====================================================== WARNING: possible circular locking dependency detected 6.10.0-syzkaller-05505-gb1bc554e009e #0 Not tainted ------------------------------------------------------ dhcpcd-run-hook/10079 is trying to acquire lock: ffff8880211740d8 (&sighand->siglock){-.-.}-{2:2}, at: __lock_task_sighand+0xc2/0x340 kernel/signal.c:1412 but task is already holding lock: ffff88802c238aa0 (lock#14){+.+.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] ffff88802c238aa0 (lock#14){+.+.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x7f/0x790 mm/mmap_lock.c:237 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (lock#14){+.+.}-{2:2}: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] stack_map_get_build_id_offset+0x602/0x760 kernel/bpf/stackmap.c:141 __bpf_get_stack+0x68a/0x710 kernel/bpf/stackmap.c:449 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1997 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1987 0xffffffffa0002522 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2447 trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38 switch_mm_irqs_off+0x68b/0xbc0 arch/x86/mm/tlb.c:642 context_switch kernel/sched/core.c:5172 [inline] __schedule+0xc4d/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 futex_wait_queue+0xfc/0x1f0 kernel/futex/waitwake.c:370 __futex_wait+0x291/0x3c0 kernel/futex/waitwake.c:669 futex_wait+0xe9/0x380 kernel/futex/waitwake.c:697 do_futex+0x22b/0x350 kernel/futex/syscalls.c:102 __do_sys_futex_time32 kernel/futex/syscalls.c:509 [inline] __se_sys_futex_time32 kernel/futex/syscalls.c:492 [inline] __ia32_sys_futex_time32+0x1da/0x460 kernel/futex/syscalls.c:492 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> #1 (&rq->__lock){-.-.}-{2:2}: _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378 raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:560 raw_spin_rq_lock kernel/sched/sched.h:1415 [inline] _raw_spin_rq_lock_irqsave kernel/sched/sched.h:1435 [inline] rq_lock_irqsave kernel/sched/sched.h:1700 [inline] class_rq_lock_irqsave_constructor kernel/sched/sched.h:1749 [inline] sched_mm_cid_before_execve+0x114/0x5e0 kernel/sched/core.c:10267 exit_signals+0x34d/0x960 kernel/signal.c:3022 do_exit+0x54e/0x2bb0 kernel/exit.c:834 __do_sys_exit kernel/exit.c:993 [inline] __se_sys_exit kernel/exit.c:991 [inline] __ia32_sys_exit+0x42/0x50 kernel/exit.c:991 ia32_sys_call+0x1b42/0x1bb0 arch/x86/include/generated/asm/syscalls_32.h:2 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> #0 (&sighand->siglock){-.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5136 lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5718 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 __lock_task_sighand+0xc2/0x340 kernel/signal.c:1412 lock_task_sighand include/linux/sched/signal.h:746 [inline] do_send_sig_info kernel/signal.c:1300 [inline] group_send_sig_info+0x290/0x300 kernel/signal.c:1451 bpf_send_signal_common+0x2e8/0x3a0 kernel/trace/bpf_trace.c:881 ____bpf_send_signal_thread kernel/trace/bpf_trace.c:898 [inline] bpf_send_signal_thread+0x16/0x20 kernel/trace/bpf_trace.c:896 bpf_prog_7bb747c56a8bcba8+0x1d/0x25 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2449 trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:52 [inline] __mmap_lock_do_trace_acquire_returned+0x456/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] get_mmap_lock_carefully mm/memory.c:5716 [inline] lock_mm_and_find_vma+0xeb/0x6a0 mm/memory.c:5776 do_user_addr_fault+0x2b5/0x13f0 arch/x86/mm/fault.c:1361 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 __put_user_8+0x11/0x20 arch/x86/lib/putuser.S:105 clear_rseq_cs kernel/rseq.c:257 [inline] rseq_ip_fixup kernel/rseq.c:291 [inline] __rseq_handle_notify_resume+0x8d5/0x10e0 kernel/rseq.c:329 rseq_handle_notify_resume include/linux/rseq.h:38 [inline] resume_user_mode_work include/linux/resume_user_mode.h:62 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x1a3/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &sighand->siglock --> &rq->__lock --> lock#14 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(lock#14); lock(&rq->__lock); lock(lock#14); lock(&sighand->siglock); *** DEADLOCK *** 5 locks held by dhcpcd-run-hook/10079: #0: ffff88801d88ba98 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #0: ffff88801d88ba98 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5716 [inline] #0: ffff88801d88ba98 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x35/0x6a0 mm/memory.c:5776 #1: ffff88802c238aa0 (lock#14){+.