========================================================
WARNING: possible irq lock inversion dependency detected
5.15.167-syzkaller #0 Not tainted
--------------------------------------------------------
ksoftirqd/1/20 just changed the state of lock:
ffff0000ed1a7a40 (&pch->upl){+..-}-{2:2}, at: ppp_input+0x344/0x840 drivers/net/ppp/ppp_generic.c:2306
but this lock took another, SOFTIRQ-unsafe lock in the past:
 (&pch->downl){+.+.}-{2:2}


and interrupts could create inverse lock ordering between them.


other info that might help us debug this:
Chain exists of:
  &pch->upl --> &ppp->wlock --> &pch->downl

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&pch->downl);
                               local_irq_disable();
                               lock(&pch->upl);
                               lock(&ppp->wlock);
  <Interrupt>
    lock(&pch->upl);

 *** DEADLOCK ***

no locks held by ksoftirqd/1/20.

the shortest dependencies between 2nd lock and 1st lock:
  -> (&pch->downl){+.+.}-{2:2} {
     HARDIRQ-ON-W at:
                        lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
                        __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                        _raw_spin_lock_bh+0x124/0x1c4 kernel/locking/spinlock.c:178
                        spin_lock_bh include/linux/spinlock.h:368 [inline]
                        ppp_unregister_channel+0x78/0x2c0 drivers/net/ppp/ppp_generic.c:2991
                        pppox_unbind_sock+0x68/0xbc drivers/net/ppp/pppox.c:58
                        pppoe_release+0x138/0x740 drivers/net/ppp/pppoe.c:584
                        __sock_release net/socket.c:649 [inline]
                        sock_close+0xb8/0x1fc net/socket.c:1336
                        __fput+0x1c4/0x800 fs/file_table.c:280
                        ____fput+0x20/0x30 fs/file_table.c:308
                        task_work_run+0x130/0x1e4 kernel/task_work.c:188
                        exit_task_work include/linux/task_work.h:33 [inline]
                        do_exit+0x670/0x20bc kernel/exit.c:874
                        do_group_exit+0x110/0x268 kernel/exit.c:996
                        get_signal+0x634/0x1550 kernel/signal.c:2897
                        do_signal arch/arm64/kernel/signal.c:890 [inline]
                        do_notify_resume+0x3d0/0x32b8 arch/arm64/kernel/signal.c:943
                        prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
                        exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
                        el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609
                        el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
                        el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
     SOFTIRQ-ON-W at:
                        lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
                        __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                        _raw_spin_lock+0xb0/0x10c kernel/locking/spinlock.c:154
                        spin_lock include/linux/spinlock.h:363 [inline]
                        ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2271 [inline]
                        ppp_input+0x168/0x840 drivers/net/ppp/ppp_generic.c:2303
                        pppoe_rcv_core+0xf8/0x330 drivers/net/ppp/pppoe.c:379
                        sk_backlog_rcv include/net/sock.h:1059 [inline]
                        __release_sock+0x1a8/0x408 net/core/sock.c:2724
                        release_sock+0x68/0x270 net/core/sock.c:3265
                        pppoe_sendmsg+0xc8/0x5d0 drivers/net/ppp/pppoe.c:903
                        sock_sendmsg_nosec net/socket.c:704 [inline]
                        __sock_sendmsg net/socket.c:716 [inline]
                        ____sys_sendmsg+0x584/0x870 net/socket.c:2431
                        ___sys_sendmsg+0x214/0x294 net/socket.c:2485
