============================= [ BUG: Invalid wait context ] 6.13.0-syzkaller-gc03320a6768c #0 Not tainted ----------------------------- syz.1.231/6730 is trying to lock: ffffffff8eac2478 (kernfs_rename_lock){....}-{3:3}, at: kernfs_path_from_node+0x92/0xb00 fs/kernfs/dir.c:229 other info that might help us debug this: context-{5:5} 2 locks held by syz.1.231/6730: #0: ffff8880b873e8d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598 #1: ffffffff8e93a120 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #1: ffffffff8e93a120 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8e93a120 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2370 [inline] #1: ffffffff8e93a120 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run2+0x1fc/0x540 kernel/trace/bpf_trace.c:2412 stack backtrace: CPU: 1 UID: 0 PID: 6730 Comm: syz.1.231 Not tainted 6.13.0-syzkaller-gc03320a6768c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_lock_invalid_wait_context kernel/locking/lockdep.c:4828 [inline] check_wait_context kernel/locking/lockdep.c:4900 [inline] __lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5178 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xdd/0x130 kernel/locking/spinlock.c:236 kernfs_path_from_node+0x92/0xb00 fs/kernfs/dir.c:229 kernfs_path include/linux/kernfs.h:598 [inline] cgroup_path include/linux/cgroup.h:599 [inline] get_mm_memcg_path+0x95/0x350 mm/mmap_lock.c:59 __mmap_lock_do_trace_start_locking+0xeb/0x310 mm/mmap_lock.c:72 __mmap_lock_trace_start_locking include/linux/mmap_lock.h:29 [inline] mmap_read_trylock include/linux/mmap_lock.h:208 [inline] stack_map_get_build_id_offset+0x81e/0x870 kernel/bpf/stackmap.c:157 __bpf_get_stack+0x8da/0xad0 kernel/bpf/stackmap.c:483 ____bpf_get_stack kernel/bpf/stackmap.c:499 [inline] bpf_get_stack+0x33/0x50 kernel/bpf/stackmap.c:496 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1948 [inline] bpf_get_stack_raw_tp+0x1a3/0x240 kernel/trace/bpf_trace.c:1938 bpf_prog_ec3b2eefa702d8d3+0x43/0x47 bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline] __bpf_prog_run include/linux/filter.h:701 [inline] bpf_prog_run include/linux/filter.h:708 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2371 [inline] bpf_trace_run2+0x2ec/0x540 kernel/trace/bpf_trace.c:2412 trace_tlb_flush+0x11c/0x140 include/trace/events/tlb.h:38 switch_mm_irqs_off+0x77a/0xa70 context_switch kernel/sched/core.c:5357 [inline] __schedule+0x10f2/0x4be0 kernel/sched/core.c:6760 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7082 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:memset_orig+0x4a/0xb0 arch/x86/lib/memset_64.S:73 Code: 75 70 48 89 d1 48 c1 e9 06 74 35 0f 1f 44 00 00 48 ff c9 48 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 28 <48> 89 47 30 48 89 47 38 48 8d 7f 40 75 d8 0f 1f 84 00 00 00 00 00 RSP: 0018:ffffc90003f0ea78 EFLAGS: 00000203 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000000002d3 RDX: 000000000001fc20 RSI: 0000000000000000 RDI: ffff888055c74ae0 RBP: 0000000000000000 R08: ffffffff814d557c R09: 0000000000000000 R10: ffff888055c603e0 R11: 0000000000000004 R12: 000000000001fc20 R13: 00000000000203e0 R14: ffff888055c40000 R15: 0000000000040000 krealloc_noprof+0x171/0x2f0 mm/slub.c:4877 kvrealloc_noprof+0x9a/0x120 mm/util.c:739 push_insn_history+0x16f/0x6b0 kernel/bpf/verifier.c:3751 check_mem_access+0xe84/0x2140 kernel/bpf/verifier.c:7429 do_check+0x7d14/0xfa40 kernel/bpf/verifier.c:19087 do_check_common+0x1b4a/0x2030 kernel/bpf/verifier.c:22258 do_check_main kernel/bpf/verifier.c:22349 [inline] bpf_check+0x59f7/0x1c150 kernel/bpf/verifier.c:23145 bpf_prog_load+0x1664/0x20e0 kernel/bpf/syscall.c:2951 __sys_bpf+0x4ee/0x810 kernel/bpf/syscall.c:5794 __do_sys_bpf kernel/bpf/syscall.c:5901 [inline] __se_sys_bpf kernel/bpf/syscall.c:5899 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5899 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0afa58cda9 Code: Unable to access opcode bytes at 0x7f0afa58cd7f. RSP: 002b:00007f0afb408038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f0afa7a5fa0 RCX: 00007f0afa58cda9 RDX: 0000000000000090 RSI: 0000000020000840 RDI: 0000000000000005 RBP: 00007f0afa60e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f0afa7a5fa0 R15: 00007fffc99ff398 ---------------- Code disassembly (best guess): 0: 75 70 jne 0x72 2: 48 89 d1 mov %rdx,%rcx 5: 48 c1 e9 06 shr $0x6,%rcx 9: 74 35 je 0x40 b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 10: 48 ff c9 dec %rcx 13: 48 89 07 mov %rax,(%rdi) 16: 48 89 47 08 mov %rax,0x8(%rdi) 1a: 48 89 47 10 mov %rax,0x10(%rdi) 1e: 48 89 47 18 mov %rax,0x18(%rdi) 22: 48 89 47 20 mov %rax,0x20(%rdi) 26: 48 89 47 28 mov %rax,0x28(%rdi) * 2a: 48 89 47 30 mov %rax,0x30(%rdi) <-- trapping instruction 2e: 48 89 47 38 mov %rax,0x38(%rdi) 32: 48 8d 7f 40 lea 0x40(%rdi),%rdi 36: 75 d8 jne 0x10 38: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) 3f: 00