------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
6.8.0-syzkaller-05236-g443574b03387 #0 Not tainted
------------------------------------------------------
dhcpcd-run-hook/11774 is trying to acquire lock:
ffffffff8e125be0 (console_owner){-...}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:303 [inline]
ffffffff8e125be0 (console_owner){-...}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:232 [inline]
ffffffff8e125be0 (console_owner){-...}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:286 [inline]
ffffffff8e125be0 (console_owner){-...}-{0:0}, at: console_flush_all+0x14a/0xec0 kernel/printk/printk.c:2948
but task is already holding lock:
ffff8880b953e158 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (&rq->__lock){-.-.}-{2:2}:
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559
raw_spin_rq_lock kernel/sched/sched.h:1385 [inline]
rq_lock kernel/sched/sched.h:1699 [inline]
task_fork_fair+0x61/0x1e0 kernel/sched/fair.c:12629
sched_cgroup_fork+0x37c/0x410 kernel/sched/core.c:4845
copy_process+0x2217/0x3df0 kernel/fork.c:2498
kernel_clone+0x21e/0x8d0 kernel/fork.c:2796
user_mode_thread+0x132/0x1a0 kernel/fork.c:2874
rest_init+0x27/0x300 init/main.c:695
arch_call_rest_init+0xe/0x10 init/main.c:831
start_kernel+0x47a/0x500 init/main.c:1077
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509
x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490
common_startup_64+0x13e/0x147
-> #3 (&p->pi_lock){-.-.}-{2:2}:
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline]
try_to_wake_up+0xb0/0x1470 kernel/sched/core.c:4262
__wake_up_common kernel/sched/wait.c:89 [inline]
__wake_up_common_lock+0x130/0x1e0 kernel/sched/wait.c:106
tty_port_default_wakeup+0xa6/0xf0 drivers/tty/tty_port.c:69
serial8250_tx_chars+0x6ad/0x8a0 drivers/tty/serial/8250/8250_port.c:1835
serial8250_handle_irq+0x558/0x710 drivers/tty/serial/8250/8250_port.c:1942
serial8250_default_handle_irq+0xd1/0x1f0 drivers/tty/serial/8250/8250_port.c:1962
serial8250_interrupt+0xa9/0x1f0 drivers/tty/serial/8250/8250_core.c:127
__handle_irq_event_percpu+0x28a/0xa30 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0x89/0x1f0 kernel/irq/handle.c:210
handle_edge_irq+0x25f/0xc20 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
handle_irq arch/x86/kernel/irq.c:238 [inline]
__common_interrupt+0x138/0x230 arch/x86/kernel/irq.c:257
common_interrupt+0xa5/0xd0 arch/x86/kernel/irq.c:247
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:667 [inline]
serial_port_runtime_resume+0x204/0x2b0 drivers/tty/serial/serial_port.c:41
__rpm_callback+0x2df/0x790 drivers/base/power/runtime.c:393
rpm_callback drivers/base/power/runtime.c:447 [inline]
rpm_resume+0x10b2/0x1af0 drivers/base/power/runtime.c:913
pm_runtime_work+0x147/0x210 drivers/base/power/runtime.c:978
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
-> #2 (&tty->write_wait){-.-.}-{2:2}:
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
__wake_up_common_lock+0x25/0x1e0 kernel/sched/wait.c:105
tty_port_default_wakeup+0xa6/0xf0 drivers/tty/tty_port.c:69
serial8250_tx_chars+0x6ad/0x8a0 drivers/tty/serial/8250/8250_port.c:1835
serial8250_handle_irq+0x558/0x710 drivers/tty/serial/8250/8250_port.c:1942
serial8250_default_handle_irq+0xd1/0x1f0 drivers/tty/serial/8250/8250_port.c:1962
serial8250_interrupt+0xa9/0x1f0 drivers/tty/serial/8250/8250_core.c:127
__handle_irq_event_percpu+0x28a/0xa30 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0x89/0x1f0 kernel/irq/handle.c:210
handle_edge_irq+0x25f/0xc20 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
handle_irq arch/x86/kernel/irq.c:238 [inline]
__common_interrupt+0x138/0x230 arch/x86/kernel/irq.c:257
common_interrupt+0xa5/0xd0 arch/x86/kernel/irq.c:247
