===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.8.0-syzkaller-05236-g443574b03387 #0 Not tainted ----------------------------------------------------- ksoftirqd/1/23 [HC0[0]:SC1[5]:HE0:SE0] is trying to acquire: ffff88807f13ea00 (&stab->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff88807f13ea00 (&stab->lock){+.-.}-{2:2}, at: __sock_map_delete net/core/sock_map.c:414 [inline] ffff88807f13ea00 (&stab->lock){+.-.}-{2:2}, at: sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 and this task is already holding: ffff888014ca0018 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x6ec/0xec0 which would create a new lock dependency: (&pool->lock){-.-.}-{2:2} -> (&stab->lock){+.-.}-{2:2} but this new dependency connects a HARDIRQ-irq-safe lock: (&pool->lock){-.-.}-{2:2} ... which became HARDIRQ-irq-safe at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 wq_worker_tick+0x207/0x440 kernel/workqueue.c:1501 scheduler_tick+0x375/0x6e0 kernel/sched/core.c:5699 update_process_times+0x202/0x230 kernel/time/timer.c:2481 tick_periodic+0x190/0x220 kernel/time/tick-common.c:100 tick_handle_periodic+0x4a/0x160 kernel/time/tick-common.c:112 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __asan_memset+0x5/0x50 mm/kasan/shadow.c:83 save_stack+0x8a/0x1f0 mm/page_owner.c:114 __set_page_owner+0x29/0x380 mm/page_owner.c:195 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 alloc_pages_mpol+0x3de/0x650 mm/mempolicy.c:2133 vm_area_alloc_pages mm/vmalloc.c:3135 [inline] __vmalloc_area_node mm/vmalloc.c:3211 [inline] __vmalloc_node_range+0x9a4/0x14a0 mm/vmalloc.c:3392 __vmalloc_node mm/vmalloc.c:3457 [inline] __vmalloc+0x79/0x90 mm/vmalloc.c:3471 pcpu_mem_zalloc mm/percpu.c:512 [inline] pcpu_alloc_chunk mm/percpu.c:1469 [inline] pcpu_create_chunk+0x31e/0xbc0 mm/percpu-vm.c:338 pcpu_balance_populated mm/percpu.c:2101 [inline] pcpu_balance_workfn+0xc4d/0xd40 mm/percpu.c:2238 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 to a HARDIRQ-irq-unsafe lock: (&stab->lock){+.-.}-{2:2} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 0xffffffffa0001b56 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x657/0x680 mm/page_alloc.c:4591 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node+0x12b/0x1b0 include/linux/gfp.h:261 page_frag_alloc_1k net/core/skbuff.c:250 [inline] __napi_alloc_skb+0x37f/0x540 net/core/skbuff.c:834 napi_alloc_skb include/linux/skbuff.h:3363 [inline] page_to_skb+0x275/0x9b0 drivers/net/virtio_net.c:569 receive_mergeable drivers/net/virtio_net.c:1683 [inline] receive_buf+0x3b3/0x3890 drivers/net/virtio_net.c:1804 virtnet_receive drivers/net/virtio_net.c:2110 [inline] virtnet_poll+0x720/0x18f0 drivers/net/virtio_net.c:2203 __napi_poll+0xcb/0x490 net/core/dev.c:6632 napi_poll net/core/dev.c:6701 [inline] net_rx_action+0x7bb/0x1090 net/core/dev.c:6813 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:998 [inline] debug_check_no_obj_freed+0x561/0x580 lib/debugobjects.c:1019 free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x319/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 skb_free_frag include/linux/skbuff.h:3341 [inline] skb_free_head net/core/skbuff.c:1106 [inline] skb_release_data+0x640/0x870 net/core/skbuff.c:1136 skb_release_all net/core/skbuff.c:1202 [inline] __kfree_skb+0x57/0x70 net/core/skbuff.c:1216 tcp_rcv_established+0x107e/0x1fd0 net/ipv4/tcp_input.c:6080 tcp_v4_do_rcv+0x8da/0xb90 net/ipv4/tcp_ipv4.c:1906 sk_backlog_rcv include/net/sock.h:1106 [inline] __release_sock+0x214/0x350 net/core/sock.c:2984 release_sock+0x61/0x1f0 net/core/sock.c:3550 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1343 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa84/0xcb0 