============================================ WARNING: possible recursive locking detected 6.11.0-syzkaller-10572-gb836cbdf3b81 #0 Not tainted -------------------------------------------- syz.1.199/6111 is trying to acquire lock: ffffc900159150d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1ea/0x600 kernel/bpf/ringbuf.c:427 but task is already holding lock: ffffc9000d3a90d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1ea/0x600 kernel/bpf/ringbuf.c:427 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&rb->spinlock); lock(&rb->spinlock); *** DEADLOCK *** May be due to missing lock nesting notation 4 locks held by syz.1.199/6111: #0: ffff8880b873ea98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:593 #1: ffffffff8e937ee0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #1: ffffffff8e937ee0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8e937ee0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2317 [inline] #1: ffffffff8e937ee0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1fc/0x540 kernel/trace/bpf_trace.c:2359 #2: ffffc9000d3a90d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1ea/0x600 kernel/bpf/ringbuf.c:427 #3: ffffffff8e937ee0 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xbc/0x8a0 stack backtrace: CPU: 1 UID: 0 PID: 6111 Comm: syz.1.199 Not tainted 6.11.0-syzkaller-10572-gb836cbdf3b81 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3034 check_deadlock kernel/locking/lockdep.c:3086 [inline] validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3888 __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5199 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 __bpf_ringbuf_reserve+0x1ea/0x600 kernel/bpf/ringbuf.c:427 ____bpf_ringbuf_output kernel/bpf/ringbuf.c:553 [inline] bpf_ringbuf_output+0x67/0x1e0 kernel/bpf/ringbuf.c:543 bpf_prog_4aaef4562453526c+0x43/0x47 bpf_dispatcher_nop_func include/linux/bpf.h:1257 [inline] __bpf_prog_run include/linux/filter.h:701 [inline] bpf_prog_run include/linux/filter.h:708 [inline] bpf_prog_run_array include/linux/bpf.h:2123 [inline] trace_call_bpf+0x369/0x8a0 kernel/trace/bpf_trace.c:146 perf_trace_run_bpf_submit+0x82/0x180 kernel/events/core.c:10417 perf_trace_lock_acquire+0x3c3/0x4f0 include/trace/events/lock.h:24 trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x51b/0x550 kernel/locking/lockdep.c:5793 rcu_lock_acquire include/linux/rcupdate.h:337 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2317 [inline] bpf_trace_run2+0x219/0x540 kernel/trace/bpf_trace.c:2359 __traceiter_contention_end+0x7b/0xb0 include/trace/events/lock.h:122 trace_contention_end+0x114/0x140 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0xb7e/0xdb0 kernel/locking/qspinlock.c:557 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline] queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0xe1/0x120 kernel/locking/spinlock.c:162 __bpf_ringbuf_reserve+0x1ea/0x600 kernel/bpf/ringbuf.c:427 ____bpf_ringbuf_reserve kernel/bpf/ringbuf.c:478 [inline] bpf_ringbuf_reserve+0x5c/0x70 kernel/bpf/ringbuf.c:470 bpf_prog_f26e02557ca7a2ba+0x3a/0x7d bpf_dispatcher_nop_func include/linux/bpf.h:1257 [inline] __bpf_prog_run include/linux/filter.h:701 [inline] bpf_prog_run include/linux/filter.h:708 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2318 [inline] bpf_trace_run2+0x2ec/0x540 kernel/trace/bpf_trace.c:2359 trace_tlb_flush+0x118/0x140 include/trace/events/tlb.h:38 switch_mm_irqs_off+0x7b0/0xb00 context_switch kernel/sched/core.c:5299 [inline] __schedule+0x111b/0x4b30 kernel/sched/core.c:6675 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:6997 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:obj_cgroup_put include/linux/memcontrol.h:827 [inline] RIP: 0010:mod_objcg_state+0x5d9/0x930 mm/memcontrol.c:2743 Code: 3c 23 00 74 08 4c 89 f7 e8 44 ac f6 ff f6 84 24 81 00 00 00 02 0f 85 89 00 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 8b 7c 24 28 <48> 85 ff 74 05 e8 cd 8c 00 00 48 c7 44 24 60 0e 36 e0 45 48 8b 44 RSP: 0018:ffffc90003bb7840 EFLAGS: 00000206 RAX: d7af212c25060900 RBX: 1ffff92000776f18 RCX: ffffffff9a3bf903 RDX: dffffc0000000000 RSI: ffffffff8c0aca40 RDI: 0000000000000000 RBP: ffffc90003bb7948 R08: ffffffff901ce56f R09: 1ffffffff2039cad R10: dffffc0000000000 R11: fffffbfff2039cae R12: dffffc0000000000 R13: 0000000000000058 R14: ffffc90003bb78c0 R15: 0000000000000246 __memcg_slab_free_hook+0x9f/0x310 mm/memcontrol.c:3011 memcg_slab_free_hook mm/slub.c:2183 [inline] slab_free mm/slub.c:4577 [inline] kfree+0x23d/0x440 mm/slub.c:4728 __free_fdtable fs/file.c:36 [inline] put_files_struct+0x2b8/0x360 fs/file.c:452 do_exit+0xa10/0x28e0 kernel/exit.c:934 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 get_signal+0x176f/0x1810 kernel/signal.c:2936 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f09aa57dff9 Code: Unable to access opcode bytes at 0x7f09aa57dfcf. RSP: 002b:00007f09a9fff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: 000000000000000d RBX: 00007f09aa735f80 RCX: 00007f09aa57dff9 RDX: 0000000000000010 RSI: 00000000200000c0 RDI: 0000000000000011 RBP: 00007f09aa5f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f09aa735f80 R15: 00007fffbf61bda8 ---------------- Code disassembly (best guess): 0: 3c 23 cmp $0x23,%al 2: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1) 6: 89 f7 mov %esi,%edi 8: e8 44 ac f6 ff call 0xfff6ac51 d: f6 84 24 81 00 00 00 testb $0x2,0x81(%rsp) 14: 02 15: 0f 85 89 00 00 00 jne 0xa4 1b: 41 f7 c7 00 02 00 00 test $0x200,%r15d 22: 74 01 je 0x25 24: fb sti 25: 48 8b 7c 24 28 mov 0x28(%rsp),%rdi * 2a: 48 85 ff test %rdi,%rdi <-- trapping instruction 2d: 74 05 je 0x34 2f: e8 cd 8c 00 00 call 0x8d01 34: 48 c7 44 24 60 0e 36 movq $0x45e0360e,0x60(%rsp) 3b: e0 45 3d: 48 rex.W 3e: 8b .byte 0x8b 3f: 44 rex.R