+.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] #1: ffff88802c238aa0 (lock#14){+.+.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x7f/0x790 mm/mmap_lock.c:237 #2: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline] #2: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline] #2: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: get_memcg_path_buf mm/mmap_lock.c:139 [inline] #2: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: get_mm_memcg_path+0xb1/0x6f0 mm/mmap_lock.c:209 #3: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline] #3: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline] #3: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2405 [inline] #3: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x1d6/0x5a0 kernel/trace/bpf_trace.c:2449 #4: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline] #4: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline] #4: ffffffff8dbb4e60 (rcu_read_lock){....}-{1:2}, at: __lock_task_sighand+0x3f/0x340 kernel/signal.c:1395 stack backtrace: CPU: 2 PID: 10079 Comm: dhcpcd-run-hook Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186 check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5136 lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5718 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 __lock_task_sighand+0xc2/0x340 kernel/signal.c:1412 lock_task_sighand include/linux/sched/signal.h:746 [inline] do_send_sig_info kernel/signal.c:1300 [inline] group_send_sig_info+0x290/0x300 kernel/signal.c:1451 bpf_send_signal_common+0x2e8/0x3a0 kernel/trace/bpf_trace.c:881 ____bpf_send_signal_thread kernel/trace/bpf_trace.c:898 [inline] bpf_send_signal_thread+0x16/0x20 kernel/trace/bpf_trace.c:896 bpf_prog_7bb747c56a8bcba8+0x1d/0x25 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2449 trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:52 [inline] __mmap_lock_do_trace_acquire_returned+0x456/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] get_mmap_lock_carefully mm/memory.c:5716 [inline] lock_mm_and_find_vma+0xeb/0x6a0 mm/memory.c:5776 do_user_addr_fault+0x2b5/0x13f0 arch/x86/mm/fault.c:1361 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:__put_user_8+0x11/0x20 arch/x86/lib/putuser.S:107 Code: 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <48> 89 01 31 c9 0f 01 ca c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 RSP: 0018:ffffc900067efdf8 EFLAGS: 00050202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fda029baea8 RDX: 1ffff1100531fbbb RSI: ffffffff81c11186 RDI: ffffffff8b902d40 RBP: ffffc900067efef8 R08: 0000000000000000 R09: fffffbfff1fc822b R10: ffffffff8fe4115f R11: 0000000000000000 R12: ffff8880298fc880 R13: ffffc900067eff58 R14: ffffc900067efe60 R15: 0000000000000000 clear_rseq_cs kernel/rseq.c:257 [inline] rseq_ip_fixup kernel/rseq.c:291 [inline] __rseq_handle_notify_resume+0x8d5/0x10e0 kernel/rseq.c:329 rseq_handle_notify_resume include/linux/rseq.h:38 [inline] resume_user_mode_work include/linux/resume_user_mode.h:62 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x1a3/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fda02af4a12 Code: 41 5d 41 5e 41 5f c3 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 10 48 8b 15 e7 43 0f 00 f7 d8 64 89 02 48 83 RSP: 002b:00007ffd1d34a068 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: 0000000000002767 RBX: 00005598835a7901 RCX: 00007fda02af4a12 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 00005598835a8b70 R08: 0000000000000000 R09: 3c00000000001001 R10: 00007fda029ba7d0 R11: 0000000000000246 R12: 00005598835b5640 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 84 00 test %al,(%rax) 2: 00 00 add %al,(%rax) 4: 00 00 add %al,(%rax) 6: 66 90 xchg %ax,%ax 8: 90 nop 9: 90 nop a: 90 nop b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: f3 0f 1e fa endbr64 1c: 48 89 cb mov %rcx,%rbx 1f: 48 c1 fb 3f sar $0x3f,%rbx 23: 48 09 d9 or %rbx,%rcx 26: 0f 01 cb stac * 29: 48 89 01 mov %rax,(%rcx) <-- trapping instruction 2c: 31 c9 xor %ecx,%ecx 2e: 0f 01 ca clac 31: c3 ret 32: cc int3 33: cc int3 34: cc int3 35: cc int3 36: 66 90 xchg %ax,%ax 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop