[v6.1] BUG: spinlock recursion in try_to_wake_up

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 347385861c50 Linux 6.1.84
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=158a00cb180000
kernel config: https://syzkaller.appspot.com/x/.config?x=40dfd13b04bfc094
dashboard link: https://syzkaller.appspot.com/bug?extid=a9380a3d0946cadd1ccb
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/584c64d6360b/disk-34738586.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ebe1b8334610/vmlinux-34738586.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e3d485b54a02/bzImage-34738586.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a9380a...@syzkaller.appspotmail.com

BUG: spinlock recursion on CPU#0, syz-executor.1/3788
lock: 0xffff8880b983aa00, .magic: dead4ead, .owner: syz-executor.1/3788, .owner_cpu: 0
CPU: 0 PID: 3788 Comm: syz-executor.1 Not tainted 6.1.84-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
do_raw_spin_lock+0x21e/0x370 kernel/locking/spinlock_debug.c:114
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537
raw_spin_rq_lock kernel/sched/sched.h:1354 [inline]
rq_lock kernel/sched/sched.h:1644 [inline]
ttwu_queue kernel/sched/core.c:3903 [inline]
try_to_wake_up+0x5bd/0x12e0 kernel/sched/core.c:4228
hrtimer_wakeup+0x5e/0x70 kernel/time/hrtimer.c:1940
__run_hrtimer kernel/time/hrtimer.c:1686 [inline]
__hrtimer_run_queues+0x5e5/0xe50 kernel/time/hrtimer.c:1750
hrtimer_interrupt+0x392/0x980 kernel/time/hrtimer.c:1812
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
__sysvec_apic_timer_interrupt+0x156/0x580 arch/x86/kernel/apic/apic.c:1112
sysvec_apic_timer_interrupt+0x8c/0xb0 arch/x86/kernel/apic/apic.c:1106
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:103 [inline]
RIP: 0010:__local_bh_enable_ip+0x16c/0x1f0 kernel/softirq.c:403
Code: 8a e8 58 26 36 09 65 66 8b 05 90 94 af 7e 66 85 c0 75 57 bf 01 00 00 00 e8 a1 38 0a 00 e8 7c 3c 3d 00 fb 65 8b 05 3c 64 ae 7e <85> c0 75 05 e8 7b 82 ac ff 48 c7 44 24 20 0e 36 e0 45 49 c7 04 1c
RSP: 0018:ffffc9000529e5a0 EFLAGS: 00000286
RAX: 0000000080000004 RBX: 1ffff92000a53cb8 RCX: 0000000000000005
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffffffff81540b04
RBP: ffffc9000529e658 R08: dffffc0000000000 R09: ffffed100b28e346
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 1ffff92000a53cbc R14: ffffc9000529e5e0 R15: 0000000000000201
__sock_map_delete net/core/sock_map.c:426 [inline]
sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e
bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
__bpf_prog_run include/linux/filter.h:603 [inline]
bpf_prog_run include/linux/filter.h:610 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
bpf_trace_run2+0x1fd/0x410 kernel/trace/bpf_trace.c:2312
trace_contention_end+0x14c/0x190 include/trace/events/lock.h:122
__pv_queued_spin_lock_slowpath+0x935/0xc50 kernel/locking/qspinlock.c:560
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline]
queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
lockdep_lock+0x1a7/0x2a0 kernel/locking/lockdep.c:144
graph_lock kernel/locking/lockdep.c:170 [inline]
lookup_chain_cache_add kernel/locking/lockdep.c:3760 [inline]
validate_chain+0x1d0/0x5950 kernel/locking/lockdep.c:3793
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
update_cfs_rq_load_avg kernel/sched/fair.c:4026 [inline]
__update_blocked_fair kernel/sched/fair.c:8706 [inline]
update_blocked_averages+0x751/0x16a0 kernel/sched/fair.c:8812
newidle_balance+0x4ae/0x10b0 kernel/sched/fair.c:11588
pick_next_task_fair+0x27d/0xdc0 kernel/sched/fair.c:7893
__pick_next_task kernel/sched/core.c:5868 [inline]
pick_next_task kernel/sched/core.c:5943 [inline]
__schedule+0x7a9/0x4550 kernel/sched/core.c:6522
schedule+0xbf/0x180 kernel/sched/core.c:6634
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
synchronize_rcu_expedited+0x360/0x930 kernel/rcu/tree_exp.h:962
synchronize_rcu+0x11c/0x3f0 kernel/rcu/tree.c:3575
rcu_sync_enter+0x1f6/0x340 kernel/rcu/sync.c:149
percpu_down_write+0x69/0x2f0 kernel/locking/percpu-rwsem.c:231
bp_constraints_lock+0xdd/0x1b0 kernel/events/hw_breakpoint.c:133
reserve_bp_slot kernel/events/hw_breakpoint.c:625 [inline]
register_perf_hw_breakpoint+0x8c/0x260 kernel/events/hw_breakpoint.c:746
hw_breakpoint_event_init+0x89/0x110 kernel/events/hw_breakpoint.c:986
perf_try_init_event+0x135/0x3e0 kernel/events/core.c:11498
perf_init_event kernel/events/core.c:11562 [inline]
perf_event_alloc+0xf66/0x2120 kernel/events/core.c:11853
__do_sys_perf_event_open kernel/events/core.c:12389 [inline]
__se_sys_perf_event_open+0x7d2/0x4960 kernel/events/core.c:12281
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f187807de69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1878dfd0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007f18781abf80 RCX: 00007f187807de69
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000020000180
RBP: 00007f18780ca47a R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f18781abf80 R15: 00007ffcd9407708
</TASK>
----------------
Code disassembly (best guess):
0: 8a e8 mov %al,%ch
2: 58 pop %rax
3: 26 36 09 65 66 es ss or %esp,0x66(%rbp)
8: 8b 05 90 94 af 7e mov 0x7eaf9490(%rip),%eax # 0x7eaf949e
e: 66 85 c0 test %ax,%ax
11: 75 57 jne 0x6a
13: bf 01 00 00 00 mov $0x1,%edi
18: e8 a1 38 0a 00 call 0xa38be
1d: e8 7c 3c 3d 00 call 0x3d3c9e
22: fb sti
23: 65 8b 05 3c 64 ae 7e mov %gs:0x7eae643c(%rip),%eax # 0x7eae6466
* 2a: 85 c0 test %eax,%eax <-- trapping instruction
2c: 75 05 jne 0x33
2e: e8 7b 82 ac ff call 0xffac82ae
33: 48 c7 44 24 20 0e 36 movq $0x45e0360e,0x20(%rsp)
3a: e0 45
3c: 49 rex.WB
3d: c7 .byte 0xc7
3e: 04 1c add $0x1c,%al


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup