================================ WARNING: inconsistent lock state 6.10.0-syzkaller-01059-g1467b49869df #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. syz.3.120/5645 [HC1[1]:SC0[0]:HE0:SE1] takes: ffff88806b038a80 (lock#11){?.+.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] ffff88806b038a80 (lock#11){?.+.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x7f/0x790 mm/mmap_lock.c:237 {HARDIRQ-ON-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] get_mmap_lock_carefully mm/memory.c:5716 [inline] lock_mm_and_find_vma+0xeb/0x6a0 mm/memory.c:5776 do_user_addr_fault+0x29c/0xe50 arch/x86/mm/fault.c:1361 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:131 [inline] copy_to_user_iter lib/iov_iter.c:25 [inline] iterate_iovec include/linux/iov_iter.h:51 [inline] iterate_and_advance2 include/linux/iov_iter.h:247 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x4cd/0x1140 lib/iov_iter.c:185 copy_page_to_iter lib/iov_iter.c:362 [inline] copy_page_to_iter+0xf1/0x180 lib/iov_iter.c:349 process_vm_rw_pages mm/process_vm_access.c:45 [inline] process_vm_rw_single_vec mm/process_vm_access.c:118 [inline] process_vm_rw_core.constprop.0+0x5c9/0xa10 mm/process_vm_access.c:216 process_vm_rw+0x301/0x360 mm/process_vm_access.c:284 __do_sys_process_vm_readv mm/process_vm_access.c:296 [inline] __se_sys_process_vm_readv mm/process_vm_access.c:292 [inline] __x64_sys_process_vm_readv+0xe2/0x1c0 mm/process_vm_access.c:292 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f irq event stamp: 220 hardirqs last enabled at (219): [] ___slab_alloc+0x870/0x1870 mm/slub.c:3577 hardirqs last disabled at (220): [] sysvec_call_function_single+0xe/0xb0 arch/x86/kernel/smp.c:266 softirqs last enabled at (0): [] copy_process+0x222f/0x8ee0 kernel/fork.c:2316 softirqs last disabled at (0): [<0000000000000000>] 0x0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(lock#11); lock(lock#11); *** DEADLOCK *** 2 locks held by syz.3.120/5645: #0: ffffffff8dbb17e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline] #0: ffffffff8dbb17e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline] #0: ffffffff8dbb17e0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2402 [inline] #0: ffffffff8dbb17e0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1c2/0x590 kernel/trace/bpf_trace.c:2444 #1: ffff88801e52e098 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #1: ffff88801e52e098 (&mm->mmap_lock){++++}-{3:3}, at: stack_map_get_build_id_offset+0x1e8/0x7c0 kernel/bpf/stackmap.c:141 stack backtrace: CPU: 0 PID: 5645 Comm: syz.3.120 Not tainted 6.10.0-syzkaller-01059-g1467b49869df #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_usage_bug kernel/locking/lockdep.c:3971 [inline] valid_state kernel/locking/lockdep.c:4013 [inline] mark_lock_irq kernel/locking/lockdep.c:4216 [inline] mark_lock+0x923/0xc60 kernel/locking/lockdep.c:4678 mark_usage kernel/locking/lockdep.c:4564 [inline] __lock_acquire+0x1359/0x3b30 kernel/locking/lockdep.c:5091 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 local_lock_acquire include/linux/local_lock_internal.h:29 [inline] __mmap_lock_do_trace_acquire_returned+0x97/0x790 mm/mmap_lock.c:237 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:164 [inline] stack_map_get_build_id_offset+0x5d9/0x7c0 