===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.9.0-rc1-syzkaller-00021-g962490525cff #0 Not tainted ----------------------------------------------------- kworker/u32:5/1085 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire: ffffc9002b36d3e0 (&htab->buckets[i].lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffffc9002b36d3e0 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_hash_delete_elem+0xd4/0x360 net/core/sock_map.c:939 and this task is already holding: ffff888014cb0018 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x39e/0x1020 kernel/workqueue.c:2360 which would create a new lock dependency: (&pool->lock){-.-.}-{2:2} -> (&htab->buckets[i].lock){+.-.}-{2:2} but this new dependency connects a HARDIRQ-irq-safe lock: (&pool->lock){-.-.}-{2:2} ... which became HARDIRQ-irq-safe at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 __queue_work+0x39e/0x1020 kernel/workqueue.c:2360 queue_work_on+0xf4/0x120 kernel/workqueue.c:2435 tick_nohz_activate kernel/time/tick-sched.c:1491 [inline] tick_setup_sched_timer+0x47c/0x790 kernel/time/tick-sched.c:1592 hrtimer_switch_to_hres kernel/time/hrtimer.c:750 [inline] hrtimer_run_queues+0x33c/0x450 kernel/time/hrtimer.c:1918 run_local_timers kernel/time/timer.c:2463 [inline] update_process_times+0xcf/0x220 kernel/time/timer.c:2485 tick_periodic+0x7e/0x230 kernel/time/tick-common.c:100 tick_handle_periodic+0x45/0x120 kernel/time/tick-common.c:112 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x10f/0x450 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 lock_acquire+0x1f2/0x560 kernel/locking/lockdep.c:5722 __fs_reclaim_acquire mm/page_alloc.c:3698 [inline] fs_reclaim_acquire+0x102/0x160 mm/page_alloc.c:3712 might_alloc include/linux/sched/mm.h:312 [inline] slab_pre_alloc_hook mm/slub.c:3746 [inline] slab_alloc_node mm/slub.c:3827 [inline] kmem_cache_alloc_lru+0x5c/0x6f0 mm/slub.c:3864 __d_alloc+0x35/0x8c0 fs/dcache.c:1624 d_alloc+0x4a/0x1e0 fs/dcache.c:1704 d_alloc_parallel+0xe9/0x12b0 fs/dcache.c:2462 __lookup_slow+0x194/0x460 fs/namei.c:1677 lookup_one_len+0x181/0x1b0 fs/namei.c:2756 tracefs_start_creating+0x110/0x2a0 fs/tracefs/inode.c:479 tracefs_create_file+0x9d/0x810 fs/tracefs/inode.c:567 trace_create_file+0x33/0x70 kernel/trace/trace.c:8759 init_trace_printk_function_export+0x3f/0x50 kernel/trace/trace_printk.c:387 do_one_initcall+0x128/0x630 init/main.c:1238 do_initcall_level init/main.c:1300 [inline] do_initcalls init/main.c:1316 [inline] do_basic_setup init/main.c:1335 [inline] kernel_init_freeable+0x660/0xc50 init/main.c:1548 kernel_init+0x1c/0x2b0 init/main.c:1437 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 to a HARDIRQ-irq-unsafe lock: (&htab->buckets[i].lock){+.-.}-{2:2} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xd4/0x360 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x176/0x460 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x3ad/0x2460 mm/page_alloc.c:4597 alloc_pages_mpol+0x275/0x610 mm/mempolicy.c:2264 vma_alloc_folio+0xad/0x160 mm/mempolicy.c:2303 folio_prealloc mm/memory.c:1046 [inline] alloc_anon_folio mm/memory.c:4373 [inline] do_anonymous_page mm/memory.c:4431 [inline] do_pte_missing mm/memory.c:3876 [inline] handle_pte_fault mm/memory.c:5298 [inline] __handle_mm_fault+0x26fd/0x4b40 mm/memory.c:5439 handle_mm_fault+0x476/0xa00 mm/memory.c:5604 do_user_addr_fault+0x426/0x1080 arch/x86/mm/fault.c:1362 handle_page_fault arch/x86/mm/fault.c:1505 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1563 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&htab->buckets[i].lock); local_irq_disable(); lock(&pool->lock); lock(&htab->buckets[i].lock); lock(&pool->lock); *** DEADLOCK *** 8 locks held by kworker/u32:5/1085: #0: ffff888015ae7948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x115f/0x1a30 kernel/workqueue.c:3229 #1: ffffc90006fd7d80 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x865/0x1a30 kernel/workqueue.c:3230 #2: ffffffff8f2f1350 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xbb/0xbf0 net/core/net_namespace.c:591 #3: ffffffff8f306208 