=============================
[ BUG: Invalid wait context ]
6.13.0-rc1-syzkaller-00201-gf136552b7ce3 #0 Not tainted
-----------------------------
syz-executor/5831 is trying to lock:
ffff88806d3f2a00 (&trie->lock){....}-{3:3}, at: trie_delete_elem+0x96/0x6a0 kernel/bpf/lpm_trie.c:462
other info that might help us debug this:
context-{3:3}
12 locks held by syz-executor/5831:
#0: ffffffff8e9eb5d0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap kernel/fork.c:642 [inline]
#0: ffffffff8e9eb5d0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1695 [inline]
#0: ffffffff8e9eb5d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x27f/0x1f90 kernel/fork.c:1744
#1: ffff888069d83c60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:122 [inline]
#1: ffff888069d83c60 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap kernel/fork.c:643 [inline]
#1: ffff888069d83c60 (&mm->mmap_lock){++++}-{4:4}, at: dup_mm kernel/fork.c:1695 [inline]
#1: ffff888069d83c60 (&mm->mmap_lock){++++}-{4:4}, at: copy_mm+0x29d/0x1f90 kernel/fork.c:1744
#2: ffff8880338532a0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:113 [inline]
#2: ffff8880338532a0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap kernel/fork.c:652 [inline]
#2: ffff8880338532a0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mm kernel/fork.c:1695 [inline]
#2: ffff8880338532a0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: copy_mm+0x3df/0x1f90 kernel/fork.c:1744
#3: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#3: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x82/0x380 mm/pgtable-generic.c:287
#4: ffff8880317fe0d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#4: ffff8880317fe0d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0x1ba/0x300 mm/pgtable-generic.c:402
#5: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#5: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#5: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x82/0x380 mm/pgtable-generic.c:287
#6: ffff888060a9e1f8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1125 [inline]
#6: ffff888060a9e1f8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x766/0x7eb0 mm/memory.c:1261
#7: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#7: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#7: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: page_ext_get+0x20/0x2a0 mm/page_ext.c:525
#8: ffffc90000007be0 (&(&bat_priv->nc.work)->timer){..-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1790
#9: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#9: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#9: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: __queue_work+0x199/0xf50 kernel/workqueue.c:2259
#10: ffff88801aca0018 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x759/0xf50
#11: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#11: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#11: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2350 [inline]
#11: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run1+0x1d6/0x520 kernel/trace/bpf_trace.c:2391
stack backtrace:
CPU: 0 UID: 0 PID: 5831 Comm: syz-executor Not tainted 6.13.0-rc1-syzkaller-00201-gf136552b7ce3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline]
check_wait_context kernel/locking/lockdep.c:4898 [inline]
__lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5176
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
trie_delete_elem+0x96/0x6a0 kernel/bpf/lpm_trie.c:462
bpf_prog_2c29ac5cdc6b1842+0x43/0x47
bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
__bpf_prog_run include/linux/filter.h:701 [inline]
bpf_prog_run include/linux/filter.h:708 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2351 [inline]
bpf_trace_run1+0x2ca/0x520 kernel/trace/bpf_trace.c:2391
trace_workqueue_activate_work+0x186/0x1f0 include/trace/events/workqueue.h:59
__queue_work+0xc7b/0xf50 kernel/workqueue.c:2338
call_timer_fn+0x187/0x650 kernel/time/timer.c:1793
expire_timers kernel/time/timer.c:1839 [inline]
__run_timers kernel/time/timer.c:2418 [inline]
__run_timer_base+0x695/0x8e0 kernel/time/timer.c:2430
run_timer_base kernel/time/timer.c:2439 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:655
irq_exit_rcu+0x9/0x30 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:page_table_check_set+0x1c7/0x540 mm/page_table_check.c:129
Code: df be 04 00 00 00 e8 98 5e f3 ff 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 0f 85 fc 00 00 00 8b 2b <31> ff 89 ee e8 70 78 88 ff 85 ed 0f 85 a6 01 00 00 48 8d 7b 04 be
RSP: 0018:ffffc90003a271e0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff88801e09a4b8 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88801e09a4b8
RBP: 0000000000000000 R08: ffff88801e09a4bb R09: 1ffff11003c13497
R10: dffffc0000000000 R11: ffffed1003c13498 R12: 1ffffffff3485fdc
R13: 0000000000000000 R14: ffff88801e09a470 R15: 0000000000000000
__page_table_check_ptes_set+0x30f/0x410 mm/page_table_check.c:225
page_table_check_ptes_set include/linux/page_table_check.h:74 [inline]
set_ptes include/linux/pgtable.h:288 [inline]
__copy_present_ptes mm/memory.c:967 [inline]
copy_present_ptes mm/memory.c:1050 [inline]
copy_pte_range mm/memory.c:1173 [inline]
copy_pmd_range+0x457c/0x7eb0 mm/memory.c:1261
copy_pud_range mm/memory.c:1298 [inline]
copy_p4d_range mm/memory.c:1322 [inline]
copy_page_range+0x99f/0xe90 mm/memory.c:1420
dup_mmap kernel/fork.c:751 [inline]
dup_mm kernel/fork.c:1695 [inline]
copy_mm+0x11c7/0x1f90 kernel/fork.c:1744
copy_process+0x1845/0x3d50 kernel/fork.c:2395
kernel_clone+0x226/0x8e0 kernel/fork.c:2807
__do_sys_clone kernel/fork.c:2950 [inline]
__se_sys_clone kernel/fork.c:2934 [inline]
__x64_sys_clone+0x258/0x2a0 kernel/fork.c:2934
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f41cf776793
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffd5f80cec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f41cf776793
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 000055556bba17d0 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000002431d R14: 00000000000242e1 R15: 00007ffd5f80d050
----------------
Code disassembly (best guess):
0: df be 04 00 00 00 fistpll 0x4(%rsi)
6: e8 98 5e f3 ff call 0xfff35ea3
b: 48 89 d8 mov %rbx,%rax
e: 48 c1 e8 03 shr $0x3,%rax
12: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
19: fc ff df
1c: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax
20: 84 c0 test %al,%al
22: 0f 85 fc 00 00 00 jne 0x124
28: 8b 2b mov (%rbx),%ebp
* 2a: 31 ff xor %edi,%edi <-- trapping instruction
2c: 89 ee mov %ebp,%esi
2e: e8 70 78 88 ff call 0xff8878a3
33: 85 ed test %ebp,%ebp
35: 0f 85 a6 01 00 00 jne 0x1e1
3b: 48 8d 7b 04 lea 0x4(%rbx),%rdi
3f: be .byte 0xbe