                        __sys_sendmmsg+0x23c/0x648 net/socket.c:2571
                        __do_sys_sendmmsg net/socket.c:2600 [inline]
                        __se_sys_sendmmsg net/socket.c:2597 [inline]
                        __arm64_sys_sendmmsg+0xa0/0xbc net/socket.c:2597
                        __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
                        invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
                        el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
                        do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
                        el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
                        el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
                        el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
     INITIAL USE at:
                       lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
                       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                       _raw_spin_lock_bh+0x124/0x1c4 kernel/locking/spinlock.c:178
                       spin_lock_bh include/linux/spinlock.h:368 [inline]
                       ppp_unregister_channel+0x78/0x2c0 drivers/net/ppp/ppp_generic.c:2991
                       pppox_unbind_sock+0x68/0xbc drivers/net/ppp/pppox.c:58
                       pppoe_release+0x138/0x740 drivers/net/ppp/pppoe.c:584
                       __sock_release net/socket.c:649 [inline]
                       sock_close+0xb8/0x1fc net/socket.c:1336
                       __fput+0x1c4/0x800 fs/file_table.c:280
                       ____fput+0x20/0x30 fs/file_table.c:308
                       task_work_run+0x130/0x1e4 kernel/task_work.c:188
                       exit_task_work include/linux/task_work.h:33 [inline]
                       do_exit+0x670/0x20bc kernel/exit.c:874
                       do_group_exit+0x110/0x268 kernel/exit.c:996
                       get_signal+0x634/0x1550 kernel/signal.c:2897
                       do_signal arch/arm64/kernel/signal.c:890 [inline]
                       do_notify_resume+0x3d0/0x32b8 arch/arm64/kernel/signal.c:943
                       prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
                       exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
                       el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609
                       el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
                       el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
   }
   ... key      at: [<ffff80001ba8ffc0>] ppp_register_net_channel.__key.1+0x0/0x20
   ... acquired at:
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0xb0/0x10c kernel/locking/spinlock.c:154
   spin_lock include/linux/spinlock.h:363 [inline]
   ppp_push+0xb4/0x105c drivers/net/ppp/ppp_generic.c:1895
   ppp_send_frame drivers/net/ppp/ppp_generic.c:1860 [inline]
   __ppp_xmit_process+0x864/0x14e0 drivers/net/ppp/ppp_generic.c:1660
   ppp_xmit_process+0x13c/0x2cc drivers/net/ppp/ppp_generic.c:1681
   ppp_write+0x328/0x454 drivers/net/ppp/ppp_generic.c:533
   do_iter_write+0x33c/0x66c fs/read_write.c:857
   vfs_writev fs/read_write.c:928 [inline]
   do_pwritev+0x1ec/0x334 fs/read_write.c:1025
   __do_sys_pwritev fs/read_write.c:1072 [inline]
   __se_sys_pwritev fs/read_write.c:1067 [inline]
   __arm64_sys_pwritev+0xa0/0xb8 fs/read_write.c:1067
   __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
   invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
   el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
   do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
   el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
   el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
   el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