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0x8f/0x9b0 net/core/dev.c:11620 #4: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #4: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #4: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: __queue_work+0xf2/0x1020 kernel/workqueue.c:2324 #5: ffff888014cb0018 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x39e/0x1020 kernel/workqueue.c:2360 #6: ffffffff8e24bde0 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_objects_fill_pool lib/debugobjects.c:614 [inline] #6: ffffffff8e24bde0 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_object_activate+0x13e/0x540 lib/debugobjects.c:704 #7: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #7: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #7: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] #7: ffffffff8d7b4b60 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x107/0x460 kernel/trace/bpf_trace.c:2422 the dependencies between HARDIRQ-irq-safe lock and the holding lock: -> (&pool->lock){-.-.}-{2:2} { IN-HARDIRQ-W at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 __queue_work+0x39e/0x1020 kernel/workqueue.c:2360 queue_work_on+0xf4/0x120 kernel/workqueue.c:2435 tick_nohz_activate kernel/time/tick-sched.c:1491 [inline] tick_setup_sched_timer+0x47c/0x790 kernel/time/tick-sched.c:1592 hrtimer_switch_to_hres kernel/time/hrtimer.c:750 [inline] hrtimer_run_queues+0x33c/0x450 kernel/time/hrtimer.c:1918 run_local_timers kernel/time/timer.c:2463 [inline] update_process_times+0xcf/0x220 kernel/time/timer.c:2485 tick_periodic+0x7e/0x230 kernel/time/tick-common.c:100 tick_handle_periodic+0x45/0x120 kernel/time/tick-common.c:112 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x10f/0x450 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 lock_acquire+0x1f2/0x560 kernel/locking/lockdep.c:5722 __fs_reclaim_acquire mm/page_alloc.c:3698 [inline] fs_reclaim_acquire+0x102/0x160 mm/page_alloc.c:3712 might_alloc include/linux/sched/mm.h:312 [inline] slab_pre_alloc_hook mm/slub.c:3746 [inline] slab_alloc_node mm/slub.c:3827 [inline] kmem_cache_alloc_lru+0x5c/0x6f0 mm/slub.c:3864 __d_alloc+0x35/0x8c0 fs/dcache.c:1624 d_alloc+0x4a/0x1e0 fs/dcache.c:1704 d_alloc_parallel+0xe9/0x12b0 fs/dcache.c:2462 __lookup_slow+0x194/0x460 fs/namei.c:1677 lookup_one_len+0x181/0x1b0 fs/namei.c:2756 tracefs_start_creating+0x110/0x2a0 fs/tracefs/inode.c:479 tracefs_create_file+0x9d/0x810 fs/tracefs/inode.c:567 trace_create_file+0x33/0x70 kernel/trace/trace.c:8759 init_trace_printk_function_export+0x3f/0x50 kernel/trace/trace_printk.c:387 do_one_initcall+0x128/0x630 init/main.c:1238 do_initcall_level init/main.c:1300 [inline] do_initcalls init/main.c:1316 [inline] do_basic_setup init/main.c:1335 [inline] kernel_init_freeable+0x660/0xc50 init/main.c:1548 kernel_init+0x1c/0x2b0 init/main.c:1437 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 IN-SOFTIRQ-W at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 __queue_work+0x39e/0x1020 kernel/workqueue.c:2360 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1839 [inline] __run_timers+0x567/0xaf0 kernel/time/timer.c:2418 __run_timer_base kernel/time/timer.c:2429 [inline] __run_timer_base kernel/time/timer.c:2422 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2438 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2448 __do_softirq+0x218/0x922 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:633 [inline] irq_exit_rcu+0xb9/0x120 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] default_idle+0xf/0x20 arch/x86/kernel/process.c:742 default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x32c/0x3f0 kernel/sched/idle.c:332 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430 rest_init+0x16b/0x2b0 init/main.c:732 start_kernel+0x3a3/0x490 init/main.c:1074 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x148 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 __queue_work+0x39e/0x1020 kernel/workqueue.c:2360 queue_work_on+0xf4/0x120 kernel/workqueue.c:2435 queue_work include/linux/workqueue.h:605 [inline] start_poll_synchronize_rcu_expedited+0x147/0x180 kernel/rcu/tree_exp.h:1017 rcu_init+0x1625/0x20c0 kernel/rcu/tree.c:5240 start_kernel+0x19e/0x490 init/main.c:966 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x148 } ... key at: [] __key.17+0x0/0x40 the dependencies between the lock to be acquired and HARDIRQ-irq-unsafe lock: -> (&htab->buckets[i].lock){+.