================================ WARNING: inconsistent lock state 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. syz.5.1322/11851 [HC1[1]:SC0[0]:HE0:SE1] takes: ffff8880b863ea98 (address_handler_list_lock){?.+.}-{2:2}, at: raw_spin_rq_lock_nested+0xb0/0x140 kernel/sched/core.c:606 {HARDIRQ-ON-W} state was registered at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:559 [inline] fw_core_add_address_handler+0x13e/0x490 drivers/firewire/core-transaction.c:585 fw_core_init+0xe0/0x210 drivers/firewire/core-transaction.c:1347 do_one_initcall+0x24a/0x880 init/main.c:1269 do_initcall_level+0x157/0x210 init/main.c:1331 do_initcalls+0x3f/0x80 init/main.c:1347 kernel_init_freeable+0x435/0x5d0 init/main.c:1580 kernel_init+0x1d/0x2b0 init/main.c:1469 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 irq event stamp: 187078 hardirqs last enabled at (187077): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1517 [inline] hardirqs last enabled at (187077): [] finish_lock_switch kernel/sched/core.c:5082 [inline] hardirqs last enabled at (187077): [] finish_task_switch+0x1e5/0x870 kernel/sched/core.c:5200 hardirqs last disabled at (187078): [] sysvec_call_function_single+0xe/0xc0 arch/x86/kernel/smp.c:266 softirqs last enabled at (187004): [] __do_softirq kernel/softirq.c:588 [inline] softirqs last enabled at (187004): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last enabled at (187004): [] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 softirqs last disabled at (186995): [] __do_softirq kernel/softirq.c:588 [inline] softirqs last disabled at (186995): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last disabled at (186995): [] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(address_handler_list_lock); lock(address_handler_list_lock); *** DEADLOCK *** 1 lock held by syz.5.1322/11851: #0: ffff888033699650 (&u->iolock){+.+.}-{3:3}, at: __unix_dgram_recvmsg+0x246/0x12f0 net/unix/af_unix.c:2432 stack backtrace: CPU: 1 UID: 0 PID: 11851 Comm: syz.5.1322 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_usage_bug+0x62e/0x8b0 kernel/locking/lockdep.c:4038 valid_state+0x13a/0x1c0 kernel/locking/lockdep.c:4052 mark_lock_irq+0xbb/0xc20 kernel/locking/lockdep.c:4263 mark_lock+0x223/0x360 kernel/locking/lockdep.c:4725 mark_usage kernel/locking/lockdep.c:4611 [inline] __lock_acquire+0xbb7/0x2050 kernel/locking/lockdep.c:5156 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378 raw_spin_rq_lock_nested+0xb0/0x140 kernel/sched/core.c:606 raw_spin_rq_lock kernel/sched/sched.h:1505 [inline] rto_push_irq_work_func+0x86/0x350 kernel/sched/rt.c:2259 irq_work_single+0x136/0x240 kernel/irq_work.c:221 __flush_smp_call_function_queue+0xa17/0x1690 kernel/smp.c:574 __sysvec_call_function_single+0xb8/0x430 arch/x86/kernel/smp.c:271 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0x9e/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 RIP: 0010:preempt_schedule+0xc9/0xf0 kernel/sched/core.c:6894 Code: e8 8c 48 2f f6 f6 44 24 21 02 75 31 48 c7 04 24 0e 36 e0 45 49 c7 04 1f 00 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 44 24 48 <75> 18 48 8d 65 e0 5b 41 5c 41 5e 41 5f 5d e9 ff e8 20 00 e8 1f 00 RSP: 0018:ffffc9000b647440 EFLAGS: 00000246 RAX: 5cfe66b946cd7100 RBX: 1ffff920016c8e88 RCX: 1ffff920016c8e60 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88807d682600 RBP: ffffc9000b6474d8 R08: ffff88807d682603 R09: 1ffff1100fad04c0 R10: dffffc0000000000 R11: ffffed100fad04c1 R12: 1ffff920016c8e8c R13: 1ffff920016c8ea8 R14: ffffc9000b647460 R15: dffffc0000000000 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0x130/0x140 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] __skb_try_recv_datagram+0x1cb/0x6a0 net/core/datagram.c:266 __unix_dgram_recvmsg+0x3ba/0x12f0 net/unix/af_unix.c:2435 sock_recvmsg_nosec+0x190/0x1d0 net/socket.c:1051 ____sys_recvmsg+0x3cd/0x480 net/socket.c:2824 ___sys_recvmsg net/socket.c:2868 [inline] do_recvmmsg+0x45e/0xad0 net/socket.c:2962 __sys_recvmmsg net/socket.c:3041 [inline] __do_sys_recvmmsg net/socket.c:3064 [inline] __se_sys_recvmmsg net/socket.c:3057 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3057 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f400577e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f40065d0038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007f4005936058 RCX: 00007f400577e719 RDX: 000000000400034f RSI: 0000000020000480 RDI: 0000000000000004 RBP: 00007f40057f139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f4005936058 R15: 00007ffcadd98d58 ---------------- Code disassembly (best guess): 0: e8 8c 48 2f f6 call 0xf62f4891 5: f6 44 24 21 02 testb $0x2,0x21(%rsp) a: 75 31 jne 0x3d c: 48 c7 04 24 0e 36 e0 movq $0x45e0360e,(%rsp) 13: 45 14: 49 c7 04 1f 00 00 00 movq $0x0,(%r15,%rbx,1) 1b: 00 1c: 65 48 8b 04 25 28 00 mov %gs:0x28,%rax 23: 00 00 25: 48 3b 44 24 48 cmp 0x48(%rsp),%rax * 2a: 75 18 jne 0x44 <-- trapping instruction 2c: 48 8d 65 e0 lea -0x20(%rbp),%rsp 30: 5b pop %rbx 31: 41 5c pop %r12 33: 41 5e pop %r14 35: 41 5f pop %r15 37: 5d pop %rbp 38: e9 ff e8 20 00 jmp 0x20e93c 3d: e8 .byte 0xe8 3e: 1f (bad)