=====================================================
WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
6.1.84-syzkaller #0 Not tainted
-----------------------------------------------------
kworker/0:0/7 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire:
ffff8880704a9820 (
&htab->buckets[i].lock){+...}-{2:2}, at: sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:932
and this task is already holding:
ffff8880b983a258 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x58c/0xf90
which would create a new lock dependency:
(&pool->lock){-.-.}-{2:2} -> (&htab->buckets[i].lock){+...}-{2:2}
but this new dependency connects a HARDIRQ-irq-safe lock:
(&pool->lock){-.-.}-{2:2}
... which became HARDIRQ-irq-safe at:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
__queue_work+0x58c/0xf90
queue_work_on+0x14b/0x250 kernel/workqueue.c:1548
hrtimer_switch_to_hres kernel/time/hrtimer.c:747 [inline]
hrtimer_run_queues+0x14b/0x450 kernel/time/hrtimer.c:1912
run_local_timers kernel/time/timer.c:1845 [inline]
update_process_times+0x7b/0x1b0 kernel/time/timer.c:1868
tick_periodic+0x197/0x210 kernel/time/tick-common.c:100
tick_handle_periodic+0x46/0x150 kernel/time/tick-common.c:112
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
__sysvec_apic_timer_interrupt+0x156/0x580 arch/x86/kernel/apic/apic.c:1112
sysvec_apic_timer_interrupt+0x8c/0xb0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
kasan_mem_to_shadow include/linux/kasan.h:59 [inline]
memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
memory_is_poisoned mm/kasan/generic.c:159 [inline]
check_region_inline mm/kasan/generic.c:180 [inline]
kasan_check_range+0x33/0x290 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:72 [inline]
atomic_long_read include/linux/atomic/atomic-instrumented.h:1265 [inline]
rwsem_owner_flags kernel/locking/rwsem.c:287 [inline]
rwsem_spin_on_owner+0x1f8/0x2e0 kernel/locking/rwsem.c:772
rwsem_optimistic_spin kernel/locking/rwsem.c:846 [inline]
rwsem_down_write_slowpath+0x2ab/0x14b0 kernel/locking/rwsem.c:1121
early_event_add_tracer+0x4a/0x70 kernel/trace/trace_events.c:3679
event_trace_init+0xe3/0x160 kernel/trace/trace_events.c:3837
tracer_init_tracefs_work_func+0xd/0x13b kernel/trace/trace.c:9949
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
to a HARDIRQ-irq-unsafe lock:
(&htab->buckets[i].lock){+...}-{2:2}
... which became HARDIRQ-irq-unsafe at:
...
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_free+0x160/0x820 net/core/sock_map.c:1149
map_create+0x97a/0xd20 kernel/bpf/syscall.c:1213
__sys_bpf+0x2d3/0x6c0 kernel/bpf/syscall.c:4987
__do_sys_bpf kernel/bpf/syscall.c:5109 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5107 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5107
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&htab->buckets[i].lock);
local_irq_disable();
lock(&pool->lock);
lock(&htab->buckets[i].lock);
<Interrupt>
lock(&pool->lock);
*** DEADLOCK ***
6 locks held by kworker/0:0/7:
#0: ffff888012472138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
#1: ffffc900000c7d20 ((work_completion)(&(&ssp->work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
#2: ffffffff91d5d7c8 (&ssp->srcu_cb_mutex){+.+.}-{3:3}, at: srcu_gp_end kernel/rcu/srcutree.c:756 [inline]
#2: ffffffff91d5d7c8 (&ssp->srcu_cb_mutex){+.+.}-{3:3}, at: srcu_advance_state kernel/rcu/srcutree.c:1554 [inline]
#2: ffffffff91d5d7c8 (&ssp->srcu_cb_mutex){+.+.}-{3:3}, at: process_srcu+0x22a/0x1300 kernel/rcu/srcutree.c:1650
#3: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#3: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#3: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: __queue_work+0xe5/0xf90 kernel/workqueue.c:1443
#4: ffff8880b983a258 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x58c/0xf90
#5: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#5: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#5: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2272 [inline]
#5: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run1+0xec/0x3d0 kernel/trace/bpf_trace.c:2311
the dependencies between HARDIRQ-irq-safe lock and the holding lock:
-> (&pool->lock){-.-.}-{2:2} {
IN-HARDIRQ-W at:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
__queue_work+0x58c/0xf90
queue_work_on+0x14b/0x250 kernel/workqueue.c:1548
hrtimer_switch_to_hres kernel/time/hrtimer.c:747 [inline]
hrtimer_run_queues+0x14b/0x450 kernel/time/hrtimer.c:1912
run_local_timers kernel/time/timer.c:1845 [inline]
update_process_times+0x7b/0x1b0 kernel/time/timer.c:1868
tick_periodic+0x197/0x210 kernel/time/tick-common.c:100
tick_handle_periodic+0x46/0x150 kernel/time/tick-common.c:112
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
__sysvec_apic_timer_interrupt+0x156/0x580 arch/x86/kernel/apic/apic.c:1112
sysvec_apic_timer_interrupt+0x8c/0xb0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
kasan_mem_to_shadow include/linux/kasan.h:59 [inline]
memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
memory_is_poisoned mm/kasan/generic.c:159 [inline]
