============================================
WARNING: possible recursive locking detected
6.10.0-syzkaller-04488-g0986ac1408ab #0 Not tainted
--------------------------------------------
kworker/1:5/5144 is trying to acquire lock:
ffff888066c3e1d8 (&qs->lock){..-.}-{2:2}, at: __stack_map_get+0x14b/0x4b0 kernel/bpf/queue_stack_maps.c:140
but task is already holding lock:
ffff888066c3e1d8 (&qs->lock){..-.}-{2:2}, at: queue_stack_map_push_elem+0x1b2/0x660 kernel/bpf/queue_stack_maps.c:210
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&qs->lock);
lock(&qs->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
8 locks held by kworker/1:5/5144:
#0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
#0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
#1: ffffc90004917d00 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
#1: ffffc90004917d00 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
#2: ffff88801faa4250 (&devlink->lock_key#10){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x57/0xaa0 drivers/net/netdevsim/dev.c:838
#3: ffff88801e9da4e0 (&nsim_trap_data->trap_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff88801e9da4e0 (&nsim_trap_data->trap_lock){+.+.}-{2:2}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:791 [inline]
#3: ffff88801e9da4e0 (&nsim_trap_data->trap_lock){+.+.}-{2:2}, at: nsim_dev_trap_report_work+0x195/0xaa0 drivers/net/netdevsim/dev.c:850
#4: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline]
#4: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline]
#4: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: ieee80211_iterate_active_interfaces_atomic+0x2a/0x170 net/mac80211/util.c:807
#5: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline]
#5: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline]
#5: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2405 [inline]
#5: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run3+0x24c/0x5a0 kernel/trace/bpf_trace.c:2448
#6: ffff888066c3e1d8 (&qs->lock){..-.}-{2:2}, at: queue_stack_map_push_elem+0x1b2/0x660 kernel/bpf/queue_stack_maps.c:210
#7: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline]
#7: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline]
#7: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2405 [inline]
#7: ffffffff8e335fe0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1fc/0x540 kernel/trace/bpf_trace.c:2447
stack backtrace:
CPU: 1 PID: 5144 Comm: kworker/1:5 Not tainted 6.10.0-syzkaller-04488-g0986ac1408ab #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: events nsim_dev_trap_report_work
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
check_deadlock kernel/locking/lockdep.c:3061 [inline]
validate_chain+0x15d3/0x5900 kernel/locking/lockdep.c:3855
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5136
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5753
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
__stack_map_get+0x14b/0x4b0 kernel/bpf/queue_stack_maps.c:140
bpf_prog_94b194d4ebfffdd5+0x46/0x4a
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:682 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
bpf_trace_run2+0x47d/0x540 kernel/trace/bpf_trace.c:2447
trace_contention_begin+0x117/0x140 include/trace/events/lock.h:95
__pv_queued_spin_lock_slowpath+0x114/0xdc0 kernel/locking/qspinlock.c:402
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0xe1/0x120 kernel/locking/spinlock.c:162
queue_stack_map_push_elem+0x1b2/0x660 kernel/bpf/queue_stack_maps.c:210
bpf_prog_216c997a1f42e404+0x40/0x44
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:682 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
bpf_trace_run3+0x4dc/0x5a0 kernel/trace/bpf_trace.c:2448
trace_kmem_cache_free include/trace/events/kmem.h:114 [inline]
kmem_cache_free+0x2a9/0x350 mm/slub.c:4512
mac80211_hwsim_beacon_tx+0x3bf/0x850 drivers/net/wireless/virtual/mac80211_hwsim.c:2315
__iterate_interfaces+0x223/0x4c0 net/mac80211/util.c:772
ieee80211_iterate_active_interfaces_atomic+0xd8/0x170 net/mac80211/util.c:808
mac80211_hwsim_beacon+0xd4/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim.c:2345
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1753
hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1770
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:crng_make_state+0x5dc/0xa80 drivers/char/random.c:373
Code: aa a2 56 06 e9 01 fd ff ff e8 b0 0d 56 fc e8 0b b9 4b 06 48 83 7c 24 28 00 74 87 e8 9e 0d 56 fc fb 48 c7 44 24 40 0e 36 e0 45 <48> b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 c7 04 08 00 00 00 00
RSP: 0018:ffffc900049177c0 EFLAGS: 00000293
RAX: ffffffff85405022 RBX: 0000000000000000 RCX: ffff888029c00000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90004917970 R08: ffffffff85404f92 R09: 1ffffffff25f9ed5
R10: dffffc0000000000 R11: fffffbfff25f9ed6 R12: 000000000000000e
R13: 1ffff110172a74fe R14: 0000000000000046 R15: ffff8880b953a7f8
_get_random_bytes+0xd7/0x2c0 drivers/char/random.c:385
eth_random_addr include/linux/etherdevice.h:238 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:756 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline]
nsim_dev_trap_report_work+0x32f/0xaa0 drivers/net/netdevsim/dev.c:850
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
----------------
Code disassembly (best guess):
0: aa stos %al,%es:(%rdi)
1: a2 56 06 e9 01 fd ff movabs %al,0xe8fffffd01e90656
8: ff e8
a: b0 0d mov $0xd,%al
c: 56 push %rsi
d: fc cld
e: e8 0b b9 4b 06 call 0x64bb91e
13: 48 83 7c 24 28 00 cmpq $0x0,0x28(%rsp)
19: 74 87 je 0xffffffa2
1b: e8 9e 0d 56 fc call 0xfc560dbe
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
31: fc ff df
34: 48 8b 4c 24 38 mov 0x38(%rsp),%rcx
39: c7 04 08 00 00 00 00 movl $0x0,(%rax,%rcx,1)