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:667 [inline]
serial_port_runtime_resume+0x204/0x2b0 drivers/tty/serial/serial_port.c:41
__rpm_callback+0x2df/0x790 drivers/base/power/runtime.c:393
rpm_callback drivers/base/power/runtime.c:447 [inline]
rpm_resume+0x10b2/0x1af0 drivers/base/power/runtime.c:913
pm_runtime_work+0x147/0x210 drivers/base/power/runtime.c:978
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
-> #1 (&port_lock_key){-.-.}-{2:2}:
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
uart_port_lock_irqsave include/linux/serial_core.h:616 [inline]
serial8250_console_write+0x1a8/0x1840 drivers/tty/serial/8250/8250_port.c:3403
console_emit_next_record kernel/printk/printk.c:2890 [inline]
console_flush_all+0x80b/0xec0 kernel/printk/printk.c:2956
console_unlock+0x13b/0x4d0 kernel/printk/printk.c:3025
vprintk_emit+0x509/0x720 kernel/printk/printk.c:2292
_printk+0xd5/0x120 kernel/printk/printk.c:2317
register_console+0x70a/0xcd0 kernel/printk/printk.c:3531
univ8250_console_init+0x49/0x50 drivers/tty/serial/8250/8250_core.c:717
console_init+0x198/0x680 kernel/printk/printk.c:3677
start_kernel+0x2d3/0x500 init/main.c:1012
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509
x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490
common_startup_64+0x13e/0x147
-> #0 (console_owner){-...}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
console_lock_spinning_enable kernel/printk/printk.c:1843 [inline]
console_emit_next_record kernel/printk/printk.c:2884 [inline]
console_flush_all+0x7ba/0xec0 kernel/printk/printk.c:2956
console_unlock+0x13b/0x4d0 kernel/printk/printk.c:3025
vprintk_emit+0x509/0x720 kernel/printk/printk.c:2292
_printk+0xd5/0x120 kernel/printk/printk.c:2317
__report_bug lib/bug.c:195 [inline]
report_bug+0x346/0x500 lib/bug.c:219
handle_bug+0x3e/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x1a/0x50 arch/x86/kernel/traps.c:260
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
__local_bh_disable_ip+0x1f6/0x220 kernel/softirq.c:307
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:125 [inline]
_raw_spin_lock_bh+0x1c/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
__sock_map_delete net/core/sock_map.c:414 [inline]
sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446
bpf_prog_2c29ac5cdc6b1842+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:657 [inline]
bpf_prog_run include/linux/filter.h:664 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420
trace_contention_end+0xf6/0x120 include/trace/events/lock.h:122
__pv_queued_spin_lock_slowpath+0x939/0xc60 kernel/locking/qspinlock.c:560
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116
raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559
raw_spin_rq_lock kernel/sched/sched.h:1385 [inline]
rq_lock kernel/sched/sched.h:1699 [inline]
ttwu_queue kernel/sched/core.c:4055 [inline]
try_to_wake_up+0x7d3/0x1470 kernel/sched/core.c:4378
hrtimer_wakeup+0x62/0x80 kernel/time/hrtimer.c:1946
__run_hrtimer kernel/time/hrtimer.c:1692 [inline]
__hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756
hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1818
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
__sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
vma_pages include/linux/mm.h:3498 [inline]
vma_last_pgoff mm/interval_tree.c:20 [inline]
vma_interval_tree_augment_compute_max mm/interval_tree.c:23 [inline]
vma_interval_tree_augment_rotate+0x9f/0x1c0 mm/interval_tree.c:23
mmap_region+0x1755/0x1fa0 mm/mmap.c:2908
do_mmap+0x7af/0xe60 mm/mmap.c:1387
vm_mmap_pgoff+0x1e3/0x420 mm/util.c:573
elf_map fs/binfmt_elf.c:385 [inline]
