====================================================== WARNING: possible circular locking dependency detected 6.11.0-rc6-syzkaller-00308-gb31c44928842 #0 Not tainted ------------------------------------------------------ syz-executor/5348 is trying to acquire lock: ffff88804b8c9020 (&htab->lockdep_key){-.-.}-{2:2}, at: htab_lock_bucket kernel/bpf/hashtab.c:167 [inline] ffff88804b8c9020 (&htab->lockdep_key){-.-.}-{2:2}, at: htab_map_delete_elem+0x1c8/0x730 kernel/bpf/hashtab.c:1426 but task is already holding lock: ffff8880235b30f8 (&htab->lockdep_key#2){-...}-{2:2}, at: htab_lock_bucket kernel/bpf/hashtab.c:167 [inline] ffff8880235b30f8 (&htab->lockdep_key#2){-...}-{2:2}, at: htab_map_delete_elem+0x1c8/0x730 kernel/bpf/hashtab.c:1426 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&htab->lockdep_key#2){-...}-{2:2}: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 htab_lock_bucket kernel/bpf/hashtab.c:167 [inline] htab_map_delete_elem+0x1c8/0x730 kernel/bpf/hashtab.c:1426 bpf_prog_1a158c95e143a564+0x45/0x4e bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2447 __bpf_trace_contention_end+0xca/0x110 include/trace/events/lock.h:122 __traceiter_contention_end+0x5a/0xa0 include/trace/events/lock.h:122 trace_contention_end.constprop.0+0xea/0x170 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0x27e/0xc90 kernel/locking/qspinlock.c:557 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x210/0x2c0 kernel/locking/spinlock_debug.c:116 htab_lock_bucket kernel/bpf/hashtab.c:167 [inline] htab_map_delete_elem+0x1c8/0x730 kernel/bpf/hashtab.c:1426 bpf_prog_1a158c95e143a564+0x45/0x4e bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2447 __bpf_trace_contention_end+0xca/0x110 include/trace/events/lock.h:122 __traceiter_contention_end+0x5a/0xa0 include/trace/events/lock.h:122 trace_contention_end+0xce/0x140 include/trace/events/lock.h:122 __mutex_lock_common kernel/locking/mutex.c:617 [inline] __mutex_lock+0x19c/0x9c0 kernel/locking/mutex.c:752 rng_dev_read+0x128/0x720 drivers/char/hw_random/core.c:218 do_loop_readv_writev fs/read_write.c:761 [inline] do_loop_readv_writev fs/read_write.c:749 [inline] vfs_readv+0x6cb/0x8a0 fs/read_write.c:934 do_preadv fs/read_write.c:1049 [inline] __do_sys_preadv fs/read_write.c:1099 [inline] __se_sys_preadv fs/read_write.c:1094 [inline] __x64_sys_preadv+0x22b/0x310 fs/read_write.c:1094 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&htab->lockdep_key){-.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142 lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 htab_lock_bucket kernel/bpf/hashtab.c:167 [inline] htab_map_delete_elem+0x1c8/0x730 kernel/bpf/hashtab.c:1426 bpf_prog_1a158c95e143a564+0x45/0x4e bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2447 __bpf_trace_contention_end+0xca/0x110 include/trace/events/lock.h:122 __traceiter_contention_end+0x5a/0xa0 include/trace/events/lock.h:122 trace_contention_end.constprop.0+0xea/0x170 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0x27e/0xc90 kernel/locking/qspinlock.c:557 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x210/0x2c0 kernel/locking/spinlock_debug.c:116 htab_lock_bucket kernel/bpf/hashtab.c:167 [inline] htab_map_delete_elem+0x1c8/0x730 kernel/bpf/hashtab.c:1426 bpf_prog_1a158c95e143a564+0x45/0x4e bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2447 __bpf_trace_contention_end+0xca/0x110 include/trace/events/lock.h:122 __traceiter_contention_end+0x5a/0xa0 include/trace/events/lock.h:122 trace_contention_end+0xce/0x140 include/trace/events/lock.h:122 __mutex_lock_common kernel/locking/mutex.c:617 [inline] __mutex_lock+0x19c/0x9c0 kernel/locking/mutex.c:752 __fdget_pos+0xeb/0x180 fs/file.c:1187 fdget_pos include/linux/file.h:76 [inline] __do_sys_getdents64 fs/readdir.c:403 [inline] __se_sys_getdents64 fs/readdir.c:392 [inline] __x64_sys_getdents64+0x117/0x2e0 fs/readdir.c:392 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&htab->lockdep_key#2); lock(&htab->lockdep_key); lock(&htab->lockdep_key#2); lock(&htab->lockdep_key); *** DEADLOCK *** 4 locks held by syz-executor/5348: #0: ffff88802d21cd48 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xeb/0x180 fs/file.c:1187 #1: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #1: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #1: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2405 [inline] #1: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1c2/0x590 kernel/trace/bpf_trace.c:2447 #2: ffff8880235b30f8 (&htab->lockdep_key#2){-...}-{2:2}, at: htab_lock_bucket kernel/bpf/hashtab.c:167 [inline] #2: ffff8880235b30f8 (&htab->lockdep_key#2){-...}-{2:2}, at: htab_map_delete_elem+0x1c8/0x730 kernel/bpf/hashtab.c:1426 #3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2405 [inline] #3: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1c2/0x590 kernel/trace/bpf_trace.c:2447 stack backtrace: CPU: 2 UID: 0 PID: 5348 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00308-gb31c44928842 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186 check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142 lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 htab_lock_bucket kernel/bpf/hashtab.c:167 [inline] htab_map_delete_elem+0x1c8/0x730 kernel/bpf/hashtab.c:1426 bpf_prog_1a158c95e143a564+0x45/0x4e bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2447 __bpf_trace_contention_end+0xca/0x110 include/trace/events/lock.h:122 __traceiter_contention_end+0x5a/0xa0 include/trace/events/lock.h:122 trace_contention_end.constprop.0+0xea/0x170 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0x27e/0xc90 kernel/locking/qspinlock.c:557 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x210/0x2c0 kernel/locking/spinlock_debug.c:116 htab_lock_bucket kernel/bpf/hashtab.c:167 [inline] htab_map_delete_elem+0x1c8/0x730 kernel/bpf/hashtab.c:1426 bpf_prog_1a158c95e143a564+0x45/0x4e bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run2+0x231/0x590 kernel/trace/bpf_trace.c:2447 __bpf_trace_contention_end+0xca/0x110 include/trace/events/lock.h:122 __traceiter_contention_end+0x5a/0xa0 include/trace/events/lock.h:122 trace_contention_end+0xce/0x140 include/trace/events/lock.h:122 __mutex_lock_common kernel/locking/mutex.c:617 [inline] __mutex_lock+0x19c/0x9c0 kernel/locking/mutex.c:752 __fdget_pos+0xeb/0x180 fs/file.c:1187 fdget_pos include/linux/file.h:76 [inline] __do_sys_getdents64 fs/readdir.c:403 [inline] __se_sys_getdents64 fs/readdir.c:392 [inline] __x64_sys_getdents64+0x117/0x2e0 fs/readdir.c:392 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f55b8daf093 Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 42 43 f8 ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8 RSP: 002b:00007fffee7a4ba8 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 RAX: ffffffffffffffda RBX: 00005555793cb5c0 RCX: 00007f55b8daf093 RDX: 0000000000008000 RSI: 00005555793cb5c0 RDI: 0000000000000003 RBP: 00005555793cb594 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000293 R12: ffffffffffffffa8 R13: 0000000000000016 R14: 00005555793cb590 R15: 00007fffee7a5d60