======================================================
WARNING: possible circular locking dependency detected
6.1.59-syzkaller #0 Not tainted
------------------------------------------------------
kworker/u4:0/9 is trying to acquire lock:
ffff88813fffeba0 (&pgdat->kswapd_wait){..-.}-{2:2}, at: __wake_up_common_lock kernel/sched/wait.c:137 [inline]
ffff88813fffeba0 (&pgdat->kswapd_wait){..-.}-{2:2}, at: __wake_up+0xfd/0x1c0 kernel/sched/wait.c:160
but task is already holding lock:
ffff8880b9928358 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x120/0x260 kernel/time/timer.c:999
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&base->lock){-.-.}-{2:2}:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5661
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
lock_timer_base+0x120/0x260 kernel/time/timer.c:999
__mod_timer+0x1cb/0xee0 kernel/time/timer.c:1072
queue_delayed_work_on+0x156/0x250 kernel/workqueue.c:1704
psi_task_change+0xf9/0x270 kernel/sched/psi.c:924
psi_enqueue kernel/sched/stats.h:141 [inline]
enqueue_task+0x2fd/0x3a0 kernel/sched/core.c:2056
activate_task kernel/sched/core.c:2088 [inline]
wake_up_new_task+0x4f5/0xca0 kernel/sched/core.c:4738
kernel_clone+0x4ed/0x920 kernel/fork.c:2713
user_mode_thread+0x12e/0x190 kernel/fork.c:2758
rest_init+0x23/0x300 init/main.c:692
start_kernel+0x0/0x53f init/main.c:887
start_kernel+0x496/0x53f init/main.c:1134
secondary_startup_64_no_verify+0xcf/0xdb
-> #2 (&rq->__lock){-.-.}-{2:2}:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5661
_raw_spin_lock_nested+0x2d/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537
raw_spin_rq_lock kernel/sched/sched.h:1354 [inline]
rq_lock kernel/sched/sched.h:1644 [inline]
task_fork_fair+0x5d/0x350 kernel/sched/fair.c:11878
sched_cgroup_fork+0x374/0x400 kernel/sched/core.c:4682
copy_process+0x2442/0x4060 kernel/fork.c:2384
kernel_clone+0x222/0x920 kernel/fork.c:2682
user_mode_thread+0x12e/0x190 kernel/fork.c:2758
rest_init+0x23/0x300 init/main.c:692
start_kernel+0x0/0x53f init/main.c:887
start_kernel+0x496/0x53f init/main.c:1134
secondary_startup_64_no_verify+0xcf/0xdb
-> #1 (&p->pi_lock){-.-.}-{2:2}:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5661
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
try_to_wake_up+0xad/0x12e0 kernel/sched/core.c:4108
autoremove_wake_function+0x12/0x110 kernel/sched/wait.c:419
__wake_up_common+0x2a0/0x4e0 kernel/sched/wait.c:107
__wake_up_common_lock kernel/sched/wait.c:138 [inline]
__wake_up+0x11a/0x1c0 kernel/sched/wait.c:160
rmqueue mm/page_alloc.c:3848 [inline]
get_page_from_freelist+0x2e8e/0x3320 mm/page_alloc.c:4276
__alloc_pages+0x28d/0x770 mm/page_alloc.c:5545
alloc_slab_page+0x6a/0x150 mm/slub.c:1794
allocate_slab mm/slub.c:1939 [inline]
new_slab+0x84/0x2d0 mm/slub.c:1992
___slab_alloc+0xc20/0x1270 mm/slub.c:3180
__slab_alloc mm/slub.c:3279 [inline]
slab_alloc_node mm/slub.c:3364 [inline]
__kmem_cache_alloc_node+0x19f/0x260 mm/slub.c:3437
__do_kmalloc_node mm/slab_common.c:954 [inline]
__kmalloc_node_track_caller+0xa0/0x220 mm/slab_common.c:975
kmalloc_reserve net/core/skbuff.c:446 [inline]
__alloc_skb+0x135/0x670 net/core/skbuff.c:515
alloc_skb include/linux/skbuff.h:1276 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:748 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline]
nsim_dev_trap_report_work+0x24c/0xa90 drivers/net/netdevsim/dev.c:850
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
-> #0 (&pgdat->kswapd_wait){..-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain+0x1667/0x58e0 kernel/locking/lockdep.c:3824
