====================================================== WARNING: possible circular locking dependency detected 6.9.0-rc6-syzkaller-00234-g7367539ad4b0 #0 Not tainted ------------------------------------------------------ syz-executor.0/5483 is trying to acquire lock: ffff8880b9429430 (krc.lock){..-.}-{2:2}, at: krc_this_cpu_lock kernel/rcu/tree.c:2960 [inline] ffff8880b9429430 (krc.lock){..-.}-{2:2}, at: add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3359 [inline] ffff8880b9429430 (krc.lock){..-.}-{2:2}, at: kvfree_call_rcu+0x182/0x790 kernel/rcu/tree.c:3444 but task is already holding lock: ffff88802b52e9f8 (&trie->lock){..-.}-{2:2}, at: trie_delete_elem+0x92/0x690 kernel/bpf/lpm_trie.c:451 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&trie->lock){..-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162 trie_delete_elem+0x92/0x690 kernel/bpf/lpm_trie.c:451 bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x200/0x420 kernel/trace/bpf_trace.c:2420 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x3c0/0x560 kernel/time/timer.c:664 internal_add_timer kernel/time/timer.c:689 [inline] __mod_timer+0xa0a/0xea0 kernel/time/timer.c:1184 call_timer_fn+0x18a/0x630 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x666/0x8d0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xff/0x170 kernel/time/timer.c:2449 __do_softirq+0x2c8/0x970 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xee/0x1b0 kernel/softirq.c:633 irq_exit_rcu+0x5/0x20 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:702 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xd4/0x140 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] trie_update_elem+0x28a/0xc10 kernel/bpf/lpm_trie.c:431 bpf_map_update_value+0x4d3/0x540 kernel/bpf/syscall.c:203 map_update_elem+0x5bf/0x750 kernel/bpf/syscall.c:1641 __sys_bpf+0x76b/0x810 kernel/bpf/syscall.c:5648 __do_sys_bpf kernel/bpf/syscall.c:5767 [inline] __se_sys_bpf kernel/bpf/syscall.c:5765 [inline] __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5765 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x84/0x190 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (&base->lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162 lock_timer_base+0x112/0x240 kernel/time/timer.c:1052 __mod_timer+0x1c6/0xea0 kernel/time/timer.c:1133 queue_delayed_work_on+0x156/0x260 kernel/workqueue.c:2608 kvfree_call_rcu+0x477/0x790 kernel/rcu/tree.c:3472 rtnl_register_internal+0x482/0x580 net/core/rtnetlink.c:265 rtnl_register+0x32/0x80 net/core/rtnetlink.c:315 ip_rt_init+0x2f1/0x3a0 net/ipv4/route.c:3720 ip_init+0xa/0x20 net/ipv4/ip_output.c:1663 inet_init+0x3d4/0x580 net/ipv4/af_inet.c:2023 do_one_initcall+0x244/0x850 init/main.c:1245 do_initcall_level+0x157/0x210 init/main.c:1307 do_initcalls+0x3f/0x80 init/main.c:1323 kernel_init_freeable+0x431/0x5d0 init/main.c:1555 kernel_init+0x19/0x2a0 init/main.c:1444 ret_from_fork+0x47/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #0 (krc.lock){..-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x3a1f/0x7fa0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e9/0x540 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 krc_this_cpu_lock kernel/rcu/tree.c:2960 [inline] add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3359 [inline] kvfree_call_rcu+0x182/0x790 kernel/rcu/tree.c:3444 trie_delete_elem+0x528/0x690 bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x200/0x420 kernel/trace/bpf_trace.c:2420 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x3c0/0x560 kernel/time/timer.c:664 internal_add_timer kernel/time/timer.c:689 [inline] __mod_timer+0xa0a/0xea0 kernel/time/timer.c:1184 call_timer_fn+0x18a/0x630 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x666/0x8d0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xff/0x170 kernel/time/timer.c:2449 __do_softirq+0x2c8/0x970 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xee/0x1b0 kernel/softirq.c:633 irq_exit_rcu+0x5/0x20 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:702 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xd4/0x140 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] trie_update_elem+0x28a/0xc10 kernel/bpf/lpm_trie.c:431 bpf_map_update_value+0x4d3/0x540 kernel/bpf/syscall.c:203 map_update_elem+0x5bf/0x750 kernel/bpf/syscall.c:1641 __sys_bpf+0x76b/0x810 kernel/bpf/syscall.c:5648 __do_sys_bpf kernel/bpf/syscall.c:5767 [inline] __se_sys_bpf kernel/bpf/syscall.c:5765 [inline] __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5765 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x84/0x190 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e other info that might help us debug this: Chain exists of: krc.lock --> &base->lock --> &trie->lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&trie->lock); lock(&base->lock); lock(&trie->lock); lock(krc.lock); *** DEADLOCK *** 5 locks held by syz-executor.0/5483: #0: ffffffff8dd321a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #0: ffffffff8dd321a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #0: ffffffff8dd321a0 (rcu_read_lock){....}-{1:2}, at: bpf_map_update_value+0x3c4/0x540 kernel/bpf/syscall.c:202 #1: ffffc90000007c00 ((&tcp_orphan_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbc/0x630 kernel/time/timer.c:1790 #2: ffff8880b942b7d8 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x112/0x240 kernel/time/timer.c:1052 #3: ffffffff8dd321a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #3: ffffffff8dd321a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #3: ffffffff8dd321a0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2380 [inline] #3: ffffffff8dd321a0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x110/0x420 kernel/trace/bpf_trace.c:2420 #4: ffff88802b52e9f8 (&trie->lock){..-.}-{2:2}, at: trie_delete_elem+0x92/0x690 kernel/bpf/lpm_trie.c:451 stack backtrace: CPU: 0 PID: 5483 Comm: syz-executor.0 Not tainted 6.9.0-rc6-syzkaller-00234-g7367539ad4b0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x23d/0x360 lib/dump_stack.c:114 check_noncircular+0x375/0x4a0 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x3a1f/0x7fa0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e9/0x540 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 krc_this_cpu_lock kernel/rcu/tree.c:2960 [inline] add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3359 [inline] kvfree_call_rcu+0x182/0x790 kernel/rcu/tree.c:3444 trie_delete_elem+0x528/0x690 bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline] bpf_trace_run2+0x200/0x420 kernel/trace/bpf_trace.c:2420 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x3c0/0x560 kernel/time/timer.c:664 internal_add_timer kernel/time/timer.c:689 [inline] __mod_timer+0xa0a/0xea0 kernel/time/timer.c:1184 call_timer_fn+0x18a/0x630 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x666/0x8d0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xff/0x170 kernel/time/timer.c:2449 __do_softirq+0x2c8/0x970 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xee/0x1b0 kernel/softirq.c:633 irq_exit_rcu+0x5/0x20 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xd4/0x140 kernel/locking/spinlock.c:194 Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 02 7d ca f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 f7 12 36 f6 65 8b 05 d8 63 d4 74 85 c0 74 43 48 c7 04 24 0e 36 RSP: 0018:ffffc90005157b00 EFLAGS: 00000206 RAX: 0cbca06ba1566b00 RBX: 1ffff92000a2af64 RCX: ffffffff93f68603 RDX: dffffc0000000000 RSI: ffffffff8b6ab3e0 RDI: 0000000000000001 RBP: ffffc90005157ba0 R08: ffffffff8f4031ef R09: 1ffffffff1e8063d R10: dffffc0000000000 R11: fffffbfff1e8063e R12: dffffc0000000000 R13: 1ffff92000a2af60 R14: ffffc90005157b20 R15: 0000000000000246 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] trie_update_elem+0x28a/0xc10 kernel/bpf/lpm_trie.c:431 bpf_map_update_value+0x4d3/0x540 kernel/bpf/syscall.c:203 map_update_elem+0x5bf/0x750 kernel/bpf/syscall.c:1641 __sys_bpf+0x76b/0x810 kernel/bpf/syscall.c:5648 __do_sys_bpf kernel/bpf/syscall.c:5767 [inline] __se_sys_bpf kernel/bpf/syscall.c:5765 [inline] __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5765 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x84/0x190 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f5611e7dda9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5612ca20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5611fabf80 RCX: 00007f5611e7dda9 RDX: 0000000000000020 RSI: 00000000200005c0 RDI: 0000000000000002 RBP: 00007f5611eca47a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f5611fabf80 R15: 00007ffd1f768938 ---------------- Code disassembly (best guess): 0: 9c pushf 1: 8f 44 24 20 pop 0x20(%rsp) 5: 42 80 3c 23 00 cmpb $0x0,(%rbx,%r12,1) a: 74 08 je 0x14 c: 4c 89 f7 mov %r14,%rdi f: e8 02 7d ca f6 call 0xf6ca7d16 14: f6 44 24 21 02 testb $0x2,0x21(%rsp) 19: 75 52 jne 0x6d 1b: 41 f7 c7 00 02 00 00 test $0x200,%r15d 22: 74 01 je 0x25 24: fb sti 25: bf 01 00 00 00 mov $0x1,%edi * 2a: e8 f7 12 36 f6 call 0xf6361326 <-- trapping instruction 2f: 65 8b 05 d8 63 d4 74 mov %gs:0x74d463d8(%rip),%eax # 0x74d4640e 36: 85 c0 test %eax,%eax 38: 74 43 je 0x7d 3a: 48 rex.W 3b: c7 .byte 0xc7 3c: 04 24 add $0x24,%al 3e: 0e (bad) 3f: 36 ss