================================ WARNING: inconsistent lock state 6.1.94-syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz-executor.3/3966 [HC0[0]:SC1[1]:HE0:SE0] takes: ffff8880b9835e90 (lock#10){+.?.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] ffff8880b9835e90 (lock#10){+.?.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x84/0x670 mm/mmap_lock.c:237 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x9d/0x670 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:137 [inline] get_mmap_lock_carefully mm/memory.c:5304 [inline] lock_mm_and_find_vma+0x219/0x2e0 mm/memory.c:5366 do_user_addr_fault arch/x86/mm/fault.c:1312 [inline] handle_page_fault arch/x86/mm/fault.c:1431 [inline] exc_page_fault+0x169/0x620 arch/x86/mm/fault.c:1487 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 irq event stamp: 3749 hardirqs last enabled at (3748): [] handle_softirqs+0x1ef/0xa40 kernel/softirq.c:555 hardirqs last disabled at (3749): [] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:117 [inline] hardirqs last disabled at (3749): [] _raw_spin_lock_irq+0xa9/0x110 kernel/locking/spinlock.c:170 softirqs last enabled at (3634): [] __fpu_restore_sig arch/x86/kernel/fpu/signal.c:359 [inline] softirqs last enabled at (3634): [] fpu__restore_sig+0x510/0x1300 arch/x86/kernel/fpu/signal.c:493 softirqs last disabled at (3747): [] __do_softirq kernel/softirq.c:605 [inline] softirqs last disabled at (3747): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last disabled at (3747): [] __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(lock#10); lock(lock#10); *** DEADLOCK *** 3 locks held by syz-executor.3/3966: #0: ffff8880b9828358 (&base->lock){-.-.}-{2:2}, at: __run_timers+0x111/0x890 kernel/time/timer.c:1802 #1: ffffffff8d12acc0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #1: ffffffff8d12acc0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #1: ffffffff8d12acc0 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xbe/0x6a0 kernel/trace/bpf_trace.c:134 #2: ffff8880769035d8 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #2: ffff8880769035d8 (&mm->mmap_lock){++++}-{3:3}, at: stack_map_get_build_id_offset+0x232/0x9c0 kernel/bpf/stackmap.c:144 stack backtrace: CPU: 0 PID: 3966 Comm: syz-executor.3 Not tainted 6.1.94-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 valid_state+0x136/0x1c0 kernel/locking/lockdep.c:3969 mark_lock_irq+0xa8/0xba0 kernel/locking/lockdep.c:4172 mark_lock+0x21c/0x340 kernel/locking/lockdep.c:4628 __lock_acquire+0xb7f/0x1f80 kernel/locking/lockdep.c:5003 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x9d/0x670 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:137 [inline] stack_map_get_build_id_offset+0x99e/0x9c0 kernel/bpf/stackmap.c:144 __bpf_get_stack+0x495/0x570 kernel/bpf/stackmap.c:452 bpf_prog_e6cf5f9c69743609+0x3a/0x3e bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline] __bpf_prog_run include/linux/filter.h:596 [inline] bpf_prog_run include/linux/filter.h:610 [inline] bpf_prog_run_array include/linux/bpf.h:1635 [inline] trace_call_bpf+0x3c8/0x6a0 kernel/trace/bpf_trace.c:135 perf_trace_run_bpf_submit+0x7b/0x1d0 kernel/events/core.c:9924 perf_trace_timer_class+0x2c8/0x380 include/trace/events/timer.h:12 trace_timer_cancel include/trace/events/timer.h:138 [inline] debug_deactivate kernel/time/timer.c:832 [inline] detach_timer+0x2f4/0x380 kernel/time/timer.c:878 expire_timers kernel/time/timer.c:1538 [inline] __run_timers+0x60c/0x890 kernel/time/timer.c:1820 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571 __do_softirq kernel/softirq.c:605 [inline] invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654 irq_exit_rcu+0x5/0x20 kernel/softirq.c:666 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653 RIP: 0010:finish_task_switch+0x1d3/0x810 kernel/sched/core.c:5124 Code: 2e 0b 00 48 83 c4 08 4c 89 f7 e8 98 30 00 00 0f 1f 44 00 00 4c 89 f7 e8 7b 23 36 09 e8 06 1e 32 00 fb 49 8d bc 24 f8 15 00 00 <48> 89 f8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df 42 0f b6 04 28 RSP: 0000:ffffc90003b5fa08 EFLAGS: 00000286 RAX: 60fe184cc4fed900 RBX: ffff888076760034 RCX: ffffffff91c95103 RDX: dffffc0000000000 RSI: ffffffff8aec0240 RDI: ffff88807e8133b8 RBP: ffffc90003b5fa50 R08: dffffc0000000000 R09: ffffed1017307541 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807e811dc0 R13: 1ffff110173076eb R14: ffff8880b983aa00 R15: ffff8880b983b758 context_switch kernel/sched/core.c:5248 [inline] __schedule+0x1435/0x4550 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 do_nanosleep+0x192/0x5f0 kernel/time/hrtimer.c:2045 hrtimer_nanosleep+0x24d/0x490 kernel/time/hrtimer.c:2098 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1308 [inline] __se_sys_clock_nanosleep+0x323/0x3b0 kernel/time/posix-timers.c:1285 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fba8dea8335 Code: 24 0c 89 3c 24 48 89 4c 24 18 e8 f6 b9 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 8b 74 24 0c 8b 3c 24 b8 e6 00 00 00 0f 05 <44> 89 c7 48 89 04 24 e8 4f ba ff ff 48 8b 04 24 48 83 c4 28 f7 d8 RSP: 002b:00007ffc9fc9bb30 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 00007fba8dfb3f80 RCX: 00007fba8dea8335 RDX: 00007ffc9fc9bb70 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fba8dfb5980 R08: 0000000000000000 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000011191 R13: 00007fba8dfb3f8c R14: 0000000000000032 R15: 00007fba8dfb5980 ---------------- Code disassembly (best guess): 0: 2e 0b 00 cs or (%rax),%eax 3: 48 83 c4 08 add $0x8,%rsp 7: 4c 89 f7 mov %r14,%rdi a: e8 98 30 00 00 call 0x30a7 f: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 14: 4c 89 f7 mov %r14,%rdi 17: e8 7b 23 36 09 call 0x9362397 1c: e8 06 1e 32 00 call 0x321e27 21: fb sti 22: 49 8d bc 24 f8 15 00 lea 0x15f8(%r12),%rdi 29: 00 * 2a: 48 89 f8 mov %rdi,%rax <-- trapping instruction 2d: 48 c1 e8 03 shr $0x3,%rax 31: 49 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%r13 38: fc ff df 3b: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax