======================================================
WARNING: possible circular locking dependency detected
5.15.173-syzkaller #0 Not tainted
------------------------------------------------------
syz.0.416/5266 is trying to acquire lock:
ffff8880206705b8 (&trie->lock){-.-.}-{2:2}, at: trie_delete_elem+0x90/0x690 kernel/bpf/lpm_trie.c:450
but task is already holding lock:
ffff8880b912a218 (hrtimer_bases.lock){-.-.}-{2:2}, at: __run_hrtimer kernel/time/hrtimer.c:1692 [inline]
ffff8880b912a218 (hrtimer_bases.lock){-.-.}-{2:2}, at: __hrtimer_run_queues+0x662/0xcf0 kernel/time/hrtimer.c:1752
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hrtimer_bases.lock){-.-.}-{2:2}:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
lock_hrtimer_base kernel/time/hrtimer.c:173 [inline]
hrtimer_start_range_ns+0x105/0xc80 kernel/time/hrtimer.c:1299
hrtimer_start include/linux/hrtimer.h:420 [inline]
run_page_cache_worker kernel/rcu/tree.c:3488 [inline]
kvfree_call_rcu+0x6a0/0x8a0 kernel/rcu/tree.c:3599
rtnl_register_internal+0x443/0x530 net/core/rtnetlink.c:223
rtnl_register+0x32/0x70 net/core/rtnetlink.c:273
ip_rt_init+0x2e6/0x390 net/ipv4/route.c:3750
ip_init+0xa/0x20 net/ipv4/ip_output.c:1749
inet_init+0x27c/0x390 net/ipv4/af_inet.c:2009
do_one_initcall+0x22b/0x7a0 init/main.c:1302
do_initcall_level+0x157/0x210 init/main.c:1375
do_initcalls+0x49/0x90 init/main.c:1391
kernel_init_freeable+0x425/0x5c0 init/main.c:1615
kernel_init+0x19/0x290 init/main.c:1506
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
-> #1 (krc.lock){..-.}-{2:2}:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
krc_this_cpu_lock kernel/rcu/tree.c:3199 [inline]
add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3506 [inline]
kvfree_call_rcu+0x1b5/0x8a0 kernel/rcu/tree.c:3597
trie_delete_elem+0x520/0x690
0xffffffffa002acd2
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1916
__bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
__traceiter_kmem_cache_free+0x2e/0x50 include/trace/events/kmem.h:138
trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
kmem_cache_free+0x1ce/0x1f0 mm/slub.c:3516
kfree_skb include/linux/skbuff.h:1118 [inline]
tipc_msg_reverse+0x191/0x920 net/tipc/msg.c:672
tipc_sk_respond+0x10d/0x310 net/tipc/socket.c:292
tsk_rej_rx_queue net/tipc/socket.c:313 [inline]
__tipc_shutdown+0xa90/0x1640 net/tipc/socket.c:577
tipc_release+0x178/0x16d0 net/tipc/socket.c:642
__sock_release net/socket.c:649 [inline]
sock_close+0xcd/0x230 net/socket.c:1336
__fput+0x3fe/0x8e0 fs/file_table.c:280
task_work_run+0x129/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x106/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #0 (&trie->lock){-.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
trie_delete_elem+0x90/0x690 kernel/bpf/lpm_trie.c:450
bpf_prog_3c288c27723019b8+0x3d/0xf1c
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x19e/0x340 kernel/trace/bpf_trace.c:1915
trace_hrtimer_start include/trace/events/timer.h:199 [inline]
debug_activate kernel/time/hrtimer.c:476 [inline]
enqueue_hrtimer+0x324/0x390 kernel/time/hrtimer.c:1084
__run_hrtimer kernel/time/hrtimer.c:1705 [inline]
__hrtimer_run_queues+0x6b6/0xcf0 kernel/time/hrtimer.c:1752
hrtimer_interrupt+0x392/0x980 kernel/time/hrtimer.c:1814
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0x13b/0x4b0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0x4d/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
neigh_rcu_free_parms+0x0/0x80
rcu_do_batch kernel/rcu/tree.c:2523 [inline]
rcu_core+0xa15/0x1650 kernel/rcu/tree.c:2763
handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
__do_softirq kernel/softirq.c:592 [inline]
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
__sanitizer_cov_trace_pc+0x0/0x60
kernfs_name_hash fs/kernfs/dir.c:311 [inline]
kernfs_find_ns+0x296/0x500 fs/kernfs/dir.c:821
kernfs_iop_lookup+0x10b/0x2f0 fs/kernfs/dir.c:1133
lookup_one_qstr_excl+0x117/0x240 fs/namei.c:1563
filename_create+0x293/0x530 fs/namei.c:3836
do_mkdirat+0xb3/0x520 fs/namei.c:4080
__do_sys_mkdir fs/namei.c:4110 [inline]
__se_sys_mkdir fs/namei.c:4108 [inline]
__x64_sys_mkdir+0x6a/0x80 fs/namei.c:4108
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
other info that might help us debug this:
Chain exists of:
&trie->lock --> krc.lock --> hrtimer_bases.lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hrtimer_bases.lock);
lock(krc.lock);
lock(hrtimer_bases.lock);
lock(&trie->lock);
*** DEADLOCK ***
6 locks held by syz.0.416/5266:
#0: ffff8880767f2460 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x3b/0x80 fs/namespace.c:377
#1: ffff888061db4660 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:824 [inline]
#1: ffff888061db4660 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x25c/0x530 fs/namei.c:3835
#2: ffffffff8ca522b0 (kernfs_rwsem){++++}-{3:3}, at: kernfs_iop_lookup+0x4b/0x2f0 fs/kernfs/dir.c:1129
#3: ffffffff8c91fd20 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire+0x0/0x20
#4: ffff8880b912a218 (hrtimer_bases.lock){-.-.}-{2:2}, at: __run_hrtimer kernel/time/hrtimer.c:1692 [inline]
#4: ffff8880b912a218 (hrtimer_bases.lock){-.-.}-{2:2}, at: __hrtimer_run_queues+0x662/0xcf0 kernel/time/hrtimer.c:1752
#5: ffffffff8c91fc60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
stack backtrace:
CPU: 1 PID: 5266 Comm: syz.0.416 Not tainted 5.15.173-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
trie_delete_elem+0x90/0x690 kernel/bpf/lpm_trie.c:450
bpf_prog_3c288c27723019b8+0x3d/0xf1c
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x19e/0x340 kernel/trace/bpf_trace.c:1915
trace_hrtimer_start include/trace/events/timer.h:199 [inline]
debug_activate kernel/time/hrtimer.c:476 [inline]
enqueue_hrtimer+0x324/0x390 kernel/time/hrtimer.c:1084
__run_hrtimer kernel/time/hrtimer.c:1705 [inline]
__hrtimer_run_queues+0x6b6/0xcf0 kernel/time/hrtimer.c:1752
hrtimer_interrupt+0x392/0x980 kernel/time/hrtimer.c:1814
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0x13b/0x4b0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0x4d/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:neigh_rcu_free_parms+0x0/0x80 net/core/neighbour.c:1658
Code: ff be 04 00 00 00 e8 6f 40 b9 fb eb cb 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 4b ff ff ff e8 18 23 7a f9 e9 41 ff ff ff 0f 1f 00 <55> 41 56 53 48 89 fb e8 64 4a 30 f9 4c 8d 73 fc 4c 89 f7 be 04 00
RSP: 0018:ffffc90000dd0bf8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffff8880233c6a40 RCX: 1ffff920001ba0fc
RDX: dffffc0000000000 RSI: ffffffff8a8b3d20 RDI: ffff8880233c6a40
RBP: ffffc90000dd0e10 R08: dffffc0000000000 R09: fffffbfff20ec824
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000002
R13: ffffffff88502930 R14: 1ffff11004678d49 R15: ffff8880233c6a48
rcu_do_batch kernel/rcu/tree.c:2523 [inline]
rcu_core+0xa15/0x1650 kernel/rcu/tree.c:2763
handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
__do_softirq kernel/softirq.c:592 [inline]
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:202
Code: 1f 84 00 00 00 00 00 0f 1f 00 53 48 89 fb e8 17 00 00 00 48 8b 3d 88 f8 68 0c 48 89 de 5b e9 27 01 49 00 cc cc cc cc cc cc cc <48> 8b 04 24 65 48 8b 0d 14 fc 81 7e 65 8b 15 15 fc 81 7e 81 e2 00
RSP: 0018:ffffc900031c7c68 EFLAGS: 00000286
RAX: c82cc6c25d157a23 RBX: ffff888072ed0dfc RCX: c1a28e26df6ab207
RDX: c1a28e26df6ab201 RSI: ffff888072ed0dfc RDI: ffff888072ed0dfd
RBP: ffff888072ed0010 R08: ffffffff81fcad7a R09: fffffbfff194a44a
R10: 0000000000000000 R11: dffffc0000000001 R12: fa54988f2b955573
R13: 51fc1bab9995a64d R14: 0000000000000ded R15: dffffc0000000000
kernfs_name_hash fs/kernfs/dir.c:311 [inline]
kernfs_find_ns+0x296/0x500 fs/kernfs/dir.c:821
kernfs_iop_lookup+0x10b/0x2f0 fs/kernfs/dir.c:1133
lookup_one_qstr_excl+0x117/0x240 fs/namei.c:1563
filename_create+0x293/0x530 fs/namei.c:3836
do_mkdirat+0xb3/0x520 fs/namei.c:4080
__do_sys_mkdir fs/namei.c:4110 [inline]
__se_sys_mkdir fs/namei.c:4108 [inline]
__x64_sys_mkdir+0x6a/0x80 fs/namei.c:4108
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fd27847f759
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd2768f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 00007fd278636f80 RCX: 00007fd27847f759
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000000
RBP: 00007fd2784f275e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fd278636f80 R15: 00007ffef2b1dae8
----------------
Code disassembly (best guess), 1 bytes skipped:
0: be 04 00 00 00 mov $0x4,%esi
5: e8 6f 40 b9 fb call 0xfbb94079
a: eb cb jmp 0xffffffd7
c: 89 f9 mov %edi,%ecx
e: 80 e1 07 and $0x7,%cl
11: 80 c1 03 add $0x3,%cl
14: 38 c1 cmp %al,%cl
16: 0f 8c 4b ff ff ff jl 0xffffff67
1c: e8 18 23 7a f9 call 0xf97a2339
21: e9 41 ff ff ff jmp 0xffffff67
26: 0f 1f 00 nopl (%rax)
* 29: 55 push %rbp <-- trapping instruction
2a: 41 56 push %r14
2c: 53 push %rbx
2d: 48 89 fb mov %rdi,%rbx
30: e8 64 4a 30 f9 call 0xf9304a99
35: 4c 8d 73 fc lea -0x4(%rbx),%r14
39: 4c 89 f7 mov %r14,%rdi
3c: be .byte 0xbe
3d: 04 00 add $0x0,%al