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&stab->lock); local_irq_disable(); lock(&pool->lock); lock(&stab->lock); lock(&pool->lock); *** DEADLOCK *** 6 locks held by ksoftirqd/1/23: #0: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #0: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #0: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: ieee80211_rx_napi+0xd6/0x3c0 net/mac80211/rx.c:5469 #1: ffff8880517016d0 (&local->rx_path_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] #1: ffff8880517016d0 (&local->rx_path_lock){+.-.}-{2:2}, at: ieee80211_rx_handlers+0xf8/0xb6f0 net/mac80211/rx.c:4159 #2: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #2: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #2: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: __queue_work+0x198/0xec0 kernel/workqueue.c:2324 #3: ffff888014ca0018 (&pool->lock){-.-.}-{2:2}, at: __queue_work+0x6ec/0xec0 #4: ffffffff8e818c60 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_objects_fill_pool+0x80/0x9b0 lib/debugobjects.c:614 #5: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #5: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #5: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] #5: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x16e/0x490 kernel/trace/bpf_trace.c:2422 the dependencies between HARDIRQ-irq-safe lock and the holding lock: -> (&pool->lock){-.-.}-{2:2} { IN-HARDIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 wq_worker_tick+0x207/0x440 kernel/workqueue.c:1501 scheduler_tick+0x375/0x6e0 kernel/sched/core.c:5699 update_process_times+0x202/0x230 kernel/time/timer.c:2481 tick_periodic+0x190/0x220 kernel/time/tick-common.c:100 tick_handle_periodic+0x4a/0x160 kernel/time/tick-common.c:112 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __asan_memset+0x5/0x50 mm/kasan/shadow.c:83 save_stack+0x8a/0x1f0 mm/page_owner.c:114 __set_page_owner+0x29/0x380 mm/page_owner.c:195 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 alloc_pages_mpol+0x3de/0x650 mm/mempolicy.c:2133 vm_area_alloc_pages mm/vmalloc.c:3135 [inline] __vmalloc_area_node mm/vmalloc.c:3211 [inline] __vmalloc_node_range+0x9a4/0x14a0 mm/vmalloc.c:3392 __vmalloc_node mm/vmalloc.c:3457 [inline] __vmalloc+0x79/0x90 mm/vmalloc.c:3471 pcpu_mem_zalloc mm/percpu.c:512 [inline] pcpu_alloc_chunk mm/percpu.c:1469 [inline] pcpu_create_chunk+0x31e/0xbc0 mm/percpu-vm.c:338 pcpu_balance_populated mm/percpu.c:2101 [inline] pcpu_balance_workfn+0xc4d/0xd40 mm/percpu.c:2238 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 IN-SOFTIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 __queue_work+0x6ec/0xec0 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1838 [inline] __run_timers kernel/time/timer.c:2408 [inline] __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2419 run_timer_base kernel/time/timer.c:2428 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] default_idle+0x13/0x20 arch/x86/kernel/process.c:742 default_idle_call+0x74/0xb0 kernel/sched/idle.c:117 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x22f/0x5d0 kernel/sched/idle.c:332 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:430 rest_init+0x2e0/0x300 init/main.c:730 arch_call_rest_init+0xe/0x10 init/main.c:831 start_kernel+0x47a/0x500 init/main.c:1077 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x147 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 __queue_work+0x6ec/0xec0 queue_work_on+0x14f/0x250 kernel/workqueue.c:2435 queue_work include/linux/workqueue.h:605 [inline] start_poll_synchronize_rcu_expedited+0xf7/0x150 kernel/rcu/tree_exp.h:1017 rcu_init+0xea/0x140 kernel/rcu/tree.c:5240 start_kernel+0x1f7/0x500 init/main.c:969 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x147 } ... key at: [] init_worker_pool.