elf_load+0x25d/0x6f0 fs/binfmt_elf.c:408
load_elf_binary+0xf3d/0x2590 fs/binfmt_elf.c:1132
search_binary_handler fs/exec.c:1777 [inline]
exec_binprm fs/exec.c:1819 [inline]
bprm_execve+0xaf8/0x1790 fs/exec.c:1871
do_execveat_common+0x553/0x700 fs/exec.c:1978
do_execve fs/exec.c:2052 [inline]
__do_sys_execve fs/exec.c:2128 [inline]
__se_sys_execve fs/exec.c:2123 [inline]
__x64_sys_execve+0x92/0xb0 fs/exec.c:2123
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75
other info that might help us debug this:
Chain exists of:
console_owner --> &p->pi_lock --> &rq->__lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock(console_owner);
*** DEADLOCK ***
7 locks held by dhcpcd-run-hook/11774:
#0: ffff88807af7a7a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:124 [inline]
#0: ffff88807af7a7a0 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x182/0x420 mm/util.c:571
#1: ffff888026efe0d0 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: i_mmap_lock_write include/linux/fs.h:503 [inline]
#1: ffff888026efe0d0 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: mmap_region+0x1419/0x1fa0 mm/mmap.c:2903
#2: ffff888029c58a10 (&p->pi_lock){-.-.}-{2:2}, at: class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline]
#2: ffff888029c58a10 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0xb0/0x1470 kernel/sched/core.c:4262
#3: ffff8880b953e158 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline]
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x114/0x420 kernel/trace/bpf_trace.c:2420
#5: ffffffff8e00d500 (console_lock){+.+.}-{0:0}, at: _printk+0xd5/0x120 kernel/printk/printk.c:2317
#6: ffffffff8e00d130 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:303 [inline]
#6: ffffffff8e00d130 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:232 [inline]
#6: ffffffff8e00d130 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:286 [inline]
#6: ffffffff8e00d130 (console_srcu){....}-{0:0}, at: console_flush_all+0x14a/0xec0 kernel/printk/printk.c:2948
stack backtrace:
CPU: 1 PID: 11774 Comm: dhcpcd-run-hook Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
console_lock_spinning_enable kernel/printk/printk.c:1843 [inline]
console_emit_next_record kernel/printk/printk.c:2884 [inline]
console_flush_all+0x7ba/0xec0 kernel/printk/printk.c:2956
console_unlock+0x13b/0x4d0 kernel/printk/printk.c:3025
vprintk_emit+0x509/0x720 kernel/printk/printk.c:2292
_printk+0xd5/0x120 kernel/printk/printk.c:2317
__report_bug lib/bug.c:195 [inline]
report_bug+0x346/0x500 lib/bug.c:219
handle_bug+0x3e/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x1a/0x50 arch/x86/kernel/traps.c:260
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
RIP: 0010:__local_bh_disable_ip+0x1f6/0x220 kernel/softirq.c:307
Code: 2c 0b 00 65 48 8b 04 25 28 00 00 00 48 3b 84 24 80 00 00 00 75 33 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 e9 99 fe ff ff e8 4d 84 16 0a 41 f7 c6 00 02 00 00 0f 85
RSP: 0018:ffffc90000a087a0 EFLAGS: 00010006
RAX: 0000000080010005 RBX: ffffffff895fa967 RCX: ffff88802bfd3c00
RDX: ffff88802bfd3c00 RSI: 0000000000000201 RDI: ffffffff895fa967
RBP: ffffc90000a08868 R08: ffffffff895fa92d R09: 1ffffffff2598ea0
R10: dffffc0000000000 R11: ffffffffa0001f98 R12: dffffc0000000000
R13: 1ffff920001410f8 R14: ffffc90000a08800 R15: 0000000000000201
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:125 [inline]
_raw_spin_lock_bh+0x1c/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
__sock_map_delete net/core/sock_map.c:414 [inline]
sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446
bpf_prog_2c29ac5cdc6b1842+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:657 [inline]
