===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted ----------------------------------------------------- syz-fuzzer/5058 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire: ffff88801fb42820 (&htab->buckets[i].lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff88801fb42820 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939 and this task is already holding: ffff8880296d40d8 (&sighand->siglock){-...}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:376 [inline] ffff8880296d40d8 (&sighand->siglock){-...}-{2:2}, at: get_signal+0x247/0x1850 kernel/signal.c:2699 which would create a new lock dependency: (&sighand->siglock){-...}-{2:2} -> (&htab->buckets[i].lock){+.-.}-{2:2} but this new dependency connects a HARDIRQ-irq-safe lock: (&sighand->siglock){-...}-{2:2} ... which became HARDIRQ-irq-safe at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 __lock_task_sighand+0x149/0x2e0 kernel/signal.c:1414 lock_task_sighand include/linux/sched/signal.h:746 [inline] send_sigqueue+0x25d/0x760 kernel/signal.c:1997 posix_timer_event kernel/time/posix-timers.c:298 [inline] posix_timer_fn+0x18a/0x3a0 kernel/time/posix-timers.c:324 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1818 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 lock_acquire+0x25b/0x530 kernel/locking/lockdep.c:5758 rcu_lock_acquire include/linux/rcupdate.h:298 [inline] rcu_read_lock_sched include/linux/rcupdate.h:842 [inline] pfn_valid+0x113/0x440 include/linux/mmzone.h:2016 page_table_check_set+0x25/0x700 mm/page_table_check.c:105 __page_table_check_ptes_set+0x220/0x280 mm/page_table_check.c:196 page_table_check_ptes_set include/linux/page_table_check.h:74 [inline] set_ptes include/linux/pgtable.h:241 [inline] copy_present_pte mm/memory.c:993 [inline] copy_pte_range mm/memory.c:1102 [inline] copy_pmd_range mm/memory.c:1187 [inline] copy_pud_range mm/memory.c:1224 [inline] copy_p4d_range mm/memory.c:1248 [inline] copy_page_range+0x2c7f/0x4240 mm/memory.c:1346 dup_mmap kernel/fork.c:747 [inline] dup_mm kernel/fork.c:1687 [inline] copy_mm+0x12f5/0x21b0 kernel/fork.c:1736 copy_process+0x187a/0x3df0 kernel/fork.c:2389 kernel_clone+0x223/0x840 kernel/fork.c:2796 __do_sys_clone kernel/fork.c:2939 [inline] __se_sys_clone kernel/fork.c:2923 [inline] __x64_sys_clone+0x258/0x2a0 kernel/fork.c:2923 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 to a HARDIRQ-irq-unsafe lock: (&htab->buckets[i].lock){+.-.}-{2:2} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_update_common+0x20c/0xa30 net/core/sock_map.c:1007 sock_map_update_elem_sys+0x5a4/0x910 net/core/sock_map.c:581 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&htab->buckets[i].lock); local_irq_disable(); lock(&sighand->siglock); lock(&htab->buckets[i].lock); lock(&sighand->siglock); *** DEADLOCK *** 2 locks held by syz-fuzzer/5058: #0: ffff8880296d40d8 (&sighand->siglock){-...}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:376 [inline] #0: ffff8880296d40d8 (&sighand->siglock){-...}-{2:2}, at: get_signal+0x247/0x1850 kernel/signal.c:2699 #1: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #1: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #1: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] #1: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run3+0x14a/0x460 kernel/trace/bpf_trace.c:2421 the dependencies between HARDIRQ-irq-safe lock and the holding lock: -> (&sighand->siglock){-...}-{2:2} { IN-HARDIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 __lock_task_sighand+0x149/0x2e0 kernel/signal.c:1414 lock_task_sighand include/linux/sched/signal.h:746 [inline] send_sigqueue+0x25d/0x760 kernel/signal.c:1997 posix_timer_event kernel/time/posix-timers.c:298 [inline] posix_timer_fn+0x18a/0x3a0 kernel/time/posix-timers.c:324 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1818 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 lock_acquire+0x25b/0x530 kernel/locking/lockdep.c:5758 rcu_lock_acquire include/linux/rcupdate.h:298 [inline] rcu_read_lock_sched include/linux/rcupdate.h:842 [inline] pfn_valid+0x113/0x440 include/linux/mmzone.h:2016 page_table_check_set+0x25/0x700 mm/page_table_check.c:105 __page_table_check_ptes_set+0x220/0x280 mm/page_table_check.c:196 page_table_check_ptes_set include/linux/page_table_check.h:74 [inline] set_ptes include/linux/pgtable.h:241 [inline] copy_present_pte mm/memory.c:993 [inline] copy_pte_range mm/memory.c:1102 [inline] copy_pmd_range mm/memory.c:1187 [inline] copy_pud_range mm/memory.c:1224 [inline] copy_p4d_range mm/memory.c:1248 [inline] copy_page_range+0x2c7f/0x4240 mm/memory.c:1346 dup_mmap kernel/fork.c:747 [inline] dup_mm kernel/fork.c:1687 [inline] copy_mm+0x12f5/0x21b0 kernel/fork.c:1736 copy_process+0x187a/0x3df0 kernel/fork.c:2389 kernel_clone+0x223/0x840 kernel/fork.c:2796 __do_sys_clone kernel/fork.c:2939 [inline] __se_sys_clone kernel/fork.c:2923 [inline] __x64_sys_clone+0x258/0x2a0 kernel/fork.c:2923 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:376 [inline] calculate_sigpending+0x4f/0x90 kernel/signal.c:188 ret_from_fork+0x24/0x80 arch/x86/kernel/process.c:143 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 } ... key at: [] sighand_ctor.