__key+0x0/0x20 the dependencies between the lock to be acquired and HARDIRQ-irq-unsafe lock: -> (&stab->lock){+.-.}-{2:2} { HARDIRQ-ON-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 0xffffffffa0001b56 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x657/0x680 mm/page_alloc.c:4591 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node+0x12b/0x1b0 include/linux/gfp.h:261 page_frag_alloc_1k net/core/skbuff.c:250 [inline] __napi_alloc_skb+0x37f/0x540 net/core/skbuff.c:834 napi_alloc_skb include/linux/skbuff.h:3363 [inline] page_to_skb+0x275/0x9b0 drivers/net/virtio_net.c:569 receive_mergeable drivers/net/virtio_net.c:1683 [inline] receive_buf+0x3b3/0x3890 drivers/net/virtio_net.c:1804 virtnet_receive drivers/net/virtio_net.c:2110 [inline] virtnet_poll+0x720/0x18f0 drivers/net/virtio_net.c:2203 __napi_poll+0xcb/0x490 net/core/dev.c:6632 napi_poll net/core/dev.c:6701 [inline] net_rx_action+0x7bb/0x1090 net/core/dev.c:6813 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:998 [inline] debug_check_no_obj_freed+0x561/0x580 lib/debugobjects.c:1019 free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x319/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 skb_free_frag include/linux/skbuff.h:3341 [inline] skb_free_head net/core/skbuff.c:1106 [inline] skb_release_data+0x640/0x870 net/core/skbuff.c:1136 skb_release_all net/core/skbuff.c:1202 [inline] __kfree_skb+0x57/0x70 net/core/skbuff.c:1216 tcp_rcv_established+0x107e/0x1fd0 net/ipv4/tcp_input.c:6080 tcp_v4_do_rcv+0x8da/0xb90 net/ipv4/tcp_ipv4.c:1906 sk_backlog_rcv include/net/sock.h:1106 [inline] __release_sock+0x214/0x350 net/core/sock.c:2984 release_sock+0x61/0x1f0 net/core/sock.c:3550 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1343 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa84/0xcb0 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 IN-SOFTIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 0xffffffffa0001b56 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x657/0x680 mm/page_alloc.c:4591 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node+0x12b/0x1b0 include/linux/gfp.h:261 page_frag_alloc_1k net/core/skbuff.c:250 [inline] __napi_alloc_skb+0x37f/0x540 net/core/skbuff.c:834 napi_alloc_skb include/linux/skbuff.h:3363 [inline] page_to_skb+0x275/0x9b0 drivers/net/virtio_net.c:569 receive_mergeable drivers/net/virtio_net.c:1683 [inline] receive_buf+0x3b3/0x3890 drivers/net/virtio_net.c:1804 virtnet_receive drivers/net/virtio_net.c:2110 [inline] virtnet_poll+0x720/0x18f0 drivers/net/virtio_net.c:2203 __napi_poll+0xcb/0x490 net/core/dev.c:6632 napi_poll net/core/dev.c:6701 [inline] net_rx_action+0x7bb/0x1090 net/core/dev.c:6813 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:998 [inline] debug_check_no_obj_freed+0x561/0x580 lib/debugobjects.c:1019 free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x319/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 skb_free_frag include/linux/skbuff.h:3341 [inline] skb_free_head net/core/skbuff.c:1106 [inline] skb_release_data+0x640/0x870 net/core/skbuff.c:1136 skb_release_all net/core/skbuff.c:1202 [inline] __kfree_skb+0x57/0x70 net/core/skbuff.c:1216 tcp_rcv_established+0x107e/0x1fd0 net/ipv4/tcp_input.c:6080 tcp_v4_do_rcv+0x8da/0xb90 net/ipv4/tcp_ipv4.c:1906 sk_backlog_rcv include/net/sock.h:1106 [inline] __release_sock+0x214/0x350 net/core/sock.c:2984 release_sock+0x61/0x1f0 net/core/sock.c:3550 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1343 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa84/0xcb0 