------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
6.9.0-rc1-syzkaller-00061-g8d025e2092e2 #0 Not tainted
------------------------------------------------------
syz-executor.3/5210 is trying to acquire lock:
ffffffff8d7a29b8 ((console_sem).lock){-.-.}-{2:2}, at: down_trylock+0x12/0x70 kernel/locking/semaphore.c:139
but task is already holding lock:
ffff88802c42a858 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x5d/0x220 kernel/time/timer.c:1052
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&base->lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
lock_timer_base+0x5d/0x220 kernel/time/timer.c:1052
__mod_timer+0x426/0xdc0 kernel/time/timer.c:1133
add_timer_global+0x8a/0xc0 kernel/time/timer.c:1331
__queue_delayed_work+0x1ba/0x2e0 kernel/workqueue.c:2567
queue_delayed_work_on+0x10e/0x130 kernel/workqueue.c:2595
psi_task_change+0x1b4/0x2e0 kernel/sched/psi.c:912
psi_enqueue kernel/sched/stats.h:139 [inline]
enqueue_task kernel/sched/core.c:2112 [inline]
activate_task+0x213/0x400 kernel/sched/core.c:2146
wake_up_new_task+0x574/0xc90 kernel/sched/core.c:4901
kernel_clone+0x236/0x980 kernel/fork.c:2827
user_mode_thread+0xb4/0xf0 kernel/fork.c:2874
rest_init+0x23/0x2b0 init/main.c:697
start_kernel+0x3a3/0x490 init/main.c:1074
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #2 (&rq->__lock){-.-.}-{2:2}:
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:559
raw_spin_rq_lock kernel/sched/sched.h:1385 [inline]
rq_lock kernel/sched/sched.h:1699 [inline]
task_fork_fair+0x70/0x240 kernel/sched/fair.c:12635
sched_cgroup_fork+0x3cf/0x510 kernel/sched/core.c:4845
copy_process+0x450e/0x6f00 kernel/fork.c:2498
kernel_clone+0xfd/0x980 kernel/fork.c:2796
user_mode_thread+0xb4/0xf0 kernel/fork.c:2874
rest_init+0x23/0x2b0 init/main.c:697
start_kernel+0x3a3/0x490 init/main.c:1074
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #1 (&p->pi_lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline]
try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4262
up+0x79/0xb0 kernel/locking/semaphore.c:191
__up_console_sem kernel/printk/printk.c:340 [inline]
__console_unlock kernel/printk/printk.c:2731 [inline]
console_unlock+0x23e/0x290 kernel/printk/printk.c:3050
vga_remove_vgacon drivers/pci/vgaarb.c:186 [inline]
vga_remove_vgacon+0x90/0xd0 drivers/pci/vgaarb.c:167
__aperture_remove_legacy_vga_devices drivers/video/aperture.c:331 [inline]
aperture_remove_conflicting_pci_devices+0x17f/0x210 drivers/video/aperture.c:374
bochs_pci_probe+0x101/0x1150 drivers/gpu/drm/tiny/bochs.c:651
local_pci_probe+0xde/0x1b0 drivers/pci/pci-driver.c:324
pci_call_probe drivers/pci/pci-driver.c:392 [inline]
__pci_device_probe drivers/pci/pci-driver.c:417 [inline]
pci_device_probe+0x29d/0x7b0 drivers/pci/pci-driver.c:451
call_driver_probe drivers/base/dd.c:578 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:656
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:798
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:828
__driver_attach+0x283/0x580 drivers/base/dd.c:1214
bus_for_each_dev+0x13c/0x1d0 drivers/base/bus.c:368
bus_add_driver+0x2ed/0x640 drivers/base/bus.c:673
driver_register+0x15c/0x4b0 drivers/base/driver.c:246
drm_pci_register_driver_if_modeset include/drm/drm_module.h:69 [inline]