 -> (&ppp->wlock){+...}-{2:2} {
    HARDIRQ-ON-W at:
                      lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
                      __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                      _raw_spin_lock_bh+0x124/0x1c4 kernel/locking/spinlock.c:178
                      spin_lock_bh include/linux/spinlock.h:368 [inline]
                      ppp_get_stats64+0xbc/0x268 drivers/net/ppp/ppp_generic.c:1538
                      dev_get_stats+0x9c/0x1e0 net/core/dev.c:10704
                      rtnl_fill_stats+0x50/0x7c0 net/core/rtnetlink.c:1205
                      rtnl_fill_ifinfo+0x125c/0x1970 net/core/rtnetlink.c:1782
                      rtmsg_ifinfo_build_skb+0xf8/0x1b4 net/core/rtnetlink.c:3856
                      rtmsg_ifinfo_event net/core/rtnetlink.c:3888 [inline]
                      rtmsg_ifinfo+0x8c/0x128 net/core/rtnetlink.c:3897
                      register_netdevice+0xff8/0x12d4 net/core/dev.c:10402
                      ppp_unit_register drivers/net/ppp/ppp_generic.c:1216 [inline]
                      ppp_dev_configure+0x720/0x9e0 drivers/net/ppp/ppp_generic.c:1272
                      ppp_create_interface drivers/net/ppp/ppp_generic.c:3347 [inline]
                      ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1057 [inline]
                      ppp_ioctl+0xa88/0x2870 drivers/net/ppp/ppp_generic.c:730
                      vfs_ioctl fs/ioctl.c:51 [inline]
                      __do_sys_ioctl fs/ioctl.c:874 [inline]
                      __se_sys_ioctl fs/ioctl.c:860 [inline]
                      __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
                      __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
                      invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
                      el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
                      do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
                      el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
                      el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
                      el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
    INITIAL USE at:
                     lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
                     __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
                     _raw_spin_lock_bh+0x124/0x1c4 kernel/locking/spinlock.c:178
                     spin_lock_bh include/linux/spinlock.h:368 [inline]
                     ppp_get_stats64+0xbc/0x268 drivers/net/ppp/ppp_generic.c:1538
                     dev_get_stats+0x9c/0x1e0 net/core/dev.c:10704
                     rtnl_fill_stats+0x50/0x7c0 net/core/rtnetlink.c:1205
                     rtnl_fill_ifinfo+0x125c/0x1970 net/core/rtnetlink.c:1782
                     rtmsg_ifinfo_build_skb+0xf8/0x1b4 net/core/rtnetlink.c:3856
                     rtmsg_ifinfo_event net/core/rtnetlink.c:3888 [inline]
                     rtmsg_ifinfo+0x8c/0x128 net/core/rtnetlink.c:3897
                     register_netdevice+0xff8/0x12d4 net/core/dev.c:10402
                     ppp_unit_register drivers/net/ppp/ppp_generic.c:1216 [inline]
                     ppp_dev_configure+0x720/0x9e0 drivers/net/ppp/ppp_generic.c:1272
                     ppp_create_interface drivers/net/ppp/ppp_generic.c:3347 [inline]
                     ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1057 [inline]
                     ppp_ioctl+0xa88/0x2870 drivers/net/ppp/ppp_generic.c:730
                     vfs_ioctl fs/ioctl.c:51 [inline]
                     __do_sys_ioctl fs/ioctl.c:874 [inline]
                     __se_sys_ioctl fs/ioctl.c:860 [inline]
                     __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
                     __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
                     invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
                     el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
                     do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
                     el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
                     el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
                     el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
  }
  ... key      at: [<ffff80001ba90140>] ppp_dev_configure.__key.67+0x0/0x20
  ... acquired at:
   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
   _raw_spin_lock_bh+0x124/0x1c4 kernel/locking/spinlock.c:178
   spin_lock_bh include/linux/spinlock.h:368 [inline]
   ppp_connect_channel+0x148/0x580 drivers/net/ppp/ppp_generic.c:3483
   ppp_ioctl+0x1450/0x2870 drivers/net/ppp/ppp_generic.c:758
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:874 [inline]
   __se_sys_ioctl fs/ioctl.c:860 [inline]
   __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
   __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
   invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
   el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
   do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
   el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
   el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
   el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

