===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 4.14.231-syzkaller #0 Not tainted ----------------------------------------------------- syz-executor908/8000 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire: (hugetlb_lock){+.+.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] (hugetlb_lock){+.+.}, at: [] free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309 and this task is already holding: (slock-AF_INET){+.-.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] (slock-AF_INET){+.-.}, at: [] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234 which would create a new lock dependency: (slock-AF_INET){+.-.} -> (hugetlb_lock){+.+.} but this new dependency connects a SOFTIRQ-irq-safe lock: (slock-AF_INET){+.-.} ... which became SOFTIRQ-irq-safe at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] sk_clone_lock+0x3cf/0x11e0 net/core/sock.c:1666 inet_csk_clone_lock+0x1e/0x3f0 net/ipv4/inet_connection_sock.c:815 tcp_create_openreq_child+0x2c/0x1880 net/ipv4/tcp_minisocks.c:437 tcp_v4_syn_recv_sock+0xa8/0xf80 net/ipv4/tcp_ipv4.c:1358 tcp_check_req+0x4c1/0x1460 net/ipv4/tcp_minisocks.c:764 tcp_v4_rcv+0x1c36/0x3560 net/ipv4/tcp_ipv4.c:1701 ip_local_deliver_finish+0x3f2/0xab0 net/ipv4/ip_input.c:216 NF_HOOK include/linux/netfilter.h:250 [inline] ip_local_deliver+0x167/0x460 net/ipv4/ip_input.c:257 dst_input include/net/dst.h:476 [inline] ip_rcv_finish+0x6e3/0x19f0 net/ipv4/ip_input.c:396 NF_HOOK include/linux/netfilter.h:250 [inline] ip_rcv+0x8a7/0xf10 net/ipv4/ip_input.c:493 __netif_receive_skb_core+0x15ee/0x2a30 net/core/dev.c:4474 __netif_receive_skb+0x27/0x1a0 net/core/dev.c:4512 netif_receive_skb_internal+0xd7/0x580 net/core/dev.c:4585 napi_skb_finish net/core/dev.c:4946 [inline] napi_gro_receive+0x2e2/0x400 net/core/dev.c:4977 receive_buf+0xaef/0x4b90 drivers/net/virtio_net.c:852 virtnet_receive drivers/net/virtio_net.c:1098 [inline] virtnet_poll+0x4b7/0x960 drivers/net/virtio_net.c:1189 napi_poll net/core/dev.c:5596 [inline] net_rx_action+0x466/0xfd0 net/core/dev.c:5662 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] do_IRQ+0x112/0x1d0 arch/x86/kernel/irq.c:242 ret_from_intr+0x0/0x1e arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] text_poke+0x388/0x470 arch/x86/kernel/alternative.c:720 text_poke_bp+0xc9/0x110 arch/x86/kernel/alternative.c:812 __jump_label_transform+0x269/0x300 arch/x86/kernel/jump_label.c:102 arch_jump_label_transform+0x26/0x40 arch/x86/kernel/jump_label.c:110 __jump_label_update+0x113/0x170 kernel/jump_label.c:374 jump_label_update kernel/jump_label.c:741 [inline] jump_label_update+0x140/0x2d0 kernel/jump_label.c:720 __static_key_slow_dec_cpuslocked+0x3d/0xf0 kernel/jump_label.c:204 __static_key_slow_dec kernel/jump_label.c:214 [inline] static_key_slow_dec+0x53/0x70 kernel/jump_label.c:228 once_deferred+0x58/0x80 lib/once.c:18 process_one_work+0x793/0x14a0 kernel/workqueue.c:2116 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 to a SOFTIRQ-irq-unsafe lock: (hugetlb_lock){+.+.} ... which became SOFTIRQ-irq-unsafe at: ... lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034 proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hugetlb_lock); local_irq_disable(); lock(slock-AF_INET); lock(hugetlb_lock); lock(slock-AF_INET); *** DEADLOCK *** 3 locks held by syz-executor908/8000: #0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] __sock_release+0x86/0x2b0 net/socket.c:601 #1: (sk_lock-AF_INET){+.+.}, at: [] lock_sock include/net/sock.h:1471 [inline] #1: (sk_lock-AF_INET){+.+.}, at: [] tcp_close+0x25/0xed0 net/ipv4/tcp.c:2144 #2: (slock-AF_INET){+.-.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] #2: (slock-AF_INET){+.-.}, at: [] tcp_close+0x540/0xed0 net/ipv4/tcp.c:2234 the dependencies between SOFTIRQ-irq-safe lock and the holding lock: -> (slock-AF_INET){+.