bochs_pci_driver_init+0x67/0x80 drivers/gpu/drm/tiny/bochs.c:735
do_one_initcall+0x128/0x630 init/main.c:1238
do_initcall_level init/main.c:1300 [inline]
do_initcalls init/main.c:1316 [inline]
do_basic_setup init/main.c:1335 [inline]
kernel_init_freeable+0x660/0xc50 init/main.c:1548
kernel_init+0x1c/0x2b0 init/main.c:1437
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
-> #0 ((console_sem).lock){-.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5137
lock_acquire kernel/locking/lockdep.c:5754 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
down_trylock+0x12/0x70 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x40/0x140 kernel/printk/printk.c:323
console_trylock kernel/printk/printk.c:2684 [inline]
console_trylock_spinning kernel/printk/printk.c:1958 [inline]
vprintk_emit kernel/printk/printk.c:2347 [inline]
vprintk_emit+0xe4/0x5a0 kernel/printk/printk.c:2303
vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45
_printk+0xc8/0x100 kernel/printk/printk.c:2373
__report_bug lib/bug.c:195 [inline]
report_bug+0x4ac/0x580 lib/bug.c:219
handle_bug+0x3d/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x17/0x50 arch/x86/kernel/traps.c:260
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
__local_bh_enable_ip+0xc3/0x120 kernel/softirq.c:362
spin_unlock_bh include/linux/spinlock.h:396 [inline]
sock_hash_delete_elem+0x2b8/0x360 net/core/sock_map.c:947
bpf_prog_2c29ac5cdc6b1842+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:657 [inline]
bpf_prog_run include/linux/filter.h:664 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x151/0x420 kernel/trace/bpf_trace.c:2420
trace_timer_start include/trace/events/timer.h:52 [inline]
enqueue_timer+0x2b4/0x550 kernel/time/timer.c:664
__mod_timer+0xada/0xdc0 kernel/time/timer.c:1182
sk_reset_timer+0x21/0xc0 net/core/sock.c:3420
tcp_send_delayed_ack+0x135/0x460 net/ipv4/tcp_output.c:4190
__tcp_ack_snd_check+0xb1c/0xc30 net/ipv4/tcp_input.c:5692
tcp_ack_snd_check net/ipv4/tcp_input.c:5733 [inline]
tcp_ack_snd_check net/ipv4/tcp_input.c:5727 [inline]
tcp_rcv_established+0x9d4/0x21b0 net/ipv4/tcp_input.c:6173
tcp_v4_do_rcv+0x6a9/0xa50 net/ipv4/tcp_ipv4.c:1906
tcp_v4_rcv+0x338b/0x3b40 net/ipv4/tcp_ipv4.c:2332
ip_protocol_deliver_rcu+0xba/0x4e0 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
dst_input include/net/dst.h:460 [inline]
ip_sublist_rcv_finish+0x2c1/0x620 net/ipv4/ip_input.c:580
ip_list_rcv_finish.constprop.0+0x559/0x720 net/ipv4/ip_input.c:631
ip_sublist_rcv net/ipv4/ip_input.c:639 [inline]
ip_list_rcv+0x339/0x450 net/ipv4/ip_input.c:674
__netif_receive_skb_list_ptype net/core/dev.c:5581 [inline]
__netif_receive_skb_list_core+0x755/0x950 net/core/dev.c:5629
__netif_receive_skb_list net/core/dev.c:5681 [inline]
netif_receive_skb_list_internal+0x753/0xda0 net/core/dev.c:5773
gro_normal_list include/net/gro.h:438 [inline]
gro_normal_list include/net/gro.h:434 [inline]
napi_complete_done+0x23f/0x9a0 net/core/dev.c:6113
e1000_clean+0x9c3/0x2840 drivers/net/ethernet/intel/e1000/e1000_main.c:3811
__napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6632
napi_poll net/core/dev.c:6701 [inline]
net_rx_action+0x9ad/0xf10 net/core/dev.c:6816