bpf_prog_run include/linux/filter.h:664 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420
trace_contention_end+0xf6/0x120 include/trace/events/lock.h:122
__pv_queued_spin_lock_slowpath+0x939/0xc60 kernel/locking/qspinlock.c:560
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116
raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559
raw_spin_rq_lock kernel/sched/sched.h:1385 [inline]
rq_lock kernel/sched/sched.h:1699 [inline]
ttwu_queue kernel/sched/core.c:4055 [inline]
try_to_wake_up+0x7d3/0x1470 kernel/sched/core.c:4378
hrtimer_wakeup+0x62/0x80 kernel/time/hrtimer.c:1946
__run_hrtimer kernel/time/hrtimer.c:1692 [inline]
__hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756
hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1818
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
__sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:vma_pages include/linux/mm.h:3498 [inline]
RIP: 0010:vma_last_pgoff mm/interval_tree.c:20 [inline]
RIP: 0010:vma_interval_tree_augment_compute_max mm/interval_tree.c:23 [inline]
RIP: 0010:vma_interval_tree_augment_rotate+0x9f/0x1c0 mm/interval_tree.c:23
Code: e8 d6 2f 1b 00 4d 8d 67 c0 49 8b 6f 40 49 8d 5f c8 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 b4 2f 1b 00 4c 8b 2b <4c> 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74
RSP: 0018:ffffc90003397620 EFLAGS: 00000246
RAX: 1ffff1100af421e1 RBX: ffff888057a10f08 RCX: ffff88802bfd3c00
RDX: 0000000000000000 RSI: ffff888057a10d40 RDI: ffff888057a10f80
RBP: 0000000000000000 R08: ffff888057a10b57 R09: 0000000000000000
R10: ffff888057a10b48 R11: ffffffff81dd07a0 R12: ffff888057a10f00
R13: 000056053aab6000 R14: 1ffff1100af421eb R15: ffff888057a10f40
mmap_region+0x1755/0x1fa0 mm/mmap.c:2908
do_mmap+0x7af/0xe60 mm/mmap.c:1387
vm_mmap_pgoff+0x1e3/0x420 mm/util.c:573
elf_map fs/binfmt_elf.c:385 [inline]
elf_load+0x25d/0x6f0 fs/binfmt_elf.c:408
load_elf_binary+0xf3d/0x2590 fs/binfmt_elf.c:1132
search_binary_handler fs/exec.c:1777 [inline]
exec_binprm fs/exec.c:1819 [inline]
bprm_execve+0xaf8/0x1790 fs/exec.c:1871
do_execveat_common+0x553/0x700 fs/exec.c:1978
do_execve fs/exec.c:2052 [inline]
__do_sys_execve fs/exec.c:2128 [inline]
__se_sys_execve fs/exec.c:2123 [inline]
__x64_sys_execve+0x92/0xb0 fs/exec.c:2123
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7faa06406ef7
Code: Unable to access opcode bytes at 0x7faa06406ecd.
RSP: 002b:00007faa062b0e78 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00007ffde59c03b0 RCX: 00007faa06406ef7
RDX: 00005607c116f6e0 RSI: 00007ffde59c08a0 RDI: 00005607b3cf3df6
RBP: 00007faa062b0ff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffde59c06c8
R13: 00007faa062b0f28 R14: 0000000000000000 R15: 0000000000000041
WARNING: CPU: 1 PID: 11774 at kernel/softirq.c:307 __local_bh_disable_ip+0x1f6/0x220 kernel/softirq.c:307
Modules linked in:
CPU: 1 PID: 11774 Comm: dhcpcd-run-hook Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:__local_bh_disable_ip+0x1f6/0x220 kernel/softirq.c:307
Code: 2c 0b 00 65 48 8b 04 25 28 00 00 00 48 3b 84 24 80 00 00 00 75 33 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 e9 99 fe ff ff e8 4d 84 16 0a 41 f7 c6 00 02 00 00 0f 85
RSP: 0018:ffffc90000a087a0 EFLAGS: 00010006
RAX: 0000000080010005 RBX: ffffffff895fa967 RCX: ffff88802bfd3c00
RDX: ffff88802bfd3c00 RSI: 0000000000000201 RDI: ffffffff895fa967
RBP: ffffc90000a08868 R08: ffffffff895fa92d R09: 1ffffffff2598ea0
R10: dffffc0000000000 R11: ffffffffa0001f98 R12: dffffc0000000000
R13: 1ffff920001410f8 R14: ffffc90000a08800 R15: 0000000000000201
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faa06406ecd CR3: 0000000048c66000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:125 [inline]