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 0xffffffffa0001b56 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x657/0x680 mm/page_alloc.c:4591 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node+0x12b/0x1b0 include/linux/gfp.h:261 page_frag_alloc_1k net/core/skbuff.c:250 [inline] __napi_alloc_skb+0x37f/0x540 net/core/skbuff.c:834 napi_alloc_skb include/linux/skbuff.h:3363 [inline] page_to_skb+0x275/0x9b0 drivers/net/virtio_net.c:569 receive_mergeable drivers/net/virtio_net.c:1683 [inline] receive_buf+0x3b3/0x3890 drivers/net/virtio_net.c:1804 virtnet_receive drivers/net/virtio_net.c:2110 [inline] virtnet_poll+0x720/0x18f0 drivers/net/virtio_net.c:2203 __napi_poll+0xcb/0x490 net/core/dev.c:6632 napi_poll net/core/dev.c:6701 [inline] net_rx_action+0x7bb/0x1090 net/core/dev.c:6813 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:998 [inline] debug_check_no_obj_freed+0x561/0x580 lib/debugobjects.c:1019 free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x319/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 skb_free_frag include/linux/skbuff.h:3341 [inline] skb_free_head net/core/skbuff.c:1106 [inline] skb_release_data+0x640/0x870 net/core/skbuff.c:1136 skb_release_all net/core/skbuff.c:1202 [inline] __kfree_skb+0x57/0x70 net/core/skbuff.c:1216 tcp_rcv_established+0x107e/0x1fd0 net/ipv4/tcp_input.c:6080 tcp_v4_do_rcv+0x8da/0xb90 net/ipv4/tcp_ipv4.c:1906 sk_backlog_rcv include/net/sock.h:1106 [inline] __release_sock+0x214/0x350 net/core/sock.c:2984 release_sock+0x61/0x1f0 net/core/sock.c:3550 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1343 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa84/0xcb0 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 } ... key at: [] sock_map_alloc.__key+0x0/0x20 ... acquired at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x657/0x680 mm/page_alloc.c:4591 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2190 allocate_slab mm/slub.c:2354 [inline] new_slab+0x84/0x2f0 mm/slub.c:2407 ___slab_alloc+0xd1b/0x13e0 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc+0x250/0x350 mm/slub.c:3867 kmem_cache_zalloc include/linux/slab.h:701 [inline] fill_pool lib/debugobjects.c:168 [inline] debug_objects_fill_pool+0x42f/0x9b0 lib/debugobjects.c:615 debug_object_activate+0x135/0x510 lib/debugobjects.c:704 debug_work_activate kernel/workqueue.c:663 [inline] insert_work+0x36/0x330 kernel/workqueue.c:2245 __queue_work+0xc14/0xec0 kernel/workqueue.c:2400 queue_work_on+0x14f/0x250 kernel/workqueue.c:2435 __ieee80211_queue_skb_to_iface net/mac80211/rx.c:233 [inline] ieee80211_queue_skb_to_iface net/mac80211/rx.c:244 [inline] ieee80211_rx_h_mgmt+0x50f/0x710 net/mac80211/rx.c:4035 ieee80211_rx_handlers+0x6a3f/0xb6f0 net/mac80211/rx.c:4193 ieee80211_invoke_rx_handlers net/mac80211/rx.c:4223 [inline] ieee80211_prepare_and_rx_handle+0x31ab/0x6360 net/mac80211/rx.c:5071 __ieee80211_rx_handle_packet net/mac80211/rx.c:5312 [inline] ieee80211_rx_list+0x2cde/0x3780 net/mac80211/rx.c:5447 ieee80211_rx_napi+0x18a/0x3c0 net/mac80211/rx.c:5470 ieee80211_rx include/net/mac80211.h:5083 [inline] ieee80211_tasklet_handler+0xeb/0x1f0 net/mac80211/main.c:438 tasklet_action_common+0x321/0x4d0 kernel/softirq.c:781 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 run_ksoftirqd+0xc5/0x130 kernel/softirq.c:924 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 stack backtrace: CPU: 1 PID: 23 Comm: ksoftirqd/1 Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline] check_irq_usage kernel/locking/lockdep.c:2865 [inline] check_prev_add kernel/locking/lockdep.c:3138 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x4dc7/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run4+0x25a/0x490 