===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.8.0-syzkaller-05236-g443574b03387 #0 Not tainted ----------------------------------------------------- syz-executor.0/5382 [HC0[0]:SC1[3]:HE0:SE0] is trying to acquire: ffff88807dbb6200 (&stab->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff88807dbb6200 (&stab->lock){+.-.}-{2:2}, at: __sock_map_delete net/core/sock_map.c:414 [inline] ffff88807dbb6200 (&stab->lock){+.-.}-{2:2}, at: sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 and this task is already holding: ffff8880b942a758 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x112/0x240 kernel/time/timer.c:1051 which would create a new lock dependency: ( &base->lock){-.-.}-{2:2} -> (&stab->lock){+.-.}-{2:2} but this new dependency connects a HARDIRQ-irq-safe lock: (&base->lock){-.-.}-{2:2} ... which became HARDIRQ-irq-safe at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 lock_timer_base+0x112/0x240 kernel/time/timer.c:1051 add_timer_on+0x1e5/0x5c0 kernel/time/timer.c:1366 handle_irq_event_percpu kernel/irq/handle.c:195 [inline] handle_irq_event+0xad/0x1f0 kernel/irq/handle.c:210 handle_edge_irq+0x25f/0xc20 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline] handle_irq arch/x86/kernel/irq.c:238 [inline] __common_interrupt+0x13a/0x230 arch/x86/kernel/irq.c:257 common_interrupt+0xa5/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 console_flush_all+0x9cd/0xec0 console_unlock+0x13b/0x4d0 kernel/printk/printk.c:3025 vprintk_emit+0x509/0x720 kernel/printk/printk.c:2292 _printk+0xd5/0x120 kernel/printk/printk.c:2317 spectre_v2_select_mitigation+0x68f/0x8f0 arch/x86/kernel/cpu/bugs.c:1763 cpu_select_mitigations+0x41/0xa0 arch/x86/kernel/cpu/bugs.c:149 arch_cpu_finalize_init+0x20/0xa0 arch/x86/kernel/cpu/common.c:2325 start_kernel+0x402/0x500 init/main.c:1043 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x147 to a HARDIRQ-irq-unsafe lock: (&stab->lock){+.-.}-{2:2} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 0xffffffffa0001da6 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run3+0x238/0x460 kernel/trace/bpf_trace.c:2421 trace_ext4_es_insert_delayed_block include/trace/events/ext4.h:2481 [inline] ext4_es_insert_delayed_block+0x9a8/0xa10 fs/ext4/extents_status.c:2082 ext4_insert_delayed_block fs/ext4/inode.c:1676 [inline] ext4_da_map_blocks fs/ext4/inode.c:1777 [inline] ext4_da_get_block_prep+0xa67/0x1420 fs/ext4/inode.c:1817 ext4_block_write_begin+0x53b/0x1850 fs/ext4/inode.c:1055 ext4_da_write_begin+0x5e8/0xa50 fs/ext4/inode.c:2894 generic_perform_write+0x322/0x640 mm/filemap.c:3921 ext4_buffered_write_iter+0xc6/0x350 fs/ext4/file.c:299 ext4_file_write_iter+0x1de/0x1a10 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa84/0xcb0 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&stab->lock ); local_irq_disable(); lock(&base->lock); lock(&stab->lock ); lock(&base->lock); *** DEADLOCK *** 4 locks held by syz-executor.0/5382: #0: ffffc9000567fb40 ((&app->periodic_timer) ){+.-.}-{0:0} , at: call_timer_fn+0xc0/0x600 kernel/time/timer.c:1789 #1: ffff88802a0948c8 (&app->lock #2){+.-.}-{2:2} , at: spin_lock include/linux/spinlock.h:351 [inline] , at: mrp_periodic_timer+0x31/0x220 net/802/mrp.c:626 #2: ffff8880b942a758 (&base->lock){-.-.}-{2:2} , at: lock_timer_base+0x112/0x240 kernel/time/timer.c:1051 #3: ffffffff8e131920 (rcu_read_lock){....}-{1:2} , at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] , at: rcu_read_lock include/linux/rcupdate.h:750 [inline] , at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] , at: bpf_trace_run2+0x114/0x420 kernel/trace/bpf_trace.c:2420 the dependencies between HARDIRQ-irq-safe lock and the holding lock: -> (&base->lock){-.-.