================================ WARNING: inconsistent lock state 6.7.0-rc1-next-20231117-syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. sshd/5060 [HC0[0]:SC1[1]:HE0:SE0] takes: ffff888029965c98 (&sighand->siglock){+.?.}-{2:2}, at: __lock_task_sighand+0xc2/0x340 kernel/signal.c:1422 {SOFTIRQ-ON-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:530 [inline] ptrace_set_stopped kernel/ptrace.c:391 [inline] ptrace_attach+0x401/0x650 kernel/ptrace.c:478 __do_sys_ptrace+0x204/0x230 kernel/ptrace.c:1290 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a irq event stamp: 36765 hardirqs last enabled at (36764): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (36764): [] _raw_spin_unlock_irqrestore+0x4e/0x70 kernel/locking/spinlock.c:194 hardirqs last disabled at (36765): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (36765): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162 softirqs last enabled at (36696): [] lock_sock include/net/sock.h:1720 [inline] softirqs last enabled at (36696): [] tcp_sendmsg+0x20/0x40 net/ipv4/tcp.c:1339 softirqs last disabled at (36699): [] invoke_softirq kernel/softirq.c:427 [inline] softirqs last disabled at (36699): [] __irq_exit_rcu kernel/softirq.c:632 [inline] softirqs last disabled at (36699): [] irq_exit_rcu+0xb5/0x120 kernel/softirq.c:644 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&sighand->siglock); lock(&sighand->siglock); *** DEADLOCK *** 5 locks held by sshd/5060: #0: ffff888027850d70 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1720 [inline] #0: ffff888027850d70 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x20/0x40 net/ipv4/tcp.c:1339 #1: ffffffff8cfacf40 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline] #1: ffffffff8cfacf40 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2152 [inline] #1: ffffffff8cfacf40 (rcu_callback){....}-{0:0}, at: rcu_core+0x7cc/0x16b0 kernel/rcu/tree.c:2431 #2: ffffffff8ce58800 (put_task_map-wait-type-override){+...}-{3:3}, at: put_task_struct include/linux/sched/task.h:135 [inline] #2: ffffffff8ce58800 (put_task_map-wait-type-override){+...}-{3:3}, at: put_task_struct include/linux/sched/task.h:123 [inline] #2: ffffffff8ce58800 (put_task_map-wait-type-override){+...}-{3:3}, at: delayed_put_task_struct+0x21e/0x2d0 kernel/exit.c:227 #3: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline] #3: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #3: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2310 [inline] #3: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xe4/0x410 kernel/trace/bpf_trace.c:2350 #4: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:301 [inline] #4: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #4: ffffffff8cfad060 (rcu_read_lock){....}-{1:2}, at: __lock_task_sighand+0x3f/0x340 kernel/signal.c:1405 stack backtrace: CPU: 0 PID: 5060 Comm: sshd Not tainted 6.7.0-rc1-next-20231117-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_usage_bug kernel/locking/lockdep.c:3970 [inline] valid_state kernel/locking/lockdep.c:4012 [inline] mark_lock_irq kernel/locking/lockdep.c:4215 [inline] mark_lock+0x91a/0xc50 kernel/locking/lockdep.c:4677 mark_usage kernel/locking/lockdep.c:4566 [inline] __lock_acquire+0x13c2/0x3b10 kernel/locking/lockdep.c:5090 lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 __lock_task_sighand+0xc2/0x340 kernel/signal.c:1422 lock_task_sighand include/linux/sched/signal.h:748 [inline] do_send_sig_info kernel/signal.c:1309 [inline] group_send_sig_info+0x288/0x300 kernel/signal.c:1460 bpf_send_signal_common+0x2e4/0x3a0 kernel/trace/bpf_trace.c:877 ____bpf_send_signal kernel/trace/bpf_trace.c:882 [inline] bpf_send_signal+0x19/0x20 kernel/trace/bpf_trace.c:880 bpf_prog_7becd524ae48fd9c+0x22/0x24 bpf_dispatcher_nop_func include/linux/bpf.h:1196 [inline] __bpf_prog_run include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2311 [inline] bpf_trace_run2+0x14e/0x410 kernel/trace/bpf_trace.c:2350 trace_kfree include/trace/events/kmem.h:94 [inline] kfree+0xf6/0x150 mm/slab_common.c:1043 security_task_free+0x88/0xe0 security/security.c:2974 __put_task_struct+0x120/0x3d0 kernel/fork.c:994 put_task_struct include/linux/sched/task.h:136 [inline] put_task_struct include/linux/sched/task.h:123 [inline] delayed_put_task_struct+0x22c/0x2d0 kernel/exit.c:227 rcu_do_batch kernel/rcu/tree.c:2158 [inline] rcu_core+0x828/0x16b0 kernel/rcu/tree.c:2431 __do_softirq+0x216/0x8d5 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0xb5/0x120 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:27 [inline] RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0xc/0x60 kernel/kcov.c:207 Code: 1e fa 48 8b be b0 01 00 00 e8 b0 ff ff ff 31 c0 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 65 48 8b 15 a4 ad 7b 7e <65> 8b 05 a5 ad 7b 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74 RSP: 0018:ffffc900039ff438 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffc900039ff518 RCX: ffffffff813a37bd RDX: ffff88807492d940 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000002 R12: ffffffff813a6062 R13: 0000000000000000 R14: fffff5200073fea4 R15: ffffc900039ff54d unwind_next_frame+0x474/0x2390 arch/x86/kernel/unwind_orc.c:494 __unwind_start+0x5a2/0x880 arch/x86/kernel/unwind_orc.c:760 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xaf/0x170 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x24/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3452 [inline] kmem_cache_alloc_node+0x180/0x330 mm/slub.c:3497 __alloc_skb+0x287/0x330 net/core/skbuff.c:641 alloc_skb_fclone include/linux/skbuff.h:1336 [inline] tcp_stream_alloc_skb+0x34/0x560 net/ipv4/tcp.c:871 tcp_sendmsg_locked+0xeb2/0x3460 net/ipv4/tcp.c:1153 tcp_sendmsg+0x2e/0x40 net/ipv4/tcp.c:1340 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 sock_write_iter+0x29b/0x3d0 net/socket.c:1158 call_write_iter include/linux/fs.h:2021 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x64d/0xdf0 fs/read_write.c:584 ksys_write+0x1f0/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a RIP: 0033:0x7f0c64716bf2 Code: 89 c7 48 89 44 24 08 e8 7b 34 fa ff 48 8b 44 24 08 48 83 c4 28 c3 c3 64 8b 04 25 18 00 00 00 85 c0 75 20 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 6f 48 8b 15 07 a2 0d 00 f7 d8 64 89 02 48 83 RSP: 002b:00007ffd638601b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000002c RCX: 00007f0c64716bf2 RDX: 000000000000002c RSI: 00005622a1aa5960 RDI: 0000000000000004 RBP: 00005622a1aae3f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00005622a127caa4 R13: 000000000000004c R14: 00005622a127d3e8 R15: 00007ffd63860228 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: fa cli 1: 48 8b be b0 01 00 00 mov 0x1b0(%rsi),%rdi 8: e8 b0 ff ff ff call 0xffffffbd d: 31 c0 xor %eax,%eax f: c3 ret 10: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 17: 00 00 00 00 1b: 66 90 xchg %ax,%ax 1d: f3 0f 1e fa endbr64 21: 65 48 8b 15 a4 ad 7b mov %gs:0x7e7bada4(%rip),%rdx # 0x7e7badcd 28: 7e * 29: 65 8b 05 a5 ad 7b 7e mov %gs:0x7e7bada5(%rip),%eax # 0x7e7badd5 <-- trapping instruction 30: a9 00 01 ff 00 test $0xff0100,%eax 35: 48 8b 34 24 mov (%rsp),%rsi 39: 74 0f je 0x4a 3b: f6 c4 01 test $0x1,%ah 3e: 74 .byte 0x74