======================================================
WARNING: possible circular locking dependency detected
6.10.0-syzkaller-04472-g51835949dda3 #0 Not tainted
------------------------------------------------------
udevd/17545 is trying to acquire lock:
ffff8880b9238aa0 (lock#12){+.+.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
ffff8880b9238aa0 (lock#12){+.+.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x7f/0x790 mm/mmap_lock.c:237

but task is already holding lock:
ffff8880b923ec98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:560

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&rq->__lock){-.-.}-{2:2}:
       _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
       raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:560
       raw_spin_rq_lock kernel/sched/sched.h:1415 [inline]
       _raw_spin_rq_lock_irqsave kernel/sched/sched.h:1435 [inline]
       rq_lock_irqsave kernel/sched/sched.h:1700 [inline]
       class_rq_lock_irqsave_constructor kernel/sched/sched.h:1749 [inline]
       sched_mm_cid_before_execve+0x114/0x5e0 kernel/sched/core.c:10267
       exit_signals+0x34d/0x960 kernel/signal.c:3022
       do_exit+0x54e/0x2bb0 kernel/exit.c:834
       __do_sys_exit kernel/exit.c:993 [inline]
       __se_sys_exit kernel/exit.c:991 [inline]
       __x64_sys_exit+0x42/0x50 kernel/exit.c:991
       x64_sys_call+0x146d/0x1680 arch/x86/include/generated/asm/syscalls_64.h:61
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (&sighand->siglock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
       __lock_task_sighand+0xc2/0x340 kernel/signal.c:1412
       lock_task_sighand include/linux/sched/signal.h:746 [inline]
       do_send_sig_info kernel/signal.c:1300 [inline]
       group_send_sig_info+0x290/0x300 kernel/signal.c:1451
       bpf_send_signal_common+0x2e8/0x3a0 kernel/trace/bpf_trace.c:881
       ____bpf_send_signal_thread kernel/trace/bpf_trace.c:898 [inline]
       bpf_send_signal_thread+0x16/0x20 kernel/trace/bpf_trace.c:896
       bpf_prog_ec3b2eefa702d8d3+0xe/0x4a
       bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
       __bpf_prog_run include/linux/filter.h:691 [inline]
       bpf_prog_run include/linux/filter.h:698 [inline]
       __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
       bpf_trace_run4+0x248/0x5a0 kernel/trace/bpf_trace.c:2449
       __bpf_trace_mmap_lock_acquire_returned+0x134/0x180 include/trace/events/mmap_lock.h:52
       trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:52 [inline]
       __mmap_lock_do_trace_acquire_returned+0x456/0x790 mm/mmap_lock.c:237
       __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline]
       mmap_write_lock_killable include/linux/mmap_lock.h:123 [inline]
       dup_mmap kernel/fork.c:634 [inline]
       dup_mm kernel/fork.c:1671 [inline]
       copy_mm kernel/fork.c:1720 [inline]
       copy_process+0x81ab/0x8de0 kernel/fork.c:2373
       kernel_clone+0xfd/0x980 kernel/fork.c:2780
       __do_sys_clone+0xba/0x100 kernel/fork.c:2923
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (lock#12){+.+.}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3133 [inline]
       check_prevs_add kernel/locking/lockdep.c:3252 [inline]
       validate_chain kernel/locking/lockdep.c:3868 [inline]
       __lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5136
       lock_acquire kernel/locking/lockdep.c:5753 [inline]
       lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5718
       local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
       __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237
       __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline]
       mmap_read_trylock include/linux/mmap_lock.h:164 [inline]
       stack_map_get_build_id_offset+0x5d9/0x7c0 kernel/bpf/stackmap.c:141
       __bpf_get_stack+0x6bf/0x700 kernel/bpf/stackmap.c:449
       ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1997 [inline]
       bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1987
       bpf_prog_ec3b2eefa702d8d3+0x42/0x4a
       bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
       __bpf_prog_run include/linux/filter.h:691 [inline]
       bpf_prog_run include/linux/filter.h:698 [inline]
       __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
       bpf_trace_run2+0x234/0x590 kernel/trace/bpf_trace.c:2447
       __bpf_trace_tlb_flush+0xd2/0x110 include/trace/events/tlb.h:38
       trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38
       switch_mm_irqs_off+0x68b/0xbc0 arch/x86/mm/tlb.c:642
       context_switch kernel/sched/core.c:5172 [inline]
       __schedule+0xc4d/0x5490 kernel/sched/core.c:6529
       preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6708
       preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
       unwind_next_frame+0x1c90/0x23a0 arch/x86/kernel/unwind_orc.c:672
       __unwind_start+0x5aa/0x880 arch/x86/kernel/unwind_orc.c:760
       unwind_start arch/x86/include/asm/unwind.h:64 [inline]
       arch_stack_walk+0xb2/0x170 arch/x86/kernel/stacktrace.c:24
       stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
       kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
       kasan_save_track+0x14/0x30 mm/kasan/common.c:68
       unpoison_slab_object mm/kasan/common.c:312 [inline]
       __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
       kasan_slab_alloc include/linux/kasan.h:201 [inline]
       slab_post_alloc_hook mm/slub.c:3940 [inline]
       slab_alloc_node mm/slub.c:4002 [inline]
       kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4009
       alloc_empty_file+0x73/0x1e0 fs/file_table.c:202
       path_openat+0xe0/0x2d20 fs/namei.c:3872
       do_filp_open+0x1dc/0x430 fs/namei.c:3913
       do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
       do_sys_open fs/open.c:1431 [inline]
       __do_sys_openat fs/open.c:1447 [inline]
       __se_sys_openat fs/open.c:1442 [inline]
       __x64_sys_openat+0x175/0x210 fs/open.c:1442
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  lock#12 --> &sighand->siglock --> &rq->__lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&rq->__lock);
                               lock(&sighand->siglock);
                               lock(&rq->__lock);
  lock(lock#12);

