===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.8.0-syzkaller-05236-g443574b03387 #0 Not tainted ----------------------------------------------------- syz-executor.1/8043 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire: ffff888056b9d020 (&htab->buckets[i].lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff888056b9d020 (&htab->buckets[i].lock){+...}-{2:2}, at: sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939 and this task is already holding: ffff888025a72518 (&sighand->siglock){-.-.}-{2:2}, at: force_sig_info_to_task+0x68/0x580 kernel/signal.c:1334 which would create a new lock dependency: (&sighand->siglock){-.-.}-{2:2} -> (&htab->buckets[i].lock){+...}-{2:2} but this new dependency connects a HARDIRQ-irq-safe lock: (&sighand->siglock){-.-.}-{2:2} ... which became HARDIRQ-irq-safe at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 __lock_task_sighand+0x149/0x2e0 kernel/signal.c:1414 lock_task_sighand include/linux/sched/signal.h:746 [inline] do_send_sig_info kernel/signal.c:1300 [inline] group_send_sig_info+0x274/0x310 kernel/signal.c:1453 do_bpf_send_signal+0x85/0x190 kernel/trace/bpf_trace.c:838 irq_work_single+0xe2/0x240 kernel/irq_work.c:221 irq_work_run_list kernel/irq_work.c:252 [inline] irq_work_run+0x18b/0x350 kernel/irq_work.c:261 __sysvec_irq_work+0xa8/0x3e0 arch/x86/kernel/irq_work.c:22 instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline] sysvec_irq_work+0x9e/0xc0 arch/x86/kernel/irq_work.c:17 asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:738 __raw_write_unlock_irq include/linux/rwlock_api_smp.h:274 [inline] _raw_write_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:358 release_task+0x165f/0x1810 kernel/exit.c:280 wait_task_zombie kernel/exit.c:1189 [inline] wait_consider_task+0x1a14/0x2e50 kernel/exit.c:1416 do_wait_thread kernel/exit.c:1479 [inline] __do_wait+0x1b0/0x850 kernel/exit.c:1597 do_wait+0x1d9/0x540 kernel/exit.c:1631 kernel_wait4+0x2a7/0x3e0 kernel/exit.c:1790 __do_sys_wait4 kernel/exit.c:1818 [inline] __se_sys_wait4 kernel/exit.c:1814 [inline] __x64_sys_wait4+0x134/0x1e0 kernel/exit.c:1814 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 to a HARDIRQ-irq-unsafe lock: (&htab->buckets[i].lock){+...}-{2:2} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_update_common+0x20c/0xa30 net/core/sock_map.c:1007 sock_map_update_elem_sys+0x5a4/0x910 net/core/sock_map.c:581 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&htab->buckets[i].lock); local_irq_disable(); lock(&sighand->siglock); lock(&htab->buckets[i].lock); lock(&sighand->siglock); *** DEADLOCK *** 2 locks held by syz-executor.1/8043: #0: ffff888025a72518 (&sighand->siglock){-.-.}-{2:2}, at: force_sig_info_to_task+0x68/0x580 kernel/signal.c:1334 #1: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #1: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #1: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] #1: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run5+0x197/0x4a0 kernel/trace/bpf_trace.c:2423 the dependencies between HARDIRQ-irq-safe lock and the holding lock: -> (&sighand->siglock){-.-.}-{2:2} { IN-HARDIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 __lock_task_sighand+0x149/0x2e0 kernel/signal.c:1414 lock_task_sighand include/linux/sched/signal.h:746 [inline] do_send_sig_info kernel/signal.c:1300 [inline] group_send_sig_info+0x274/0x310 kernel/signal.c:1453 do_bpf_send_signal+0x85/0x190 kernel/trace/bpf_trace.c:838 irq_work_single+0xe2/0x240 kernel/irq_work.c:221 irq_work_run_list kernel/irq_work.c:252 [inline] irq_work_run+0x18b/0x350 kernel/irq_work.c:261 __sysvec_irq_work+0xa8/0x3e0 arch/x86/kernel/irq_work.c:22 instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline] sysvec_irq_work+0x9e/0xc0 