kernel/trace/bpf_trace.c:2422 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] __alloc_pages+0x657/0x680 mm/page_alloc.c:4591 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2190 allocate_slab mm/slub.c:2354 [inline] new_slab+0x84/0x2f0 mm/slub.c:2407 ___slab_alloc+0xd1b/0x13e0 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc+0x250/0x350 mm/slub.c:3867 kmem_cache_zalloc include/linux/slab.h:701 [inline] fill_pool lib/debugobjects.c:168 [inline] debug_objects_fill_pool+0x42f/0x9b0 lib/debugobjects.c:615 debug_object_activate+0x135/0x510 lib/debugobjects.c:704 debug_work_activate kernel/workqueue.c:663 [inline] insert_work+0x36/0x330 kernel/workqueue.c:2245 __queue_work+0xc14/0xec0 kernel/workqueue.c:2400 queue_work_on+0x14f/0x250 kernel/workqueue.c:2435 __ieee80211_queue_skb_to_iface net/mac80211/rx.c:233 [inline] ieee80211_queue_skb_to_iface net/mac80211/rx.c:244 [inline] ieee80211_rx_h_mgmt+0x50f/0x710 net/mac80211/rx.c:4035 ieee80211_rx_handlers+0x6a3f/0xb6f0 net/mac80211/rx.c:4193 ieee80211_invoke_rx_handlers net/mac80211/rx.c:4223 [inline] ieee80211_prepare_and_rx_handle+0x31ab/0x6360 net/mac80211/rx.c:5071 __ieee80211_rx_handle_packet net/mac80211/rx.c:5312 [inline] ieee80211_rx_list+0x2cde/0x3780 net/mac80211/rx.c:5447 ieee80211_rx_napi+0x18a/0x3c0 net/mac80211/rx.c:5470 ieee80211_rx include/net/mac80211.h:5083 [inline] ieee80211_tasklet_handler+0xeb/0x1f0 net/mac80211/main.c:438 tasklet_action_common+0x321/0x4d0 kernel/softirq.c:781 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 run_ksoftirqd+0xc5/0x130 kernel/softirq.c:924 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 ------------[ cut here ]------------ raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 23 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x29/0x40 kernel/locking/irqflag-debug.c:10 Modules linked in: CPU: 1 PID: 23 Comm: ksoftirqd/1 Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:warn_bogus_irq_restore+0x29/0x40 kernel/locking/irqflag-debug.c:10 Code: 90 f3 0f 1e fa 90 80 3d de 59 01 04 00 74 06 90 c3 cc cc cc cc c6 05 cf 59 01 04 01 90 48 c7 c7 20 ba aa 8b e8 f8 d5 e7 f5 90 <0f> 0b 90 90 90 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f RSP: 0018:ffffc900001d70f8 EFLAGS: 00010246 RAX: a8e4ba712b8aa700 RBX: 0000000000000200 RCX: ffff8880172dda00 RDX: 0000000000000301 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900001d71d8 R08: ffffffff8157cc12 R09: 1ffff9200003ad74 R10: dffffc0000000000 R11: fffff5200003ad75 R12: 0000000000000200 R13: 0000000000000000 R14: 0000000000000246 R15: 1ffff9200003ae24 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31121000 CR3: 000000001e590000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: queue_work_on+0x1ea/0x250 kernel/workqueue.c:2439 __ieee80211_queue_skb_to_iface net/mac80211/rx.c:233 [inline] ieee80211_queue_skb_to_iface net/mac80211/rx.c:244 [inline] ieee80211_rx_h_mgmt+0x50f/0x710 net/mac80211/rx.c:4035 ieee80211_rx_handlers+0x6a3f/0xb6f0 net/mac80211/rx.c:4193 ieee80211_invoke_rx_handlers net/mac80211/rx.c:4223 [inline] ieee80211_prepare_and_rx_handle+0x31ab/0x6360 net/mac80211/rx.c:5071 __ieee80211_rx_handle_packet net/mac80211/rx.c:5312 [inline] ieee80211_rx_list+0x2cde/0x3780 net/mac80211/rx.c:5447 ieee80211_rx_napi+0x18a/0x3c0 net/mac80211/rx.c:5470 ieee80211_rx include/net/mac80211.h:5083 [inline] ieee80211_tasklet_handler+0xeb/0x1f0 net/mac80211/main.c:438 tasklet_action_common+0x321/0x4d0 kernel/softirq.c:781 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 run_ksoftirqd+0xc5/0x130 kernel/softirq.c:924 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243