================================ WARNING: inconsistent lock state 6.1.94-syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. udevd/3003 [HC0[0]:SC1[1]:HE0:SE0] takes: ffff8880b9835e90 (lock#10){+.?.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] ffff8880b9835e90 (lock#10){+.?.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x84/0x670 mm/mmap_lock.c:237 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x9d/0x670 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_lock include/linux/mmap_lock.h:118 [inline] acct_collect+0x7d0/0x7f0 kernel/acct.c:564 do_exit+0x984/0x26a0 kernel/exit.c:848 do_group_exit+0x202/0x2b0 kernel/exit.c:1019 get_signal+0x16f7/0x17d0 kernel/signal.c:2862 arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 irq event stamp: 1635393 hardirqs last enabled at (1635392): [] handle_softirqs+0x1ef/0xa40 kernel/softirq.c:555 hardirqs last disabled at (1635393): [] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:117 [inline] hardirqs last disabled at (1635393): [] _raw_spin_lock_irq+0xa9/0x110 kernel/locking/spinlock.c:170 softirqs last enabled at (1634722): [] __do_softirq kernel/softirq.c:605 [inline] softirqs last enabled at (1634722): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last enabled at (1634722): [] __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654 softirqs last disabled at (1635391): [] __do_softirq kernel/softirq.c:605 [inline] softirqs last disabled at (1635391): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last disabled at (1635391): [] __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(lock#10); lock(lock#10); *** DEADLOCK *** 4 locks held by udevd/3003: #0: ffff888012473548 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_dop_revalidate+0xca/0x590 fs/kernfs/dir.c:1123 #1: ffff8880b9828358 (&base->lock){-.-.}-{2:2}, at: __run_timers+0x111/0x890 kernel/time/timer.c:1802 #2: ffffffff8d12acc0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #2: ffffffff8d12acc0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #2: ffffffff8d12acc0 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xbe/0x6a0 kernel/trace/bpf_trace.c:134 #3: ffff88807c929f58 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #3: ffff88807c929f58 (&mm->mmap_lock){++++}-{3:3}, at: stack_map_get_build_id_offset+0x232/0x9c0 kernel/bpf/stackmap.c:144 stack backtrace: CPU: 0 PID: 3003 Comm: udevd Not tainted 6.1.94-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 valid_state+0x136/0x1c0 kernel/locking/lockdep.c:3969 mark_lock_irq+0xa8/0xba0 kernel/locking/lockdep.c:4172 mark_lock+0x21c/0x340 kernel/locking/lockdep.c:4628 __lock_acquire+0xb7f/0x1f80 kernel/locking/lockdep.c:5003 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x9d/0x670 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:137 [inline] stack_map_get_build_id_offset+0x99e/0x9c0 kernel/bpf/stackmap.c:144 __bpf_get_stack+0x495/0x570 kernel/bpf/stackmap.c:452 bpf_prog_e6cf5f9c69743609+0x3a/0x3e bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline] __bpf_prog_run include/linux/filter.h:603 [inline] bpf_prog_run include/linux/filter.h:610 [inline] bpf_prog_run_array include/linux/bpf.h:1635 [inline] trace_call_bpf+0x345/0x6a0 kernel/trace/bpf_trace.c:135 perf_trace_run_bpf_submit+0x7b/0x1d0 kernel/events/core.c:9924 perf_trace_timer_class+0x2c8/0x380 include/trace/events/timer.h:12 trace_timer_cancel include/trace/events/timer.h:138 [inline] debug_deactivate kernel/time/timer.c:832 [inline] detach_timer+0x2f4/0x380 kernel/time/timer.c:878 expire_timers kernel/time/timer.c:1538 [inline] __run_timers+0x60c/0x890 kernel/time/timer.c:1820 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571 __do_softirq kernel/softirq.c:605 [inline] invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654 irq_exit_rcu+0x5/0x20 kernel/softirq.c:666 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653 RIP: 0010:preempt_count_sub+0x2/0x160 kernel/sched/core.c:5730 Code: c7 c1 e8 be 73 8e 80 e1 07 80 c1 03 38 c1 7c 80 48 c7 c7 e8 be 73 8e e8 4c b1 83 00 e9 6f ff ff ff 0f 1f 80 00 00 00 00 41 56 <53> 89 fb 48 c7 c0 60 51 c9 91 48 c1 e8 03 49 be 00 00 00 00 00 fc RSP: 0018:ffffc900031af6d0 EFLAGS: 00000246 RAX: 0000000000000001 RBX: ffff8880124734e0 RCX: ffffffff8a945c4a RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001 RBP: ffffc900031af838 R08: dffffc0000000000 R09: ffffed100248e69d R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92000635ee8 R13: dffffc0000000000 R14: ffff88807cb39dc1 R15: 1ffff1100248e69c __down_read_common kernel/locking/rwsem.c:1268 [inline] __down_read kernel/locking/rwsem.c:1274 [inline] down_read+0x825/0xa30 kernel/locking/rwsem.c:1522 kernfs_dop_revalidate+0xca/0x590 fs/kernfs/dir.c:1123 d_revalidate fs/namei.c:859 [inline] lookup_fast+0x1ec/0x490 fs/namei.c:1651 walk_component fs/namei.c:1994 [inline] link_path_walk+0x604/0xee0 fs/namei.c:2325 path_lookupat+0xa9/0x450 fs/namei.c:2478 filename_lookup+0x251/0x600 fs/namei.c:2508 vfs_statx+0x107/0x4b0 fs/stat.c:229 vfs_fstatat fs/stat.c:267 [inline] __do_sys_newfstatat fs/stat.c:437 [inline] __se_sys_newfstatat fs/stat.c:431 [inline] __x64_sys_newfstatat+0x151/0x1e0 fs/stat.c:431 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f69c5d165f4 Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8 RSP: 002b:00007fff5e68ff68 EFLAGS: 00000246 ORIG_RAX: 0000000000000106 RAX: ffffffffffffffda RBX: 000055aad2e5c2c0 RCX: 00007f69c5d165f4 RDX: 00007fff5e68ff78 RSI: 00007fff5e690408 RDI: 00000000ffffff9c RBP: 00007fff5e690008 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff5e690408 R13: 00007fff5e68ff78 R14: 000055aad2e5b910 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: c7 c1 e8 be 73 8e mov $0x8e73bee8,%ecx 6: 80 e1 07 and $0x7,%cl 9: 80 c1 03 add $0x3,%cl c: 38 c1 cmp %al,%cl e: 7c 80 jl 0xffffff90 10: 48 c7 c7 e8 be 73 8e mov $0xffffffff8e73bee8,%rdi 17: e8 4c b1 83 00 call 0x83b168 1c: e9 6f ff ff ff jmp 0xffffff90 21: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 28: 41 56 push %r14 * 2a: 53 push %rbx <-- trapping instruction 2b: 89 fb mov %edi,%ebx 2d: 48 c7 c0 60 51 c9 91 mov $0xffffffff91c95160,%rax 34: 48 c1 e8 03 shr $0x3,%rax 38: 49 rex.WB 39: be 00 00 00 00 mov $0x0,%esi 3e: 00 fc add %bh,%ah