}-{2:2} { IN-HARDIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 lock_timer_base+0x112/0x240 kernel/time/timer.c:1051 add_timer_on+0x1e5/0x5c0 kernel/time/timer.c:1366 handle_irq_event_percpu kernel/irq/handle.c:195 [inline] handle_irq_event+0xad/0x1f0 kernel/irq/handle.c:210 handle_edge_irq+0x25f/0xc20 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline] handle_irq arch/x86/kernel/irq.c:238 [inline] __common_interrupt+0x13a/0x230 arch/x86/kernel/irq.c:257 common_interrupt+0xa5/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 console_flush_all+0x9cd/0xec0 console_unlock+0x13b/0x4d0 kernel/printk/printk.c:3025 vprintk_emit+0x509/0x720 kernel/printk/printk.c:2292 _printk+0xd5/0x120 kernel/printk/printk.c:2317 spectre_v2_select_mitigation+0x68f/0x8f0 arch/x86/kernel/cpu/bugs.c:1763 cpu_select_mitigations+0x41/0xa0 arch/x86/kernel/cpu/bugs.c:149 arch_cpu_finalize_init+0x20/0xa0 arch/x86/kernel/cpu/common.c:2325 start_kernel+0x402/0x500 init/main.c:1043 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x147 IN-SOFTIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:170 __run_timer_base+0x103/0x8e0 kernel/time/timer.c:2418 run_timer_base kernel/time/timer.c:2428 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2436 __do_softirq+0x2be/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 console_flush_all+0x9cd/0xec0 console_unlock+0x13b/0x4d0 kernel/printk/printk.c:3025 vprintk_emit+0x509/0x720 kernel/printk/printk.c:2292 _printk+0xd5/0x120 kernel/printk/printk.c:2317 print_xstate_feature+0x11c/0x130 arch/x86/kernel/fpu/xstate.c:262 print_xstate_features+0xf/0x90 arch/x86/kernel/fpu/xstate.c:270 setup_init_fpu_buf+0x66/0xf0 arch/x86/kernel/fpu/xstate.c:364 fpu__init_system_xstate+0x507/0x790 arch/x86/kernel/fpu/xstate.c:869 fpu__init_system+0x114/0x240 arch/x86/kernel/fpu/init.c:227 arch_cpu_finalize_init+0x2f/0xa0 arch/x86/kernel/cpu/common.c:2345 start_kernel+0x402/0x500 init/main.c:1043 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x147 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 lock_timer_base+0x112/0x240 kernel/time/timer.c:1051 __mod_timer+0x1ca/0xeb0 kernel/time/timer.c:1132 queue_delayed_work_on+0x15a/0x260 kernel/workqueue.c:2595 queue_delayed_work include/linux/workqueue.h:620 [inline] crng_reseed+0xe7/0x220 drivers/char/random.c:258 random_init+0x1a9/0x300 drivers/char/random.c:901 start_kernel+0x253/0x500 init/main.c:991 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0x99/0xa0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x147 } ... key at: [] init_timer_cpu.__key+0x0/0x20 the dependencies between the lock to be acquired and HARDIRQ-irq-unsafe lock: -> (&stab->lock ){+.-.}-{2:2} { HARDIRQ-ON-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 0xffffffffa0001da6 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run3+0x238/0x460 kernel/trace/bpf_trace.c:2421 trace_ext4_es_insert_delayed_block include/trace/events/ext4.h:2481 [inline] ext4_es_insert_delayed_block+0x9a8/0xa10 fs/ext4/extents_status.c:2082 ext4_insert_delayed_block fs/ext4/inode.c:1676 [inline] ext4_da_map_blocks fs/ext4/inode.c:1777 [inline] ext4_da_get_block_prep+0xa67/0x1420 fs/ext4/inode.c:1817 ext4_block_write_begin+0x53b/0x1850 fs/ext4/inode.c:1055 ext4_da_write_begin+0x5e8/0xa50 fs/ext4/inode.c:2894 generic_perform_write+0x322/0x640 mm/filemap.c:3921 ext4_buffered_write_iter+0xc6/0x350 fs/ext4/file.c:299 ext4_file_write_iter+0x1de/0x1a10 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa84/0xcb0 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 IN-SOFTIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x396/0x550 kernel/time/timer.c:663 internal_add_timer kernel/time/timer.c:688 [inline] __mod_timer+0xa0e/0xeb0 kernel/time/timer.c:1183 mrp_periodic_timer_arm net/802/mrp.c:618 [inline] mrp_periodic_timer+0x1da/0x220 net/802/mrp.c:630 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers kernel/time/timer.c:2408 