arch/x86/kernel/irq_work.c:17 asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:738 __raw_write_unlock_irq include/linux/rwlock_api_smp.h:274 [inline] _raw_write_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:358 release_task+0x165f/0x1810 kernel/exit.c:280 wait_task_zombie kernel/exit.c:1189 [inline] wait_consider_task+0x1a14/0x2e50 kernel/exit.c:1416 do_wait_thread kernel/exit.c:1479 [inline] __do_wait+0x1b0/0x850 kernel/exit.c:1597 do_wait+0x1d9/0x540 kernel/exit.c:1631 kernel_wait4+0x2a7/0x3e0 kernel/exit.c:1790 __do_sys_wait4 kernel/exit.c:1818 [inline] __se_sys_wait4 kernel/exit.c:1814 [inline] __x64_sys_wait4+0x134/0x1e0 kernel/exit.c:1814 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 IN-SOFTIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 __lock_task_sighand+0x149/0x2e0 kernel/signal.c:1414 lock_task_sighand include/linux/sched/signal.h:746 [inline] do_send_sig_info kernel/signal.c:1300 [inline] group_send_sig_info+0x274/0x310 kernel/signal.c:1453 bpf_send_signal_common+0x2dd/0x430 kernel/trace/bpf_trace.c:881 ____bpf_send_signal_thread kernel/trace/bpf_trace.c:898 [inline] bpf_send_signal_thread+0x16/0x20 kernel/trace/bpf_trace.c:896 0xffffffffa000202e bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:650 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x375/0x420 kernel/trace/bpf_trace.c:2420 trace_kfree include/trace/events/kmem.h:94 [inline] kfree+0x291/0x380 mm/slub.c:4396 ref_tracker_free+0x4ef/0x7e0 lib/ref_tracker.c:272 netdev_tracker_free include/linux/netdevice.h:4084 [inline] netdev_put include/linux/netdevice.h:4101 [inline] fib_nh_common_release+0x52/0x430 net/ipv4/fib_semantics.c:215 fib_nh_release net/ipv4/fib_semantics.c:229 [inline] free_fib_info_rcu+0xdc/0x490 net/ipv4/fib_semantics.c:241 rcu_do_batch kernel/rcu/tree.c:2196 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 mt_slot lib/maple_tree.c:788 [inline] mas_slot lib/maple_tree.c:821 [inline] mt_validate_nulls lib/maple_tree.c:7547 [inline] mt_validate+0x4205/0x4aa0 lib/maple_tree.c:7601 validate_mm+0xe7/0x530 mm/mmap.c:288 __split_vma+0xb1a/0xd00 mm/mmap.c:2389 do_vmi_align_munmap+0x3a6/0x1930 mm/mmap.c:2544 do_vmi_munmap+0x24e/0x2d0 mm/mmap.c:2703 mmap_region+0x678/0x1fa0 mm/mmap.c:2754 do_mmap+0x7af/0xe60 mm/mmap.c:1387 vm_mmap_pgoff+0x1e3/0x420 mm/util.c:573 ksys_mmap_pgoff+0x504/0x6e0 mm/mmap.c:1433 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:376 [inline] calculate_sigpending+0x4f/0x90 kernel/signal.c:188 ret_from_fork+0x24/0x80 arch/x86/kernel/process.c:143 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 } ... key at: [] sighand_ctor.__key+0x0/0x20 the dependencies between the lock to be acquired and HARDIRQ-irq-unsafe lock: -> (&htab->buckets[i].lock){+...}-{2:2} { HARDIRQ-ON-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_update_common+0x20c/0xa30 net/core/sock_map.c:1007 sock_map_update_elem_sys+0x5a4/0x910 net/core/sock_map.c:581 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_update_common+0x20c/0xa30 net/core/sock_map.c:1007 sock_map_update_elem_sys+0x5a4/0x910 net/core/sock_map.c:581 map_update_elem+0x53a/0x6f0 kernel/bpf/syscall.c:1641 __sys_bpf+0x76f/0x810 kernel/bpf/syscall.c:5619 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 } ... key at: [] sock_hash_alloc.