============================================ WARNING: possible recursive locking detected 5.15.159-syzkaller #0 Not tainted -------------------------------------------- syz-executor.4/4159 is trying to acquire lock: ffff888060ecb668 (&htab->buckets[i].lock){+...}-{2:2}, at: sock_hash_delete_elem+0x177/0x400 net/core/sock_map.c:943 but task is already holding lock: ffff888060ecb668 (&htab->buckets[i].lock){+...}-{2:2}, at: sock_hash_delete_elem+0x177/0x400 net/core/sock_map.c:943 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&htab->buckets[i].lock); lock(&htab->buckets[i].lock); *** DEADLOCK *** May be due to missing lock nesting notation 6 locks held by syz-executor.4/4159: #0: ffff88801ee3d610 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:789 [inline] #0: ffff88801ee3d610 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:648 [inline] #0: ffff88801ee3d610 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x98/0x230 net/socket.c:1336 #1: ffff88814b246a20 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1668 [inline] #1: ffff88814b246a20 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: tipc_release+0xb0/0x16d0 net/tipc/socket.c:639 #2: ffffffff8c91fae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311 #3: ffff888060ecb668 (&htab->buckets[i].lock){+...}-{2:2}, at: sock_hash_delete_elem+0x177/0x400 net/core/sock_map.c:943 #4: ffff888075640290 (&psock->link_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline] #4: ffff888075640290 (&psock->link_lock){+...}-{2:2}, at: sock_map_del_link net/core/sock_map.c:147 [inline] #4: ffff888075640290 (&psock->link_lock){+...}-{2:2}, at: sock_map_unref+0xcc/0x5d0 net/core/sock_map.c:182 #5: ffffffff8c91fae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311 stack backtrace: CPU: 1 PID: 4159 Comm: syz-executor.4 Not tainted 5.15.159-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2946 [inline] check_deadlock kernel/locking/lockdep.c:2989 [inline] validate_chain+0x46d2/0x5930 kernel/locking/lockdep.c:3775 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178 sock_hash_delete_elem+0x177/0x400 net/core/sock_map.c:943 bpf_prog_2c29ac5cdc6b1842+0x3a/0x468 bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline] __bpf_prog_run include/linux/filter.h:628 [inline] bpf_prog_run include/linux/filter.h:635 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline] bpf_trace_run2+0x19e/0x340 kernel/trace/bpf_trace.c:1917 __bpf_trace_kfree+0x6e/0x90 include/trace/events/kmem.h:118 trace_kfree include/trace/events/kmem.h:118 [inline] kfree+0x22f/0x270 mm/slub.c:4549 sk_psock_free_link include/linux/skmsg.h:421 [inline] sock_map_del_link net/core/sock_map.c:160 [inline] sock_map_unref+0x3ac/0x5d0 net/core/sock_map.c:182 sock_hash_delete_elem+0x388/0x400 net/core/sock_map.c:947 bpf_prog_2c29ac5cdc6b1842+0x3a/0x468 bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline] __bpf_prog_run include/linux/filter.h:628 [inline] bpf_prog_run include/linux/filter.h:635 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline] bpf_trace_run2+0x19e/0x340 kernel/trace/bpf_trace.c:1917 __bpf_trace_kfree+0x6e/0x90 include/trace/events/kmem.h:118 trace_kfree include/trace/events/kmem.h:118 [inline] kfree+0x22f/0x270 mm/slub.c:4549 skb_free_head net/core/skbuff.c:655 [inline] skb_release_data+0x73a/0x8a0 net/core/skbuff.c:677 skb_release_all net/core/skbuff.c:742 [inline] __kfree_skb net/core/skbuff.c:756 [inline] kfree_skb_reason+0xb3/0x170 net/core/skbuff.c:776 kfree_skb include/linux/skbuff.h:1123 [inline] tipc_msg_reverse+0x191/0x920 net/tipc/msg.c:672 tipc_sk_respond+0x10d/0x310 net/tipc/socket.c:292 tsk_rej_rx_queue net/tipc/socket.c:313 [inline] __tipc_shutdown+0xa90/0x1640 net/tipc/socket.c:577 tipc_release+0x178/0x16d0 net/tipc/socket.c:642 __sock_release net/socket.c:649 [inline] sock_close+0xcd/0x230 net/socket.c:1336 __fput+0x3bf/0x890 fs/file_table.c:280 task_work_run+0x129/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0x6a3/0x2480 kernel/exit.c:872 do_group_exit+0x144/0x310 kernel/exit.c:994 get_signal+0xc66/0x14e0 kernel/signal.c:2889 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f83718792f5 Code: Unable to access opcode bytes at RIP 0x7f83718792cb. RSP: 002b:00007ffc465f8080 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 RAX: 0000000000000000 RBX: 00007f837197cf80 RCX: 00007f83718792f5 RDX: 00007ffc465f80c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f837197e980 R08: 0000000000000000 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000156aa R13: 00007f837197d12c R14: 00007f837197d120 R15: 0000000000000032