===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted ----------------------------------------------------- kworker/1:3/5101 [HC0[0]:SC1[3]:HE0:SE0] is trying to acquire: ffff88807fe24820 (&htab->buckets[i].lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff88807fe24820 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_hash_delete_elem+0xcb/0x260 net/core/sock_map.c:939 and this task is already holding: ffff888016ef6410 (&p->pi_lock){-.-.}-{2:2}, at: class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline] ffff888016ef6410 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4262 which would create a new lock dependency: (&p->pi_lock){-.-.}-{2:2} -> (&htab->buckets[i].lock){+.-.}-{2:2} but this new dependency connects a HARDIRQ-irq-safe lock: (&p->pi_lock){-.-.}-{2:2} ... which became HARDIRQ-irq-safe at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline] try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4262 autoremove_wake_function+0x16/0x150 kernel/sched/wait.c:384 __wake_up_common+0x134/0x1e0 kernel/sched/wait.c:89 __wake_up_common_lock kernel/sched/wait.c:106 [inline] __wake_up+0x31/0x60 kernel/sched/wait.c:127 irq_work_single+0x1bf/0x260 kernel/irq_work.c:221 irq_work_run_list+0x92/0xc0 kernel/irq_work.c:252 irq_work_run+0x58/0xd0 kernel/irq_work.c:261 __sysvec_irq_work+0x8c/0x3a0 arch/x86/kernel/irq_work.c:22 instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline] sysvec_irq_work+0x90/0xb0 arch/x86/kernel/irq_work.c:17 asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:738 __wrmsr arch/x86/include/asm/msr.h:96 [inline] native_write_msr arch/x86/include/asm/msr.h:160 [inline] wrmsr arch/x86/include/asm/msr.h:269 [inline] native_apic_msr_write arch/x86/include/asm/apic.h:207 [inline] native_apic_msr_write+0x28/0x40 arch/x86/include/asm/apic.h:201 __apic_send_IPI_self arch/x86/include/asm/apic.h:458 [inline] arch_irq_work_raise+0x4f/0x70 arch/x86/kernel/irq_work.c:31 irq_work_raise kernel/irq_work.c:84 [inline] __irq_work_queue_local+0x14c/0x410 kernel/irq_work.c:112 irq_work_queue kernel/irq_work.c:124 [inline] irq_work_queue+0x4a/0x80 kernel/irq_work.c:116 __kfence_alloc+0x18c/0x15d0 mm/kfence/core.c:1088 kfence_alloc include/linux/kfence.h:129 [inline] slab_alloc_node mm/slub.c:3831 [inline] __do_kmalloc_node mm/slub.c:3965 [inline] __kmalloc+0x295/0x440 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] kzalloc include/linux/slab.h:749 [inline] alloc_workqueue+0x14a/0x1c90 kernel/workqueue.c:5542 init_mm_internals+0x25/0x610 mm/vmstat.c:2122 kernel_init_freeable+0x334/0xc40 init/main.c:1536 kernel_init+0x1c/0x2a0 init/main.c:1439 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 to a HARDIRQ-irq-unsafe lock: (&htab->buckets[i].lock){+.-.}-{2:2} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_free+0x130/0x820 net/core/sock_map.c:1154 bpf_map_free_deferred+0x1d1/0x420 kernel/bpf/syscall.c:734 process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416 kthread+0x2c4/0x3a0 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&htab->buckets[i].lock); local_irq_disable(); lock(&p->pi_lock); lock(&htab->buckets[i].lock); lock(&p->pi_lock); *** DEADLOCK *** 6 locks held by kworker/1:3/5101: #0: ffff888015075948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1296/0x1a60 kernel/workqueue.c:3229 #1: ffffc900045e7d80 ((gc_work).work){+.+.}-{0:0}, at: process_one_work+0x906/0x1a60 kernel/workqueue.c:3230 #2: ffffffff8e772338 ("ratelimiter_table_lock"){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #2: ffffffff8e772338 ("ratelimiter_table_lock"){+.+.}-{2:2}, at: wg_ratelimiter_gc_entries+0xc6/0x520 drivers/net/wireguard/ratelimiter.c:63 #3: ffffc90000a08cb0 ((&timer.timer)){+.-.}-{0:0}, at: call_timer_fn+0x11a/0x5b0 kernel/time/timer.c:1789 #4: ffff888016ef6410 (&p->pi_lock){-.-.}-{2:2}, at: class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline] #4: ffff888016ef6410 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4262 #5: ffffffff8d7b49e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #5: ffffffff8d7b49e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #5: ffffffff8d7b49e0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] #5: ffffffff8d7b49e0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xe4/0x420 kernel/trace/bpf_trace.c:2420 the dependencies between HARDIRQ-irq-safe lock and the holding lock: -> (&p->pi_lock){-.-.