====================================================== WARNING: possible circular locking dependency detected 6.4.0-syzkaller-01554-g6f612579be9d #0 Not tainted ------------------------------------------------------ syz-executor192/8326 is trying to acquire lock: ffff88801e4e3900 (&rm->m_rs_lock){..-.}-{2:2}, at: rds_message_purge net/rds/message.c:138 [inline] ffff88801e4e3900 (&rm->m_rs_lock){..-.}-{2:2}, at: rds_message_put+0x14a/0xaa0 net/rds/message.c:180 but task is already holding lock: ffff8880205c8df0 (&rs->rs_recv_lock){...-}-{2:2}, at: rds_clear_recv_queue+0x35/0x3b0 net/rds/recv.c:762 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&rs->rs_recv_lock){...-}-{2:2}: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xdd/0x120 kernel/locking/spinlock.c:236 rds_wake_sk_sleep+0x2e/0xd0 net/rds/af_rds.c:109 rds_send_remove_from_sock+0x1c9/0x800 net/rds/send.c:634 rds_send_path_drop_acked+0x366/0x3b0 net/rds/send.c:710 rds_tcp_write_space+0x197/0x560 net/rds/tcp_send.c:198 tcp_new_space net/ipv4/tcp_input.c:5483 [inline] tcp_check_space+0x17a/0xac0 net/ipv4/tcp_input.c:5502 tcp_data_snd_check net/ipv4/tcp_input.c:5511 [inline] tcp_rcv_established+0xb32/0x1f80 net/ipv4/tcp_input.c:6021 tcp_v4_do_rcv+0x6bd/0xb50 net/ipv4/tcp_ipv4.c:1722 sk_backlog_rcv include/net/sock.h:1115 [inline] __release_sock+0x19c/0x4b0 net/core/sock.c:2911 release_sock+0x61/0x1c0 net/core/sock.c:3478 rds_send_xmit+0x1d1a/0x2530 net/rds/send.c:422 rds_send_worker+0x7d/0x2b0 net/rds/threads.c:200 process_one_work+0x8a0/0x10e0 kernel/workqueue.c:2408 worker_thread+0xa63/0x1210 kernel/workqueue.c:2555 kthread+0x2b8/0x350 kernel/kthread.c:389 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 -> #0 (&rm->m_rs_lock){..-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3142 [inline] check_prevs_add kernel/locking/lockdep.c:3261 [inline] validate_chain kernel/locking/lockdep.c:3876 [inline] __lock_acquire+0x39ff/0x7f70 kernel/locking/lockdep.c:5144 lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5761 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 rds_message_purge net/rds/message.c:138 [inline] rds_message_put+0x14a/0xaa0 net/rds/message.c:180 rds_inc_put net/rds/recv.c:83 [inline] rds_clear_recv_queue+0x2e2/0x3b0 net/rds/recv.c:768 rds_release+0xc5/0x2e0 net/rds/af_rds.c:73 __sock_release net/socket.c:654 [inline] sock_close+0xd1/0x230 net/socket.c:1398 __fput+0x3f8/0x950 fs/file_table.c:378 task_work_run+0x24a/0x300 kernel/task_work.c:179 ptrace_notify+0x2cd/0x380 kernel/signal.c:2371 ptrace_report_syscall include/linux/ptrace.h:411 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline] syscall_exit_work kernel/entry/common.c:252 [inline] syscall_exit_to_user_mode_prepare kernel/entry/common.c:279 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:284 [inline] syscall_exit_to_user_mode+0x157/0x280 kernel/entry/common.c:297 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rs->rs_recv_lock); lock(&rm->m_rs_lock); lock(&rs->rs_recv_lock); lock(&rm->m_rs_lock); *** DEADLOCK *** 2 locks held by syz-executor192/8326: #0: ffff88807076d610 (&sb->s_type->i_mutex_key#9){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:771 [inline] #0: ffff88807076d610 (&sb->s_type->i_mutex_key#9){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline] #0: ffff88807076d610 (&sb->s_type->i_mutex_key#9){+.+.}-{3:3}, at: sock_close+0x9c/0x230 net/socket.c:1398 #1: ffff8880205c8df0 (&rs->rs_recv_lock){...-}-{2:2}, at: rds_clear_recv_queue+0x35/0x3b0 net/rds/recv.c:762 stack backtrace: CPU: 1 PID: 8326 Comm: syz-executor192 Not tainted 6.4.0-syzkaller-01554-g6f612579be9d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 check_noncircular+0x375/0x4a0 kernel/locking/lockdep.c:2195 check_prev_add kernel/locking/lockdep.c:3142 [inline] check_prevs_add kernel/locking/lockdep.c:3261 [inline] validate_chain kernel/locking/lockdep.c:3876 [inline] __lock_acquire+0x39ff/0x7f70 kernel/locking/lockdep.c:5144 lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5761 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 rds_message_purge net/rds/message.c:138 [inline] rds_message_put+0x14a/0xaa0 net/rds/message.c:180 rds_inc_put net/rds/recv.c:83 [inline] rds_clear_recv_queue+0x2e2/0x3b0 net/rds/recv.c:768 rds_release+0xc5/0x2e0 net/rds/af_rds.c:73 __sock_release net/socket.c:654 [inline] sock_close+0xd1/0x230 net/socket.c:1398 __fput+0x3f8/0x950 fs/file_table.c:378 task_work_run+0x24a/0x300 kernel/task_work.c:179 ptrace_notify+0x2cd/0x380 kernel/signal.c:2371 ptrace_report_syscall include/linux/ptrace.h:411 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline] syscall_exit_work kernel/entry/common.c:252 [inline] syscall_exit_to_user_mode_prepare kernel/entry/common.c:279 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:284 [inline] syscall_exit_to_user_mode+0x157/0x280 kernel/entry/common.c:297 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fa47690c59b Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 03 fd ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 41 fd ff ff 8b 44 RSP: 002b:00007ffd9b2eaff0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007fa47690c59b RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 0000000000000032 R08: 0000000000000000 R09: 00007fa4769a21a7 R10: 0000000000000000 R11: 0000000000000293 R12: 00007fa4769d54ec R13: 00007ffd9b2eb040 R14: 00007ffd9b2eb060 R15: 00007ffd9b2eb0d0