__do_softirq+0x218/0x922 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:633 [inline]
irq_exit_rcu+0xb9/0x120 kernel/softirq.c:645
common_interrupt+0xb0/0xd0 arch/x86/kernel/irq.c:247
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
kasan_check_range+0x158/0x1a0 mm/kasan/generic.c:190
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_long_try_cmpxchg_release include/linux/atomic/atomic-instrumented.h:4479 [inline]
__mutex_unlock_slowpath+0x155/0x650 kernel/locking/mutex.c:929
get_info+0x46a/0x750 net/ipv4/netfilter/ip_tables.c:991
do_ipt_get_ctl+0x16a/0xaa0 net/ipv4/netfilter/ip_tables.c:1651
nf_getsockopt+0x79/0xe0 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x18e/0x1e0 net/ipv4/ip_sockglue.c:1777
tcp_getsockopt+0x9e/0x100 net/ipv4/tcp.c:4373
do_sock_getsockopt+0x2e5/0x7c0 net/socket.c:2373
__sys_getsockopt+0x1a1/0x270 net/socket.c:2402
__do_compat_sys_socketcall+0x42b/0x700 net/compat.c:494
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x7a/0x120 arch/x86/entry/common.c:321
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:346
entry_SYSENTER_compat_after_hwframe+0x7a/0x84
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> &rq->__lock --> &base->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&base->lock);
lock(&rq->__lock);
lock(&base->lock);
lock((console_sem).lock);
*** DEADLOCK ***
6 locks held by syz-executor.3/5210:
#0: ffff88801bd5a3b8 (&xt[i].compat_mutex){+.+.}-{3:3}, at: get_info+0x18c/0x750 net/ipv4/netfilter/ip_tables.c:961
#1: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#1: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#1: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_list_internal+0x359/0xda0 net/core/dev.c:5758
#2: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#2: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#2: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: ip_local_deliver_finish+0x263/0x570 net/ipv4/ip_input.c:232
#3: ffff88802963a698 (slock-AF_INET/1){+.-.}-{2:2}, at: tcp_v4_rcv+0x30ee/0x3b40 net/ipv4/tcp_ipv4.c:2328
#4: ffff88802c42a858 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x5d/0x220 kernel/time/timer.c:1052
#5: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#5: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#5: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline]
#5: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xe4/0x420 kernel/trace/bpf_trace.c:2420
stack backtrace:
CPU: 2 PID: 5210 Comm: syz-executor.3 Not tainted 6.9.0-rc1-syzkaller-00061-g8d025e2092e2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5137
lock_acquire kernel/locking/lockdep.c:5754 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
down_trylock+0x12/0x70 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x40/0x140 kernel/printk/printk.c:323
console_trylock kernel/printk/printk.c:2684 [inline]
console_trylock_spinning kernel/printk/printk.c:1958 [inline]
vprintk_emit kernel/printk/printk.c:2347 [inline]
vprintk_emit+0xe4/0x5a0 kernel/printk/printk.c:2303
vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45
_printk+0xc8/0x100 kernel/printk/printk.c:2373
__report_bug lib/bug.c:195 [inline]
report_bug+0x4ac/0x580 lib/bug.c:219
handle_bug+0x3d/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x17/0x50 arch/x86/kernel/traps.c:260
