====================================================== WARNING: possible circular locking dependency detected 6.10.0-rc2-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.1/7346 is trying to acquire lock: ffff888022392e58 (&sighand->siglock){-.-.}-{2:2}, at: __lock_task_sighand+0xc2/0x340 kernel/signal.c:1412 but task is already holding lock: ffff88806b238ac0 (lock#11){+.+.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] ffff88806b238ac0 (lock#11){+.+.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x7f/0x790 mm/mmap_lock.c:237 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (lock#11){+.+.}-{2:2}: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] stack_map_get_build_id_offset+0x5d9/0x7c0 kernel/bpf/stackmap.c:141 __bpf_get_stack+0x6bf/0x700 kernel/bpf/stackmap.c:449 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1994 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1984 ___bpf_prog_run+0x3e51/0xabd0 kernel/bpf/core.c:2012 __bpf_prog_run32+0xc1/0x100 kernel/bpf/core.c:2253 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2444 __bpf_trace_tlb_flush+0xd2/0x110 include/trace/events/tlb.h:38 trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38 switch_mm_irqs_off+0x68b/0xbc0 arch/x86/mm/tlb.c:642 context_switch kernel/sched/core.c:5392 [inline] __schedule+0xd2b/0x5d00 kernel/sched/core.c:6745 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6924 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] __text_poke+0x618/0xca0 arch/x86/kernel/alternative.c:1944 text_poke_bp_batch+0x1cd/0x760 arch/x86/kernel/alternative.c:2276 text_poke_flush arch/x86/kernel/alternative.c:2470 [inline] text_poke_flush arch/x86/kernel/alternative.c:2467 [inline] text_poke_finish+0x30/0x40 arch/x86/kernel/alternative.c:2477 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 jump_label_update+0x1d7/0x400 kernel/jump_label.c:882 static_key_enable_cpuslocked+0x1b7/0x270 kernel/jump_label.c:205 static_key_enable+0x1a/0x20 kernel/jump_label.c:218 tracepoint_add_func+0xa4c/0xe50 kernel/tracepoint.c:361 tracepoint_probe_register_prio_may_exist+0xbd/0x110 kernel/tracepoint.c:482 tracepoint_probe_register_may_exist include/linux/tracepoint.h:52 [inline] bpf_probe_register+0x189/0x200 kernel/trace/bpf_trace.c:2471 bpf_raw_tp_link_attach+0x30b/0x640 kernel/bpf/syscall.c:3874 bpf_raw_tracepoint_open kernel/bpf/syscall.c:3905 [inline] __sys_bpf+0x3a5/0x49a0 kernel/bpf/syscall.c:5729 __do_sys_bpf kernel/bpf/syscall.c:5794 [inline] __se_sys_bpf kernel/bpf/syscall.c:5792 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5792 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&rq->__lock){-.-.}-{2:2}: _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378 raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:559 raw_spin_rq_lock kernel/sched/sched.h:1406 [inline] _raw_spin_rq_lock_irqsave kernel/sched/sched.h:1425 [inline] rq_lock_irqsave kernel/sched/sched.h:1686 [inline] class_rq_lock_irqsave_constructor kernel/sched/sched.h:1740 [inline] sched_mm_cid_before_execve+0x114/0x5e0 kernel/sched/core.c:12026 exit_signals+0x34d/0x960 kernel/signal.c:3014 do_exit+0x54e/0x2ba0 kernel/exit.c:833 __do_sys_exit kernel/exit.c:990 [inline] __se_sys_exit kernel/exit.c:988 [inline] __x64_sys_exit+0x42/0x50 kernel/exit.c:988 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&sighand->siglock){-.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5137 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 __lock_task_sighand+0xc2/0x340 kernel/signal.c:1412 lock_task_sighand include/linux/sched/signal.h:746 [inline] do_send_sig_info kernel/signal.c:1300 [inline] group_send_sig_info+0x290/0x300 kernel/signal.c:1451 bpf_send_signal_common+0x2e8/0x3a0 kernel/trace/bpf_trace.c:881 ____bpf_send_signal kernel/trace/bpf_trace.c:886 [inline] bpf_send_signal+0x19/0x30 kernel/trace/bpf_trace.c:884 ___bpf_prog_run+0x3e51/0xabd0 kernel/bpf/core.c:2012 __bpf_prog_run32+0xc1/0x100 kernel/bpf/core.c:2253 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline] bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2446 __bpf_trace_mmap_lock_acquire_returned+0x134/0x180 include/trace/events/mmap_lock.h:52 trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:52 [inline] __mmap_lock_do_trace_acquire_returned+0x456/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] get_mmap_lock_carefully