FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
======================================================
WARNING: possible circular locking dependency detected
5.15.166-syzkaller #0 Not tainted
------------------------------------------------------
syz.1.801/7889 is trying to acquire lock:
ffffffff8c7fc438 ((console_sem).lock){-.-.}-{2:2}, at: down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
but task is already holding lock:
ffff8880b903a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xa8/0x140 kernel/sched/core.c:483
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&rq->__lock){-.-.}-{2:2}:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
_raw_spin_lock_nested+0x2d/0x40 kernel/locking/spinlock.c:368
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
rq_lock kernel/sched/sched.h:1621 [inline]
task_fork_fair+0x5d/0x350 kernel/sched/fair.c:11484
sched_cgroup_fork+0x2d3/0x330 kernel/sched/core.c:4463
copy_process+0x224a/0x3ef0 kernel/fork.c:2320
kernel_clone+0x210/0x960 kernel/fork.c:2604
kernel_thread+0x168/0x1e0 kernel/fork.c:2656
rest_init+0x21/0x330 init/main.c:706
start_kernel+0x48c/0x540 init/main.c:1140
secondary_startup_64_no_verify+0xb1/0xbb
-> #1 (&p->pi_lock){-.-.}-{2:2}:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
try_to_wake_up+0xae/0x1300 kernel/sched/core.c:4027
up+0x6e/0x90 kernel/locking/semaphore.c:190
__up_console_sem+0x11a/0x1e0 kernel/printk/printk.c:256
console_unlock+0x1145/0x12b0 kernel/printk/printk.c:2760
vprintk_emit+0xbf/0x150 kernel/printk/printk.c:2274
_printk+0xd1/0x120 kernel/printk/printk.c:2299
addrconf_notify+0xa80/0xf30 net/ipv6/addrconf.c:3659
notifier_call_chain kernel/notifier.c:83 [inline]
raw_notifier_call_chain+0xd0/0x170 kernel/notifier.c:391
call_netdevice_notifiers_info net/core/dev.c:2018 [inline]
netdev_state_change+0x1a3/0x250 net/core/dev.c:1409
linkwatch_do_dev+0x10c/0x160 net/core/link_watch.c:167
__linkwatch_run_queue+0x4ca/0x7f0 net/core/link_watch.c:213
linkwatch_event+0x48/0x50 net/core/link_watch.c:252
process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
-> #0 ((console_sem).lock){-.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
__down_trylock_console_sem+0x105/0x250 kernel/printk/printk.c:239
console_trylock kernel/printk/printk.c:2575 [inline]
console_trylock_spinning+0x8a/0x3f0 kernel/printk/printk.c:1867
vprintk_emit+0xa6/0x150 kernel/printk/printk.c:2273
_printk+0xd1/0x120 kernel/printk/printk.c:2299
fail_dump lib/fault-inject.c:45 [inline]
should_fail+0x36c/0x4c0 lib/fault-inject.c:146
__copy_to_user_inatomic include/linux/uaccess.h:133 [inline]
copy_to_user_nofault+0xdd/0x1c0 mm/maccess.c:255
bpf_prog_6303d92f98284ad8+0x3b/0x488
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
__traceiter_sched_switch+0x7d/0xb0 include/trace/events/sched.h:220
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6370
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6777
irqentry_exit+0x53/0x80 kernel/entry/common.c:432
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:643
fsnotify_parent include/linux/fsnotify.h:62 [inline]
fsnotify_file include/linux/fsnotify.h:105 [inline]
fsnotify_modify include/linux/fsnotify.h:323 [inline]
vfs_write+0x5c5/0xe50 fs/read_write.c:598
ksys_write+0x1a2/0x2c0 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> &p->pi_lock --> &rq->__lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock((console_sem).lock);
*** DEADLOCK ***
4 locks held by syz.1.801/7889:
#0: ffff888077598870 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2cb/0x380 fs/file.c:1084
#1: ffff88805b3b8460 (sb_writers#4){.+.+}-{0:0}, at: vfs_write+0x29a/0xe50 fs/read_write.c:590
#2: ffff8880b903a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xa8/0x140 kernel/sched/core.c:483
#3: ffffffff8c91fbe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
stack backtrace:
CPU: 1 PID: 7889 Comm: syz.1.801 Not tainted 5.15.166-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
__down_trylock_console_sem+0x105/0x250 kernel/printk/printk.c:239
console_trylock kernel/printk/printk.c:2575 [inline]
console_trylock_spinning+0x8a/0x3f0 kernel/printk/printk.c:1867
vprintk_emit+0xa6/0x150 kernel/printk/printk.c:2273
_printk+0xd1/0x120 kernel/printk/printk.c:2299
fail_dump lib/fault-inject.c:45 [inline]
should_fail+0x36c/0x4c0 lib/fault-inject.c:146
__copy_to_user_inatomic include/linux/uaccess.h:133 [inline]
copy_to_user_nofault+0xdd/0x1c0 mm/maccess.c:255
bpf_prog_6303d92f98284ad8+0x3b/0x488
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