__key+0x0/0x20 the dependencies between the lock to be acquired and HARDIRQ-irq-unsafe lock: -> (&htab->buckets[i].lock){+.-.}-{2:2} { HARDIRQ-ON-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_update_common+0x20c/0xa30 net/core/sock_map.c:1007 sock_map_update_elem_sys+0x5a4/0x910 net/core/sock_map.c:581 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 IN-SOFTIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run3+0x238/0x460 kernel/trace/bpf_trace.c:2421 trace_kmem_cache_free include/trace/events/kmem.h:114 [inline] kmem_cache_free+0x23c/0x2b0 mm/slub.c:4343 packet_rcv+0x163/0x13e0 net/packet/af_packet.c:2230 dev_queue_xmit_nit+0xad4/0xc10 net/core/dev.c:2296 xmit_one net/core/dev.c:3527 [inline] dev_hard_start_xmit+0x15f/0x790 net/core/dev.c:3547 sch_direct_xmit+0x2b6/0x5f0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3760 [inline] __dev_queue_xmit+0x1912/0x3b10 net/core/dev.c:4301 dev_queue_xmit include/linux/netdevice.h:3091 [inline] neigh_hh_output include/net/neighbour.h:526 [inline] neigh_output include/net/neighbour.h:540 [inline] ip_finish_output2+0xd41/0x1380 net/ipv4/ip_output.c:235 ip_local_out net/ipv4/ip_output.c:129 [inline] __ip_queue_xmit+0x118c/0x1b70 net/ipv4/ip_output.c:535 __tcp_transmit_skb+0x2557/0x3b80 net/ipv4/tcp_output.c:1462 tcp_delack_timer_handler+0x35f/0x510 net/ipv4/tcp_timer.c:344 tcp_delack_timer+0x190/0x2f0 net/ipv4/tcp_timer.c:367 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers kernel/time/timer.c:2408 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419 run_timer_base kernel/time/timer.c:2428 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 unwind_next_frame+0xd4/0x2a00 arch/x86/kernel/unwind_orc.c:482 arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3966 [inline] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] kzalloc include/linux/slab.h:749 [inline] tomoyo_encode2 security/tomoyo/realpath.c:45 [inline] tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x69/0x570 security/security.c:2955 do_dentry_open+0x327/0x15a0 fs/open.c:942 do_open fs/namei.c:3642 [inline] path_openat+0x2860/0x3240 fs/namei.c:3799 do_filp_open+0x235/0x490 fs/namei.c:3826 do_sys_openat2+0x13e/0x1d0 fs/open.c:1406 do_sys_open fs/open.c:1421 [inline] __do_sys_openat fs/open.c:1437 [inline] __se_sys_openat fs/open.c:1432 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1432 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_update_common+0x20c/0xa30 net/core/sock_map.c:1007 sock_map_update_elem_sys+0x5a4/0x910 net/core/sock_map.c:581 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 } ... key at: [] sock_hash_alloc.__key+0x0/0x20 ... acquired at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run3+0x238/0x460 kernel/trace/bpf_trace.c:2421 trace_kmem_cache_free include/trace/events/kmem.h:114 [inline] kmem_cache_free+0x23c/0x2b0 mm/slub.c:4343 __sigqueue_free kernel/signal.c:451 [inline] collect_signal kernel/signal.c:594 [inline] __dequeue_signal+0x4ac/0x5c0 kernel/signal.c:616 dequeue_signal+0xd8/0x5a0 kernel/signal.c:636 get_signal+0x5f7/0x1850 kernel/signal.c:2787 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:105 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] irqentry_exit_to_user_mode+0x79/0x270 kernel/entry/common.c:225 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 stack backtrace: CPU: 0 PID: 5058 Comm: syz-fuzzer Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline] check_irq_usage kernel/locking/lockdep.c:2865 [inline] check_prev_add kernel/locking/lockdep.c:3138 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x4dc7/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run3+0x238/0x460 kernel/trace/bpf_trace.c:2421 trace_kmem_cache_free include/trace/events/kmem.h:114 [inline] kmem_cache_free+0x23c/0x2b0 mm/slub.c:4343 __sigqueue_free kernel/signal.c:451 [inline] collect_signal kernel/signal.c:594 [inline] __dequeue_signal+0x4ac/0x5c0 kernel/signal.c:616 dequeue_signal+0xd8/0x5a0 kernel/signal.c:636 get_signal+0x5f7/0x1850 kernel/signal.c:2787 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:105 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] irqentry_exit_to_user_mode+0x79/0x270 kernel/entry/common.c:225 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0033:0x6710bb Code: 89 c2 49 29 f0 49 c1 f8 3f 4d 21 d0 49 89 cb 4d 29 d3 4d 01 c8 49 39 fa 0f 82 96 01 00 00 4d 89 d4 49 29 fa 49 89 fd 48 29 f7 <48> c1 ff 3f 4c 21 ef 4a 8d 1c 0f 4d 39 da 4d 0f 4c da 4c 39 c3 74 RSP: 002b:000000c000b88c60 EFLAGS: 00000287 RAX: 000000c0002d5900 RBX: 0000000000000001 RCX: 000000000000183c RDX: 000000000000173a RSI: 0000000000008000 RDI: ffffffffffff9739 RBP: 000000c000b88cd0 R08: 000000c0001df73b R09: 000000c0001de000 R10: 0000000000000002 R11: 0000000000000101 R12: 000000000000173b R13: 0000000000001739 R14: 000000c0000061a0 R15: 0000000000000001