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
RIP: 0010:__local_bh_enable_ip+0xc3/0x120 kernel/softirq.c:362
Code: 00 e8 21 56 0b 00 e8 dc 54 42 00 fb 65 8b 05 1c 01 b1 7e 85 c0 74 52 5b 5d c3 cc cc cc cc 65 8b 05 9e b1 af 7e 85 c0 75 9e 90 <0f> 0b 90 eb 98 e8 e3 52 42 00 eb 99 48 89 ef e8 09 cf 19 00 eb a2
RSP: 0018:ffffc90000530078 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000201 RCX: 1ffffffff1f3f383
RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff88ce5318
RBP: ffffffff88ce5318 R08: 0000000000000000 R09: ffffed100b481401
R10: ffff88805a40a00b R11: 0000000000000446 R12: dffffc0000000000
R13: ffff8880533f0400 R14: 0000000000000000 R15: 0000000000000004
spin_unlock_bh include/linux/spinlock.h:396 [inline]
sock_hash_delete_elem+0x2b8/0x360 net/core/sock_map.c:947
bpf_prog_2c29ac5cdc6b1842+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:657 [inline]
bpf_prog_run include/linux/filter.h:664 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x151/0x420 kernel/trace/bpf_trace.c:2420
trace_timer_start include/trace/events/timer.h:52 [inline]
enqueue_timer+0x2b4/0x550 kernel/time/timer.c:664
__mod_timer+0xada/0xdc0 kernel/time/timer.c:1182
sk_reset_timer+0x21/0xc0 net/core/sock.c:3420
tcp_send_delayed_ack+0x135/0x460 net/ipv4/tcp_output.c:4190
__tcp_ack_snd_check+0xb1c/0xc30 net/ipv4/tcp_input.c:5692
tcp_ack_snd_check net/ipv4/tcp_input.c:5733 [inline]
tcp_ack_snd_check net/ipv4/tcp_input.c:5727 [inline]
tcp_rcv_established+0x9d4/0x21b0 net/ipv4/tcp_input.c:6173
tcp_v4_do_rcv+0x6a9/0xa50 net/ipv4/tcp_ipv4.c:1906
tcp_v4_rcv+0x338b/0x3b40 net/ipv4/tcp_ipv4.c:2332
ip_protocol_deliver_rcu+0xba/0x4e0 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
dst_input include/net/dst.h:460 [inline]
ip_sublist_rcv_finish+0x2c1/0x620 net/ipv4/ip_input.c:580
ip_list_rcv_finish.constprop.0+0x559/0x720 net/ipv4/ip_input.c:631
ip_sublist_rcv net/ipv4/ip_input.c:639 [inline]
ip_list_rcv+0x339/0x450 net/ipv4/ip_input.c:674
__netif_receive_skb_list_ptype net/core/dev.c:5581 [inline]
__netif_receive_skb_list_core+0x755/0x950 net/core/dev.c:5629
__netif_receive_skb_list net/core/dev.c:5681 [inline]
netif_receive_skb_list_internal+0x753/0xda0 net/core/dev.c:5773
gro_normal_list include/net/gro.h:438 [inline]
gro_normal_list include/net/gro.h:434 [inline]
napi_complete_done+0x23f/0x9a0 net/core/dev.c:6113
e1000_clean+0x9c3/0x2840 drivers/net/ethernet/intel/e1000/e1000_main.c:3811
__napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6632
napi_poll net/core/dev.c:6701 [inline]
net_rx_action+0x9ad/0xf10 net/core/dev.c:6816
__do_softirq+0x218/0x922 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:633 [inline]
irq_exit_rcu+0xb9/0x120 kernel/softirq.c:645
common_interrupt+0xb0/0xd0 arch/x86/kernel/irq.c:247
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:kasan_check_range+0x158/0x1a0 mm/kasan/generic.c:190
Code: 74 11 80 38 00 74 ef 4d 8d 1c 2c 48 85 c0 48 89 c2 75 93 48 89 da 4c 89 d8 4c 29 da e9 2c ff ff ff 5b b8 01 00 00 00 5d 41 5c cc cc cc cc b8 01 00 00 00 c3 cc cc cc cc 48 29 c3 48 89 da 49
RSP: 0018:ffffc90003c076c8 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff88801bd5a2a0 RCX: ffffffff8ad72e85
RDX: ffffed10037ab455 RSI: 0000000000000008 RDI: ffff88801bd5a2a0