__traceiter_sched_switch+0x7d/0xb0 include/trace/events/sched.h:220
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6370
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6777
irqentry_exit+0x53/0x80 kernel/entry/common.c:432
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:643
RIP: 0010:instrument_atomic_read include/linux/instrumented.h:71 [inline]
RIP: 0010:atomic_long_read include/linux/atomic/atomic-instrumented.h:1183 [inline]
RIP: 0010:fsnotify_parent include/linux/fsnotify.h:62 [inline]
RIP: 0010:fsnotify_file include/linux/fsnotify.h:105 [inline]
RIP: 0010:fsnotify_modify include/linux/fsnotify.h:323 [inline]
RIP: 0010:vfs_write+0x5c5/0xe50 fs/read_write.c:598
Code: 21 10 f5 ff 4c 8b 2b 49 8d 5d 28 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 04 10 f5 ff 41 bc d0 07 00 00 4c 03 23 <4c> 89 e7 be 08 00 00 00 e8 7e 11 f5 ff 4c 89 e0 48 c1 e8 03 48 b9
RSP: 0018:ffffc90003097ca0 EFLAGS: 00000282
RAX: 1ffff1100e8e02ba RBX: ffff8880747015d0 RCX: ffff88801ec71dc0
RDX: ffff88801ec71dc0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003097e30 R08: ffffffff81d5106c R09: ffffed1003d8e3be
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88805b3b87d0
R13: ffff8880747015a8 R14: 1ffff92000612fa0 R15: 0000000000000001
ksys_write+0x1a2/0x2c0 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f3dfc90f9df
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48
RSP: 002b:00007f3dfad8a030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f3dfc90f9df
RDX: 0000000000000001 RSI: 00007f3dfad8a090 RDI: 0000000000000006
RBP: 00007f3dfad8a090 R08: 0000000000000000 R09: 00007f3dfad89df7
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 0000000000000000 R14: 00007f3dfcac9f80 R15: 00007ffe8dba81d8
CPU: 1 PID: 7889 Comm: syz.1.801 Not tainted 5.15.166-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
fail_dump lib/fault-inject.c:52 [inline]
should_fail+0x38a/0x4c0 lib/fault-inject.c:146
__copy_to_user_inatomic include/linux/uaccess.h:133 [inline]
copy_to_user_nofault+0xdd/0x1c0 mm/maccess.c:255
bpf_prog_6303d92f98284ad8+0x3b/0x488
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
__traceiter_sched_switch+0x7d/0xb0 include/trace/events/sched.h:220
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6370
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6777
irqentry_exit+0x53/0x80 kernel/entry/common.c:432
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:643
RIP: 0010:instrument_atomic_read include/linux/instrumented.h:71 [inline]
RIP: 0010:atomic_long_read include/linux/atomic/atomic-instrumented.h:1183 [inline]
RIP: 0010:fsnotify_parent include/linux/fsnotify.h:62 [inline]
RIP: 0010:fsnotify_file include/linux/fsnotify.h:105 [inline]
RIP: 0010:fsnotify_modify include/linux/fsnotify.h:323 [inline]
RIP: 0010:vfs_write+0x5c5/0xe50 fs/read_write.c:598
Code: 21 10 f5 ff 4c 8b 2b 49 8d 5d 28 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 04 10 f5 ff 41 bc d0 07 00 00 4c 03 23 <4c> 89 e7 be 08 00 00 00 e8 7e 11 f5 ff 4c 89 e0 48 c1 e8 03 48 b9
RSP: 0018:ffffc90003097ca0 EFLAGS: 00000282
RAX: 1ffff1100e8e02ba RBX: ffff8880747015d0 RCX: ffff88801ec71dc0
RDX: ffff88801ec71dc0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003097e30 R08: ffffffff81d5106c R09: ffffed1003d8e3be
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88805b3b87d0
R13: ffff8880747015a8 R14: 1ffff92000612fa0 R15: 0000000000000001
ksys_write+0x1a2/0x2c0 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f3dfc90f9df
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48
RSP: 002b:00007f3dfad8a030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f3dfc90f9df
RDX: 0000000000000001 RSI: 00007f3dfad8a090 RDI: 0000000000000006
RBP: 00007f3dfad8a090 R08: 0000000000000000 R09: 00007f3dfad89df7
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 0000000000000000 R14: 00007f3dfcac9f80 R15: 00007ffe8dba81d8
----------------
Code disassembly (best guess):
0: 21 10 and %edx,(%rax)
2: f5 cmc
3: ff 4c 8b 2b decl 0x2b(%rbx,%rcx,4)
7: 49 8d 5d 28 lea 0x28(%r13),%rbx
b: 48 89 d8 mov %rbx,%rax
e: 48 c1 e8 03 shr $0x3,%rax
12: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
17: 74 08 je 0x21
19: 48 89 df mov %rbx,%rdi
1c: e8 04 10 f5 ff call 0xfff51025
21: 41 bc d0 07 00 00 mov $0x7d0,%r12d
27: 4c 03 23 add (%rbx),%r12
* 2a: 4c 89 e7 mov %r12,%rdi <-- trapping instruction
2d: be 08 00 00 00 mov $0x8,%esi
32: e8 7e 11 f5 ff call 0xfff511b5
37: 4c 89 e0 mov %r12,%rax
3a: 48 c1 e8 03 shr $0x3,%rax
3e: 48 rex.W
3f: b9 .byte 0xb9