======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
udevd/3638 is trying to acquire lock:
ffff8880b8f281d8 (krc.lock){..-.}-{2:2}, at: krc_this_cpu_lock kernel/rcu/tree.c:2995 [inline]
ffff8880b8f281d8 (krc.lock){..-.}-{2:2}, at: add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3315 [inline]
ffff8880b8f281d8 (krc.lock){..-.}-{2:2}, at: kvfree_call_rcu+0x184/0x870 kernel/rcu/tree.c:3406
but task is already holding lock:
ffff8880b8f28418 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x123/0x270 kernel/time/timer.c:999
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&base->lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162
lock_timer_base+0x123/0x270 kernel/time/timer.c:999
__mod_timer+0x117/0xd20 kernel/time/timer.c:1072
queue_delayed_work_on+0x126/0x1e0 kernel/workqueue.c:1704
queue_delayed_work include/linux/workqueue.h:527 [inline]
schedule_delayed_monitor_work kernel/rcu/tree.c:3176 [inline]
kvfree_call_rcu+0x4cb/0x870 kernel/rcu/tree.c:3432
rtnl_register_internal+0x489/0x590 net/core/rtnetlink.c:260
rtnl_register+0x2e/0x70 net/core/rtnetlink.c:310
ip_rt_init+0x323/0x3b5 net/ipv4/route.c:3796
ip_init+0xa/0x14 net/ipv4/ip_output.c:1771
inet_init+0x2bd/0x3cf net/ipv4/af_inet.c:2033
do_one_initcall+0x214/0x7a0 init/main.c:1298
do_initcall_level+0x137/0x1e4 init/main.c:1371
do_initcalls+0x4b/0x8a init/main.c:1387
kernel_init_freeable+0x3fa/0x5ac init/main.c:1626
kernel_init+0x19/0x1b0 init/main.c:1514
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #0 (krc.lock){..-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049
lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
krc_this_cpu_lock kernel/rcu/tree.c:2995 [inline]
add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3315 [inline]
kvfree_call_rcu+0x184/0x870 kernel/rcu/tree.c:3406
trie_delete_elem+0x52d/0x690 kernel/bpf/lpm_trie.c:545
bpf_prog_5186c38a4019a4cb+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1012 [inline]
__bpf_prog_run include/linux/filter.h:603 [inline]
bpf_prog_run include/linux/filter.h:610 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline]
bpf_trace_run3+0x1e3/0x400 kernel/trace/bpf_trace.c:2325
trace_timer_start include/trace/events/timer.h:53 [inline]
enqueue_timer+0x411/0x5c0 kernel/time/timer.c:609
internal_add_timer kernel/time/timer.c:634 [inline]
__mod_timer+0x8e1/0xd20 kernel/time/timer.c:1115
dsp_cmx_send+0x1ab4/0x1b30 drivers/isdn/mISDN/dsp_cmx.c:1850
call_timer_fn+0x1a0/0x670 kernel/time/timer.c:1504
expire_timers kernel/time/timer.c:1549 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1820
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
handle_softirqs+0x2a1/0x920 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
unwind_next_frame+0x1119/0x20b0 arch/x86/kernel/unwind_orc.c:598
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
task_work_add+0x79/0x330 kernel/task_work.c:48
fput+0xd9/0x1a0 fs/file_table.c:376
filp_close+0x108/0x150 fs/open.c:1437
__do_sys_close fs/open.c:1450 [inline]
__se_sys_close fs/open.c:1448 [inline]
__x64_sys_close+0x34/0x70 fs/open.c:1448
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&base->lock);
lock(krc.lock);
lock(&base->lock);
lock(krc.lock);
*** DEADLOCK ***
4 locks held by udevd/3638:
#0: ffffc900001e0bc0 ((&dsp_spl_tl)){+.-.}-{0:0}, at: call_timer_fn+0xc1/0x670 kernel/time/timer.c:1501
#1: ffffffff8dac93b8 (dsp_lock){..-.}-{2:2}, at: dsp_cmx_send+0x22/0x1b30 drivers/isdn/mISDN/dsp_cmx.c:1643
#2: ffff8880b8f28418 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x123/0x270 kernel/time/timer.c:999
#3: ffffffff8cb2abe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#3: ffffffff8cb2abe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#3: ffffffff8cb2abe0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2284 [inline]
#3: ffffffff8cb2abe0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run3+0xf0/0x400 kernel/trace/bpf_trace.c:2325
stack backtrace:
CPU: 1 PID: 3638 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2170
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049
lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
krc_this_cpu_lock kernel/rcu/tree.c:2995 [inline]
add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3315 [inline]
kvfree_call_rcu+0x184/0x870 kernel/rcu/tree.c:3406
trie_delete_elem+0x52d/0x690 kernel/bpf/lpm_trie.c:545
bpf_prog_5186c38a4019a4cb+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1012 [inline]
__bpf_prog_run include/linux/filter.h:603 [inline]
bpf_prog_run include/linux/filter.h:610 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline]
bpf_trace_run3+0x1e3/0x400 kernel/trace/bpf_trace.c:2325
trace_timer_start include/trace/events/timer.h:53 [inline]
enqueue_timer+0x411/0x5c0 kernel/time/timer.c:609
internal_add_timer kernel/time/timer.c:634 [inline]
__mod_timer+0x8e1/0xd20 kernel/time/timer.c:1115
dsp_cmx_send+0x1ab4/0x1b30 drivers/isdn/mISDN/dsp_cmx.c:1850
call_timer_fn+0x1a0/0x670 kernel/time/timer.c:1504
expire_timers kernel/time/timer.c:1549 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1820
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
handle_softirqs+0x2a1/0x920 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:unwind_next_frame+0x1119/0x20b0 arch/x86/kernel/unwind_orc.c:598
Code: 40 48 8b 44 24 48 42 0f b6 04 28 84 c0 0f 85 e0 0a 00 00 43 0f b6 04 2f 84 c0 0f 85 f6 0a 00 00 0f b7 75 00 c1 ee 04 83 e6 0f <83> fe 04 0f 84 d3 05 00 00 83 fe 01 0f 84 86 05 00 00 85 f6 0f 85
RSP: 0018:ffffc900032f7970 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc900032f7a48 RCX: 1ffff9200065ef01
RDX: ffffc900032f7f58 RSI: 0000000000000000 RDI: ffffc900032f7f58
RBP: ffffffff8f3a48d8 R08: 0000000000000004 R09: 0000000000000007
R10: fffff5200065ef55 R11: 1ffff9200065ef53 R12: ffffffff8f3a48d4
R13: dffffc0000000000 R14: ffffc900032f7a98 R15: 1ffffffff1e7491b
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
task_work_add+0x79/0x330 kernel/task_work.c:48
fput+0xd9/0x1a0 fs/file_table.c:376
filp_close+0x108/0x150 fs/open.c:1437
__do_sys_close fs/open.c:1450 [inline]
__se_sys_close fs/open.c:1448 [inline]
__x64_sys_close+0x34/0x70 fs/open.c:1448
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f6cf34a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffdb489cca0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007f6cf3c25880 RCX: 00007f6cf34a7407
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000c
RBP: 00007f6cf3c256e8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002
R13: 00000000ffffffff R14: ffffffffffffffff R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 40 rex
1: 48 8b 44 24 48 mov 0x48(%rsp),%rax
6: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax
b: 84 c0 test %al,%al
d: 0f 85 e0 0a 00 00 jne 0xaf3
13: 43 0f b6 04 2f movzbl (%r15,%r13,1),%eax
18: 84 c0 test %al,%al
1a: 0f 85 f6 0a 00 00 jne 0xb16
20: 0f b7 75 00 movzwl 0x0(%rbp),%esi
24: c1 ee 04 shr $0x4,%esi
27: 83 e6 0f and $0xf,%esi
* 2a: 83 fe 04 cmp $0x4,%esi <-- trapping instruction
2d: 0f 84 d3 05 00 00 je 0x606
33: 83 fe 01 cmp $0x1,%esi
36: 0f 84 86 05 00 00 je 0x5c2
3c: 85 f6 test %esi,%esi
3e: 0f .byte 0xf
3f: 85 .byte 0x85