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5048
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5661
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
__wake_up_common_lock kernel/sched/wait.c:137 [inline]
__wake_up+0xfd/0x1c0 kernel/sched/wait.c:160
rmqueue mm/page_alloc.c:3848 [inline]
get_page_from_freelist+0x2e8e/0x3320 mm/page_alloc.c:4276
__alloc_pages+0x28d/0x770 mm/page_alloc.c:5545
alloc_slab_page+0x6a/0x150 mm/slub.c:1794
allocate_slab mm/slub.c:1939 [inline]
new_slab+0x84/0x2d0 mm/slub.c:1992
___slab_alloc+0xc20/0x1270 mm/slub.c:3180
__slab_alloc mm/slub.c:3279 [inline]
slab_alloc_node mm/slub.c:3364 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x1a5/0x2d0 mm/slub.c:3422
kmem_cache_zalloc include/linux/slab.h:679 [inline]
fill_pool lib/debugobjects.c:168 [inline]
debug_objects_fill_pool+0x5a1/0xa10 lib/debugobjects.c:606
debug_object_activate+0x134/0x890 lib/debugobjects.c:702
debug_timer_activate kernel/time/timer.c:782 [inline]
__mod_timer+0x7bf/0xee0 kernel/time/timer.c:1103
call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1790
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803
__do_softirq+0x2e9/0xa4c kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
PagePoisoned include/linux/page-flags.h:304 [inline]
page_to_nid include/linux/mm.h:1290 [inline]
page_zone include/linux/mm.h:1490 [inline]
folio_zone include/linux/mm.h:1500 [inline]
zone_stat_mod_folio include/linux/vmstat.h:433 [inline]
__folio_start_writeback+0x989/0x10c0 mm/page-writeback.c:3006
ext4_bio_write_page+0x33d/0x26e0 fs/ext4/page-io.c:453
mpage_submit_page+0x18d/0x230 fs/ext4/inode.c:2118
mpage_map_and_submit_buffers fs/ext4/inode.c:2363 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2502 [inline]
ext4_writepages+0x2076/0x3de0 fs/ext4/inode.c:2831
do_writepages+0x3a2/0x670 mm/page-writeback.c:2469
__writeback_single_inode+0x15d/0x11e0 fs/fs-writeback.c:1590
writeback_sb_inodes+0xc21/0x1ac0 fs/fs-writeback.c:1881
wb_writeback+0x49d/0xe10 fs/fs-writeback.c:2055
wb_do_writeback fs/fs-writeback.c:2198 [inline]
wb_workfn+0x427/0x1020 fs/fs-writeback.c:2238
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
other info that might help us debug this:
Chain exists of:
&pgdat->kswapd_wait --> &rq->__lock --> &base->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&base->lock);
lock(&rq->__lock);
lock(&base->lock);
lock(&pgdat->kswapd_wait);
*** DEADLOCK ***
7 locks held by kworker/u4:0/9:
#0: ffff8880142ce938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
#1: ffffc900000e7d20 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
#2: ffff88814c288b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1e5/0x3de0 fs/ext4/inode.c:2691
#3: ffff88814c28a990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1f51/0x21b0 fs/jbd2/transaction.c:463
#4: ffffffff8d12a020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:306 [inline]
#4: ffffffff8d12a020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline]
#4: ffffffff8d12a020 (rcu_read_lock){....}-{1:2}, at: folio_memcg_lock+0x85/0x380 mm/memcontrol.c:2098
#5: ffffc900001e0bc0 ((&ipvs->est_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc2/0x6b0 kernel/time/timer.c:1471
#6: ffff8880b9928358 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x120/0x260 kernel/time/timer.c:999
stack backtrace:
CPU: 1 PID: 9 Comm: kworker/u4:0 Not tainted 6.1.59-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
