============================================
WARNING: possible recursive locking detected
6.9.0-rc5-syzkaller-01502-gfcd1ed89a043 #0 Not tainted
--------------------------------------------
udevd/4538 is trying to acquire lock:
ffff8880227a61d8 (&qs->lock){..-.}-{2:2}, at: __stack_map_get+0x14b/0x4b0 kernel/bpf/queue_stack_maps.c:140
but task is already holding lock:
ffff88802c7de1d8 (&qs->lock){..-.}-{2:2}, at: queue_stack_map_push_elem+0x1b2/0x660 kernel/bpf/queue_stack_maps.c:210
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&qs->lock);
lock(&qs->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
5 locks held by udevd/4538:
#0: ffffffff8e334ee0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#0: ffffffff8e334ee0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2190 [inline]
#0: ffffffff8e334ee0 (rcu_callback){....}-{0:0}, at: rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2471
#1: ffffffff8e1d5380 (put_task_map-wait-type-override){+...}-{3:3}, at: put_task_struct include/linux/sched/task.h:137 [inline]
#1: ffffffff8e1d5380 (put_task_map-wait-type-override){+...}-{3:3}, at: delayed_put_task_struct+0xfa/0x2f0 kernel/exit.c:229
#2: ffffffff8e334e20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#2: ffffffff8e334e20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#2: ffffffff8e334e20 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2402 [inline]
#2: ffffffff8e334e20 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run3+0x24c/0x5a0 kernel/trace/bpf_trace.c:2445
#3: ffff88802c7de1d8 (&qs->lock){..-.}-{2:2}, at: queue_stack_map_push_elem+0x1b2/0x660 kernel/bpf/queue_stack_maps.c:210
#4: ffffffff8e334e20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#4: ffffffff8e334e20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#4: ffffffff8e334e20 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2402 [inline]
#4: ffffffff8e334e20 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1fc/0x540 kernel/trace/bpf_trace.c:2444
stack backtrace:
CPU: 1 PID: 4538 Comm: udevd Not tainted 6.9.0-rc5-syzkaller-01502-gfcd1ed89a043 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
check_deadlock kernel/locking/lockdep.c:3062 [inline]
validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
__stack_map_get+0x14b/0x4b0 kernel/bpf/queue_stack_maps.c:140
bpf_prog_00798911c748094f+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:691 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline]
bpf_trace_run2+0x2ec/0x540 kernel/trace/bpf_trace.c:2444
trace_contention_end+0x114/0x140 include/trace/events/lock.h:122
__pv_queued_spin_lock_slowpath+0x939/0xc60 kernel/locking/qspinlock.c:560
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0xe1/0x120 kernel/locking/spinlock.c:162
queue_stack_map_push_elem+0x1b2/0x660 kernel/bpf/queue_stack_maps.c:210
bpf_prog_216c997a1f42e404+0x3f/0x43
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:691 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline]
bpf_trace_run3+0x33a/0x5a0 kernel/trace/bpf_trace.c:2445
trace_kmem_cache_free include/trace/events/kmem.h:114 [inline]
kmem_cache_free+0x25a/0x2c0 mm/slub.c:4343
put_task_struct include/linux/sched/task.h:138 [inline]
delayed_put_task_struct+0x125/0x2f0 kernel/exit.c:229
rcu_do_batch kernel/rcu/tree.c:2196 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471
__do_softirq+0x2c6/0x980 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:80 [inline]
RIP: 0010:__orc_find arch/x86/kernel/unwind_orc.c:102 [inline]
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:227 [inline]
RIP: 0010:unwind_next_frame+0x4fb/0x2a00 arch/x86/kernel/unwind_orc.c:494
Code: c1 48 c1 f9 02 48 c1 e8 3f 48 01 c8 48 83 e0 fe 49 8d 5c 45 00 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 <84> c0 75 34 48 63 2b 48 01 dd 48 89 ef 4c 89 f6 e8 30 da 54 00 48
RSP: 0018:ffffc90003907828 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: ffffffff9021c0d8 RCX: dffffc0000000000
RDX: ffff88807aadda00 RSI: 00000000001ade7f RDI: 00000000001ade80
RBP: 00000000000a813b R08: ffffffff8141424e R09: ffffc900039079f0
R10: 0000000000000003 R11: ffffffff8181fb90 R12: ffffffff9021c0d8
R13: ffffffff9021c0d8 R14: ffffffff8b813ba4 R15: ffffffff9021c0d8
arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc+0x174/0x340 mm/slub.c:3852
getname_flags+0xbd/0x4f0 fs/namei.c:139
user_path_at_empty+0x2c/0x60 fs/namei.c:2920
do_readlinkat+0x118/0x3b0 fs/stat.c:499
__do_sys_readlink fs/stat.c:532 [inline]
__se_sys_readlink fs/stat.c:529 [inline]
__x64_sys_readlink+0x7f/0x90 fs/stat.c:529
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1e8f717d47
Code: 73 01 c3 48 8b 0d e1 90 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 59 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b1 90 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd6dcfb088 EFLAGS: 00000246 ORIG_RAX: 0000000000000059
RAX: ffffffffffffffda RBX: 00007ffd6dcfb098 RCX: 00007f1e8f717d47
RDX: 0000000000000400 RSI: 00007ffd6dcfb098 RDI: 00007ffd6dcfb578
RBP: 0000000000000400 R08: 0000558e756f4ba4 R09: 0000000000000000
R10: 0000000000000812 R11: 0000000000000246 R12: 00007ffd6dcfb578
R13: 00007ffd6dcfb4e8 R14: 0000558e756e1910 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: c1 48 c1 f9 rorl $0xf9,-0x3f(%rax)
4: 02 48 c1 add -0x3f(%rax),%cl
7: e8 3f 48 01 c8 call 0xc801484b
c: 48 83 e0 fe and $0xfffffffffffffffe,%rax
10: 49 8d 5c 45 00 lea 0x0(%r13,%rax,2),%rbx
15: 48 89 d8 mov %rbx,%rax
18: 48 c1 e8 03 shr $0x3,%rax
1c: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
23: fc ff df
26: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax
* 2a: 84 c0 test %al,%al <-- trapping instruction
2c: 75 34 jne 0x62
2e: 48 63 2b movslq (%rbx),%rbp
31: 48 01 dd add %rbx,%rbp
34: 48 89 ef mov %rbp,%rdi
37: 4c 89 f6 mov %r14,%rsi
3a: e8 30 da 54 00 call 0x54da6f
3f: 48 rex.W