================================ WARNING: inconsistent lock state 6.8.0-syzkaller-05243-g14bb1e8c8d4a #0 Not tainted -------------------------------- inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. syz-executor314/5061 [HC0[0]:SC1[1]:HE0:SE0] takes: ffff8880b952b818 (&base->lock ){?.-.}-{2:2}, at: lock_timer_base+0x112/0x240 kernel/time/timer.c:1051 {IN-HARDIRQ-W} state was registered at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 lock_timer_base+0x112/0x240 kernel/time/timer.c:1051 add_timer_on+0x1e5/0x5c0 kernel/time/timer.c:1366 handle_irq_event_percpu kernel/irq/handle.c:195 [inline] handle_irq_event+0xad/0x1f0 kernel/irq/handle.c:210 handle_level_irq+0x3c5/0x6e0 kernel/irq/chip.c:648 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline] handle_irq arch/x86/kernel/irq.c:238 [inline] __common_interrupt+0x13a/0x230 arch/x86/kernel/irq.c:257 common_interrupt+0xa5/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194 __setup_irq+0x1277/0x1cf0 kernel/irq/manage.c:1818 request_threaded_irq+0x2ab/0x380 kernel/irq/manage.c:2202 request_irq include/linux/interrupt.h:168 [inline] setup_default_timer_irq+0x25/0x60 arch/x86/kernel/time.c:70 x86_late_time_init+0x66/0xc0 arch/x86/kernel/time.c:94 start_kernel+0x3f3/0x500 init/main.c:1039 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x147 irq event stamp: 939 hardirqs last enabled at (938): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (938): [] _raw_spin_unlock_irqrestore+0x8f/0x140 kernel/locking/spinlock.c:194 hardirqs last disabled at (939): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (939): [] _raw_spin_lock_irqsave+0xb0/0x120 kernel/locking/spinlock.c:162 softirqs last enabled at (834): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (834): [] bpf_link_settle+0x81/0x150 kernel/bpf/syscall.c:3181 softirqs last disabled at (931): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last disabled at (931): [] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&base->lock ); lock(&base->lock ); *** DEADLOCK *** 7 locks held by syz-executor314/5061: #0: ffff888076ef4da0 (&mm->mmap_lock ){++++}-{3:3} , at: mmap_read_lock include/linux/mmap_lock.h:146 [inline] , at: exit_mmap+0x1be/0xd40 mm/mmap.c:3271 #1: ffffffff8e131920 (rcu_read_lock ){....}-{1:2} , at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] , at: rcu_read_lock include/linux/rcupdate.h:750 [inline] , at: __pte_offset_map+0x82/0x380 mm/pgtable-generic.c:285 #2: ffff88802d62ea38 (ptlock_ptr(ptdesc) #2 ){+.+.}-{2:2} , at: spin_lock include/linux/spinlock.h:351 [inline] , at: __pte_offset_map_lock+0x1ba/0x300 mm/pgtable-generic.c:373 #3: ffffffff8e1318a0 (rcu_read_lock_sched ){....}-{1:2} , at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] , at: rcu_read_lock_sched include/linux/rcupdate.h:842 [inline] , at: pfn_valid+0xf6/0x440 include/linux/mmzone.h:2016 #4: ffffc90000a08c00 ((&tcp_orphan_timer) ){+.-.}-{0:0} , at: call_timer_fn+0xc0/0x600 kernel/time/timer.c:1789 #5: ffff8880b952b818 (&base->lock ){?.-.}-{2:2} , at: lock_timer_base+0x112/0x240 kernel/time/timer.c:1051 #6: ffffffff8e131920 (rcu_read_lock ){....