======================================================== WARNING: possible irq lock inversion dependency detected 5.3.0+ #0 Not tainted -------------------------------------------------------- syz-executor.4/8479 just changed the state of lock: ffff8880570f3b58 (&(&ctx->ctx_lock)->rlock){..-.}, at: spin_lock_irq include/linux/spinlock.h:363 [inline] ffff8880570f3b58 (&(&ctx->ctx_lock)->rlock){..-.}, at: free_ioctx_users+0x33/0x1d0 fs/aio.c:618 but this lock took another, SOFTIRQ-unsafe lock in the past: (&fiq->waitq){+.+.} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&fiq->waitq); local_irq_disable(); lock(&(&ctx->ctx_lock)->rlock); lock(&fiq->waitq); lock(&(&ctx->ctx_lock)->rlock); *** DEADLOCK *** 4 locks held by syz-executor.4/8479: #0: ffff888093f38f40 (&p->lock){+.+.}, at: seq_read+0x6e/0xd70 fs/seq_file.c:161 #1: ffffffff888d3900 (rcu_read_lock){....}, at: rcu_lock_acquire+0x9/0x40 include/linux/rcupdate.h:207 #2: ffffffff888d3940 (rcu_callback){....}, at: rcu_lock_acquire+0x4/0x30 include/linux/rcupdate.h:207 #3: ffffffff888d38d8 (rcu_read_lock_sched){....}, at: rcu_lock_acquire+0x9/0x40 include/linux/rcupdate.h:207 the shortest dependencies between 2nd lock and 1st lock: -> (&fiq->waitq){+.+.} { HARDIRQ-ON-W at: lock_acquire+0x158/0x250 kernel/locking/lockdep.c:4487 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] flush_bg_queue fs/fuse/dev.c:415 [inline] fuse_request_queue_background+0x673/0xc60 fs/fuse/dev.c:676 fuse_request_send_background+0x56/0x100 fs/fuse/dev.c:687 cuse_send_init fs/fuse/cuse.c:459 [inline] cuse_channel_open+0x485/0x660 fs/fuse/cuse.c:519 misc_open+0x3ef/0x440 drivers/char/misc.c:141 chrdev_open+0x509/0x590 fs/char_dev.c:414 do_dentry_open+0x73b/0xf90 fs/open.c:797 vfs_open+0x73/0x80 fs/open.c:906 do_last fs/namei.c:3408 [inline] path_openat+0x1397/0x4460 fs/namei.c:3525 do_filp_open+0x192/0x3d0 fs/namei.c:3555 do_sys_open+0x29f/0x560 fs/open.c:1089 __do_sys_openat fs/open.c:1116 [inline] __se_sys_openat fs/open.c:1110 [inline] __x64_sys_openat+0xa2/0xb0 fs/open.c:1110 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe SOFTIRQ-ON-W at: lock_acquire+0x158/0x250 kernel/locking/lockdep.c:4487 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] flush_bg_queue fs/fuse/dev.c:415 [inline] fuse_request_queue_background+0x673/0xc60 fs/fuse/dev.c:676 fuse_request_send_background+0x56/0x100 fs/fuse/dev.c:687 cuse_send_init fs/fuse/cuse.c:459 [inline] cuse_channel_open+0x485/0x660 fs/fuse/cuse.c:519 misc_open+0x3ef/0x440 drivers/char/misc.c:141 chrdev_open+0x509/0x590 fs/char_dev.c:414 do_dentry_open+0x73b/0xf90 fs/open.c:797 vfs_open+0x73/0x80 fs/open.c:906 do_last fs/namei.c:3408 [inline] path_openat+0x1397/0x4460 fs/namei.c:3525 do_filp_open+0x192/0x3d0 fs/namei.c:3555 do_sys_open+0x29f/0x560 fs/open.c:1089 __do_sys_openat fs/open.c:1116 [inline] __se_sys_openat fs/open.c:1110 [inline] __x64_sys_openat+0xa2/0xb0 fs/open.c:1110 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe INITIAL USE at: lock_acquire+0x158/0x250 kernel/locking/lockdep.c:4487 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] flush_bg_queue fs/fuse/dev.c:415 [inline] fuse_request_queue_background+0x673/0xc60 fs/fuse/dev.c:676 fuse_request_send_background+0x56/0x100 fs/fuse/dev.c:687 cuse_send_init fs/fuse/cuse.c:459 [inline] cuse_channel_open+0x485/0x660 fs/fuse/cuse.c:519 misc_open+0x3ef/0x440 drivers/char/misc.c:141 chrdev_open+0x509/0x590 fs/char_dev.c:414 do_dentry_open+0x73b/0xf90 fs/open.c:797 vfs_open+0x73/0x80 fs/open.c:906 do_last fs/namei.c:3408 [inline] path_openat+0x1397/0x4460 fs/namei.c:3525 do_filp_open+0x192/0x3d0 fs/namei.c:3555 do_sys_open+0x29f/0x560 fs/open.c:1089 __do_sys_openat fs/open.c:1116 [inline] __se_sys_openat fs/open.c:1110 [inline] __x64_sys_openat+0xa2/0xb0 fs/open.c:1110 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe } ... key at: [] fuse_iqueue_init.__key+0x0/0x10 ... acquired at: lock_acquire+0x158/0x250 kernel/locking/lockdep.c:4487 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] aio_poll fs/aio.c:1751 [inline] __io_submit_one fs/aio.c:1825 [inline] io_submit_one+0x108c/0x1970 fs/aio.c:1862 __do_sys_io_submit fs/aio.c:1921 [inline] __se_sys_io_submit+0x12f/0x240 fs/aio.c:1891 __x64_sys_io_submit+0x7b/0x90 fs/aio.c:1891 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> (&(&ctx->ctx_lock)->rlock){..-.} { IN-SOFTIRQ-W at: lock_acquire+0x158/0x250 kernel/locking/lockdep.c:4487 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline] _raw_spin_lock_irq+0x6a/0x80 kernel/locking/spinlock.c:167 spin_lock_irq include/linux/spinlock.h:363 [inline] free_ioctx_users+0x33/0x1d0 fs/aio.c:618 percpu_ref_put_many include/linux/percpu-refcount.h:293 [inline] percpu_ref_put+0x1c6/0x1d0 include/linux/percpu-refcount.h:309 percpu_ref_call_confirm_rcu lib/percpu-refcount.c:130 [inline] percpu_ref_switch_to_atomic_rcu+0x344/0x420 lib/percpu-refcount.c:165 __rcu_reclaim kernel/rcu/rcu.h:222 [inline] rcu_do_batch kernel/rcu/tree.c:2157 [inline] rcu_core+0x843/0x1050 kernel/rcu/tree.c:2377 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2386 __do_softirq+0x333/0x7c4 arch/x86/include/asm/paravirt.h:766 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x227/0x230 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x113/0x280 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 arch_local_irq_enable arch/x86/include/asm/paravirt.h:766 [inline] __local_bh_enable_ip+0x16d/0x240 kernel/softirq.c:194 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline] _raw_spin_unlock_bh+0x34/0x40 kernel/locking/spinlock.c:207 spin_unlock_bh include/linux/spinlock.h:383 [inline] igmp_mcf_get_next+0xc9/0x4a0 net/ipv4/igmp.c:2914 igmp_mcf_get_idx net/ipv4/igmp.c:2940 [inline] igmp_mcf_seq_start+0xf3/0x140 net/ipv4/igmp.c:2949 seq_read+0x452/0xd70 fs/seq_file.c:224 proc_reg_read+0x1e2/0x2d0 fs/proc/inode.c:223 do_loop_readv_writev fs/read_write.c:714 [inline] do_iter_read+0x4b1/0x5b0 fs/read_write.c:935 vfs_readv fs/read_write.c:997 [inline] do_preadv+0x178/0x290 fs/read_write.c:1089 __do_sys_preadv fs/read_write.c:1139 [inline] __se_sys_preadv fs/read_write.c:1134 [inline] __x64_sys_preadv+0x9e/0xb0 fs/read_write.c:1134 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe INITIAL USE at: lock_acquire+0x158/0x250 kernel/locking/lockdep.c:4487 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline] _raw_spin_lock_irq+0x6a/0x80 kernel/locking/spinlock.c:167 spin_lock_irq include/linux/spinlock.h:363 [inline] aio_poll fs/aio.c:1749 [inline] __io_submit_one fs/aio.c:1825 [inline] io_submit_one+0x1057/0x1970 fs/aio.c:1862 __do_sys_io_submit fs/aio.c:1921 [inline] __se_sys_io_submit+0x12f/0x240 fs/aio.c:1891 __x64_sys_io_submit+0x7b/0x90 fs/aio.c:1891 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe } ... key at: [] ioctx_alloc.__key+0x0/0x10 ... acquired at: mark_lock_irq kernel/locking/lockdep.c:3317 [inline] mark_lock+0x46b/0x1650 kernel/locking/lockdep.c:3666 mark_usage kernel/locking/lockdep.c:3566 [inline] __lock_acquire+0x5a0/0x1be0 kernel/locking/lockdep.c:3909 lock_acquire+0x158/0x250 kernel/locking/lockdep.c:4487 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline] _raw_spin_lock_irq+0x6a/0x80 kernel/locking/spinlock.c:167 spin_lock_irq include/linux/spinlock.h:363 [inline] free_ioctx_users+0x33/0x1d0 fs/aio.c:618 percpu_ref_put_many include/linux/percpu-refcount.h:293 [inline] percpu_ref_put+0x1c6/0x1d0 include/linux/percpu-refcount.h:309 percpu_ref_call_confirm_rcu lib/percpu-refcount.c:130 [inline] percpu_ref_switch_to_atomic_rcu+0x344/0x420 lib/percpu-refcount.c:165 __rcu_reclaim kernel/rcu/rcu.h:222 [inline] rcu_do_batch kernel/rcu/tree.c:2157 [inline] rcu_core+0x843/0x1050 kernel/rcu/tree.c:2377 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2386 __do_softirq+0x333/0x7c4 arch/x86/include/asm/paravirt.h:766 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x227/0x230 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x113/0x280 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 arch_local_irq_enable arch/x86/include/asm/paravirt.h:766 [inline] __local_bh_enable_ip+0x16d/0x240 kernel/softirq.c:194 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline] _raw_spin_unlock_bh+0x34/0x40 kernel/locking/spinlock.c:207 spin_unlock_bh include/linux/spinlock.h:383 [inline] igmp_mcf_get_next+0xc9/0x4a0 net/ipv4/igmp.c:2914 igmp_mcf_get_idx net/ipv4/igmp.c:2940 [inline] igmp_mcf_seq_start+0xf3/0x140 net/ipv4/igmp.c:2949 seq_read+0x452/0xd70 fs/seq_file.c:224 proc_reg_read+0x1e2/0x2d0 fs/proc/inode.c:223 do_loop_readv_writev fs/read_write.c:714 [inline] do_iter_read+0x4b1/0x5b0 fs/read_write.c:935 vfs_readv fs/read_write.c:997 [inline] do_preadv+0x178/0x290 fs/read_write.c:1089 __do_sys_preadv fs/read_write.c:1139 [inline] __se_sys_preadv fs/read_write.c:1134 [inline] __x64_sys_preadv+0x9e/0xb0 fs/read_write.c:1134 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe stack backtrace: CPU: 0 PID: 8479 Comm: syz-executor.4 Not tainted 5.3.0+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x2f8 lib/dump_stack.c:113 print_irq_inversion_bug+0x940/0xb80 kernel/locking/lockdep.c:3179 check_usage_forwards+0x144/0x240 kernel/locking/lockdep.c:3204 