}-{2:2} { IN-HARDIRQ-W at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline] try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4262 autoremove_wake_function+0x16/0x150 kernel/sched/wait.c:384 __wake_up_common+0x134/0x1e0 kernel/sched/wait.c:89 __wake_up_common_lock kernel/sched/wait.c:106 [inline] __wake_up+0x31/0x60 kernel/sched/wait.c:127 irq_work_single+0x1bf/0x260 kernel/irq_work.c:221 irq_work_run_list+0x92/0xc0 kernel/irq_work.c:252 irq_work_run+0x58/0xd0 kernel/irq_work.c:261 __sysvec_irq_work+0x8c/0x3a0 arch/x86/kernel/irq_work.c:22 instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline] sysvec_irq_work+0x90/0xb0 arch/x86/kernel/irq_work.c:17 asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:738 __wrmsr arch/x86/include/asm/msr.h:96 [inline] native_write_msr arch/x86/include/asm/msr.h:160 [inline] wrmsr arch/x86/include/asm/msr.h:269 [inline] native_apic_msr_write arch/x86/include/asm/apic.h:207 [inline] native_apic_msr_write+0x28/0x40 arch/x86/include/asm/apic.h:201 __apic_send_IPI_self arch/x86/include/asm/apic.h:458 [inline] arch_irq_work_raise+0x4f/0x70 arch/x86/kernel/irq_work.c:31 irq_work_raise kernel/irq_work.c:84 [inline] __irq_work_queue_local+0x14c/0x410 kernel/irq_work.c:112 irq_work_queue kernel/irq_work.c:124 [inline] irq_work_queue+0x4a/0x80 kernel/irq_work.c:116 __kfence_alloc+0x18c/0x15d0 mm/kfence/core.c:1088 kfence_alloc include/linux/kfence.h:129 [inline] slab_alloc_node mm/slub.c:3831 [inline] __do_kmalloc_node mm/slub.c:3965 [inline] __kmalloc+0x295/0x440 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] kzalloc include/linux/slab.h:749 [inline] alloc_workqueue+0x14a/0x1c90 kernel/workqueue.c:5542 init_mm_internals+0x25/0x610 mm/vmstat.c:2122 kernel_init_freeable+0x334/0xc40 init/main.c:1536 kernel_init+0x1c/0x2a0 init/main.c:1439 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 IN-SOFTIRQ-W at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline] try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4262 call_timer_fn+0x1a3/0x5b0 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers+0x74b/0xab0 kernel/time/timer.c:2408 __run_timer_base kernel/time/timer.c:2419 [inline] __run_timer_base kernel/time/timer.c:2412 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2428 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2438 __do_softirq+0x21b/0x8de kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:633 [inline] irq_exit_rcu+0xb9/0x120 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] default_idle+0xf/0x20 arch/x86/kernel/process.c:742 default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x32c/0x3f0 kernel/sched/idle.c:332 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430 rest_init+0x16f/0x2b0 init/main.c:730 arch_call_rest_init+0x13/0x40 init/main.c:831 start_kernel+0x3a3/0x490 init/main.c:1077 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x148 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 sched_cgroup_fork+0x2b/0x510 kernel/sched/core.c:4828 copy_process+0x4106/0x9160 kernel/fork.c:2498 kernel_clone+0xfd/0x940 kernel/fork.c:2796 user_mode_thread+0xb4/0xf0 kernel/fork.c:2874 rest_init+0x27/0x2b0 init/main.c:695 arch_call_rest_init+0x13/0x40 init/main.c:831 start_kernel+0x3a3/0x490 init/main.c:1077 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:509 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:490 common_startup_64+0x13e/0x148 } ... key at: [] __key.330+0x0/0x40 the dependencies between the lock to be acquired and HARDIRQ-irq-unsafe lock: -> (&htab->buckets[i].lock){+.-.}-{2:2} { HARDIRQ-ON-W at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_free+0x130/0x820 net/core/sock_map.c:1154 bpf_map_free_deferred+0x1d1/0x420 kernel/bpf/syscall.c:734 process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416 kthread+0x2c4/0x3a0 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 IN-SOFTIRQ-W at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xcb/0x260 net/core/sock_map.c:939 bpf_prog_05fc780d7a5f93f9+0x52/0x52 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x154/0x420 kernel/trace/bpf_trace.c:2420 trace_kfree include/trace/events/kmem.h:94 [inline] kfree+0x225/0x370 mm/slub.c:4377 rcu_do_batch kernel/rcu/tree.c:2196 [inline] rcu_core+0x82b/0x16b0 kernel/rcu/tree.c:2471 __do_softirq+0x21b/0x8de kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:633 [inline] irq_exit_rcu+0xb9/0x120 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 arch_local_irq_restore arch/x86/include/asm/irqflags.h:134 [inline] __cancel_work+0x20d/0x340 kernel/workqueue.c:4285 mld_dad_stop_work net/ipv6/mcast.c:1096 [inline] ipv6_mc_down+0x285/0x500 net/ipv6/mcast.c:2730 ipv6_mc_destroy_dev+0x29/0x690 net/ipv6/mcast.c:2788 addrconf_ifdown.isra.0+0x14c9/0x1b40 net/ipv6/addrconf.c:3996 addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3776 notifier_call_chain+0xbc/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1950 call_netdevice_notifiers_extack net/core/dev.c:1988 [inline] call_netdevice_notifiers net/core/dev.c:2002 [inline] unregister_netdevice_many_notify+0x8a1/0x19f0 net/core/dev.c:11096 unregister_netdevice_many net/core/dev.c:11154 [inline] unregister_netdevice_queue+0x307/0x3f0 net/core/dev.c:11033 unregister_netdevice include/linux/netdevice.h:3115 [inline] _cfg80211_unregister_wdev+0x624/0x7f0 net/wireless/core.c:1206 ieee80211_remove_interfaces+0x36d/0x760 net/mac80211/iface.c:2302 ieee80211_unregister_hw+0x55/0x3a0 net/mac80211/main.c:1652 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim.c:5560 [inline] hwsim_exit_net+0x3ad/0x7d0 drivers/net/wireless/virtual/mac80211_hwsim.c:6437 ops_exit_list+0xb3/0x180 net/core/net_namespace.c:170 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:637 process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416 kthread+0x2c4/0x3a0 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_free+0x130/0x820 net/core/sock_map.c:1154 bpf_map_free_deferred+0x1d1/0x420 kernel/bpf/syscall.c:734 process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416 kthread+0x2c4/0x3a0 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 } ... key at: [] __key.0+0x0/0x40 ... acquired at: lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xcb/0x260 net/core/sock_map.c:939 bpf_prog_05fc780d7a5f93f9+0x4a/0x52 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x154/0x420 kernel/trace/bpf_trace.c:2420 __bpf_trace_contention_end+0xca/0x110 include/trace/events/lock.h:122 __traceiter_contention_end+0x5d/0xa0 include/trace/events/lock.h:122 trace_contention_end.constprop.0+0xe2/0x140 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0x266/0xc80 kernel/locking/qspinlock.c:560 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x210/0x2c0 kernel/locking/spinlock_debug.c:116 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0x42/0x60 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline] try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4262 call_timer_fn+0x1a3/0x5b0 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers+0x74b/0xab0 kernel/time/timer.c:2408 __run_timer_base kernel/time/timer.c:2419 [inline] __run_timer_base kernel/time/timer.c:2412 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2428 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2438 __do_softirq+0x21b/0x8de kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:633 [inline] irq_exit_rcu+0xb9/0x120 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 wg_ratelimiter_gc_entries+0xca/0x520 drivers/net/wireguard/ratelimiter.c:64 process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416 kthread+0x2c4/0x3a0 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 stack backtrace: CPU: 1 PID: 5101 Comm: kworker/1:3 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: events_power_efficient wg_ratelimiter_gc_entries Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline] check_irq_usage+0xe3c/0x1490 kernel/locking/lockdep.c:2865 check_prev_add kernel/locking/lockdep.c:3138 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x248e/0x3b30 kernel/locking/lockdep.c:5137 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x540 kernel/locking/lockdep.c:5719 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] sock_hash_delete_elem+0xcb/0x260 net/core/sock_map.c:939 bpf_prog_05fc780d7a5f93f9+0x4a/0x52 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x154/0x420 kernel/trace/bpf_trace.c:2420 __bpf_trace_contention_end+0xca/0x110 include/trace/events/lock.h:122 __traceiter_contention_end+0x5d/0xa0 include/trace/events/lock.h:122 trace_contention_end.constprop.0+0xe2/0x140 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0x266/0xc80 kernel/locking/qspinlock.c:560 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x210/0x2c0 kernel/locking/spinlock_debug.c:116 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0x42/0x60 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline] try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4262 call_timer_fn+0x1a3/0x5b0 