}-{1:2} , at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] , at: rcu_read_lock include/linux/rcupdate.h:750 [inline] , at: __bpf_trace_run kernel/trace/bpf_trace.c:2395 [inline] , at: bpf_trace_run2+0x1fc/0x530 kernel/trace/bpf_trace.c:2437 stack backtrace: CPU: 1 PID: 5061 Comm: syz-executor314 Not tainted 6.8.0-syzkaller-05243-g14bb1e8c8d4a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 valid_state+0x13a/0x1c0 kernel/locking/lockdep.c:4013 mark_lock_irq+0xbb/0xc20 kernel/locking/lockdep.c:4216 mark_lock+0x223/0x350 kernel/locking/lockdep.c:4678 mark_held_locks kernel/locking/lockdep.c:4274 [inline] __trace_hardirqs_on_caller kernel/locking/lockdep.c:4292 [inline] lockdep_hardirqs_on_prepare+0x282/0x780 kernel/locking/lockdep.c:4359 trace_hardirqs_on+0x28/0x40 kernel/trace/trace_preemptirq.c:61 __local_bh_enable_ip+0x168/0x200 kernel/softirq.c:387 spin_unlock_bh include/linux/spinlock.h:396 [inline] __sock_map_delete net/core/sock_map.c:424 [inline] sock_map_delete_elem+0xca/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1233 [inline] __bpf_prog_run include/linux/filter.h:667 [inline] bpf_prog_run include/linux/filter.h:674 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2396 [inline] bpf_trace_run2+0x2ec/0x530 kernel/trace/bpf_trace.c:2437 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x396/0x550 kernel/time/timer.c:663 internal_add_timer kernel/time/timer.c:688 [inline] __mod_timer+0xa0e/0xeb0 kernel/time/timer.c:1183 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers kernel/time/timer.c:2408 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419 run_timer_base kernel/time/timer.c:2428 [inline] run_timer_softirq+0x103/0x170 kernel/time/timer.c:2439 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x25b/0x530 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 63 af 86 00 f6 44 24 61 02 0f 85 8e 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90003da7460 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920007b4e98 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8baad3a0 RDI: ffffffff8bfec660 RBP: ffffc90003da75a8 R08: ffffffff92cc7507 R09: 1ffffffff2598ea0 R10: dffffc0000000000 R11: fffffbfff2598ea1 R12: 1ffff920007b4e94 R13: dffffc0000000000 R14: ffffc90003da74c0 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:298 [inline] rcu_read_lock_sched include/linux/rcupdate.h:842 [inline] pfn_valid+0x113/0x440 include/linux/mmzone.h:2016 page_table_check_clear+0x21/0x730 mm/page_table_check.c:68 zap_pte_range mm/memory.c:1452 [inline] zap_pmd_range mm/memory.c:1597 [inline] zap_pud_range mm/memory.c:1626 [inline] zap_p4d_range mm/memory.c:1647 [inline] unmap_page_range+0x1f7a/0x3610 mm/memory.c:1668 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1758 exit_mmap+0x2c6/0xd40 mm/mmap.c:3287 __mmput+0x115/0x3c0 kernel/fork.c:1345 exit_mm+0x220/0x310 kernel/exit.c:569 do_exit+0x99e/0x27e0 kernel/exit.c:865 do_group_exit+0x207/0x2c0 kernel/exit.c:1027 __do_sys_exit_group kernel/exit.c:1038 [inline] __se_sys_exit_group kernel/exit.c:1036 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f25ef811f09 Code: Unable to access opcode bytes at 0x7f25ef811edf. RSP: 002b:00007ffedd378ff8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f25ef811f09 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007f25ef88d2b0 R08: ffffffffffffffb8 R09: 0000000000000006 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f25ef88d2b0 R13: 0000000000000000 R14: 00007f25ef88dd00 R15: 00007f25ef7e3140 ------------[ cut here ]------------ raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 5061 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x29/0x40 kernel/locking/irqflag-debug.c:10 Modules linked in: CPU: 1 PID: 5061 Comm: syz-executor314 Not tainted 6.8.0-syzkaller-05243-g14bb1e8c8d4a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:warn_bogus_irq_restore+0x29/0x40 kernel/locking/irqflag-debug.c:10 Code: 90 f3 0f 1e fa 90 80 3d de 49 01 04 00 74 06 90 c3 cc cc cc cc c6 05 cf 49 01 04 01 90 48 c7 c7 20 ba aa 8b e8 d8 c5 e7 f5 90 <0f> 0b 90 90 90 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f RSP: 0018:ffffc90000a089b8 EFLAGS: 00010246 RAX: 2459947bc4029400 RBX: 1ffff9200014113c RCX: ffff888028b50000 RDX: 0000000000000103 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000a08a50 R08: ffffffff8157cbf2 R09: fffffbfff1bf9650 R10: dffffc0000000000 R11: fffffbfff1bf9650 R12: dffffc0000000000 R13: 1ffff92000141138 R14: ffffc90000a089e0 R15: 0000000000000246 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f25ef88e110 CR3: 000000007b618000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x120/0x140 kernel/locking/spinlock.c:194 __mod_timer+0xb89/0xeb0 kernel/time/timer.c:1186 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers kernel/time/timer.c:2408 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419 run_timer_base kernel/time/timer.c:2428 [inline] run_timer_softirq+0x103/0x170 kernel/time/timer.c:2439 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x25b/0x530 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 63 af 86 00 f6 44 24 61 02 0f 85 8e 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90003da7460 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920007b4e98 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8baad3a0 RDI: ffffffff8bfec660 RBP: ffffc90003da75a8 R08: ffffffff92cc7507 R09: 1ffffffff2598ea0 R10: dffffc0000000000 R11: fffffbfff2598ea1 R12: 1ffff920007b4e94 R13: dffffc0000000000 R14: ffffc90003da74c0 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:298 [inline] rcu_read_lock_sched include/linux/rcupdate.h:842 [inline] pfn_valid+0x113/0x440 include/linux/mmzone.h:2016 page_table_check_clear+0x21/0x730 mm/page_table_check.c:68 zap_pte_range mm/memory.c:1452 [inline] zap_pmd_range mm/memory.c:1597 [inline] zap_pud_range mm/memory.c:1626 [inline] zap_p4d_range mm/memory.c:1647 [inline] unmap_page_range+0x1f7a/0x3610 mm/memory.c:1668 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1758 exit_mmap+0x2c6/0xd40 mm/mmap.c:3287 __mmput+0x115/0x3c0 kernel/fork.c:1345 exit_mm+0x220/0x310 kernel/exit.c:569 do_exit+0x99e/0x27e0 kernel/exit.c:865 do_group_exit+0x207/0x2c0 kernel/exit.c:1027 __do_sys_exit_group kernel/exit.c:1038 [inline] __se_sys_exit_group kernel/exit.c:1036 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f25ef811f09 Code: Unable to access opcode bytes at 0x7f25ef811edf. RSP: 002b:00007ffedd378ff8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f25ef811f09 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007f25ef88d2b0 R08: ffffffffffffffb8 R09: 0000000000000006 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f25ef88d2b0 R13: 0000000000000000 R14: 00007f25ef88dd00 R15: 00007f25ef7e3140 irq event stamp: 939 hardirqs last enabled at (938): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (938): [] _raw_spin_unlock_irqrestore+0x8f/0x140 kernel/locking/spinlock.c:194 hardirqs last disabled at (939): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (939): [] _raw_spin_lock_irqsave+0xb0/0x120 kernel/locking/spinlock.c:162 softirqs last enabled at (834): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (834): [] bpf_link_settle+0x81/0x150 kernel/bpf/syscall.c:3181 softirqs last disabled at (931): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last disabled at (931): [] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 2b 00 sub (%rax),%eax 2: 74 08 je 0xc 4: 4c 89 f7 mov %r14,%rdi 7: e8 63 af 86 00 call 0x86af6f c: f6 44 24 61 02 testb $0x2,0x61(%rsp) 11: 0f 85 8e 01 00 00 jne 0x1a5 17: 41 f7 c7 00 02 00 00 test $0x200,%r15d 1e: 74 01 je 0x21 20: fb sti 21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp) 28: e0 45 * 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction 31: 00 00 33: 43 c7 44 25 09 00 00 movl $0x0,0x9(%r13,%r12,1) 3a: 00 00 3c: 43 rex.XB 3d: c7 .byte 0xc7 3e: 44 rex.R 3f: 25 .byte 0x25