-.}-{2:2} { HARDIRQ-ON-W at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xd4/0x360 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x176/0x460 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x3ad/0x2460 mm/page_alloc.c:4597 alloc_pages_mpol+0x275/0x610 mm/mempolicy.c:2264 vma_alloc_folio+0xad/0x160 mm/mempolicy.c:2303 folio_prealloc mm/memory.c:1046 [inline] alloc_anon_folio mm/memory.c:4373 [inline] do_anonymous_page mm/memory.c:4431 [inline] do_pte_missing mm/memory.c:3876 [inline] handle_pte_fault mm/memory.c:5298 [inline] __handle_mm_fault+0x26fd/0x4b40 mm/memory.c:5439 handle_mm_fault+0x476/0xa00 mm/memory.c:5604 do_user_addr_fault+0x426/0x1080 arch/x86/mm/fault.c:1362 handle_page_fault arch/x86/mm/fault.c:1505 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1563 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 IN-SOFTIRQ-W at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xd4/0x360 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x176/0x460 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x3ad/0x2460 mm/page_alloc.c:4597 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] page_frag_alloc_1k net/core/skbuff.c:250 [inline] __napi_alloc_skb+0x4f8/0x710 net/core/skbuff.c:834 napi_alloc_skb include/linux/skbuff.h:3363 [inline] e1000_alloc_rx_skb drivers/net/ethernet/intel/e1000/e1000_main.c:4112 [inline] e1000_copybreak drivers/net/ethernet/intel/e1000/e1000_main.c:4328 [inline] e1000_clean_rx_irq+0x67d/0xff0 drivers/net/ethernet/intel/e1000/e1000_main.c:4380 e1000_clean+0x976/0x2840 drivers/net/ethernet/intel/e1000/e1000_main.c:3803 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6632 napi_poll net/core/dev.c:6701 [inline] net_rx_action+0x9ad/0xf10 net/core/dev.c:6816 __do_softirq+0x218/0x922 kernel/softirq.c:554 do_softirq kernel/softirq.c:455 [inline] do_softirq+0xb2/0xf0 kernel/softirq.c:442 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:851 [inline] __dev_queue_xmit+0x879/0x3f20 net/core/dev.c:4362 dev_queue_xmit include/linux/netdevice.h:3091 [inline] neigh_hh_output include/net/neighbour.h:526 [inline] neigh_output include/net/neighbour.h:540 [inline] ip_finish_output2+0x16bf/0x2590 net/ipv4/ip_output.c:235 __ip_finish_output net/ipv4/ip_output.c:313 [inline] __ip_finish_output+0x49e/0x950 net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:450 [inline] ip_local_out+0x33e/0x4a0 net/ipv4/ip_output.c:129 __ip_queue_xmit+0x747/0x1940 net/ipv4/ip_output.c:535 __tcp_transmit_skb+0x29c1/0x3da0 net/ipv4/tcp_output.c:1462 tcp_transmit_skb net/ipv4/tcp_output.c:1480 [inline] tcp_write_xmit+0xfe0/0x7ee0 net/ipv4/tcp_output.c:2792 __tcp_push_pending_frames+0xaf/0x390 net/ipv4/tcp_output.c:2977 tcp_push+0x221/0x6f0 net/ipv4/tcp.c:738 tcp_sendmsg_locked+0x27b8/0x3480 net/ipv4/tcp.c:1310 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1342 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_write_iter+0x4b8/0x5c0 net/socket.c:1160 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x6db/0x1100 fs/read_write.c:590 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd2/0x260 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xd4/0x360 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x176/0x460 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x3ad/0x2460 mm/page_alloc.c:4597 alloc_pages_mpol+0x275/0x610 mm/mempolicy.c:2264 vma_alloc_folio+0xad/0x160 mm/mempolicy.c:2303 folio_prealloc mm/memory.c:1046 [inline] alloc_anon_folio mm/memory.c:4373 [inline] do_anonymous_page mm/memory.c:4431 [inline] do_pte_missing mm/memory.c:3876 [inline] handle_pte_fault mm/memory.c:5298 [inline] __handle_mm_fault+0x26fd/0x4b40 mm/memory.c:5439 handle_mm_fault+0x476/0xa00 mm/memory.c:5604 do_user_addr_fault+0x426/0x1080 arch/x86/mm/fault.c:1362 handle_page_fault arch/x86/mm/fault.c:1505 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1563 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 } ... key at: [] __key.0+0x0/0x40 ... acquired at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xd4/0x360 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x176/0x460 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x3ad/0x2460 mm/page_alloc.c:4597 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2175 [inline] allocate_slab mm/slub.c:2338 [inline] new_slab+0xcc/0x3a0 mm/slub.c:2391 ___slab_alloc+0x670/0x16d0 mm/slub.c:3525 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610 __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] kmem_cache_alloc+0x2e9/0x320 mm/slub.c:3852 kmem_cache_zalloc include/linux/slab.h:739 [inline] fill_pool+0x275/0x5d0 lib/debugobjects.c:168 debug_objects_fill_pool lib/debugobjects.c:615 [inline] debug_object_activate+0x151/0x540 lib/debugobjects.c:704 debug_work_activate kernel/workqueue.c:663 [inline] insert_work+0x2e/0x230 kernel/workqueue.c:2245 __queue_work+0x944/0x1020 kernel/workqueue.c:2400 queue_work_on+0xf4/0x120 kernel/workqueue.c:2435 queue_work include/linux/workqueue.h:605 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:659 [inline] netdevice_event+0x736/0xa10 drivers/infiniband/core/roce_gid_mgmt.c:802 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1950 call_netdevice_notifiers_extack net/core/dev.c:1988 [inline] call_netdevice_notifiers net/core/dev.c:2002 [inline] unregister_netdevice_many_notify+0x8a1/0x19f0 net/core/dev.c:11099 unregister_netdevice_many net/core/dev.c:11157 [inline] default_device_exit_batch+0x731/0x9b0 net/core/dev.c:11634 ops_exit_list+0x128/0x180 net/core/net_namespace.c:175 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:637 process_one_work+0x902/0x1a30 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416 kthread+0x2c1/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 stack backtrace: CPU: 0 PID: 1085 Comm: kworker/u32:5 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline] check_irq_usage+0xe3c/0x1490 kernel/locking/lockdep.c:2865 check_prev_add kernel/locking/lockdep.c:3138 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x248e/0x3b30 kernel/locking/lockdep.c:5137 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xd4/0x360 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x176/0x460 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x3ad/0x2460 mm/page_alloc.c:4597 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2175 [inline] allocate_slab mm/slub.c:2338 [inline] new_slab+0xcc/0x3a0 mm/slub.c:2391 ___slab_alloc+0x670/0x16d0 mm/slub.c:3525 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610 __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] kmem_cache_alloc+0x2e9/0x320 mm/slub.c:3852 kmem_cache_zalloc include/linux/slab.h:739 [inline] fill_pool+0x275/0x5d0 lib/debugobjects.c:168 debug_objects_fill_pool lib/debugobjects.c:615 [inline] debug_object_activate+0x151/0x540 lib/debugobjects.c:704 debug_work_activate kernel/workqueue.c:663 [inline] insert_work+0x2e/0x230 kernel/workqueue.c:2245 __queue_work+0x944/0x1020 kernel/workqueue.c:2400 queue_work_on+0xf4/0x120 kernel/workqueue.c:2435 queue_work include/linux/workqueue.h:605 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:659 [inline] netdevice_event+0x736/0xa10 drivers/infiniband/core/roce_gid_mgmt.c:802 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1950 call_netdevice_notifiers_extack net/core/dev.c:1988 [inline] call_netdevice_notifiers net/core/dev.c:2002 [inline] unregister_netdevice_many_notify+0x8a1/0x19f0 net/core/dev.c:11099 unregister_netdevice_many net/core/dev.c:11157 [inline] default_device_exit_batch+0x731/0x9b0 net/core/dev.c:11634 ops_exit_list+0x128/0x180 net/core/net_namespace.c:175 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:637 process_one_work+0x902/0x1a30 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416 kthread+0x2c1/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243