===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted ----------------------------------------------------- syz-executor.0/6825 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire: ffff8880558a5a00 (&stab->lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff8880558a5a00 (&stab->lock){+...}-{2:2}, at: __sock_map_delete net/core/sock_map.c:414 [inline] ffff8880558a5a00 (&stab->lock){+...}-{2:2}, at: sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 and this task is already holding: ffff88801f9fc3f0 (&dev->event_lock){-.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff88801f9fc3f0 (&dev->event_lock){-.-.}-{2:2}, at: vkms_crtc_atomic_flush+0x8d/0x1c0 drivers/gpu/drm/vkms/vkms_crtc.c:253 which would create a new lock dependency: (&dev->event_lock){-.-.}-{2:2} -> (&stab->lock){+...}-{2:2} but this new dependency connects a HARDIRQ-irq-safe lock: (&dev->event_lock){-.-.}-{2:2} ... which became HARDIRQ-irq-safe at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 drm_handle_vblank+0xc8/0x4c0 drivers/gpu/drm/drm_vblank.c:1885 vkms_vblank_simulate+0xd6/0x360 drivers/gpu/drm/vkms/vkms_crtc.c:29 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1818 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:112 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707 cpuidle_enter_state+0x118/0x490 drivers/cpuidle/cpuidle.c:267 cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:388 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:236 [inline] do_idle+0x375/0x5d0 kernel/sched/idle.c:332 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:430 rest_init+0x2e0/0x300 init/main.c:730 arch_call_rest_init+0xe/0x10 init/main.c:831 start_kernel+0x47a/0x500 init/main.c:1077 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x147 to a HARDIRQ-irq-unsafe lock: (&stab->lock){+...}-{2:2} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_map_update_common+0x1b6/0x5b0 net/core/sock_map.c:490 sock_map_update_elem_sys+0x55f/0x910 net/core/sock_map.c:579 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&stab->lock); local_irq_disable(); lock(&dev->event_lock); lock(&stab->lock); lock(&dev->event_lock); *** DEADLOCK *** 5 locks held by syz-executor.0/6825: #0: ffffc90003ddfb20 (crtc_ww_class_acquire){+.+.}-{0:0}, at: set_property_atomic drivers/gpu/drm/drm_mode_object.c:527 [inline] #0: ffffc90003ddfb20 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_obj_set_property_ioctl+0x600/0xdd0 drivers/gpu/drm/drm_mode_object.c:584 #1: ffff88801f9fc518 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0x2bf/0x650 drivers/gpu/drm/drm_modeset_lock.c:314 #2: ffff88801f9fe860 (&vkms_out->lock){-.-.}-{2:2}, at: drm_atomic_helper_commit_planes+0x1d1/0xe00 drivers/gpu/drm/drm_atomic_helper.c:2757 #3: ffff88801f9fc3f0 (&dev->event_lock){-.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #3: ffff88801f9fc3f0 (&dev->event_lock){-.-.}-{2:2}, at: vkms_crtc_atomic_flush+0x8d/0x1c0 drivers/gpu/drm/vkms/vkms_crtc.c:253 #4: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #4: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #4: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] #4: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x16e/0x490 kernel/trace/bpf_trace.c:2422 the dependencies between HARDIRQ-irq-safe lock and the holding lock: -> (&dev->event_lock){-.-.}-{2:2} { IN-HARDIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 drm_handle_vblank+0xc8/0x4c0 drivers/gpu/drm/drm_vblank.c:1885 vkms_vblank_simulate+0xd6/0x360 drivers/gpu/drm/vkms/vkms_crtc.c:29 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1818 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:112 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707 cpuidle_enter_state+0x118/0x490 drivers/cpuidle/cpuidle.c:267 cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:388 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:236 [inline] do_idle+0x375/0x5d0 kernel/sched/idle.c:332 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:430 rest_init+0x2e0/0x300 init/main.c:730 arch_call_rest_init+0xe/0x10 init/main.c:831 start_kernel+0x47a/0x500 init/main.c:1077 