mm/memory.c:5715 [inline] lock_mm_and_find_vma+0xeb/0x6a0 mm/memory.c:5775 do_user_addr_fault+0x29c/0xe50 arch/x86/mm/fault.c:1361 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 __put_user_4+0x11/0x20 arch/x86/lib/putuser.S:86 schedule_tail+0xa6/0xd0 kernel/sched/core.c:5343 ret_from_fork+0x23/0x80 arch/x86/kernel/process.c:143 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Chain exists of: &sighand->siglock --> &rq->__lock --> lock#11 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(lock#11); lock(&rq->__lock); lock(lock#11); lock(&sighand->siglock); *** DEADLOCK *** 5 locks held by syz-executor.1/7346: #0: ffff88801d7b8b18 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #0: ffff88801d7b8b18 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5715 [inline] #0: ffff88801d7b8b18 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x35/0x6a0 mm/memory.c:5775 #1: ffff88806b238ac0 (lock#11){+.+.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] #1: ffff88806b238ac0 (lock#11){+.+.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x7f/0x790 mm/mmap_lock.c:237 #2: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #2: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #2: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: get_memcg_path_buf mm/mmap_lock.c:139 [inline] #2: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: get_mm_memcg_path+0xb1/0x6f0 mm/mmap_lock.c:209 #3: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #3: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #3: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2402 [inline] #3: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x1d6/0x5a0 kernel/trace/bpf_trace.c:2446 #4: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #4: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #4: ffffffff8dbb18e0 (rcu_read_lock){....}-{1:2}, at: __lock_task_sighand+0x3f/0x340 kernel/signal.c:1395 stack backtrace: CPU: 2 PID: 7346 Comm: syz-executor.1 Not tainted 6.10.0-rc2-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5137 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 __lock_task_sighand+0xc2/0x340 kernel/signal.c:1412 lock_task_sighand include/linux/sched/signal.h:746 [inline] do_send_sig_info kernel/signal.c:1300 [inline] group_send_sig_info+0x290/0x300 kernel/signal.c:1451 bpf_send_signal_common+0x2e8/0x3a0 kernel/trace/bpf_trace.c:881 ____bpf_send_signal kernel/trace/bpf_trace.c:886 [inline] bpf_send_signal+0x19/0x30 kernel/trace/bpf_trace.c:884 ___bpf_prog_run+0x3e51/0xabd0 kernel/bpf/core.c:2012 __bpf_prog_run32+0xc1/0x100 kernel/bpf/core.c:2253 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline] bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2446 __bpf_trace_mmap_lock_acquire_returned+0x134/0x180 include/trace/events/mmap_lock.h:52 trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:52 [inline] __mmap_lock_do_trace_acquire_returned+0x456/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] get_mmap_lock_carefully mm/memory.c:5715 [inline] lock_mm_and_find_vma+0xeb/0x6a0 mm/memory.c:5775 do_user_addr_fault+0x29c/0xe50 arch/x86/mm/fault.c:1361 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:__put_user_4+0x11/0x20 arch/x86/lib/putuser.S:88 Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 RSP: 0018:ffffc90007697f10 EFLAGS: 00050206 RAX: 00000000000000cd RBX: 0000000000000000 RCX: 000055557bcbc750 RDX: dffffc0000000000 RSI: ffffffff8b2cb0c0 RDI: ffff888028e2cf10 RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff1fc8c92 R10: ffffffff8fe46497 R11: 0000000000000000 R12: ffff88801b060000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 schedule_tail+0xa6/0xd0 kernel/sched/core.c:5343 ret_from_fork+0x23/0x80 arch/x86/kernel/process.c:143 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 ---------------- Code disassembly (best guess): 0: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) 7: 00 8: 90 nop 9: 90 nop a: 90 nop b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: f3 0f 1e fa endbr64 1d: 48 89 cb mov %rcx,%rbx 20: 48 c1 fb 3f sar $0x3f,%rbx 24: 48 09 d9 or %rbx,%rcx 27: 0f 01 cb stac * 2a: 89 01 mov %eax,(%rcx) <-- trapping instruction 2c: 31 c9 xor %ecx,%ecx 2e: 0f 01 ca clac 31: c3 ret 32: cc int3 33: cc int3 34: cc int3 35: cc int3 36: 0f 1f 00 nopl (%rax) 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop