0xfffffda8 23: 9c pushf 24: 58 pop %rax 25: f6 c4 02 test $0x2,%ah 28: 75 50 jne 0x7a * 2a: eb 03 jmp 0x2f <-- trapping instruction 2c: 5b pop %rbx 2d: 5d pop %rbp 2e: c3 ret 2f: 48 8d bb c0 02 00 00 lea 0x2c0(%rbx),%rdi 36: 85 ed test %ebp,%ebp 38: 7e 2d jle 0x67 3a: 5b pop %rbx 3b: 48 63 f5 movslq %ebp,%rsi 3e: 5d pop %rbp 3f: e9 .byte 0xe9