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x147 IN-SOFTIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 drm_handle_vblank+0xc8/0x4c0 drivers/gpu/drm/drm_vblank.c:1885 vkms_vblank_simulate+0xd6/0x360 drivers/gpu/drm/vkms/vkms_crtc.c:29 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1818 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 unwind_next_frame+0x1ddb/0x2a00 arch/x86/kernel/unwind_orc.c:665 arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2106 [inline] slab_free mm/slub.c:4280 [inline] kfree+0x14a/0x380 mm/slub.c:4390 security_task_free+0xa0/0xc0 security/security.c:3026 __put_task_struct+0xf9/0x290 kernel/fork.c:976 put_task_struct include/linux/sched/task.h:138 [inline] delayed_put_task_struct+0x115/0x2d0 kernel/exit.c:229 rcu_do_batch kernel/rcu/tree.c:2196 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 kasan_check_range+0x1b8/0x290 mm/kasan/generic.c:189 __asan_memset+0x23/0x50 mm/kasan/shadow.c:84 unwind_next_frame+0x13ab/0x2a00 arch/x86/kernel/unwind_orc.c:592 arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3966 [inline] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] kzalloc include/linux/slab.h:749 [inline] lsm_cred_alloc security/security.c:614 [inline] security_prepare_creds+0x4c/0x140 security/security.c:3086 prepare_creds+0x467/0x640 kernel/cred.c:242 copy_creds+0x109/0x9c0 kernel/cred.c:312 copy_process+0x9e8/0x3df0 kernel/fork.c:2253 kernel_clone+0x223/0x840 kernel/fork.c:2796 user_mode_thread+0x132/0x1a0 kernel/fork.c:2874 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:172 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] vkms_crtc_atomic_flush+0x8d/0x1c0 drivers/gpu/drm/vkms/vkms_crtc.c:253 drm_atomic_helper_commit_planes+0xaf1/0xe00 drivers/gpu/drm/drm_atomic_helper.c:2820 vkms_atomic_commit_tail+0x5d/0x200 drivers/gpu/drm/vkms/vkms_drv.c:73 commit_tail+0x2a9/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:1832 drm_atomic_helper_commit+0x953/0x9f0 drivers/gpu/drm/drm_atomic_helper.c:2072 drm_atomic_commit+0x2ac/0x310 drivers/gpu/drm/drm_atomic.c:1514 drm_client_modeset_commit_atomic+0x676/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1051 drm_client_modeset_commit_locked+0xe0/0x520 drivers/gpu/drm/drm_client_modeset.c:1154 drm_client_modeset_commit+0x4a/0x70 drivers/gpu/drm/drm_client_modeset.c:1180 __drm_fb_helper_restore_fbdev_mode_unlocked+0xc3/0x170 drivers/gpu/drm/drm_fb_helper.c:251 drm_fb_helper_set_par+0xaf/0x100 drivers/gpu/drm/drm_fb_helper.c:1344 fbcon_init+0x1129/0x2190 drivers/video/fbdev/core/fbcon.c:1094 visual_init+0x2e6/0x650 drivers/tty/vt/vt.c:1023 do_bind_con_driver+0x863/0xf60 drivers/tty/vt/vt.c:3643 do_take_over_console+0x5e7/0x750 drivers/tty/vt/vt.c:4222 do_fbcon_takeover+0x11a/0x200 drivers/video/fbdev/core/fbcon.c:532 do_fb_registered drivers/video/fbdev/core/fbcon.c:3000 [inline] fbcon_fb_registered+0x352/0x600 drivers/video/fbdev/core/fbcon.c:3020 do_register_framebuffer drivers/video/fbdev/core/fbmem.c:449 [inline] register_framebuffer+0x6b2/0x8d0 drivers/video/fbdev/core/fbmem.c:515 __drm_fb_helper_initial_config_and_unlock+0x172d/0x1e30 drivers/gpu/drm/drm_fb_helper.c:1871 drm_fbdev_generic_client_hotplug+0x16e/0x230 drivers/gpu/drm/drm_fbdev_generic.c:279 drm_client_register+0x17f/0x210 drivers/gpu/drm/drm_client.c:141 vkms_create drivers/gpu/drm/vkms/vkms_drv.c:226 [inline] vkms_init+0x5f5/0x730 drivers/gpu/drm/vkms/vkms_drv.c:252 do_one_initcall+0x238/0x830 init/main.c:1241 do_initcall_level+0x157/0x210 init/main.c:1303 do_initcalls+0x3f/0x80 init/main.c:1319 kernel_init_freeable+0x435/0x5d0 init/main.c:1550 kernel_init+0x1d/0x2a0 init/main.c:1439 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 } ... key at: [] drm_dev_init.__key.17+0x0/0x20 the dependencies between the lock to be acquired and HARDIRQ-irq-unsafe lock: -> (&stab->lock){+...}-{2:2} { HARDIRQ-ON-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_map_update_common+0x1b6/0x5b0 net/core/sock_map.c:490 sock_map_update_elem_sys+0x55f/0x910 net/core/sock_map.c:579 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_map_update_common+0x1b6/0x5b0 net/core/sock_map.c:490 sock_map_update_elem_sys+0x55f/0x910 net/core/sock_map.c:579 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 } ... key at: [] sock_map_alloc.