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers+0x74b/0xab0 kernel/time/timer.c:2408 __run_timer_base kernel/time/timer.c:2419 [inline] __run_timer_base kernel/time/timer.c:2412 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2428 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2438 __do_softirq+0x21b/0x8de kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:633 [inline] irq_exit_rcu+0xb9/0x120 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:wg_ratelimiter_gc_entries+0xca/0x520 drivers/net/wireguard/ratelimiter.c:64 Code: 24 0c 89 ef 44 89 fe e8 e4 8f 8c fb 41 39 ef 0f 83 24 03 00 00 e8 b6 95 8c fb 48 c7 c7 20 23 77 8e e8 6a 44 d5 04 8b 44 24 0c <48> 8b 2d 0f c4 92 0e 48 c1 e0 03 48 01 c5 48 89 44 24 18 48 89 e8 RSP: 0018:ffffc900045e7c78 EFLAGS: 00000286 RAX: 0000000000000843 RBX: dffffc0000000000 RCX: ffffffff816cfecd RDX: 1ffffffff1cee466 RSI: 0000000000000004 RDI: ffffc900045e7c08 RBP: 0000000000002000 R08: 0000000000000001 R09: fffff520008bcf81 R10: 0000000000000003 R11: 0000000000000002 R12: ffff888015097000 R13: ffffffff8e772180 R14: 0000013a85a18489 R15: 0000000000000843 process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416 kthread+0x2c4/0x3a0 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 ------------[ cut here ]------------ raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 5101 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x29/0x30 kernel/locking/irqflag-debug.c:10 Modules linked in: CPU: 1 PID: 5101 Comm: kworker/1:3 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: events_power_efficient wg_ratelimiter_gc_entries RIP: 0010:warn_bogus_irq_restore+0x29/0x30 kernel/locking/irqflag-debug.c:10 Code: 90 f3 0f 1e fa 90 80 3d be b2 b5 04 00 74 06 90 e9 3c f8 03 00 c6 05 af b2 b5 04 01 90 48 c7 c7 00 c3 0c 8b e8 98 c2 7d f6 90 <0f> 0b 90 90 eb df 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90000a08b90 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888016ef63f8 RCX: ffffffff8150f3e9 RDX: ffff8880505ebc00 RSI: ffffffff8150f3f6 RDI: 0000000000000001 RBP: 0000000000000287 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 000000000000c3c8 R12: 0000000000000003 R13: ffff888016ef5a18 R14: ffff888016ef63f8 R15: 000000000003d40c FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020058000 CR3: 0000000062a5e000 CR4: 0000000000350ef0 Call Trace: __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x74/0x80 kernel/locking/spinlock.c:194 class_raw_spinlock_irqsave_destructor include/linux/spinlock.h:553 [inline] try_to_wake_up+0x13f/0x13e0 kernel/sched/core.c:4262 call_timer_fn+0x1a3/0x5b0 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers+0x74b/0xab0 kernel/time/timer.c:2408 __run_timer_base kernel/time/timer.c:2419 [inline] __run_timer_base kernel/time/timer.c:2412 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2428 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2438 __do_softirq+0x21b/0x8de kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:633 [inline] irq_exit_rcu+0xb9/0x120 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:wg_ratelimiter_gc_entries+0xca/0x520 drivers/net/wireguard/ratelimiter.c:64 Code: 24 0c 89 ef 44 89 fe e8 e4 8f 8c fb 41 39 ef 0f 83 24 03 00 00 e8 b6 95 8c fb 48 c7 c7 20 23 77 8e e8 6a 44 d5 04 8b 44 24 0c <48> 8b 2d 0f c4 92 0e 48 c1 e0 03 48 01 c5 48 89 44 24 18 48 89 e8 RSP: 0018:ffffc900045e7c78 EFLAGS: 00000286 RAX: 0000000000000843 RBX: dffffc0000000000 RCX: ffffffff816cfecd RDX: 1ffffffff1cee466 RSI: 0000000000000004 RDI: ffffc900045e7c08 RBP: 0000000000002000 R08: 0000000000000001 R09: fffff520008bcf81 R10: 0000000000000003 R11: 0000000000000002 R12: ffff888015097000 R13: ffffffff8e772180 R14: 0000013a85a18489 R15: 0000000000000843 process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416 kthread+0x2c4/0x3a0 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 ---------------- Code disassembly (best guess): 0: 24 0c and $0xc,%al 2: 89 ef mov %ebp,%edi 4: 44 89 fe mov %r15d,%esi 7: e8 e4 8f 8c fb call 0xfb8c8ff0 c: 41 39 ef cmp %ebp,%r15d f: 0f 83 24 03 00 00 jae 0x339 15: e8 b6 95 8c fb call 0xfb8c95d0 1a: 48 c7 c7 20 23 77 8e mov $0xffffffff8e772320,%rdi 21: e8 6a 44 d5 04 call 0x4d54490 26: 8b 44 24 0c mov 0xc(%rsp),%eax * 2a: 48 8b 2d 0f c4 92 0e mov 0xe92c40f(%rip),%rbp # 0xe92c440 <-- trapping instruction 31: 48 c1 e0 03 shl $0x3,%rax 35: 48 01 c5 add %rax,%rbp 38: 48 89 44 24 18 mov %rax,0x18(%rsp) 3d: 48 89 e8 mov %rbp,%rax