_raw_spin_lock_bh+0x1c/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
__sock_map_delete net/core/sock_map.c:414 [inline]
sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446
bpf_prog_2c29ac5cdc6b1842+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:657 [inline]
bpf_prog_run include/linux/filter.h:664 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420
trace_contention_end+0xf6/0x120 include/trace/events/lock.h:122
__pv_queued_spin_lock_slowpath+0x939/0xc60 kernel/locking/qspinlock.c:560
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116
raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559
raw_spin_rq_lock kernel/sched/sched.h:1385 [inline]
rq_lock kernel/sched/sched.h:1699 [inline]
ttwu_queue kernel/sched/core.c:4055 [inline]
try_to_wake_up+0x7d3/0x1470 kernel/sched/core.c:4378
hrtimer_wakeup+0x62/0x80 kernel/time/hrtimer.c:1946
__run_hrtimer kernel/time/hrtimer.c:1692 [inline]
__hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756
hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1818
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
__sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:vma_pages include/linux/mm.h:3498 [inline]
RIP: 0010:vma_last_pgoff mm/interval_tree.c:20 [inline]
RIP: 0010:vma_interval_tree_augment_compute_max mm/interval_tree.c:23 [inline]
RIP: 0010:vma_interval_tree_augment_rotate+0x9f/0x1c0 mm/interval_tree.c:23
Code: e8 d6 2f 1b 00 4d 8d 67 c0 49 8b 6f 40 49 8d 5f c8 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 b4 2f 1b 00 4c 8b 2b <4c> 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74
RSP: 0018:ffffc90003397620 EFLAGS: 00000246
RAX: 1ffff1100af421e1 RBX: ffff888057a10f08 RCX: ffff88802bfd3c00
RDX: 0000000000000000 RSI: ffff888057a10d40 RDI: ffff888057a10f80
RBP: 0000000000000000 R08: ffff888057a10b57 R09: 0000000000000000
R10: ffff888057a10b48 R11: ffffffff81dd07a0 R12: ffff888057a10f00
R13: 000056053aab6000 R14: 1ffff1100af421eb R15: ffff888057a10f40
mmap_region+0x1755/0x1fa0 mm/mmap.c:2908
do_mmap+0x7af/0xe60 mm/mmap.c:1387
vm_mmap_pgoff+0x1e3/0x420 mm/util.c:573
elf_map fs/binfmt_elf.c:385 [inline]
elf_load+0x25d/0x6f0 fs/binfmt_elf.c:408
load_elf_binary+0xf3d/0x2590 fs/binfmt_elf.c:1132
search_binary_handler fs/exec.c:1777 [inline]
exec_binprm fs/exec.c:1819 [inline]
bprm_execve+0xaf8/0x1790 fs/exec.c:1871
do_execveat_common+0x553/0x700 fs/exec.c:1978
do_execve fs/exec.c:2052 [inline]
__do_sys_execve fs/exec.c:2128 [inline]
__se_sys_execve fs/exec.c:2123 [inline]
__x64_sys_execve+0x92/0xb0 fs/exec.c:2123
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7faa06406ef7
Code: Unable to access opcode bytes at 0x7faa06406ecd.
RSP: 002b:00007faa062b0e78 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00007ffde59c03b0 RCX: 00007faa06406ef7
RDX: 00005607c116f6e0 RSI: 00007ffde59c08a0 RDI: 00005607b3cf3df6
RBP: 00007faa062b0ff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffde59c06c8
R13: 00007faa062b0f28 R14: 0000000000000000 R15: 0000000000000041
----------------
Code disassembly (best guess):
0: e8 d6 2f 1b 00 call 0x1b2fdb
5: 4d 8d 67 c0 lea -0x40(%r15),%r12
9: 49 8b 6f 40 mov 0x40(%r15),%rbp
d: 49 8d 5f c8 lea -0x38(%r15),%rbx
11: 48 89 d8 mov %rbx,%rax
14: 48 c1 e8 03 shr $0x3,%rax
18: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
1d: 74 08 je 0x27
1f: 48 89 df mov %rbx,%rdi
22: e8 b4 2f 1b 00 call 0x1b2fdb
27: 4c 8b 2b mov (%rbx),%r13
* 2a: 4c 89 e0 mov %r12,%rax <-- trapping instruction
2d: 48 c1 e8 03 shr $0x3,%rax
31: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
38: fc ff df
3b: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1)
3f: 74 .byte 0x74