====================================================== WARNING: possible circular locking dependency detected 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0 Not tainted ------------------------------------------------------ syz-executor.0/5710 is trying to acquire lock: ffff88813fffad58 (&zone->lock){-.-.}-{2:2}, at: rmqueue_buddy mm/page_alloc.c:2835 [inline] ffff88813fffad58 (&zone->lock){-.-.}-{2:2}, at: rmqueue mm/page_alloc.c:3014 [inline] ffff88813fffad58 (&zone->lock){-.-.}-{2:2}, at: get_page_from_freelist+0xb5f/0x2f00 mm/page_alloc.c:3417 but task is already holding lock: ffff88802c2b71f8 (&trie->lock){-.-.}-{2:2}, at: trie_update_elem+0xc8/0xc00 kernel/bpf/lpm_trie.c:333 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&trie->lock){-.-.}-{2:2}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 trie_delete_elem+0x96/0x6a0 kernel/bpf/lpm_trie.c:462 0xffffffffa0000872 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline] bpf_trace_run2+0x2ee/0x540 kernel/trace/bpf_trace.c:2444 trace_contention_end+0x114/0x140 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0xb81/0xdc0 kernel/locking/qspinlock.c:557 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline] queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0xe1/0x120 kernel/locking/spinlock.c:162 rmqueue_bulk mm/page_alloc.c:2237 [inline] __rmqueue_pcplist+0x44a/0x22c0 mm/page_alloc.c:2929 rmqueue_pcplist mm/page_alloc.c:2971 [inline] rmqueue mm/page_alloc.c:3008 [inline] get_page_from_freelist+0x851/0x2f00 mm/page_alloc.c:3417 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 get_free_pages_noprof+0xc/0x30 mm/page_alloc.c:4725 _pgd_alloc arch/x86/mm/pgtable.c:423 [inline] pgd_alloc+0x24/0x210 arch/x86/mm/pgtable.c:439 mm_alloc_pgd kernel/fork.c:796 [inline] mm_init+0x593/0xbc0 kernel/fork.c:1295 dup_mm kernel/fork.c:1685 [inline] copy_mm+0x1b6/0x2020 kernel/fork.c:1737 copy_process+0x187a/0x3dc0 kernel/fork.c:2390 kernel_clone+0x226/0x8f0 kernel/fork.c:2797 __do_sys_clone kernel/fork.c:2940 [inline] __se_sys_clone kernel/fork.c:2924 [inline] __x64_sys_clone+0x258/0x2a0 kernel/fork.c:2924 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&zone->lock){-.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18e0/0x5900 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 rmqueue_buddy mm/page_alloc.c:2835 [inline] rmqueue mm/page_alloc.c:3014 [inline] get_page_from_freelist+0xb5f/0x2f00 mm/page_alloc.c:3417 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] __kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4067 __do_kmalloc_node mm/slub.c:4110 [inline] __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4129 kmalloc_node_noprof include/linux/slab.h:681 [inline] bpf_map_kmalloc_node+0xd3/0x1c0 kernel/bpf/syscall.c:422 lpm_trie_node_alloc kernel/bpf/lpm_trie.c:299 [inline] trie_update_elem+0x1cd/0xc00 kernel/bpf/lpm_trie.c:342 bpf_map_update_value+0x4d5/0x540 kernel/bpf/syscall.c:203 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1654 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5676 __do_sys_bpf kernel/bpf/syscall.c:5795 [inline] __se_sys_bpf kernel/bpf/syscall.c:5793 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5793 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&trie->lock); lock(&zone->lock); lock(&trie->lock); lock(&zone->lock); *** DEADLOCK *** 2 locks held by syz-executor.0/5710: #0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: bpf_map_update_value+0x3c4/0x540 kernel/bpf/syscall.c:202 #1: ffff88802c2b71f8 (&trie->lock){-.-.}-{2:2}, at: trie_update_elem+0xc8/0xc00 kernel/bpf/lpm_trie.c:333 stack backtrace: CPU: 1 PID: 5710 Comm: syz-executor.0 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18e0/0x5900 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 rmqueue_buddy mm/page_alloc.c:2835 [inline] rmqueue mm/page_alloc.c:3014 [inline] get_page_from_freelist+0xb5f/0x2f00 mm/page_alloc.c:3417 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] __kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4067 __do_kmalloc_node mm/slub.c:4110 [inline] __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4129 kmalloc_node_noprof include/linux/slab.h:681 [inline] bpf_map_kmalloc_node+0xd3/0x1c0 kernel/bpf/syscall.c:422 lpm_trie_node_alloc kernel/bpf/lpm_trie.c:299 [inline] trie_update_elem+0x1cd/0xc00 kernel/bpf/lpm_trie.c:342 bpf_map_update_value+0x4d5/0x540 kernel/bpf/syscall.c:203 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1654 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5676 __do_sys_bpf kernel/bpf/syscall.c:5795 [inline] __se_sys_bpf kernel/bpf/syscall.c:5793 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5793 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f86b9a7cea9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f86ba85b0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f86b9bb3f80 RCX: 00007f86b9a7cea9 RDX: 0000000000000020 RSI: 0000000020000080 RDI: 0000000000000002 RBP: 00007f86b9aebff4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f86b9bb3f80 R15: 00007ffd96f22c78