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419 run_timer_base kernel/time/timer.c:2428 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x57/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 0xffffffffa0001da6 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run3+0x238/0x460 kernel/trace/bpf_trace.c:2421 trace_ext4_es_insert_delayed_block include/trace/events/ext4.h:2481 [inline] ext4_es_insert_delayed_block+0x9a8/0xa10 fs/ext4/extents_status.c:2082 ext4_insert_delayed_block fs/ext4/inode.c:1676 [inline] ext4_da_map_blocks fs/ext4/inode.c:1777 [inline] ext4_da_get_block_prep+0xa67/0x1420 fs/ext4/inode.c:1817 ext4_block_write_begin+0x53b/0x1850 fs/ext4/inode.c:1055 ext4_da_write_begin+0x5e8/0xa50 fs/ext4/inode.c:2894 generic_perform_write+0x322/0x640 mm/filemap.c:3921 ext4_buffered_write_iter+0xc6/0x350 fs/ext4/file.c:299 ext4_file_write_iter+0x1de/0x1a10 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa84/0xcb0 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 } ... key at: [] sock_map_alloc.__key+0x0/0x20 ... acquired at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x396/0x550 kernel/time/timer.c:663 internal_add_timer kernel/time/timer.c:688 [inline] __mod_timer+0xa0e/0xeb0 kernel/time/timer.c:1183 mrp_periodic_timer_arm net/802/mrp.c:618 [inline] mrp_periodic_timer+0x1da/0x220 net/802/mrp.c:630 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers kernel/time/timer.c:2408 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419 run_timer_base kernel/time/timer.c:2428 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x57/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 stack backtrace: CPU: 0 PID: 5382 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline] check_irq_usage kernel/locking/lockdep.c:2865 [inline] check_prev_add kernel/locking/lockdep.c:3138 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x4dc7/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x396/0x550 kernel/time/timer.c:663 internal_add_timer kernel/time/timer.c:688 [inline] __mod_timer+0xa0e/0xeb0 kernel/time/timer.c:1183 mrp_periodic_timer_arm net/802/mrp.c:618 [inline] mrp_periodic_timer+0x1da/0x220 net/802/mrp.c:630 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers kernel/time/timer.c:2408 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419 run_timer_base kernel/time/timer.c:2428 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x57/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0033:0x7f43ab839bdb Code: 00 09 c5 80 3d f6 ba c9 00 00 0f 85 6f ff ff ff 44 0f b6 6c 24 0f 44 8d 55 04 89 e8 41 89 c1 41 81 e1 ff 1f 00 00 43 8b 14 8e <39> d5 0f 84 5e ff ff ff 85 d2 0f 84 65 01 00 00 83 c0 01 41 39 c2 RSP: 002b:00007fff66b26e10 EFLAGS: 00000206 RAX: 0000000081891127 RBX: 00007f43ab9ac018 RCX: 00000000000017fd RDX: 0000000081891127 RSI: 0000000080000000 RDI: 000000000001d03f RBP: 0000000081891127 R08: 0000001b31020000 R09: 0000000000001127 R10: 000000008189112b R11: 0000000000000000 R12: 00000000000017fd R13: 0000000000000001 R14: 00007f43ab9a0000 R15: ffffffff81891f08 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5377 at kernel/softirq.c:307 __local_bh_disable_ip+0x1f6/0x220 kernel/softirq.c:307 Modules linked in: CPU: 0 PID: 5377 Comm: syz-executor.3 Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:__local_bh_disable_ip+0x1f6/0x220 kernel/softirq.c:307 Code: 2c 0b 00 65 48 8b 04 25 28 00 00 00 48 3b 84 24 80 00 00 00 75 33 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 e9 99 fe ff ff e8 4d 84 16 0a 41 f7 c6 00 02 00 00 0f 85 RSP: 0018:ffffc90000007bc0 EFLAGS: 00010006 RAX: 0000000000010003 RBX: ffffffff895fa967 RCX: ffff88807881da00 RDX: ffff88807881da00 RSI: 0000000000000201 RDI: ffffffff895fa967 RBP: ffffc90000007c88 R08: ffffffff895fa92d R09: 1ffffffff1f0d5cd R10: dffffc0000000000 R11: ffffffffa0001de8 R12: dffffc0000000000 R13: 1ffff92000000f7c R14: ffffc90000007c20 R15: 0000000000000201 FS: 000055555bd15480(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4e3e77c038 CR3: 000000002b272000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: __raw_spin_lock_bh include/linux/spinlock_api_smp.h:125 [inline] _raw_spin_lock_bh+0x1c/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] __sock_map_delete net/core/sock_map.c:414 [inline] sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x396/0x550 kernel/time/timer.c:663 internal_add_timer kernel/time/timer.c:688 [inline] add_timer_on+0x421/0x5c0 kernel/time/timer.c:1386 handle_irq_event_percpu kernel/irq/handle.c:195 [inline] handle_irq_event+0xad/0x1f0 kernel/irq/handle.c:210 handle_edge_irq+0x25f/0xc20 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline] handle_irq arch/x86/kernel/irq.c:238 [inline] __common_interrupt+0x138/0x230 arch/x86/kernel/irq.c:257 common_interrupt+0xa5/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 RIP: 0010:csd_lock_wait kernel/smp.c:311 [inline] RIP: 0010:smp_call_function_single+0x459/0x16a0 kernel/smp.c:650 Code: 0d 0f 0c 00 41 83 e4 01 75 16 e8 c2 0a 0c 00 4d 89 fc 44 8b 7c 24 14 eb 46 e8 b3 0a 0c 00 eb 3f 4d 89 fc 44 8b 7c 24 14 f3 90 <42> 0f b6 04 2b 84 c0 75 10 41 f7 06 01 00 00 00 74 1e e8 90 0a 0c RSP: 0018:ffffc90004d17b20 EFLAGS: 00000293 RAX: ffffffff8188e5e0 RBX: 1ffff920009a2f7d RCX: ffff88807881da00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90004d17c90 R08: ffffffff8188e5a3 R09: 1ffffffff1f0d5cd R10: dffffc0000000000 R11: ffffffff813e09a0 R12: 1ffff920009a2f78 R13: dffffc0000000000 R14: ffffc90004d17be8 R15: 0000000000000000 rcu_barrier+0x334/0x550 kernel/rcu/tree.c:4125 netdev_run_todo+0x3a0/0x1000 net/core/dev.c:10557 tun_detach drivers/net/tun.c:704 [inline] tun_chr_close+0x13a/0x1b0 drivers/net/tun.c:3498 __fput+0x429/0x8a0 fs/file_table.c:423 __do_sys_close fs/open.c:1557 [inline] __se_sys_close fs/open.c:1542 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1542 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f6c3447cd9a Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 03 7f 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 63 7f 02 00 8b 44 24 RSP: 002b:00007ffe99262f50 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f6c3447cd9a RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f6c345ad980 R08: 00007f6c34400000 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000293 R12: 0000000000010376 R13: 0000000000010344 R14: 00007ffe99263110 R15: 00007f6c34434cb0 irq event stamp: 4000 hardirqs last enabled at (3999): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (3999): [] _raw_spin_unlock_irqrestore+0x8f/0x140 kernel/locking/spinlock.c:194 hardirqs last disabled at (4000): [] __schedule+0x335/0x4a20 kernel/sched/core.c:6634 softirqs last enabled at (3534): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last enabled at (3534): [] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 softirqs last disabled at (3513): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last disabled at (3513): [] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5377 at kernel/softirq.c:361 __local_bh_enable_ip+0x1ae/0x200 kernel/softirq.c:361 Modules linked in: CPU: 0 PID: 5377 Comm: syz-executor.3 Tainted: G W 6.8.0-syzkaller-05236-g443574b03387 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:__local_bh_enable_ip+0x1ae/0x200 kernel/softirq.c:361 Code: 04 1c 00 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 44 24 60 75 52 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 e9 ca fe ff ff e8 55 00 00 00 eb 9c 90 0f 0b 90 e9 fa fe RSP: 0018:ffffc90000007be0 EFLAGS: 00010006 RAX: 0000000000010204 RBX: 1ffff92000000f80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff895fa99a