====================================================== WARNING: possible circular locking dependency detected 6.9.0-rc7-syzkaller-00132-g1164057b3c00 #0 Not tainted ------------------------------------------------------ syz-executor.3/12540 is trying to acquire lock: ffff88801179d3f0 (clock-AF_UNIX ){++..}-{2:2} , at: sk_psock_drop+0x34/0x500 net/core/skmsg.c:837 but task is already holding lock: ffff88805a038a00 (&stab->lock ){+.-.}-{2:2} , at: spin_lock_bh include/linux/spinlock.h:356 [inline] , at: __sock_map_delete net/core/sock_map.c:417 [inline] , at: sock_map_delete_elem+0x175/0x250 net/core/sock_map.c:449 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 ( &stab->lock){+.-.}-{2:2} : lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:417 [inline] sock_map_delete_elem+0x175/0x250 net/core/sock_map.c:449 bpf_prog_0605f9f479290f07+0x3b/0x3b bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420 trace_kfree include/trace/events/kmem.h:94 [inline] kfree+0x2bd/0x3b0 mm/slub.c:4383 __bpf_prog_put_noref+0xd7/0x310 kernel/bpf/syscall.c:2244 bpf_prog_put_deferred+0x2f3/0x3e0 kernel/bpf/syscall.c:2270 __bpf_prog_put kernel/bpf/syscall.c:2282 [inline] bpf_prog_put+0x264/0x2a0 kernel/bpf/syscall.c:2289 psock_set_prog include/linux/skmsg.h:477 [inline] sk_psock_stop_verdict net/core/skmsg.c:1247 [inline] sk_psock_drop+0x214/0x500 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x209/0x2d0 net/core/sock_map.c:1654 unix_release+0x85/0xc0 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x429/0x8a0 fs/file_table.c:422 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 ( clock-AF_UNIX ){++..}-{2:2}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline] _raw_write_lock_bh+0x35/0x50 kernel/locking/spinlock.c:334 sk_psock_drop+0x34/0x500 net/core/skmsg.c:837 __sock_map_delete net/core/sock_map.c:423 [inline] sock_map_delete_elem+0x1a2/0x250 net/core/sock_map.c:449 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422 trace_ext4_ext_remove_space include/trace/events/ext4.h:2098 [inline] ext4_ext_remove_space+0x4b0f/0x4e40 fs/ext4/extents.c:2813 ext4_ext_truncate+0x159/0x2b0 fs/ext4/extents.c:4440 ext4_truncate+0xa18/0x1180 fs/ext4/inode.c:4146 ext4_setattr+0x119a/0x1bb0 fs/ext4/inode.c:5454 notify_change+0xb9d/0xe70 fs/attr.c:497 do_truncate+0x220/0x310 fs/open.c:65 handle_truncate fs/namei.c:3300 [inline] do_open fs/namei.c:3646 [inline] path_openat+0x29fe/0x3240 fs/namei.c:3799 do_filp_open+0x235/0x490 fs/namei.c:3826 do_sys_openat2+0x13e/0x1d0 fs/open.c:1406 do_sys_open fs/open.c:1421 [inline] __do_sys_openat fs/open.c:1437 [inline] __se_sys_openat fs/open.c:1432 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1432 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&stab->lock); lock(clock-AF_UNIX); lock(&stab->lock); lock(clock-AF_UNIX); *** DEADLOCK *** 7 locks held by syz-executor.3/12540: #0: ffff88807c890420 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:409 #1: ffff88805e210e00 (&sb->s_type->i_mutex_key#8){++++}-{3:3}, at: inode_lock include/linux/fs.h:795 [inline] #1: ffff88805e210e00 (&sb->s_type->i_mutex_key#8){++++}-{3:3}, at: do_truncate+0x20c/0x310 fs/open.c:63 #2: ffff88805e210fa0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:840 [inline] #2: ffff88805e210fa0 (mapping.invalidate_lock){++++}-{3:3}, at: ext4_setattr+0xf35/0x1bb0 fs/ext4/inode.c:5378 #3: ffff88807c894950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x203f/0x22a0 fs/jbd2/transaction.c:463 #4: ffff88805e210c88 (&ei->i_data_sem){++++}-{3:3}, at: ext4_truncate+0x991/0x1180 fs/ext4/inode.c:4141 #5: ffffffff8e334da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #5: ffffffff8e334da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #5: ffffffff8e334da0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] #5: ffffffff8e334da0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x16e/0x490 kernel/trace/bpf_trace.c:2422 #6: ffff88805a038a00 (&stab->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] #6: ffff88805a038a00 (&stab->lock){+.-.}-{2:2}, at: __sock_map_delete net/core/sock_map.c:417 [inline] #6: ffff88805a038a00 (&stab->lock){+.-.}-{2:2}, at: sock_map_delete_elem+0x175/0x250 net/core/sock_map.c:449 stack backtrace: CPU: 1 PID: 12540 Comm: syz-executor.3 Not tainted 6.9.0-rc7-syzkaller-00132-g1164057b3c00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline] _raw_write_lock_bh+0x35/0x50 kernel/locking/spinlock.c:334 sk_psock_drop+0x34/0x500 net/core/skmsg.c:837 __sock_map_delete net/core/sock_map.c:423 [inline] sock_map_delete_elem+0x1a2/0x250 net/core/sock_map.c:449 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422 trace_ext4_ext_remove_space include/trace/events/ext4.h:2098 [inline] ext4_ext_remove_space+0x4b0f/0x4e40 fs/ext4/extents.c:2813 ext4_ext_truncate+0x159/0x2b0 fs/ext4/extents.c:4440 ext4_truncate+0xa18/0x1180 fs/ext4/inode.c:4146 ext4_setattr+0x119a/0x1bb0 fs/ext4/inode.c:5454 notify_change+0xb9d/0xe70 fs/attr.c:497 do_truncate+0x220/0x310 fs/open.c:65 handle_truncate fs/namei.c:3300 [inline] do_open fs/namei.c:3646 [inline] path_openat+0x29fe/0x3240 fs/namei.c:3799 do_filp_open+0x235/0x490 fs/namei.c:3826 do_sys_openat2+0x13e/0x1d0 fs/open.c:1406 do_sys_open fs/open.c:1421 [inline] __do_sys_openat fs/open.c:1437 [inline] __se_sys_openat fs/open.c:1432 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1432 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f34b3a7dd69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f34b470e0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f34b3babf80 RCX: 00007f34b3a7dd69 RDX: 000000000000275a RSI: 0000000020000040 RDI: ffffffffffffff9c RBP: 00007f34b3aca49e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f34b3babf80 R15: 00007ffc0e97bc88