============================================ WARNING: possible recursive locking detected 5.16.0-rc2-syzkaller #0 Not tainted -------------------------------------------- syz-executor.5/6808 is trying to acquire lock: ffff88808356d130 (&runtime->sleep){..-.}-{2:2}, at: io_poll_double_wake+0x2be/0x820 fs/io_uring.c:5423 but task is already holding lock: ffff88807303b130 (&runtime->sleep){..-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:137 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&runtime->sleep); lock(&runtime->sleep); *** DEADLOCK *** May be due to missing lock nesting notation 7 locks held by syz-executor.5/6808: #0: ffffffff8bc53710 (dup_mmap_sem){++++}-{0:0}, at: dup_mmap kernel/fork.c:497 [inline] #0: ffffffff8bc53710 (dup_mmap_sem){++++}-{0:0}, at: dup_mm+0x108/0x13e0 kernel/fork.c:1450 #1: ffff88803e8b3828 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #1: ffff88803e8b3828 (&mm->mmap_lock#2){++++}-{3:3}, at: dup_mmap kernel/fork.c:498 [inline] #1: ffff88803e8b3828 (&mm->mmap_lock#2){++++}-{3:3}, at: dup_mm+0x12e/0x13e0 kernel/fork.c:1450 #2: ffff88807d80a9e8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:78 [inline] #2: ffff88807d80a9e8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap kernel/fork.c:507 [inline] #2: ffff88807d80a9e8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mm+0x18a/0x13e0 kernel/fork.c:1450 #3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline] #3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pte_range mm/memory.c:1024 [inline] #3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pmd_range mm/memory.c:1159 [inline] #3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pud_range mm/memory.c:1196 [inline] #3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_p4d_range mm/memory.c:1220 [inline] #3: ffff88801d0e2a98 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_page_range+0xc16/0x42c0 mm/memory.c:1293 #4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pte_range mm/memory.c:1031 [inline] #4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pmd_range mm/memory.c:1159 [inline] #4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pud_range mm/memory.c:1196 [inline] #4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_p4d_range mm/memory.c:1220 [inline] #4: ffff8880182117f8 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_page_range+0xceb/0x42c0 mm/memory.c:1293 #5: ffff88802440a910 (&group->lock){..-.}-{2:2}, at: _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170 #6: ffff88807303b130 (&runtime->sleep){..-.}-{2:2}, at: __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:137 stack backtrace: CPU: 1 PID: 6808 Comm: syz-executor.5 Not tainted 5.16.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2956 [inline] check_deadlock kernel/locking/lockdep.c:2999 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire.cold+0x149/0x3ab kernel/locking/lockdep.c:5027 lock_acquire kernel/locking/lockdep.c:5637 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 io_poll_double_wake+0x2be/0x820 fs/io_uring.c:5423 __wake_up_common+0x147/0x650 kernel/sched/wait.c:108 __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:138 snd_pcm_update_state+0x46a/0x540 sound/core/pcm_lib.c:204 snd_pcm_update_hw_ptr0+0xa75/0x1a50 sound/core/pcm_lib.c:465 snd_pcm_period_elapsed_under_stream_lock+0x15a/0x230 sound/core/pcm_lib.c:1817 snd_pcm_period_elapsed+0x28/0x50 sound/core/pcm_lib.c:1849 dummy_hrtimer_callback+0x94/0x1b0 sound/drivers/dummy.c:377 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:__kasan_check_read+0x0/0x10 mm/kasan/shadow.c:31 Code: 8b e8 fd 11 44 07 48 85 db 0f 85 7f 65 45 07 48 83 c4 60 5b 5d 41 5c 41 5d c3 c3 e9 7f 66 45 07 cc cc cc cc cc cc cc cc cc cc <48> 8b 0c 24 89 f6 31 d2 e9 f3 f9 ff ff 0f 1f 00 48 8b 0c 24 89 f6 RSP: 0018:ffffc90002af77f8 EFLAGS: 00000293 RAX: 0000000000000000 RBX: 8000000019d43007 RCX: 0000000000000000 RDX: ffff88803e4202c0 RSI: 0000000000000008 RDI: ffffea00006750c0 RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff81acd396 R11: 0000000000000000 R12: ffffea00006750c0 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 instrument_atomic_read include/linux/instrumented.h:71 [inline] test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] PageSwapBacked include/linux/page-flags.h:446 [inline] mm_counter_file include/linux/mm.h:2068 [inline] mm_counter include/linux/mm.h:2077 [inline] copy_present_pte mm/memory.c:959 [inline] copy_pte_range mm/memory.c:1073 [inline] copy_pmd_range mm/memory.c:1159 [inline] copy_pud_range mm/memory.c:1196 [inline] copy_p4d_range mm/memory.c:1220 [inline] copy_page_range+0x1806/0x42c0 mm/memory.c:1293 dup_mmap kernel/fork.c:609 [inline] dup_mm+0xa4e/0x13e0 kernel/fork.c:1450 copy_mm kernel/fork.c:1502 [inline] copy_process+0x6fed/0x75a0 kernel/fork.c:2191 kernel_clone+0xe7/0xab0 kernel/fork.c:2582 __do_sys_clone+0xc8/0x110 kernel/fork.c:2699 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fbc5a27b0db Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00 RSP: 002b:00007fff5d4ad4d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbc5a27b0db RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 0000000000000001 R08: 0000000000000000 R09: 00005555558e0400 R10: 00005555558e06d0 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000001 R14: 0000000000000001 R15: 00007fff5d4ad5b0 ---------------- Code disassembly (best guess): 0: 8b e8 mov %eax,%ebp 2: fd std 3: 11 44 07 48 adc %eax,0x48(%rdi,%rax,1) 7: 85 db test %ebx,%ebx 9: 0f 85 7f 65 45 07 jne 0x745658e f: 48 83 c4 60 add $0x60,%rsp 13: 5b pop %rbx 14: 5d pop %rbp 15: 41 5c pop %r12 17: 41 5d pop %r13 19: c3 retq 1a: c3 retq 1b: e9 7f 66 45 07 jmpq 0x745669f 20: cc int3 21: cc int3 22: cc int3 23: cc int3 24: cc int3 25: cc int3 26: cc int3 27: cc int3 28: cc int3 29: cc int3 * 2a: 48 8b 0c 24 mov (%rsp),%rcx <-- trapping instruction 2e: 89 f6 mov %esi,%esi 30: 31 d2 xor %edx,%edx 32: e9 f3 f9 ff ff jmpq 0xfffffa2a 37: 0f 1f 00 nopl (%rax) 3a: 48 8b 0c 24 mov (%rsp),%rcx 3e: 89 f6 mov %esi,%esi