------------[ cut here ]------------ ====================================================== WARNING: possible circular locking dependency detected 5.15.106-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.5/12344 is trying to acquire lock: ffff80001497f498 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0x28/0xd8 kernel/locking/semaphore.c:138 but task is already holding lock: ffff80001508f098 (depot_lock){-.-.}-{2:2}, at: stack_depot_save+0x204/0x4a0 lib/stackdepot.c:307 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (depot_lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162 stack_depot_save+0x204/0x4a0 lib/stackdepot.c:307 kasan_save_stack+0x54/0x68 mm/kasan/common.c:40 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348 irq_work_queue_on+0xcc/0x224 kernel/irq_work.c:101 tell_cpu_to_push+0x1d8/0x408 kernel/sched/rt.c:2149 pull_rt_task kernel/sched/rt.c:2215 [inline] balance_rt+0x268/0x354 kernel/sched/rt.c:1560 put_prev_task_balance kernel/sched/core.c:5620 [inline] __pick_next_task kernel/sched/core.c:5660 [inline] pick_next_task kernel/sched/core.c:6188 [inline] __schedule+0x714/0x1e38 kernel/sched/core.c:6336 schedule+0x11c/0x1c8 kernel/sched/core.c:6455 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6514 rwsem_down_read_slowpath+0x5b0/0x988 kernel/locking/rwsem.c:1047 __down_read_common+0x6c/0x2dc kernel/locking/rwsem.c:1231 __down_read kernel/locking/rwsem.c:1244 [inline] down_read+0xc8/0x11c kernel/locking/rwsem.c:1490 mmap_read_lock include/linux/mmap_lock.h:117 [inline] do_page_fault+0x66c/0xb60 arch/arm64/mm/fault.c:590 do_mem_abort+0x70/0x1d8 arch/arm64/mm/fault.c:819 el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:358 el1h_64_sync_handler+0x5c/0x98 arch/arm64/kernel/entry-common.c:409 el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:579 ____sys_recvmsg+0x398/0x720 net/socket.c:2644 ___sys_recvmsg+0x240/0x2cc net/socket.c:2673 do_recvmmsg+0x310/0x9a4 net/socket.c:2767 __sys_recvmmsg net/socket.c:2846 [inline] __do_sys_recvmmsg net/socket.c:2869 [inline] __se_sys_recvmmsg net/socket.c:2862 [inline] __arm64_sys_recvmmsg+0x180/0x23c net/socket.c:2862 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 -> #2 (&rq->__lock){-.-.}-{2:2}: _raw_spin_lock_nested+0xb4/0x110 kernel/locking/spinlock.c:368 raw_spin_rq_lock_nested+0x2c/0x44 kernel/sched/core.c:475 raw_spin_rq_lock kernel/sched/sched.h:1325 [inline] rq_lock kernel/sched/sched.h:1620 [inline] task_fork_fair+0x7c/0x23c kernel/sched/fair.c:11372 sched_cgroup_fork+0x334/0x3d8 kernel/sched/core.c:4462 copy_process+0x24d4/0x3750 kernel/fork.c:2312 kernel_clone+0x1d8/0xa58 kernel/fork.c:2601 kernel_thread+0x148/0x1bc kernel/fork.c:2653 rest_init+0x2c/0x38c init/main.c:701 arch_call_rest_init+0x14/0x20 init/main.c:889 start_kernel+0x440/0x600 init/main.c:1144 __primary_switched+0xa8/0xb0 arch/arm64/kernel/head.S:468 -> #1 (&p->pi_lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162 try_to_wake_up+0xb0/0xc2c kernel/sched/core.c:4026 wake_up_process+0x18/0x24 kernel/sched/core.c:4211 __up+0x11c/0x148 kernel/locking/semaphore.c:265 up+0x90/0xb0 kernel/locking/semaphore.c:190 __up_console_sem+0x8c/0x100 kernel/printk/printk.c:256 console_unlock+0x1160/0x1394 kernel/printk/printk.c:2750 vprintk_emit+0x13c/0x218 kernel/printk/printk.c:2268 vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2279 vprintk+0x218/0x2f0 kernel/printk/printk_safe.c:50 _printk+0xdc/0x128 kernel/printk/printk.c:2289 squashfs_read_inode+0xfb4/0x21f0 fs/squashfs/inode.c:409 squashfs_fill_super+0x1280/0x1920 fs/squashfs/super.c:360 get_tree_bdev+0x360/0x54c fs/super.c:1303 squashfs_get_tree+0x28/0x38 fs/squashfs/super.c:398 vfs_get_tree+0x90/0x274 fs/super.c:1508 do_new_mount+0x25c/0x8c8 fs/namespace.c:2994 path_mount+0x590/0x104c fs/namespace.c:3324 do_mount fs/namespace.c:3337 [inline] __do_sys_mount fs/namespace.c:3545 [inline] __se_sys_mount fs/namespace.c:3522 [inline] __arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3522 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 -> #0 ((console_sem).lock){-...