-> (&pch->upl){+..-}-{2:2} {
   HARDIRQ-ON-W at:
                    lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
                    __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
                    _raw_write_lock_bh+0x124/0x1c4 kernel/locking/spinlock.c:324
                    ppp_disconnect_channel+0x3c/0x2ac drivers/net/ppp/ppp_generic.c:3521
                    ppp_unregister_channel+0xa8/0x2c0 drivers/net/ppp/ppp_generic.c:2995
                    pppox_unbind_sock+0x68/0xbc drivers/net/ppp/pppox.c:58
                    pppoe_release+0x138/0x740 drivers/net/ppp/pppoe.c:584
                    __sock_release net/socket.c:649 [inline]
                    sock_close+0xb8/0x1fc net/socket.c:1336
                    __fput+0x1c4/0x800 fs/file_table.c:280
                    ____fput+0x20/0x30 fs/file_table.c:308
                    task_work_run+0x130/0x1e4 kernel/task_work.c:188
                    exit_task_work include/linux/task_work.h:33 [inline]
                    do_exit+0x670/0x20bc kernel/exit.c:874
                    do_group_exit+0x110/0x268 kernel/exit.c:996
                    get_signal+0x634/0x1550 kernel/signal.c:2897
                    do_signal arch/arm64/kernel/signal.c:890 [inline]
                    do_notify_resume+0x3d0/0x32b8 arch/arm64/kernel/signal.c:943
                    prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
                    exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
                    el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609
                    el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
                    el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
   IN-SOFTIRQ-R at:
                    lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
                    __raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
                    _raw_read_lock_bh+0x154/0x224 kernel/locking/spinlock.c:252
                    ppp_input+0x344/0x840 drivers/net/ppp/ppp_generic.c:2306
                    ppp_async_process+0x98/0x150 drivers/net/ppp/ppp_async.c:505
                    tasklet_action_common+0x364/0x404
                    tasklet_action+0x60/0x84 kernel/softirq.c:809
                    handle_softirqs+0x384/0xdbc kernel/softirq.c:558
                    run_ksoftirqd+0x6c/0x29c kernel/softirq.c:925
                    smpboot_thread_fn+0x4b0/0x920 kernel/smpboot.c:164
                    kthread+0x37c/0x45c kernel/kthread.c:334
                    ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
   INITIAL USE at:
                   lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
                   __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
                   _raw_write_lock_bh+0x124/0x1c4 kernel/locking/spinlock.c:324
                   ppp_disconnect_channel+0x3c/0x2ac drivers/net/ppp/ppp_generic.c:3521
                   ppp_unregister_channel+0xa8/0x2c0 drivers/net/ppp/ppp_generic.c:2995
                   pppox_unbind_sock+0x68/0xbc drivers/net/ppp/pppox.c:58
                   pppoe_release+0x138/0x740 drivers/net/ppp/pppoe.c:584
                   __sock_release net/socket.c:649 [inline]
                   sock_close+0xb8/0x1fc net/socket.c:1336
                   __fput+0x1c4/0x800 fs/file_table.c:280
                   ____fput+0x20/0x30 fs/file_table.c:308
                   task_work_run+0x130/0x1e4 kernel/task_work.c:188
                   exit_task_work include/linux/task_work.h:33 [inline]
                   do_exit+0x670/0x20bc kernel/exit.c:874
                   do_group_exit+0x110/0x268 kernel/exit.c:996
                   get_signal+0x634/0x1550 kernel/signal.c:2897
                   do_signal arch/arm64/kernel/signal.c:890 [inline]
                   do_notify_resume+0x3d0/0x32b8 arch/arm64/kernel/signal.c:943
                   prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
                   exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
                   el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609
                   el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
                   el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
 }
 ... key      at: [<ffff80001ba8ffe0>] ppp_register_net_channel.__key.3+0x0/0x20
 ... acquired at:
   mark_lock+0x258/0x360 kernel/locking/lockdep.c:4591
   __lock_acquire+0xb84/0x7638 kernel/locking/lockdep.c:4966
   lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
   __raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
   _raw_read_lock_bh+0x154/0x224 kernel/locking/spinlock.c:252
   ppp_input+0x344/0x840 drivers/net/ppp/ppp_generic.c:2306
   ppp_async_process+0x98/0x150 drivers/net/ppp/ppp_async.c:505
   tasklet_action_common+0x364/0x404
   tasklet_action+0x60/0x84 kernel/softirq.c:809
   handle_softirqs+0x384/0xdbc kernel/softirq.c:558
   run_ksoftirqd+0x6c/0x29c kernel/softirq.c:925
   smpboot_thread_fn+0x4b0/0x920 kernel/smpboot.c:164
   kthread+0x37c/0x45c kernel/kthread.c:334
   ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870


stack backtrace:
CPU: 1 PID: 20 Comm: ksoftirqd/1 Not tainted 5.15.167-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 print_irq_inversion_bug+0x330/0x388 kernel/locking/lockdep.c:3999
 mark_lock_irq+0x8b0/0xd2c
 mark_lock+0x258/0x360 kernel/locking/lockdep.c:4591
 __lock_acquire+0xb84/0x7638 kernel/locking/lockdep.c:4966
 lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
 __raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline]
 _raw_read_lock_bh+0x154/0x224 kernel/locking/spinlock.c:252
 ppp_input+0x344/0x840 drivers/net/ppp/ppp_generic.c:2306
 ppp_async_process+0x98/0x150 drivers/net/ppp/ppp_async.c:505
 tasklet_action_common+0x364/0x404
 tasklet_action+0x60/0x84 kernel/softirq.c:809
 handle_softirqs+0x384/0xdbc kernel/softirq.c:558
 run_ksoftirqd+0x6c/0x29c kernel/softirq.c:925
 smpboot_thread_fn+0x4b0/0x920 kernel/smpboot.c:164
 kthread+0x37c/0x45c kernel/kthread.c:334
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
vkms_vblank_simulate: vblank timer overrun