============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- kworker/1:3/5777 is trying to acquire lock: ffff888076588838 (rhashtable_bucket){-.-.}-{0:0}, at: rht_lock+0x8b/0x180 include/linux/rhashtable.h:331 but task is already holding lock: ffff8880236ae038 (rhashtable_bucket){-.-.}-{0:0}, at: rht_lock+0x8b/0x180 include/linux/rhashtable.h:331 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(rhashtable_bucket); lock(rhashtable_bucket); *** DEADLOCK *** May be due to missing lock nesting notation 8 locks held by kworker/1:3/5777: #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90004427c40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90004427c40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888055aca250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1fd/0x3b0 drivers/net/netdevsim/fib.c:1490 #3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: __rhashtable_insert_fast include/linux/rhashtable.h:774 [inline] #3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rhashtable_insert_fast include/linux/rhashtable.h:887 [inline] #3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: nsim_fib4_rt_add drivers/net/netdevsim/fib.c:362 [inline] #3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: nsim_fib4_rt_insert drivers/net/netdevsim/fib.c:432 [inline] #3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: nsim_fib4_event drivers/net/netdevsim/fib.c:464 [inline] #3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: nsim_fib_event+0x1112/0xa390 drivers/net/netdevsim/fib.c:884 #4: ffff8880236ae038 (rhashtable_bucket){-.-.}-{0:0}, at: rht_lock+0x8b/0x180 include/linux/rhashtable.h:331 #5: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #5: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #5: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: trace_call_bpf+0xb6/0xb80 kernel/trace/bpf_trace.c:-1 #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline] #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rhtab_map_delete_elem+0x21/0x190 kernel/bpf/hashtab.c:2979 #7: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #7: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #7: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: __rhashtable_remove_fast include/linux/rhashtable.h:1137 [inline] #7: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rhashtable_remove_fast include/linux/rhashtable.h:1175 [inline] #7: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rhtab_delete_elem+0x15c/0x1b30 kernel/bpf/hashtab.c:-1 stack backtrace: CPU: 1 UID: 0 PID: 5777 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: events nsim_fib_event_work Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041 check_deadlock kernel/locking/lockdep.c:3093 [inline] validate_chain kernel/locking/lockdep.c:3895 [inline] __lock_acquire+0x24df/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 rht_lock+0xa3/0x180 include/linux/rhashtable.h:331 __rhashtable_remove_fast_one include/linux/rhashtable.h:1065 [inline] __rhashtable_remove_fast include/linux/rhashtable.h:1146 [inline] rhashtable_remove_fast include/linux/rhashtable.h:1175 [inline] rhtab_delete_elem+0x404/0x1b30 kernel/bpf/hashtab.c:2954 rhtab_map_delete_elem+0xe2/0x190 kernel/bpf/hashtab.c:2985 bpf_prog_d25b6cf98522e2a8+0x4e/0x56 bpf_dispatcher_nop_func include/linux/bpf.h:1453 [inline] __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run include/linux/filter.h:731 [inline] bpf_prog_run_array include/linux/bpf.h:2605 [inline] trace_call_bpf+0x3f0/0xb80 kernel/trace/bpf_trace.c:147 perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:11398 do_perf_trace_lock include/trace/events/lock.h:49 [inline] perf_trace_lock+0x32d/0x410 include/trace/events/lock.h:49 __do_trace_lock_release include/trace/events/lock.h:68 [inline] trace_lock_release include/trace/events/lock.h:68 [inline] lock_release+0x38e/0x3c0 kernel/locking/lockdep.c:5879 rht_assign_unlock include/linux/rhashtable.h:431 [inline] __rhashtable_insert_fast include/linux/rhashtable.h:850 [inline] rhashtable_insert_fast include/linux/rhashtable.h:887 [inline] nsim_fib4_rt_add drivers/net/netdevsim/fib.c:362 [inline] nsim_fib4_rt_insert drivers/net/netdevsim/fib.c:432 [inline] nsim_fib4_event drivers/net/netdevsim/fib.c:464 [inline] nsim_fib_event+0x415c/0xa390 drivers/net/netdevsim/fib.c:884 nsim_fib_event_work+0x244/0x3b0 drivers/net/netdevsim/fib.c:1493 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245