====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ kworker/u4:4/57 is trying to acquire lock: ffff88801ce54a00 (kn->active#5){++++}-{0:0}, at: __kernfs_remove+0x3f4/0x6c0 fs/kernfs/dir.c:1461 but task is already holding lock: ffffffff8d7ca1b0 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_remove+0x1cb/0x360 drivers/acpi/acpi_processor.c:461 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (cpu_hotplug_lock){++++}-{0:0}: percpu_down_write+0x50/0x2f0 kernel/locking/percpu-rwsem.c:227 cpus_write_lock kernel/cpu.c:328 [inline] _cpu_up+0x78/0x8f0 kernel/cpu.c:1412 cpu_up+0x1ea/0x270 kernel/cpu.c:1494 bringup_nonboot_cpus+0x11f/0x1c0 kernel/cpu.c:1560 smp_init+0x3a/0x142 kernel/smp.c:1122 kernel_init_freeable+0x3bc/0x5ab init/main.c:1590 kernel_init+0x19/0x1b0 init/main.c:1487 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #2 (cpu_add_remove_lock){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x12d/0xae0 kernel/locking/mutex.c:747 cpu_maps_update_begin kernel/cpu.c:290 [inline] cpu_down+0x75/0x1d0 kernel/cpu.c:1282 device_offline+0x259/0x3a0 drivers/base/core.c:4231 acpi_bus_offline+0x23e/0x400 drivers/acpi/scan.c:163 acpi_scan_try_to_offline drivers/acpi/scan.c:226 [inline] acpi_scan_hot_remove drivers/acpi/scan.c:258 [inline] acpi_generic_hotplug_event drivers/acpi/scan.c:368 [inline] acpi_device_hotplug+0x562/0xc90 drivers/acpi/scan.c:392 acpi_hotplug_work_fn+0x51/0x80 drivers/acpi/osl.c:1162 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #1 (&device->physical_node_lock){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x12d/0xae0 kernel/locking/mutex.c:747 acpi_get_first_physical_node drivers/acpi/bus.c:657 [inline] acpi_primary_dev_companion drivers/acpi/bus.c:676 [inline] acpi_companion_match+0x86/0x110 drivers/acpi/bus.c:730 acpi_device_uevent_modalias+0x16/0x30 drivers/acpi/device_sysfs.c:284 platform_uevent+0x38/0xb0 drivers/base/platform.c:1366 dev_uevent+0x3a5/0x740 drivers/base/core.c:2605 kobject_uevent_env+0x45b/0x890 lib/kobject_uevent.c:572 kobject_synth_uevent+0x457/0x940 lib/kobject_uevent.c:208 uevent_store+0x22/0x60 drivers/base/core.c:2689 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2271 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x482/0x9a0 fs/read_write.c:584 ksys_write+0x14d/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #0 (kn->active#5){++++}-{0:0}: check_prev_add kernel/locking/lockdep.c:3162 [inline] check_prevs_add kernel/locking/lockdep.c:3281 [inline] validate_chain kernel/locking/lockdep.c:3897 [inline] __lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171 lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790 kernfs_drain+0x31a/0x6d0 fs/kernfs/dir.c:499 __kernfs_remove+0x3f4/0x6c0 fs/kernfs/dir.c:1461 kernfs_remove_by_name_ns+0xd8/0x150 fs/kernfs/dir.c:1667 sysfs_remove_file include/linux/sysfs.h:629 [inline] device_remove_file drivers/base/core.c:3071 [inline] device_del+0x62f/0xa80 drivers/base/core.c:3898 device_unregister+0x1c/0xc0 drivers/base/core.c:3943 unregister_cpu+0x4d/0xf0 drivers/base/cpu.c:81 acpi_processor_remove+0x1e0/0x360 drivers/acpi/acpi_processor.c:464 acpi_bus_trim_one drivers/acpi/scan.c:2479 [inline] acpi_bus_trim drivers/acpi/scan.c:2504 [inline] acpi_scan_hot_remove drivers/acpi/scan.c:265 [inline] acpi_generic_hotplug_event drivers/acpi/scan.c:368 [inline] acpi_device_hotplug+0x8df/0xc90 drivers/acpi/scan.c:392 acpi_hotplug_work_fn+0x51/0x80 drivers/acpi/osl.c:1162 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 other info that might help us debug this: Chain exists of: kn->active#5 --> cpu_add_remove_lock --> cpu_hotplug_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(cpu_hotplug_lock); lock(cpu_add_remove_lock); lock(cpu_hotplug_lock); lock(kn->active#5); *** DEADLOCK *** 6 locks held by kworker/u4:4/57: #0: ffff88801cac1938 ((wq_completion)kacpi_hotplug){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc90001587d00 ((work_completion)(&hpw->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffffffff8e1cfb08 (device_hotplug_lock){+.+.}-{3:3}, at: acpi_device_hotplug+0x85/0xc90 drivers/acpi/scan.c:378 #3: ffffffff8e027748 (acpi_scan_lock){+.+.}-{3:3}, at: acpi_device_hotplug+0x93/0xc90 drivers/acpi/scan.c:379 #4: ffffffff8d7ca088 (cpu_add_remove_lock){+.+.}-{3:3}, at: acpi_processor_remove+0x1c6/0x360 drivers/acpi/acpi_processor.c:460 #5: ffffffff8d7ca1b0 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_remove+0x1cb/0x360 drivers/acpi/acpi_processor.c:461 stack backtrace: CPU: 0 PID: 57 Comm: kworker/u4:4 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Workqueue: kacpi_hotplug acpi_hotplug_work_fn Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2215 check_prev_add kernel/locking/lockdep.c:3162 [inline] check_prevs_add kernel/locking/lockdep.c:3281 [inline] validate_chain kernel/locking/lockdep.c:3897 [inline] __lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171 lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790 kernfs_drain+0x31a/0x6d0 fs/kernfs/dir.c:499 __kernfs_remove+0x3f4/0x6c0 fs/kernfs/dir.c:1461 kernfs_remove_by_name_ns+0xd8/0x150 fs/kernfs/dir.c:1667 sysfs_remove_file include/linux/sysfs.h:629 [inline] device_remove_file drivers/base/core.c:3071 [inline] device_del+0x62f/0xa80 drivers/base/core.c:3898 device_unregister+0x1c/0xc0 drivers/base/core.c:3943 unregister_cpu+0x4d/0xf0 drivers/base/cpu.c:81 acpi_processor_remove+0x1e0/0x360 drivers/acpi/acpi_processor.c:464 acpi_bus_trim_one drivers/acpi/scan.c:2479 [inline] acpi_bus_trim drivers/acpi/scan.c:2504 [inline] acpi_scan_hot_remove drivers/acpi/scan.c:265 [inline] acpi_generic_hotplug_event drivers/acpi/scan.c:368 [inline] acpi_device_hotplug+0x8df/0xc90 drivers/acpi/scan.c:392 acpi_hotplug_work_fn+0x51/0x80 drivers/acpi/osl.c:1162 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ACPI: \_SB_.C001: Eject incomplete - status 0xf