__key+0x0/0x20 ... acquired at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:650 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x3d7/0x490 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x657/0x680 mm/page_alloc.c:4591 alloc_pages_mpol+0x3de/0x650 mm/mempolicy.c:2133 stack_depot_save_flags+0x6fd/0x860 lib/stackdepot.c:676 save_stack+0x109/0x1f0 mm/page_owner.c:130 __set_page_owner+0x29/0x380 mm/page_owner.c:195 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 alloc_pages_mpol+0x3de/0x650 mm/mempolicy.c:2133 stack_depot_save_flags+0x6fd/0x860 lib/stackdepot.c:676 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_save_track+0x51/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2106 [inline] slab_free mm/slub.c:4280 [inline] kfree+0x14a/0x380 mm/slub.c:4390 drm_crtc_send_vblank_event+0x196/0x240 drivers/gpu/drm/drm_vblank.c:1129 vkms_crtc_atomic_flush+0xe7/0x1c0 drivers/gpu/drm/vkms/vkms_crtc.c:256 drm_atomic_helper_commit_planes+0xaf1/0xe00 drivers/gpu/drm/drm_atomic_helper.c:2820 vkms_atomic_commit_tail+0x5d/0x200 drivers/gpu/drm/vkms/vkms_drv.c:73 commit_tail+0x2a9/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:1832 drm_atomic_helper_commit+0x953/0x9f0 drivers/gpu/drm/drm_atomic_helper.c:2072 drm_atomic_commit+0x2ac/0x310 drivers/gpu/drm/drm_atomic.c:1514 drm_atomic_connector_commit_dpms+0x373/0x450 drivers/gpu/drm/drm_atomic_uapi.c:980 set_property_atomic drivers/gpu/drm/drm_mode_object.c:537 [inline] drm_mode_obj_set_property_ioctl+0x713/0xdd0 drivers/gpu/drm/drm_mode_object.c:584 drm_ioctl_kernel+0x33a/0x440 drivers/gpu/drm/drm_ioctl.c:744 drm_ioctl+0x63a/0xb10 drivers/gpu/drm/drm_ioctl.c:841 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 stack backtrace: CPU: 0 PID: 6825 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline] check_irq_usage kernel/locking/lockdep.c:2865 [inline] check_prev_add kernel/locking/lockdep.c:3138 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x4dc7/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:650 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x3d7/0x490 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x657/0x680 mm/page_alloc.c:4591 alloc_pages_mpol+0x3de/0x650 mm/mempolicy.c:2133 stack_depot_save_flags+0x6fd/0x860 lib/stackdepot.c:676 save_stack+0x109/0x1f0 mm/page_owner.c:130 __set_page_owner+0x29/0x380 mm/page_owner.c:195 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 alloc_pages_mpol+0x3de/0x650 mm/mempolicy.c:2133 stack_depot_save_flags+0x6fd/0x860 lib/stackdepot.c:676 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_save_track+0x51/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2106 [inline] slab_free mm/slub.c:4280 [inline] kfree+0x14a/0x380 mm/slub.c:4390 drm_crtc_send_vblank_event+0x196/0x240 drivers/gpu/drm/drm_vblank.c:1129 vkms_crtc_atomic_flush+0xe7/0x1c0 drivers/gpu/drm/vkms/vkms_crtc.c:256 drm_atomic_helper_commit_planes+0xaf1/0xe00 drivers/gpu/drm/drm_atomic_helper.c:2820 vkms_atomic_commit_tail+0x5d/0x200 drivers/gpu/drm/vkms/vkms_drv.c:73 commit_tail+0x2a9/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:1832 drm_atomic_helper_commit+0x953/0x9f0 drivers/gpu/drm/drm_atomic_helper.c:2072 drm_atomic_commit+0x2ac/0x310 drivers/gpu/drm/drm_atomic.c:1514 drm_atomic_connector_commit_dpms+0x373/0x450 drivers/gpu/drm/drm_atomic_uapi.c:980 set_property_atomic drivers/gpu/drm/drm_mode_object.c:537 [inline] drm_mode_obj_set_property_ioctl+0x713/0xdd0 drivers/gpu/drm/drm_mode_object.c:584 drm_ioctl_kernel+0x33a/0x440 drivers/gpu/drm/drm_ioctl.c:744 drm_ioctl+0x63a/0xb10 drivers/gpu/drm/drm_ioctl.c:841 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f89c507de69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f89c5d5d0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f89c51abf80 RCX: 00007f89c507de69 RDX: 0000000020000100 RSI: 00000000c01864ba RDI: 000000000000000e RBP: 00007f89c50ca47a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f89c51abf80 R15: 00007ffdaca8a758