RBP: 1ffff92000780edf R08: 0000000000000001 R09: ffffed10037ab454
R10: ffff88801bd5a2a7 R11: 0000000000000000 R12: 0000000000000003
R13: fffffbfff28cdd54 R14: ffffffff9466eaa0 R15: ffffc90003c07758
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_long_try_cmpxchg_release include/linux/atomic/atomic-instrumented.h:4479 [inline]
__mutex_unlock_slowpath+0x155/0x650 kernel/locking/mutex.c:929
get_info+0x46a/0x750 net/ipv4/netfilter/ip_tables.c:991
do_ipt_get_ctl+0x16a/0xaa0 net/ipv4/netfilter/ip_tables.c:1651
nf_getsockopt+0x79/0xe0 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x18e/0x1e0 net/ipv4/ip_sockglue.c:1777
tcp_getsockopt+0x9e/0x100 net/ipv4/tcp.c:4373
do_sock_getsockopt+0x2e5/0x7c0 net/socket.c:2373
__sys_getsockopt+0x1a1/0x270 net/socket.c:2402
__do_compat_sys_socketcall+0x42b/0x700 net/compat.c:494
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x7a/0x120 arch/x86/entry/common.c:321
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:346
entry_SYSENTER_compat_after_hwframe+0x7a/0x84
RIP: 0023:0xf7278579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ff8b9ad0 EFLAGS: 00000282 ORIG_RAX: 0000000000000066
RAX: ffffffffffffffda RBX: 000000000000000f RCX: 00000000ff8b9b08
RDX: 00000000ff8b9b84 RSI: 00000000ff8b9b88 RDI: 00000000f73cfff4
RBP: 00000000f73d49c8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
WARNING: CPU: 2 PID: 5210 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120 kernel/softirq.c:362
Modules linked in:
CPU: 2 PID: 5210 Comm: syz-executor.3 Not tainted 6.9.0-rc1-syzkaller-00061-g8d025e2092e2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:__local_bh_enable_ip+0xc3/0x120 kernel/softirq.c:362
Code: 00 e8 21 56 0b 00 e8 dc 54 42 00 fb 65 8b 05 1c 01 b1 7e 85 c0 74 52 5b 5d c3 cc cc cc cc 65 8b 05 9e b1 af 7e 85 c0 75 9e 90 <0f> 0b 90 eb 98 e8 e3 52 42 00 eb 99 48 89 ef e8 09 cf 19 00 eb a2
RSP: 0018:ffffc90000530078 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000201 RCX: 1ffffffff1f3f383
RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff88ce5318
RBP: ffffffff88ce5318 R08: 0000000000000000 R09: ffffed100b481401
R10: ffff88805a40a00b R11: 0000000000000446 R12: dffffc0000000000
R13: ffff8880533f0400 R14: 0000000000000000 R15: 0000000000000004
FS: 0000000000000000(0000) GS:ffff88802c400000(0063) knlGS:0000000057b7b400
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f73d0170 CR3: 00000000459de000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
spin_unlock_bh include/linux/spinlock.h:396 [inline]
sock_hash_delete_elem+0x2b8/0x360 net/core/sock_map.c:947
bpf_prog_2c29ac5cdc6b1842+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:657 [inline]
bpf_prog_run include/linux/filter.h:664 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x151/0x420 kernel/trace/bpf_trace.c:2420
trace_timer_start include/trace/events/timer.h:52 [inline]
enqueue_timer+0x2b4/0x550 kernel/time/timer.c:664
__mod_timer+0xada/0xdc0 kernel/time/timer.c:1182
sk_reset_timer+0x21/0xc0 net/core/sock.c:3420
tcp_send_delayed_ack+0x135/0x460 net/ipv4/tcp_output.c:4190
__tcp_ack_snd_check+0xb1c/0xc30 net/ipv4/tcp_input.c:5692
tcp_ack_snd_check net/ipv4/tcp_input.c:5733 [inline]
tcp_ack_snd_check net/ipv4/tcp_input.c:5727 [inline]