check_region_inline mm/kasan/generic.c:180 [inline]
kasan_check_range+0x33/0x290 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:72 [inline]
atomic_long_read include/linux/atomic/atomic-instrumented.h:1265 [inline]
rwsem_owner_flags kernel/locking/rwsem.c:287 [inline]
rwsem_spin_on_owner+0x1f8/0x2e0 kernel/locking/rwsem.c:772
rwsem_optimistic_spin kernel/locking/rwsem.c:846 [inline]
rwsem_down_write_slowpath+0x2ab/0x14b0 kernel/locking/rwsem.c:1121
early_event_add_tracer+0x4a/0x70 kernel/trace/trace_events.c:3679
event_trace_init+0xe3/0x160 kernel/trace/trace_events.c:3837
tracer_init_tracefs_work_func+0xd/0x13b kernel/trace/trace.c:9949
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
IN-SOFTIRQ-W at:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
__queue_work+0x58c/0xf90
call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1504
expire_timers kernel/time/timer.c:1544 [inline]
__run_timers+0x6a8/0x890 kernel/time/timer.c:1820
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
__do_softirq+0x2e9/0xa4c kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
update_event_printk kernel/trace/trace_events.c:2643 [inline]
trace_event_eval_update+0x3ed/0xfc0 kernel/trace/trace_events.c:2788
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
INITIAL USE at:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
pwq_adjust_max_active+0x14e/0x550 kernel/workqueue.c:3765
link_pwq kernel/workqueue.c:3831 [inline]
alloc_and_link_pwqs kernel/workqueue.c:4227 [inline]
alloc_workqueue+0xbf8/0x1440 kernel/workqueue.c:4349
workqueue_init_early+0x71a/0x927 kernel/workqueue.c:6055
start_kernel+0x208/0x53f init/main.c:1030
secondary_startup_64_no_verify+0xcf/0xdb
}
... key at: [<ffffffff8fea1ce0>] init_worker_pool.__key+0x0/0x20
the dependencies between the lock to be acquired
and HARDIRQ-irq-unsafe lock:
-> (&htab->buckets[i].lock){+...}-{2:2} {
HARDIRQ-ON-W at:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_free+0x160/0x820 net/core/sock_map.c:1149
map_create+0x97a/0xd20 kernel/bpf/syscall.c:1213
__sys_bpf+0x2d3/0x6c0 kernel/bpf/syscall.c:4987
__do_sys_bpf kernel/bpf/syscall.c:5109 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5107 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5107
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
INITIAL USE at:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_free+0x160/0x820 net/core/sock_map.c:1149
map_create+0x97a/0xd20 kernel/bpf/syscall.c:1213
__sys_bpf+0x2d3/0x6c0 kernel/bpf/syscall.c:4987
__do_sys_bpf kernel/bpf/syscall.c:5109 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5107 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5107
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
}
... key at: [<ffffffff920b1340>] sock_hash_alloc.__key+0x0/0x20
... acquired at:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:932
bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e
bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
__bpf_prog_run include/linux/filter.h:603 [inline]
bpf_prog_run include/linux/filter.h:610 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
bpf_trace_run1+0x1d9/0x3d0 kernel/trace/bpf_trace.c:2311
trace_workqueue_activate_work+0x1c0/0x250 include/trace/events/workqueue.h:59
__queue_work+0xa81/0xf90 kernel/workqueue.c:1509
queue_work_on+0x14b/0x250 kernel/workqueue.c:1548
srcu_queue_delayed_work_on kernel/rcu/srcutree.c:697 [inline]
srcu_schedule_cbs_sdp kernel/rcu/srcutree.c:710 [inline]
srcu_gp_end kernel/rcu/srcutree.c:777 [inline]
srcu_advance_state kernel/rcu/srcutree.c:1554 [inline]
process_srcu+0xe49/0x1300 kernel/rcu/srcutree.c:1650
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
stack backtrace:
CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.1.84-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: rcu_gp process_srcu
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_bad_irq_dependency kernel/locking/lockdep.c:2604 [inline]
check_irq_usage kernel/locking/lockdep.c:2843 [inline]
check_prev_add kernel/locking/lockdep.c:3094 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain+0x4d16/0x5950 kernel/locking/lockdep.c:3825
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:932
bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e
bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
__bpf_prog_run include/linux/filter.h:603 [inline]
bpf_prog_run include/linux/filter.h:610 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
bpf_trace_run1+0x1d9/0x3d0 kernel/trace/bpf_trace.c:2311
trace_workqueue_activate_work+0x1c0/0x250 include/trace/events/workqueue.h:59
__queue_work+0xa81/0xf90 kernel/workqueue.c:1509
queue_work_on+0x14b/0x250 kernel/workqueue.c:1548
srcu_queue_delayed_work_on kernel/rcu/srcutree.c:697 [inline]
srcu_schedule_cbs_sdp kernel/rcu/srcutree.c:710 [inline]
srcu_gp_end kernel/rcu/srcutree.c:777 [inline]
srcu_advance_state kernel/rcu/srcutree.c:1554 [inline]
process_srcu+0xe49/0x1300 kernel/rcu/srcutree.c:1650
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
</TASK>