 *** DEADLOCK ***

3 locks held by udevd/17545:
 #0: ffff8880b923ec98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:560
 #1: ffffffff8dbb58a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline]
 #1: ffffffff8dbb58a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline]
 #1: ffffffff8dbb58a0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2405 [inline]
 #1: ffffffff8dbb58a0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1c2/0x590 kernel/trace/bpf_trace.c:2447
 #2: ffff88807f59e098 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline]
 #2: ffff88807f59e098 (&mm->mmap_lock){++++}-{3:3}, at: stack_map_get_build_id_offset+0x1e8/0x7c0 kernel/bpf/stackmap.c:141

stack backtrace:
CPU: 0 PID: 17545 Comm: udevd Not tainted 6.10.0-syzkaller-04472-g51835949dda3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
 check_prev_add kernel/locking/lockdep.c:3133 [inline]
 check_prevs_add kernel/locking/lockdep.c:3252 [inline]
 validate_chain kernel/locking/lockdep.c:3868 [inline]
 __lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5136
 lock_acquire kernel/locking/lockdep.c:5753 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5718
 local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
 __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237
 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline]
 mmap_read_trylock include/linux/mmap_lock.h:164 [inline]
 stack_map_get_build_id_offset+0x5d9/0x7c0 kernel/bpf/stackmap.c:141
 __bpf_get_stack+0x6bf/0x700 kernel/bpf/stackmap.c:449
 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1997 [inline]
 bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1987
 bpf_prog_ec3b2eefa702d8d3+0x42/0x4a
 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
 __bpf_prog_run include/linux/filter.h:691 [inline]
 bpf_prog_run include/linux/filter.h:698 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
 bpf_trace_run2+0x234/0x590 kernel/trace/bpf_trace.c:2447
 __bpf_trace_tlb_flush+0xd2/0x110 include/trace/events/tlb.h:38
 trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38
 switch_mm_irqs_off+0x68b/0xbc0 arch/x86/mm/tlb.c:642
 context_switch kernel/sched/core.c:5172 [inline]
 __schedule+0xc4d/0x5490 kernel/sched/core.c:6529
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6708
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
 unwind_next_frame+0x1c90/0x23a0 arch/x86/kernel/unwind_orc.c:672
 __unwind_start+0x5aa/0x880 arch/x86/kernel/unwind_orc.c:760
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0xb2/0x170 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:312 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3940 [inline]
 slab_alloc_node mm/slub.c:4002 [inline]
 kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4009
 alloc_empty_file+0x73/0x1e0 fs/file_table.c:202
 path_openat+0xe0/0x2d20 fs/namei.c:3872
 do_filp_open+0x1dc/0x430 fs/namei.c:3913
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
 do_sys_open fs/open.c:1431 [inline]
 __do_sys_openat fs/open.c:1447 [inline]
 __se_sys_openat fs/open.c:1442 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1442
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4bf89169a4
Code: Unable to access opcode bytes at 0x7f4bf891697a.
RSP: 002b:00007ffed08a07c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4bf89169a4
RDX: 0000000000080000 RSI: 0000556d0b969580 RDI: 00000000ffffff9c
RBP: 0000556d0b969580 R08: 0000556d0b98df90 R09: 00007f4bf89f1c10
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
R13: 0000556d0b98df90 R14: 0000000000000000 R15: 0000000000000001
 </TASK>