tcp_rcv_established+0x9d4/0x21b0 net/ipv4/tcp_input.c:6173
tcp_v4_do_rcv+0x6a9/0xa50 net/ipv4/tcp_ipv4.c:1906
tcp_v4_rcv+0x338b/0x3b40 net/ipv4/tcp_ipv4.c:2332
ip_protocol_deliver_rcu+0xba/0x4e0 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
dst_input include/net/dst.h:460 [inline]
ip_sublist_rcv_finish+0x2c1/0x620 net/ipv4/ip_input.c:580
ip_list_rcv_finish.constprop.0+0x559/0x720 net/ipv4/ip_input.c:631
ip_sublist_rcv net/ipv4/ip_input.c:639 [inline]
ip_list_rcv+0x339/0x450 net/ipv4/ip_input.c:674
__netif_receive_skb_list_ptype net/core/dev.c:5581 [inline]
__netif_receive_skb_list_core+0x755/0x950 net/core/dev.c:5629
__netif_receive_skb_list net/core/dev.c:5681 [inline]
netif_receive_skb_list_internal+0x753/0xda0 net/core/dev.c:5773
gro_normal_list include/net/gro.h:438 [inline]
gro_normal_list include/net/gro.h:434 [inline]
napi_complete_done+0x23f/0x9a0 net/core/dev.c:6113
e1000_clean+0x9c3/0x2840 drivers/net/ethernet/intel/e1000/e1000_main.c:3811
__napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6632
napi_poll net/core/dev.c:6701 [inline]
net_rx_action+0x9ad/0xf10 net/core/dev.c:6816
__do_softirq+0x218/0x922 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:633 [inline]
irq_exit_rcu+0xb9/0x120 kernel/softirq.c:645
common_interrupt+0xb0/0xd0 arch/x86/kernel/irq.c:247
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:kasan_check_range+0x158/0x1a0 mm/kasan/generic.c:190
Code: 74 11 80 38 00 74 ef 4d 8d 1c 2c 48 85 c0 48 89 c2 75 93 48 89 da 4c 89 d8 4c 29 da e9 2c ff ff ff 5b b8 01 00 00 00 5d 41 5c cc cc cc cc b8 01 00 00 00 c3 cc cc cc cc 48 29 c3 48 89 da 49
RSP: 0018:ffffc90003c076c8 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff88801bd5a2a0 RCX: ffffffff8ad72e85
RDX: ffffed10037ab455 RSI: 0000000000000008 RDI: ffff88801bd5a2a0
RBP: 1ffff92000780edf R08: 0000000000000001 R09: ffffed10037ab454
R10: ffff88801bd5a2a7 R11: 0000000000000000 R12: 0000000000000003
R13: fffffbfff28cdd54 R14: ffffffff9466eaa0 R15: ffffc90003c07758
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_long_try_cmpxchg_release include/linux/atomic/atomic-instrumented.h:4479 [inline]
__mutex_unlock_slowpath+0x155/0x650 kernel/locking/mutex.c:929
get_info+0x46a/0x750 net/ipv4/netfilter/ip_tables.c:991
do_ipt_get_ctl+0x16a/0xaa0 net/ipv4/netfilter/ip_tables.c:1651
nf_getsockopt+0x79/0xe0 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x18e/0x1e0 net/ipv4/ip_sockglue.c:1777
tcp_getsockopt+0x9e/0x100 net/ipv4/tcp.c:4373
do_sock_getsockopt+0x2e5/0x7c0 net/socket.c:2373
__sys_getsockopt+0x1a1/0x270 net/socket.c:2402
----------------
Code disassembly (best guess):
0: 74 11 je 0x13
2: 80 38 00 cmpb $0x0,(%rax)
5: 74 ef je 0xfffffff6
7: 4d 8d 1c 2c lea (%r12,%rbp,1),%r11
b: 48 85 c0 test %rax,%rax
e: 48 89 c2 mov %rax,%rdx
11: 75 93 jne 0xffffffa6
13: 48 89 da mov %rbx,%rdx
16: 4c 89 d8 mov %r11,%rax
19: 4c 29 da sub %r11,%rdx
1c: e9 2c ff ff ff jmp 0xffffff4d
21: 5b pop %rbx
22: b8 01 00 00 00 mov $0x1,%eax
27: 5d pop %rbp
28: 41 5c pop %r12
* 2a: c3 ret <-- trapping instruction
2b: cc int3
2c: cc int3
2d: cc int3
2e: cc int3
2f: b8 01 00 00 00 mov $0x1,%eax
34: c3 ret
35: cc int3
36: cc int3
37: cc int3
38: cc int3
39: 48 29 c3 sub %rax,%rbx
3c: 48 89 da mov %rbx,%rdx
3f: 49 rex.WB