============================================
WARNING: possible recursive locking detected
6.12.0-rc5-syzkaller-g6c52d4da1c74 #0 Not tainted
--------------------------------------------
kworker/u8:6/3405 is trying to acquire lock:
ffffc900040830d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1ea/0x600 kernel/bpf/ringbuf.c:427
but task is already holding lock:
ffffc90002fd80d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1ea/0x600 kernel/bpf/ringbuf.c:427
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&rb->spinlock);
lock(&rb->spinlock);
*** DEADLOCK ***
May be due to missing lock nesting notation
6 locks held by kworker/u8:6/3405:
#0: ffff8880314d3148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline]
#0: ffff8880314d3148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310
#1: ffffc9000c30fd00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline]
#1: ffffc9000c30fd00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310
#2: ffffffff8e937e60 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#2: ffffffff8e937e60 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2561 [inline]
#2: ffffffff8e937e60 (rcu_callback){....}-{0:0}, at: rcu_core+0xa37/0x17a0 kernel/rcu/tree.c:2823
#3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2315 [inline]
#3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1fc/0x540 kernel/trace/bpf_trace.c:2357
#4: ffffc90002fd80d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1ea/0x600 kernel/bpf/ringbuf.c:427
#5: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xbc/0x8a0
stack backtrace:
CPU: 0 UID: 0 PID: 3405 Comm: kworker/u8:6 Not tainted 6.12.0-rc5-syzkaller-g6c52d4da1c74 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: bat_events batadv_nc_worker
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3037
check_deadlock kernel/locking/lockdep.c:3089 [inline]
validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3891
__lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
__bpf_ringbuf_reserve+0x1ea/0x600 kernel/bpf/ringbuf.c:427
____bpf_ringbuf_output kernel/bpf/ringbuf.c:553 [inline]
bpf_ringbuf_output+0x67/0x1e0 kernel/bpf/ringbuf.c:543
bpf_prog_224b060aaa884769+0x47/0x4b
bpf_dispatcher_nop_func include/linux/bpf.h:1265 [inline]
__bpf_prog_run include/linux/filter.h:701 [inline]
bpf_prog_run include/linux/filter.h:708 [inline]
bpf_prog_run_array include/linux/bpf.h:2131 [inline]
trace_call_bpf+0x369/0x8a0 kernel/trace/bpf_trace.c:146
perf_trace_run_bpf_submit+0x82/0x180 kernel/events/core.c:10416
perf_trace_lock+0x388/0x490 include/trace/events/lock.h:50
trace_lock_release include/trace/events/lock.h:69 [inline]
lock_release+0x9cc/0xa30 kernel/locking/lockdep.c:5836
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:149 [inline]
_raw_spin_unlock_irqrestore+0x79/0x140 kernel/locking/spinlock.c:194
__bpf_ringbuf_reserve+0x48a/0x600 kernel/bpf/ringbuf.c:465
____bpf_ringbuf_output kernel/bpf/ringbuf.c:553 [inline]
bpf_ringbuf_output+0x67/0x1e0 kernel/bpf/ringbuf.c:543
bpf_prog_bc20a984d57ef3f1+0x43/0x6b
bpf_dispatcher_nop_func include/linux/bpf.h:1265 [inline]
__bpf_prog_run include/linux/filter.h:701 [inline]
bpf_prog_run include/linux/filter.h:708 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2316 [inline]
bpf_trace_run2+0x2ec/0x540 kernel/trace/bpf_trace.c:2357
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0x35e/0x440 mm/slub.c:4714
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823
handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x5d/0x70 kernel/kcov.c:235
Code: f8 15 00 00 83 fa 02 75 21 48 8b 91 00 16 00 00 48 8b 32 48 8d 7e 01 8b 89 fc 15 00 00 48 39 cf 73 08 48 89 3a 48 89 44 f2 08 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90
RSP: 0018:ffffc9000c30fb50 EFLAGS: 00000293
RAX: ffffffff8b90cbd2 RBX: ffffffff8b90c9eb RCX: ffff888031541e00
RDX: 0000000000000000 RSI: ffffffff8c0adc40 RDI: ffffffff8c610420
RBP: 0000000000000000 R08: ffffffff901d042f R09: 1ffffffff203a085
R10: dffffc0000000000 R11: fffffbfff203a086 R12: ffff88807b1f8cc0
R13: 0000000000000369 R14: ffff88801eb02b00 R15: dffffc0000000000
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:405 [inline]
batadv_nc_worker+0x2b2/0x610 net/batman-adv/network-coding.c:719
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
----------------
Code disassembly (best guess):
0: f8 clc
1: 15 00 00 83 fa adc $0xfa830000,%eax
6: 02 75 21 add 0x21(%rbp),%dh
9: 48 8b 91 00 16 00 00 mov 0x1600(%rcx),%rdx
10: 48 8b 32 mov (%rdx),%rsi
13: 48 8d 7e 01 lea 0x1(%rsi),%rdi
17: 8b 89 fc 15 00 00 mov 0x15fc(%rcx),%ecx
1d: 48 39 cf cmp %rcx,%rdi
20: 73 08 jae 0x2a
22: 48 89 3a mov %rdi,(%rdx)
25: 48 89 44 f2 08 mov %rax,0x8(%rdx,%rsi,8)
* 2a: c3 ret <-- trapping instruction
2b: cc int3
2c: cc int3
2d: cc int3
2e: cc int3
2f: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
36: 00 00 00
39: 0f 1f 40 00 nopl 0x0(%rax)
3d: 90 nop
3e: 90 nop
3f: 90 nop