check_noncircular+0x2fa/0x3b0 kernel/locking/lockdep.c:2170
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain+0x1667/0x58e0 kernel/locking/lockdep.c:3824
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5048
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5661
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
__wake_up_common_lock kernel/sched/wait.c:137 [inline]
__wake_up+0xfd/0x1c0 kernel/sched/wait.c:160
rmqueue mm/page_alloc.c:3848 [inline]
get_page_from_freelist+0x2e8e/0x3320 mm/page_alloc.c:4276
__alloc_pages+0x28d/0x770 mm/page_alloc.c:5545
alloc_slab_page+0x6a/0x150 mm/slub.c:1794
allocate_slab mm/slub.c:1939 [inline]
new_slab+0x84/0x2d0 mm/slub.c:1992
___slab_alloc+0xc20/0x1270 mm/slub.c:3180
__slab_alloc mm/slub.c:3279 [inline]
slab_alloc_node mm/slub.c:3364 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x1a5/0x2d0 mm/slub.c:3422
kmem_cache_zalloc include/linux/slab.h:679 [inline]
fill_pool lib/debugobjects.c:168 [inline]
debug_objects_fill_pool+0x5a1/0xa10 lib/debugobjects.c:606
debug_object_activate+0x134/0x890 lib/debugobjects.c:702
debug_timer_activate kernel/time/timer.c:782 [inline]
__mod_timer+0x7bf/0xee0 kernel/time/timer.c:1103
call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1790
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803
__do_softirq+0x2e9/0xa4c kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:PagePoisoned include/linux/page-flags.h:304 [inline]
RIP: 0010:page_to_nid include/linux/mm.h:1290 [inline]
RIP: 0010:page_zone include/linux/mm.h:1490 [inline]
RIP: 0010:folio_zone include/linux/mm.h:1500 [inline]
RIP: 0010:zone_stat_mod_folio include/linux/vmstat.h:433 [inline]
RIP: 0010:__folio_start_writeback+0x989/0x10c0 mm/page-writeback.c:3006
Code: cf ff e9 65 fa ff ff e8 75 d7 cf ff e8 50 0e cd 08 4d 85 ff 0f 84 e5 fd ff ff e8 62 d7 cf ff fb 48 b8 00 00 00 00 00 fc ff df <48> 8b 4c 24 10 80 3c 01 00 74 08 4c 89 ef e8 44 fe 26 00 49 8b 5d
RSP: 0018:ffffc900000e6ce0 EFLAGS: 00000293
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88813feb0000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900000e6e58 R08: ffffffff81ba97f7 R09: fffffbfff2091658
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff9200001cda8
R13: ffffea000555aec0 R14: 0000000000000046 R15: 0000000000000200
ext4_bio_write_page+0x33d/0x26e0 fs/ext4/page-io.c:453
mpage_submit_page+0x18d/0x230 fs/ext4/inode.c:2118
mpage_map_and_submit_buffers fs/ext4/inode.c:2363 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2502 [inline]
ext4_writepages+0x2076/0x3de0 fs/ext4/inode.c:2831
do_writepages+0x3a2/0x670 mm/page-writeback.c:2469
__writeback_single_inode+0x15d/0x11e0 fs/fs-writeback.c:1590
writeback_sb_inodes+0xc21/0x1ac0 fs/fs-writeback.c:1881
wb_writeback+0x49d/0xe10 fs/fs-writeback.c:2055
wb_do_writeback fs/fs-writeback.c:2198 [inline]
wb_workfn+0x427/0x1020 fs/fs-writeback.c:2238
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
----------------
Code disassembly (best guess), 2 bytes skipped:
0: e9 65 fa ff ff jmp 0xfffffa6a
5: e8 75 d7 cf ff call 0xffcfd77f
a: e8 50 0e cd 08 call 0x8cd0e5f
f: 4d 85 ff test %r15,%r15
12: 0f 84 e5 fd ff ff je 0xfffffdfd
18: e8 62 d7 cf ff call 0xffcfd77f
1d: fb sti
1e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
25: fc ff df
* 28: 48 8b 4c 24 10 mov 0x10(%rsp),%rcx <-- trapping instruction
2d: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1)
31: 74 08 je 0x3b
33: 4c 89 ef mov %r13,%rdi
36: e8 44 fe 26 00 call 0x26fe7f
3b: 49 rex.WB
3c: 8b .byte 0x8b
3d: 5d pop %rbp