}-{2:2}: check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3787 [inline] __lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011 lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162 down_trylock+0x28/0xd8 kernel/locking/semaphore.c:138 __down_trylock_console_sem+0x80/0x144 kernel/printk/printk.c:239 console_trylock+0xb8/0x1f8 kernel/printk/printk.c:2565 console_trylock_spinning+0x1c/0x280 kernel/printk/printk.c:1867 vprintk_emit+0x120/0x218 kernel/printk/printk.c:2267 vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2279 vprintk+0x218/0x2f0 kernel/printk/printk_safe.c:50 _printk+0xdc/0x128 kernel/printk/printk.c:2289 __warn_printk+0xb4/0x134 kernel/panic.c:710 depot_alloc_stack lib/stackdepot.c:114 [inline] stack_depot_save+0x490/0x4a0 lib/stackdepot.c:312 kasan_save_stack mm/kasan/common.c:40 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc+0xd8/0xfc mm/kasan/common.c:513 __kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] __kmalloc_node_track_caller+0x234/0x448 mm/slub.c:4963 kmalloc_reserve+0xe8/0x270 net/core/skbuff.c:356 pskb_expand_head+0xf8/0x1064 net/core/skbuff.c:1703 __skb_unclone_keeptruesize+0x80/0x1e0 net/core/skbuff.c:1803 skb_unclone_keeptruesize include/linux/skbuff.h:1746 [inline] __tcp_retransmit_skb+0x3dc/0x1228 net/ipv4/tcp_output.c:3199 tcp_retransmit_skb+0x44/0x33c net/ipv4/tcp_output.c:3270 tcp_xmit_retransmit_queue+0x3d8/0x92c net/ipv4/tcp_output.c:3352 tcp_xmit_recovery net/ipv4/tcp_input.c:3733 [inline] tcp_ack+0x3510/0x5410 net/ipv4/tcp_input.c:3908 tcp_rcv_state_process+0x510/0x3dd8 net/ipv4/tcp_input.c:6471 tcp_v6_do_rcv+0x704/0x135c net/ipv6/tcp_ipv6.c:1551 sk_backlog_rcv include/net/sock.h:1057 [inline] __release_sock+0x1a8/0x408 net/core/sock.c:2690 release_sock+0x68/0x270 net/core/sock.c:3231 tcp_recvmsg+0x208/0x67c net/ipv4/tcp.c:2558 inet6_recvmsg+0x124/0x614 net/ipv6/af_inet6.c:660 ____sys_recvmsg+0x234/0x720 ___sys_recvmsg+0x240/0x2cc net/socket.c:2673 __sys_recvmsg net/socket.c:2703 [inline] __do_sys_recvmsg net/socket.c:2713 [inline] __se_sys_recvmsg net/socket.c:2710 [inline] __arm64_sys_recvmsg+0x1a8/0x258 net/socket.c:2710 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 other info that might help us debug this: Chain exists of: (console_sem).lock --> &rq->__lock --> depot_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(depot_lock); lock(&rq->__lock); lock(depot_lock); lock((console_sem).lock); *** DEADLOCK *** 2 locks held by syz-executor.5/12344: #0: ffff000135e2f3e0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1649 [inline] #0: ffff000135e2f3e0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sk_wait_data+0x28c/0x3f4 net/core/sock.c:2732 #1: ffff80001508f098 (depot_lock){-.-.}-{2:2}, at: stack_depot_save+0x204/0x4a0 lib/stackdepot.c:307 stack backtrace: CPU: 1 PID: 12344 Comm: syz-executor.5 Not tainted 5.15.106-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011 check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133 check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3787 [inline] __lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011 lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162 down_trylock+0x28/0xd8 kernel/locking/semaphore.c:138 __down_trylock_console_sem+0x80/0x144 kernel/printk/printk.c:239 console_trylock+0xb8/0x1f8 kernel/printk/printk.c:2565 console_trylock_spinning+0x1c/0x280 kernel/printk/printk.c:1867 vprintk_emit+0x120/0x218 kernel/printk/printk.c:2267 vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2279 vprintk+0x218/0x2f0 kernel/printk/printk_safe.c:50 _printk+0xdc/0x128 kernel/printk/printk.c:2289 __warn_printk+0xb4/0x134 kernel/panic.c:710 depot_alloc_stack lib/stackdepot.c:114 [inline] stack_depot_save+0x490/0x4a0 lib/stackdepot.c:312 kasan_save_stack mm/kasan/common.c:40 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc+0xd8/0xfc mm/kasan/common.c:513 __kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] __kmalloc_node_track_caller+0x234/0x448 mm/slub.c:4963 kmalloc_reserve+0xe8/0x270 net/core/skbuff.c:356 pskb_expand_head+0xf8/0x1064 net/core/skbuff.c:1703 __skb_unclone_keeptruesize+0x80/0x1e0 net/core/skbuff.c:1803 skb_unclone_keeptruesize include/linux/skbuff.h:1746 [inline] __tcp_retransmit_skb+0x3dc/0x1228 net/ipv4/tcp_output.c:3199 tcp_retransmit_skb+0x44/0x33c net/ipv4/tcp_output.c:3270 tcp_xmit_retransmit_queue+0x3d8/0x92c net/ipv4/tcp_output.c:3352 tcp_xmit_recovery net/ipv4/tcp_input.c:3733 [inline] tcp_ack+0x3510/0x5410 net/ipv4/tcp_input.c:3908 tcp_rcv_state_process+0x510/0x3dd8 net/ipv4/tcp_input.c:6471 tcp_v6_do_rcv+0x704/0x135c net/ipv6/tcp_ipv6.c:1551 sk_backlog_rcv include/net/sock.h:1057 [inline] __release_sock+0x1a8/0x408 net/core/sock.c:2690 release_sock+0x68/0x270 net/core/sock.c:3231 tcp_recvmsg+0x208/0x67c net/ipv4/tcp.c:2558 inet6_recvmsg+0x124/0x614 net/ipv6/af_inet6.c:660 ____sys_recvmsg+0x234/0x720 ___sys_recvmsg+0x240/0x2cc net/socket.c:2673 __sys_recvmsg net/socket.c:2703 [inline] __do_sys_recvmsg net/socket.c:2713 [inline] __se_sys_recvmsg net/socket.c:2710 [inline] __arm64_sys_recvmsg+0x1a8/0x258 net/socket.c:2710 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Stack depot reached limit capacity WARNING: CPU: 1 PID: 12344 at lib/stackdepot.c:114 stack_depot_save+0x494/0x4a0 lib/stackdepot.c:312 Modules linked in: CPU: 1 PID: 12344 Comm: syz-executor.5 Not tainted 5.15.106-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : stack_depot_save+0x494/0x4a0 lib/stackdepot.c:312 lr : depot_alloc_stack lib/stackdepot.c:114 [inline] lr : stack_depot_save+0x490/0x4a0 lib/stackdepot.c:312 sp : ffff8000267868b0 x29: ffff8000267868c0 x28: 00000000000000e0 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000099054 x24: ffff0001b3000000 x23: 0000000009d99054 x22: 00000000000000c8 x21: ffff00013c5b8400 x20: 0000000000000019 x19: ffff800026786920 x18: 0000000000000001 x17: ff8080000ab5067c x16: ffff800011940934 x15: ffff80000ab5067c x14: 0000000000000012 x13: ffffffffffffffff x12: 0000000000040000 x11: 000000000003ffff x10: ffff80001de4a000 x9 : 59cc0a4eb6743200 x8 : 59cc0a4eb6743200 x7 : 6361657220746f70 x6 : ffff800008327a9c x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000854a334 x2 : 0000000000000001 x1 : 0000000100000001 x0 : 0000000000000022 Call trace: stack_depot_save+0x494/0x4a0 lib/stackdepot.c:312 kasan_save_stack mm/kasan/common.c:40 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc+0xd8/0xfc mm/kasan/common.c:513 __kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] __kmalloc_node_track_caller+0x234/0x448 mm/slub.c:4963 kmalloc_reserve+0xe8/0x270 net/core/skbuff.c:356 pskb_expand_head+0xf8/0x1064 net/core/skbuff.c:1703 __skb_unclone_keeptruesize+0x80/0x1e0 net/core/skbuff.c:1803 skb_unclone_keeptruesize include/linux/skbuff.h:1746 [inline] __tcp_retransmit_skb+0x3dc/0x1228 net/ipv4/tcp_output.c:3199 tcp_retransmit_skb+0x44/0x33c net/ipv4/tcp_output.c:3270 tcp_xmit_retransmit_queue+0x3d8/0x92c net/ipv4/tcp_output.c:3352 tcp_xmit_recovery net/ipv4/tcp_input.c:3733 [inline] tcp_ack+0x3510/0x5410 net/ipv4/tcp_input.c:3908 tcp_rcv_state_process+0x510/0x3dd8 net/ipv4/tcp_input.c:6471 tcp_v6_do_rcv+0x704/0x135c net/ipv6/tcp_ipv6.c:1551 sk_backlog_rcv include/net/sock.h:1057 [inline] __release_sock+0x1a8/0x408 net/core/sock.c:2690 release_sock+0x68/0x270 net/core/sock.c:3231 tcp_recvmsg+0x208/0x67c net/ipv4/tcp.c:2558 inet6_recvmsg+0x124/0x614 net/ipv6/af_inet6.c:660 ____sys_recvmsg+0x234/0x720 ___sys_recvmsg+0x240/0x2cc net/socket.c:2673 __sys_recvmsg net/socket.c:2703 [inline] __do_sys_recvmsg net/socket.c:2713 [inline] __se_sys_recvmsg net/socket.c:2710 [inline] __arm64_sys_recvmsg+0x1a8/0x258 net/socket.c:2710 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 40822 hardirqs last enabled at (40821): [] ___slab_alloc+0xc48/0xdbc mm/slub.c:2963 hardirqs last disabled at (40822): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (40822): [] _raw_spin_lock_irqsave+0xfc/0x14c kernel/locking/spinlock.c:162 softirqs last enabled at (40792): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (40792): [] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587 softirqs last disabled at (40741): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (40741): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (40741): [] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636 ---[ end trace 7c9ace6cacadf2b8 ]---