================================ WARNING: inconsistent lock state 6.9.0-rc7-syzkaller-00056-g45db3ab70092 #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. syz-executor.3/10941 [HC1[1]:SC0[0]:HE0:SE1] takes: ffff8880b9538a80 (lock#10){?.+.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] ffff8880b9538a80 (lock#10){?.+.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x7f/0x790 mm/mmap_lock.c:237 {HARDIRQ-ON-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_lock include/linux/mmap_lock.h:147 [inline] __do_sys_mincore+0x452/0x630 mm/mincore.c:266 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f irq event stamp: 74 hardirqs last enabled at (73): [] syscall_enter_from_user_mode include/linux/entry-common.h:197 [inline] hardirqs last enabled at (73): [] do_syscall_64+0x91/0x260 arch/x86/entry/common.c:79 hardirqs last disabled at (74): [] sysvec_call_function_single+0xe/0xb0 arch/x86/kernel/smp.c:266 softirqs last enabled at (0): [] copy_process+0x24cc/0x9090 kernel/fork.c:2336 softirqs last disabled at (0): [<0000000000000000>] 0x0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(lock#10); lock(lock#10); *** DEADLOCK *** 2 locks held by syz-executor.3/10941: #0: ffffffff8d9b4e20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #0: ffffffff8d9b4e20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #0: ffffffff8d9b4e20 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] #0: ffffffff8d9b4e20 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xe4/0x420 kernel/trace/bpf_trace.c:2420 #1: ffff888078918b20 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:165 [inline] #1: ffff888078918b20 (&mm->mmap_lock){++++}-{3:3}, at: stack_map_get_build_id_offset+0x1e8/0x7d0 kernel/bpf/stackmap.c:141 stack backtrace: CPU: 1 PID: 10941 Comm: syz-executor.3 Not tainted 6.9.0-rc7-syzkaller-00056-g45db3ab70092 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_usage_bug kernel/locking/lockdep.c:3971 [inline] valid_state kernel/locking/lockdep.c:4013 [inline] mark_lock_irq kernel/locking/lockdep.c:4216 [inline] mark_lock+0x923/0xc60 kernel/locking/lockdep.c:4678 mark_usage kernel/locking/lockdep.c:4564 [inline] __lock_acquire+0x1359/0x3b30 kernel/locking/lockdep.c:5091 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:166 [inline] stack_map_get_build_id_offset+0x5df/0x7d0 kernel/bpf/stackmap.c:141 __bpf_get_stack+0x6bf/0x700 kernel/bpf/stackmap.c:449 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1985 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1975 bpf_prog_e6cf5f9c69743609+0x42/0x4a bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:650 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x22c/0x420 kernel/trace/bpf_trace.c:2420 __bpf_trace_tlb_flush+0xd2/0x110 include/trace/events/tlb.h:38 trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38 csd_do_func kernel/smp.c:133 [inline] __flush_smp_call_function_queue+0x27d/0x8c0 kernel/smp.c:511 __sysvec_call_function_single+0x8c/0x410 arch/x86/kernel/smp.c:271 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0x90/0xb0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 RIP: 0010:__sanitizer_cov_trace_pc+0x4c/0x60 kernel/kcov.c:213 Code: 35 8b 82 14 16 00 00 85 c0 74 2b 8b 82 f0 15 00 00 83 f8 02 75 20 48 8b 8a f8 15 00 00 8b 92 f4 15 00 00 48 8b 01 48 83 c0 01 <48> 39 d0 73 07 48 89 01 48 89 34 c1 e9 5e 33 81 09 0f 1f 00 90 90 RSP: 0018:ffffc90004637a28 EFLAGS: 00000202 RAX: 00000000000006cb RBX: ffffc90004637b08 RCX: ffffc9000a355000 RDX: 0000000000040000 RSI: ffffffff813d173b RDI: 0000000000000005 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000 R13: fffff520008c6f63 R14: fffff520008c6f62 R15: ffffc90004637b00 unwind_next_frame+0x6b/0x23a0 arch/x86/kernel/unwind_orc.c:470 __unwind_start+0x5aa/0x880 arch/x86/kernel/unwind_orc.c:760 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xb2/0x170 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3972 [inline] __kmalloc+0x1f9/0x440 mm/slub.c:3985 kmalloc include/linux/slab.h:632 [inline] __do_sys_memfd_create+0x19e/0x670 mm/memfd.c:318 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd9e6a7dd69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd9e7737ea8 EFLAGS: 00000202 ORIG_RAX: 000000000000013f RAX: ffffffffffffffda RBX: 0000000000000aa6 RCX: 00007fd9e6a7dd69 RDX: 00007fd9e7737f80 RSI: 0000000000000000 RDI: 00007fd9e6ac9747 RBP: 0000000020001100 R08: 00007fd9e7737c47 R09: 0000000000000000 R10: 000000000000000a R11: 0000000000000202 R12: 0000000020000300 R13: 00007fd9e7737f80 R14: 00007fd9e7737f40 R15: 00000000200002c0 ---------------- Code disassembly (best guess): 0: 35 8b 82 14 16 xor $0x1614828b,%eax 5: 00 00 add %al,(%rax) 7: 85 c0 test %eax,%eax 9: 74 2b je 0x36 b: 8b 82 f0 15 00 00 mov 0x15f0(%rdx),%eax 11: 83 f8 02 cmp $0x2,%eax 14: 75 20 jne 0x36 16: 48 8b 8a f8 15 00 00 mov 0x15f8(%rdx),%rcx 1d: 8b 92 f4 15 00 00 mov 0x15f4(%rdx),%edx 23: 48 8b 01 mov (%rcx),%rax 26: 48 83 c0 01 add $0x1,%rax * 2a: 48 39 d0 cmp %rdx,%rax <-- trapping instruction 2d: 73 07 jae 0x36 2f: 48 89 01 mov %rax,(%rcx) 32: 48 89 34 c1 mov %rsi,(%rcx,%rax,8) 36: e9 5e 33 81 09 jmp 0x9813399 3b: 0f 1f 00 nopl (%rax) 3e: 90 nop 3f: 90 nop