RBP: ffffc90000007ca0 R08: ffff88807dbb61eb R09: 1ffff1100fb76c3d R10: dffffc0000000000 R11: ffffed100fb76c3e R12: dffffc0000000000 R13: ffff88805affa280 R14: 0000000000000000 R15: 0000000000000201 FS: 000055555bd15480(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4e3e77c038 CR3: 000000002b272000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: spin_unlock_bh include/linux/spinlock.h:396 [inline] __sock_map_delete net/core/sock_map.c:424 [inline] sock_map_delete_elem+0xca/0x140 net/core/sock_map.c:446 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x396/0x550 kernel/time/timer.c:663 internal_add_timer kernel/time/timer.c:688 [inline] add_timer_on+0x421/0x5c0 kernel/time/timer.c:1386 handle_irq_event_percpu kernel/irq/handle.c:195 [inline] handle_irq_event+0xad/0x1f0 kernel/irq/handle.c:210 handle_edge_irq+0x25f/0xc20 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline] handle_irq arch/x86/kernel/irq.c:238 [inline] __common_interrupt+0x138/0x230 arch/x86/kernel/irq.c:257 common_interrupt+0xa5/0xd0 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 RIP: 0010:csd_lock_wait kernel/smp.c:311 [inline] RIP: 0010:smp_call_function_single+0x459/0x16a0 kernel/smp.c:650 Code: 0d 0f 0c 00 41 83 e4 01 75 16 e8 c2 0a 0c 00 4d 89 fc 44 8b 7c 24 14 eb 46 e8 b3 0a 0c 00 eb 3f 4d 89 fc 44 8b 7c 24 14 f3 90 <42> 0f b6 04 2b 84 c0 75 10 41 f7 06 01 00 00 00 74 1e e8 90 0a 0c RSP: 0018:ffffc90004d17b20 EFLAGS: 00000293 RAX: ffffffff8188e5e0 RBX: 1ffff920009a2f7d RCX: ffff88807881da00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90004d17c90 R08: ffffffff8188e5a3 R09: 1ffffffff1f0d5cd R10: dffffc0000000000 R11: ffffffff813e09a0 R12: 1ffff920009a2f78 R13: dffffc0000000000 R14: ffffc90004d17be8 R15: 0000000000000000 rcu_barrier+0x334/0x550 kernel/rcu/tree.c:4125 netdev_run_todo+0x3a0/0x1000 net/core/dev.c:10557 tun_detach drivers/net/tun.c:704 [inline] tun_chr_close+0x13a/0x1b0 drivers/net/tun.c:3498 __fput+0x429/0x8a0 fs/file_table.c:423 __do_sys_close fs/open.c:1557 [inline] __se_sys_close fs/open.c:1542 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1542 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f6c3447cd9a Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 03 7f 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 63 7f 02 00 8b 44 24 RSP: 002b:00007ffe99262f50 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f6c3447cd9a RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f6c345ad980 R08: 00007f6c34400000 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000293 R12: 0000000000010376 R13: 0000000000010344 R14: 00007ffe99263110 R15: 00007f6c34434cb0 irq event stamp: 4000 hardirqs last enabled at (3999): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (3999): [] _raw_spin_unlock_irqrestore+0x8f/0x140 kernel/locking/spinlock.c:194 hardirqs last disabled at (4000): [] __schedule+0x335/0x4a20 kernel/sched/core.c:6634 softirqs last enabled at (3534): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last enabled at (3534): [] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 softirqs last disabled at (3513): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last disabled at (3513): [] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 0d 0f 0c 00 41 or $0x41000c0f,%eax 5: 83 e4 01 and $0x1,%esp 8: 75 16 jne 0x20 a: e8 c2 0a 0c 00 call 0xc0ad1 f: 4d 89 fc mov %r15,%r12 12: 44 8b 7c 24 14 mov 0x14(%rsp),%r15d 17: eb 46 jmp 0x5f 19: e8 b3 0a 0c 00 call 0xc0ad1 1e: eb 3f jmp 0x5f 20: 4d 89 fc mov %r15,%r12 23: 44 8b 7c 24 14 mov 0x14(%rsp),%r15d 28: f3 90 pause * 2a: 42 0f b6 04 2b movzbl (%rbx,%r13,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 75 10 jne 0x43 33: 41 f7 06 01 00 00 00 testl $0x1,(%r14) 3a: 74 1e je 0x5a 3c: e8 .byte 0xe8 3d: 90 nop 3e: 0a .byte 0xa 3f: 0c .byte 0xc