mark_lock_irq kernel/locking/lockdep.c:3317 [inline] mark_lock+0x46b/0x1650 kernel/locking/lockdep.c:3666 mark_usage kernel/locking/lockdep.c:3566 [inline] __lock_acquire+0x5a0/0x1be0 kernel/locking/lockdep.c:3909 lock_acquire+0x158/0x250 kernel/locking/lockdep.c:4487 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline] _raw_spin_lock_irq+0x6a/0x80 kernel/locking/spinlock.c:167 spin_lock_irq include/linux/spinlock.h:363 [inline] free_ioctx_users+0x33/0x1d0 fs/aio.c:618 percpu_ref_put_many include/linux/percpu-refcount.h:293 [inline] percpu_ref_put+0x1c6/0x1d0 include/linux/percpu-refcount.h:309 percpu_ref_call_confirm_rcu lib/percpu-refcount.c:130 [inline] percpu_ref_switch_to_atomic_rcu+0x344/0x420 lib/percpu-refcount.c:165 __rcu_reclaim kernel/rcu/rcu.h:222 [inline] rcu_do_batch kernel/rcu/tree.c:2157 [inline] rcu_core+0x843/0x1050 kernel/rcu/tree.c:2377 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2386 __do_softirq+0x333/0x7c4 arch/x86/include/asm/paravirt.h:766 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x227/0x230 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x113/0x280 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 RIP: 0010:should_resched arch/x86/include/asm/preempt.h:102 [inline] RIP: 0010:__local_bh_enable_ip+0x16d/0x240 kernel/softirq.c:196 Code: e8 03 42 80 3c 28 00 74 0c 48 c7 c7 c0 8b 8a 88 e8 18 5c 65 00 48 83 3d e0 3d 43 07 00 0f 84 d0 00 00 00 fb 66 0f 1f 44 00 00 <65> 8b 05 d8 af ba 7e 85 c0 75 05 e8 b3 10 b9 ff 5b 41 5c 41 5d 41 RSP: 0018:ffff88805546fae0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff1115178 RBX: ffff888055466914 RCX: ffffffff8158ef97 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8880554668c0 RBP: ffff88805546fb08 R08: ffff8880554668d8 R09: fffffbfff12bb0ad R10: fffffbfff12bb0ad R11: 0000000000000000 R12: ffff8880554668e0 R13: dffffc0000000000 R14: ffffffff8652faa9 R15: 0000000000000200 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline] _raw_spin_unlock_bh+0x34/0x40 kernel/locking/spinlock.c:207 spin_unlock_bh include/linux/spinlock.h:383 [inline] igmp_mcf_get_next+0xc9/0x4a0 net/ipv4/igmp.c:2914 igmp_mcf_get_idx net/ipv4/igmp.c:2940 [inline] igmp_mcf_seq_start+0xf3/0x140 net/ipv4/igmp.c:2949 seq_read+0x452/0xd70 fs/seq_file.c:224 proc_reg_read+0x1e2/0x2d0 fs/proc/inode.c:223 do_loop_readv_writev fs/read_write.c:714 [inline] do_iter_read+0x4b1/0x5b0 fs/read_write.c:935 vfs_readv fs/read_write.c:997 [inline] do_preadv+0x178/0x290 fs/read_write.c:1089 __do_sys_preadv fs/read_write.c:1139 [inline] __se_sys_preadv fs/read_write.c:1134 [inline] __x64_sys_preadv+0x9e/0xb0 fs/read_write.c:1134 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459a09 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f490bdc9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a09 RDX: 10000000000002a1 RSI: 0000000020000480 RDI: 0000000000000008 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000010400003 R11: 0000000000000246 R12: 00007f490bdca6d4 R13: 00000000004c6d09 R14: 00000000004dc098 R15: 00000000ffffffff