__key+0x0/0x20 ... acquired at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run5+0x282/0x4a0 kernel/trace/bpf_trace.c:2423 trace_signal_generate+0x194/0x200 include/trace/events/signal.h:50 __send_signal_locked+0xb44/0xdc0 kernel/signal.c:1187 force_sig_info_to_task+0x2ff/0x580 kernel/signal.c:1352 force_sig_info kernel/signal.c:1363 [inline] force_sig+0x119/0x1d0 kernel/signal.c:1679 gp_user_force_sig_segv arch/x86/kernel/traps.c:641 [inline] __exc_general_protection arch/x86/kernel/traps.c:674 [inline] exc_general_protection+0x1d1/0x5d0 arch/x86/kernel/traps.c:644 asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:617 stack backtrace: CPU: 1 PID: 8043 Comm: syz-executor.1 Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline] check_irq_usage kernel/locking/lockdep.c:2865 [inline] check_prev_add kernel/locking/lockdep.c:3138 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x4dc7/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xb0/0x300 net/core/sock_map.c:939 bpf_prog_2c29ac5cdc6b1842+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run5+0x282/0x4a0 kernel/trace/bpf_trace.c:2423 trace_signal_generate+0x194/0x200 include/trace/events/signal.h:50 __send_signal_locked+0xb44/0xdc0 kernel/signal.c:1187 force_sig_info_to_task+0x2ff/0x580 kernel/signal.c:1352 force_sig_info kernel/signal.c:1363 [inline] force_sig+0x119/0x1d0 kernel/signal.c:1679 gp_user_force_sig_segv arch/x86/kernel/traps.c:641 [inline] __exc_general_protection arch/x86/kernel/traps.c:674 [inline] exc_general_protection+0x1d1/0x5d0 arch/x86/kernel/traps.c:644 asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:617 RIP: 0033:0x7fcc8f66fd39 Code: f8 77 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 27 01 00 00 fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 e9 30 01 00 00 66 RSP: 002b:00007fcc9036a858 EFLAGS: 00010283 RAX: 0000000000000999 RBX: 00007fcc9036adc0 RCX: 00007fcc8f775bc0 RDX: 9999999999999999 RSI: 00007fcc8f6c9062 RDI: 9999999999999999 RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000000073 R13: 00007fcc9036af40 R14: 9999999999999999 R15: 0000000000000000 ------------[ cut here ]------------ raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 8043 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x29/0x40 kernel/locking/irqflag-debug.c:10 Modules linked in: CPU: 1 PID: 8043 Comm: syz-executor.1 Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:warn_bogus_irq_restore+0x29/0x40 kernel/locking/irqflag-debug.c:10 Code: 90 f3 0f 1e fa 90 80 3d de 59 01 04 00 74 06 90 c3 cc cc cc cc c6 05 cf 59 01 04 01 90 48 c7 c7 20 ba aa 8b e8 f8 d5 e7 f5 90 <0f> 0b 90 90 90 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f RSP: 0000:ffffc9000304fc38 EFLAGS: 00010246 RAX: 273e689fde218c00 RBX: 1ffff92000609f8c RCX: 0000000000040000 RDX: ffffc90005001000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: ffffc9000304fcd8 R08: ffffffff8157cc12 R09: 1ffff92000609edc R10: dffffc0000000000 R11: fffff52000609edd R12: dffffc0000000000 R13: 1ffff92000609f88 R14: ffffc9000304fc60 R15: 0000000000000246 FS: 00007fcc9036b6c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffff7000000 CR3: 0000000056078000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x120/0x140 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] force_sig_info_to_task+0x41c/0x580 kernel/signal.c:1356 force_sig_info kernel/signal.c:1363 [inline] force_sig+0x119/0x1d0 kernel/signal.c:1679 gp_user_force_sig_segv arch/x86/kernel/traps.c:641 [inline] __exc_general_protection arch/x86/kernel/traps.c:674 [inline] exc_general_protection+0x1d1/0x5d0 arch/x86/kernel/traps.c:644 asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:617 RIP: 0033:0x7fcc8f66fd39 Code: f8 77 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 27 01 00 00 fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 e9 30 01 00 00 66 RSP: 002b:00007fcc9036a858 EFLAGS: 00010283 RAX: 0000000000000999 RBX: 00007fcc9036adc0 RCX: 00007fcc8f775bc0 RDX: 9999999999999999 RSI: 00007fcc8f6c9062 RDI: 9999999999999999 RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000000073 R13: 00007fcc9036af40 R14: 9999999999999999 R15: 0000000000000000