-.} ops: 6909 { HARDIRQ-ON-W at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:176 spin_lock_bh include/linux/spinlock.h:322 [inline] lock_sock_nested+0x39/0x100 net/core/sock.c:2788 lock_sock include/net/sock.h:1471 [inline] inet_autobind+0x1a/0x180 net/ipv4/af_inet.c:178 inet_dgram_connect+0x134/0x1f0 net/ipv4/af_inet.c:538 SYSC_connect net/socket.c:1655 [inline] SyS_connect+0x1f4/0x240 net/socket.c:1636 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb IN-SOFTIRQ-W at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] sk_clone_lock+0x3cf/0x11e0 net/core/sock.c:1666 inet_csk_clone_lock+0x1e/0x3f0 net/ipv4/inet_connection_sock.c:815 tcp_create_openreq_child+0x2c/0x1880 net/ipv4/tcp_minisocks.c:437 tcp_v4_syn_recv_sock+0xa8/0xf80 net/ipv4/tcp_ipv4.c:1358 tcp_check_req+0x4c1/0x1460 net/ipv4/tcp_minisocks.c:764 tcp_v4_rcv+0x1c36/0x3560 net/ipv4/tcp_ipv4.c:1701 ip_local_deliver_finish+0x3f2/0xab0 net/ipv4/ip_input.c:216 NF_HOOK include/linux/netfilter.h:250 [inline] ip_local_deliver+0x167/0x460 net/ipv4/ip_input.c:257 dst_input include/net/dst.h:476 [inline] ip_rcv_finish+0x6e3/0x19f0 net/ipv4/ip_input.c:396 NF_HOOK include/linux/netfilter.h:250 [inline] ip_rcv+0x8a7/0xf10 net/ipv4/ip_input.c:493 __netif_receive_skb_core+0x15ee/0x2a30 net/core/dev.c:4474 __netif_receive_skb+0x27/0x1a0 net/core/dev.c:4512 netif_receive_skb_internal+0xd7/0x580 net/core/dev.c:4585 napi_skb_finish net/core/dev.c:4946 [inline] napi_gro_receive+0x2e2/0x400 net/core/dev.c:4977 receive_buf+0xaef/0x4b90 drivers/net/virtio_net.c:852 virtnet_receive drivers/net/virtio_net.c:1098 [inline] virtnet_poll+0x4b7/0x960 drivers/net/virtio_net.c:1189 napi_poll net/core/dev.c:5596 [inline] net_rx_action+0x466/0xfd0 net/core/dev.c:5662 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] do_IRQ+0x112/0x1d0 arch/x86/kernel/irq.c:242 ret_from_intr+0x0/0x1e arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] text_poke+0x388/0x470 arch/x86/kernel/alternative.c:720 text_poke_bp+0xc9/0x110 arch/x86/kernel/alternative.c:812 __jump_label_transform+0x269/0x300 arch/x86/kernel/jump_label.c:102 arch_jump_label_transform+0x26/0x40 arch/x86/kernel/jump_label.c:110 __jump_label_update+0x113/0x170 kernel/jump_label.c:374 jump_label_update kernel/jump_label.c:741 [inline] jump_label_update+0x140/0x2d0 kernel/jump_label.c:720 __static_key_slow_dec_cpuslocked+0x3d/0xf0 kernel/jump_label.c:204 __static_key_slow_dec kernel/jump_label.c:214 [inline] static_key_slow_dec+0x53/0x70 kernel/jump_label.c:228 once_deferred+0x58/0x80 lib/once.c:18 process_one_work+0x793/0x14a0 kernel/workqueue.c:2116 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INITIAL USE at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:176 spin_lock_bh include/linux/spinlock.h:322 [inline] lock_sock_nested+0x39/0x100 net/core/sock.c:2788 lock_sock include/net/sock.h:1471 [inline] inet_autobind+0x1a/0x180 net/ipv4/af_inet.c:178 inet_dgram_connect+0x134/0x1f0 net/ipv4/af_inet.c:538 SYSC_connect net/socket.c:1655 [inline] SyS_connect+0x1f4/0x240 net/socket.c:1636 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb } ... key at: [] af_family_slock_keys+0x10/0x180 ... acquired at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309 __put_page+0xb9/0x2f0 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] __skb_frag_unref include/linux/skbuff.h:2829 [inline] skb_release_data+0x25a/0x820 net/core/skbuff.c:577 skb_release_all net/core/skbuff.c:640 [inline] __kfree_skb+0x46/0x60 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1425 [inline] tcp_write_queue_purge include/net/tcp.h:1631 [inline] tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904 inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866 tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298 inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425 __sock_release+0xcd/0x2b0 net/socket.c:602 sock_close+0x15/0x20 net/socket.c:1139 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa44/0x2850 kernel/exit.c:868 do_group_exit+0x100/0x2e0 kernel/exit.c:965 SYSC_exit_group kernel/exit.c:976 [inline] SyS_exit_group+0x19/0x20 kernel/exit.c:974 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: -> (hugetlb_lock){+.