kernel/bpf/stackmap.c:141 __bpf_get_stack+0x6bf/0x700 kernel/bpf/stackmap.c:449 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1994 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1984 ___bpf_prog_run+0x3e51/0xabd0 kernel/bpf/core.c:2011 __bpf_prog_run32+0xc1/0x100 kernel/bpf/core.c:2252 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2444 __bpf_trace_tlb_flush+0xd2/0x110 include/trace/events/tlb.h:38 __traceiter_tlb_flush+0x64/0xb0 include/trace/events/tlb.h:38 trace_tlb_flush+0xf3/0x170 include/trace/events/tlb.h:38 csd_do_func kernel/smp.c:134 [inline] __flush_smp_call_function_queue+0x27a/0x8c0 kernel/smp.c:512 __sysvec_call_function_single+0x8c/0x410 arch/x86/kernel/smp.c:271 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0x90/0xb0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:80 [inline] RIP: 0010:__orc_find+0xa1/0x130 arch/x86/kernel/unwind_orc.c:102 Code: 25 51 00 48 89 e8 48 29 d8 48 89 c2 48 c1 e8 3f 48 c1 fa 02 48 01 d0 48 d1 f8 4c 8d 3c 83 4c 89 fa 48 c1 ea 03 42 0f b6 0c 32 <4c> 89 fa 83 e2 07 83 c2 03 38 ca 7c 04 84 c9 75 73 49 63 17 4c 89 RSP: 0018:ffffc90003047848 EFLAGS: 00000a06 RAX: 0000000000000003 RBX: ffffffff90504684 RCX: 0000000000000000 RDX: 1ffffffff20a08d2 RSI: ffffffff813ccbda RDI: 0000000000000005 RBP: ffffffff905046a0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000008 R11: 0000000000000000 R12: ffffffff88b9c487 R13: ffffffff90fc1d46 R14: dffffc0000000000 R15: ffffffff90504690 orc_find arch/x86/kernel/unwind_orc.c:227 [inline] unwind_next_frame+0x335/0x23a0 arch/x86/kernel/unwind_orc.c:494 arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4123 [inline] __kmalloc_noprof+0x1ec/0x410 mm/slub.c:4136 kmalloc_noprof include/linux/slab.h:664 [inline] sk_prot_alloc+0x1a8/0x2a0 net/core/sock.c:2080 sk_alloc+0x36/0xb90 net/core/sock.c:2133 __netlink_create+0x63/0x300 net/netlink/af_netlink.c:647 netlink_create+0x3d8/0x670 net/netlink/af_netlink.c:708 __sock_create+0x32e/0x800 net/socket.c:1571 sock_create net/socket.c:1622 [inline] __sys_socket_create net/socket.c:1659 [inline] __sys_socket+0x14f/0x260 net/socket.c:1706 __do_sys_socket net/socket.c:1720 [inline] __se_sys_socket net/socket.c:1718 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1718 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdce0b75bd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdce18bc048 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 00007fdce0d04038 RCX: 00007fdce0b75bd9 RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000010 RBP: 00007fdce0be4e60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007fdce0d04038 R15: 00007fff23e1bf88 ---------------- Code disassembly (best guess): 0: 25 51 00 48 89 and $0x89480051,%eax 5: e8 48 29 d8 48 call 0x48d82952 a: 89 c2 mov %eax,%edx c: 48 c1 e8 3f shr $0x3f,%rax 10: 48 c1 fa 02 sar $0x2,%rdx 14: 48 01 d0 add %rdx,%rax 17: 48 d1 f8 sar %rax 1a: 4c 8d 3c 83 lea (%rbx,%rax,4),%r15 1e: 4c 89 fa mov %r15,%rdx 21: 48 c1 ea 03 shr $0x3,%rdx 25: 42 0f b6 0c 32 movzbl (%rdx,%r14,1),%ecx * 2a: 4c 89 fa mov %r15,%rdx <-- trapping instruction 2d: 83 e2 07 and $0x7,%edx 30: 83 c2 03 add $0x3,%edx 33: 38 ca cmp %cl,%dl 35: 7c 04 jl 0x3b 37: 84 c9 test %cl,%cl 39: 75 73 jne 0xae 3b: 49 63 17 movslq (%r15),%rdx 3e: 4c rex.WR 3f: 89 .byte 0x89