wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 ====================================================== WARNING: possible circular locking dependency detected 5.11.0-syzkaller #0 Not tainted ------------------------------------------------------ kworker/u4:1/24 is trying to acquire lock: ffff8880187d41d8 (&rs->rs_recv_lock){....}-{2:2}, at: rds_wake_sk_sleep+0x1a/0xc0 net/rds/af_rds.c:109 but task is already holding lock: ffff888014cdc100 (&rm->m_rs_lock){....}-{2:2}, at: rds_send_remove_from_sock+0x1e6/0x960 net/rds/send.c:628 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&rm->m_rs_lock){....}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:159 rds_message_purge net/rds/message.c:138 [inline] rds_message_put+0x16d/0xc60 net/rds/message.c:180 rds_clear_recv_queue+0x1c5/0x350 net/rds/recv.c:771 rds_release+0xca/0x350 net/rds/af_rds.c:73 __sock_release+0xbb/0x270 net/socket.c:597 sock_close+0xf/0x20 net/socket.c:1256 __fput+0x204/0x870 fs/file_table.c:280 task_work_run+0xc0/0x160 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x249/0x250 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x44/0xa9 -> #0 (&rs->rs_recv_lock){....}-{2:2}: check_prev_add kernel/locking/lockdep.c:2868 [inline] check_prevs_add kernel/locking/lockdep.c:2993 [inline] validate_chain kernel/locking/lockdep.c:3608 [inline] __lock_acquire+0x2b2a/0x5500 kernel/locking/lockdep.c:4832 lock_acquire kernel/locking/lockdep.c:5442 [inline] lock_acquire+0x1a8/0x720 kernel/locking/lockdep.c:5407 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:159 [inline] _raw_read_lock_irqsave+0x45/0x90 kernel/locking/spinlock.c:231 rds_wake_sk_sleep+0x1a/0xc0 net/rds/af_rds.c:109 rds_send_remove_from_sock+0x250/0x960 net/rds/send.c:634 rds_send_path_drop_acked+0x276/0x360 net/rds/send.c:710 rds_tcp_write_space+0x196/0x5a0 net/rds/tcp_send.c:198 tcp_new_space net/ipv4/tcp_input.c:5378 [inline] tcp_check_space+0x353/0x5f0 net/ipv4/tcp_input.c:5387 tcp_data_snd_check net/ipv4/tcp_input.c:5396 [inline] tcp_rcv_established+0x776/0x1f50 net/ipv4/tcp_input.c:5890 tcp_v4_do_rcv+0x4f0/0x750 net/ipv4/tcp_ipv4.c:1676 sk_backlog_rcv include/net/sock.h:1016 [inline] __release_sock+0x113/0x350 net/core/sock.c:2542 release_sock+0x4a/0x170 net/core/sock.c:3066 rds_send_xmit+0x1010/0x2350 net/rds/send.c:422 rds_send_worker+0x77/0x270 net/rds/threads.c:200 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2275 worker_thread+0x598/0xf80 kernel/workqueue.c:2421 kthread+0x36f/0x450 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rm->m_rs_lock); lock(&rs->rs_recv_lock); lock(&rm->m_rs_lock); lock(&rs->rs_recv_lock); *** DEADLOCK *** 5 locks held by kworker/u4:1/24: #0: ffff88814a5cd938 ((wq_completion)krdsd){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff88814a5cd938 ((wq_completion)krdsd){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] #0: ffff88814a5cd938 ((wq_completion)krdsd){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline] #0: ffff88814a5cd938 ((wq_completion)krdsd){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline] #0: ffff88814a5cd938 ((wq_completion)krdsd){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff88814a5cd938 ((wq_completion)krdsd){+.+.}-{0:0}, at: process_one_work+0x771/0x13b0 kernel/workqueue.c:2246 #1: ffffc90000defdb0 ((work_completion)(&(&cp->cp_send_w)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0x13b0 kernel/workqueue.c:2250 #2: ffff88801a35c7a0 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1594 [inline] #2: ffff88801a35c7a0 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sock_set_cork+0xe/0x70 net/ipv4/tcp.c:3146 #3: ffff88801a35ca48 (k-clock-AF_INET){++.-}-{2:2}, at: rds_tcp_write_space+0x20/0x5a0 net/rds/tcp_send.c:184 #4: ffff888014cdc100 (&rm->m_rs_lock){....}-{2:2}, at: rds_send_remove_from_sock+0x1e6/0x960 net/rds/send.c:628 stack backtrace: CPU: 0 PID: 24 Comm: kworker/u4:1 Not tainted 5.11.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: krdsd rds_send_worker Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x9a/0xcc lib/dump_stack.c:120 check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2117 check_prev_add kernel/locking/lockdep.c:2868 [inline] check_prevs_add kernel/locking/lockdep.c:2993 [inline] validate_chain kernel/locking/lockdep.c:3608 [inline] __lock_acquire+0x2b2a/0x5500 kernel/locking/lockdep.c:4832 lock_acquire kernel/locking/lockdep.c:5442 [inline] lock_acquire+0x1a8/0x720 kernel/locking/lockdep.c:5407 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:159 [inline] _raw_read_lock_irqsave+0x45/0x90 kernel/locking/spinlock.c:231 rds_wake_sk_sleep+0x1a/0xc0 net/rds/af_rds.c:109 rds_send_remove_from_sock+0x250/0x960 net/rds/send.c:634 rds_send_path_drop_acked+0x276/0x360 net/rds/send.c:710 rds_tcp_write_space+0x196/0x5a0 net/rds/tcp_send.c:198 tcp_new_space net/ipv4/tcp_input.c:5378 [inline] tcp_check_space+0x353/0x5f0 net/ipv4/tcp_input.c:5387 tcp_data_snd_check net/ipv4/tcp_input.c:5396 [inline] tcp_rcv_established+0x776/0x1f50 net/ipv4/tcp_input.c:5890 tcp_v4_do_rcv+0x4f0/0x750 net/ipv4/tcp_ipv4.c:1676 sk_backlog_rcv include/net/sock.h:1016 [inline] __release_sock+0x113/0x350 net/core/sock.c:2542 release_sock+0x4a/0x170 net/core/sock.c:3066 rds_send_xmit+0x1010/0x2350 net/rds/send.c:422 rds_send_worker+0x77/0x270 net/rds/threads.c:200 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2275 worker_thread+0x598/0xf80 kernel/workqueue.c:2421 kthread+0x36f/0x450 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296