+.} ops: 32 { HARDIRQ-ON-W at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034 proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb SOFTIRQ-ON-W at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034 proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb INITIAL USE at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034 proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb } ... key at: [] hugetlb_lock+0x18/0x15e0 ... acquired at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309 __put_page+0xb9/0x2f0 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] __skb_frag_unref include/linux/skbuff.h:2829 [inline] skb_release_data+0x25a/0x820 net/core/skbuff.c:577 skb_release_all net/core/skbuff.c:640 [inline] __kfree_skb+0x46/0x60 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1425 [inline] tcp_write_queue_purge include/net/tcp.h:1631 [inline] tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904 inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866 tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298 inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425 __sock_release+0xcd/0x2b0 net/socket.c:602 sock_close+0x15/0x20 net/socket.c:1139 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa44/0x2850 kernel/exit.c:868 do_group_exit+0x100/0x2e0 kernel/exit.c:965 SYSC_exit_group kernel/exit.c:976 [inline] SyS_exit_group+0x19/0x20 kernel/exit.c:974 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb stack backtrace: CPU: 1 PID: 8000 Comm: syz-executor908 Not tainted 4.14.231-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_bad_irq_dependency kernel/locking/lockdep.c:1609 [inline] check_usage.cold+0x806/0xbe6 kernel/locking/lockdep.c:1641 check_irq_usage kernel/locking/lockdep.c:1697 [inline] check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline] check_prev_add kernel/locking/lockdep.c:1910 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x1cfc/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309 __put_page+0xb9/0x2f0 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] __skb_frag_unref include/linux/skbuff.h:2829 [inline] skb_release_data+0x25a/0x820 net/core/skbuff.c:577 skb_release_all net/core/skbuff.c:640 [inline] __kfree_skb+0x46/0x60 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1425 [inline] tcp_write_queue_purge include/net/tcp.h:1631 [inline] tcp_v4_destroy_sock+0x223/0x920 net/ipv4/tcp_ipv4.c:1904 inet_csk_destroy_sock+0x169/0x400 net/ipv4/inet_connection_sock.c:866 tcp_close+0x85e/0xed0 net/ipv4/tcp.c:2298 inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425 __sock_release+0xcd/0x2b0 net/socket.c:602 sock_close+0x15/0x20 net/socket.c:1139 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa44/0x2850 kernel/exit.c:868 do_group_exit+0x100/0x2e0 kernel/exit.c:965 SYSC_exit_group kernel/exit.c:976 [inline] SyS_exit_group+0x19/0x20 kernel/exit.c:974 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x44c1c9 RSP: 002b:00007ffe057b8458 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00000000004cb370 RCX: 000000000044c1c9 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffffffffffb8 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004cb370 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001