[v5.15] possible deadlock in task_fork_fair (2)

0 views
Skip to first unread message

syzbot

unread,
Feb 22, 2024, 12:55:22 AMFeb 22
to syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 6139f2a02fe0 Linux 5.15.148
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=124b45c8180000
kernel config: https://syzkaller.appspot.com/x/.config?x=c170eb20d8be8542
dashboard link: https://syzkaller.appspot.com/bug?extid=463efc4f92134aef1adc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/528e8fe56997/disk-6139f2a0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/18abf1e442f9/vmlinux-6139f2a0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0538a5d3b1f3/bzImage-6139f2a0.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+463efc...@syzkaller.appspotmail.com

FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
======================================================
WARNING: possible circular locking dependency detected
5.15.148-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/7384 is trying to acquire lock:
ffffffff8c7fba78 ((console_sem).lock){-.-.}-{2:2}, at: down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138

but task is already holding lock:
ffff8880b9b39718 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&rq->__lock){-.-.}-{2:2}:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
_raw_spin_lock_nested+0x2d/0x40 kernel/locking/spinlock.c:368
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
rq_lock kernel/sched/sched.h:1621 [inline]
task_fork_fair+0x5d/0x350 kernel/sched/fair.c:11480
sched_cgroup_fork+0x2d3/0x330 kernel/sched/core.c:4466
copy_process+0x224a/0x3ef0 kernel/fork.c:2320
kernel_clone+0x210/0x960 kernel/fork.c:2604
kernel_thread+0x168/0x1e0 kernel/fork.c:2656
rest_init+0x21/0x330 init/main.c:703
start_kernel+0x48c/0x535 init/main.c:1137
secondary_startup_64_no_verify+0xb1/0xbb

-> #1 (&p->pi_lock){-.-.}-{2:2}:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
try_to_wake_up+0xae/0x1300 kernel/sched/core.c:4030
up+0x6e/0x90 kernel/locking/semaphore.c:190
__up_console_sem+0x11a/0x1e0 kernel/printk/printk.c:256
console_unlock+0x1145/0x12b0 kernel/printk/printk.c:2754
vprintk_emit+0xbf/0x150 kernel/printk/printk.c:2268
_printk+0xd1/0x111 kernel/printk/printk.c:2293
mnt_warn_timestamp_expiry+0x313/0x350 fs/namespace.c:2577
do_new_mount_fc fs/namespace.c:2940 [inline]
do_new_mount+0x42b/0xb40 fs/namespace.c:3007
do_mount fs/namespace.c:3348 [inline]
__do_sys_mount fs/namespace.c:3556 [inline]
__se_sys_mount+0x2d5/0x3c0 fs/namespace.c:3533
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

-> #0 ((console_sem).lock){-.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
__down_trylock_console_sem+0x105/0x250 kernel/printk/printk.c:239
console_trylock kernel/printk/printk.c:2569 [inline]
console_trylock_spinning+0x8a/0x3f0 kernel/printk/printk.c:1867
vprintk_emit+0xa6/0x150 kernel/printk/printk.c:2267
_printk+0xd1/0x111 kernel/printk/printk.c:2293
fail_dump lib/fault-inject.c:45 [inline]
should_fail+0x36c/0x4c0 lib/fault-inject.c:146
strncpy_from_user+0x32/0x370 lib/strncpy_from_user.c:118
strncpy_from_user_nofault+0x6c/0x130 mm/maccess.c:295
bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:194 [inline]
____bpf_probe_read_user_str kernel/trace/bpf_trace.c:203 [inline]
bpf_probe_read_user_str+0x26/0x70 kernel/trace/bpf_trace.c:200
bpf_prog_b0fe9b75aaebb688+0x38/0xd28
bpf_dispatcher_nop_func include/linux/bpf.h:776 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1921
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6780
irqentry_exit+0x53/0x80 kernel/entry/common.c:426
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
crng_make_state+0x530/0x690 drivers/char/random.c:393
_get_random_bytes+0xd3/0x2b0 drivers/char/random.c:405
wg_cookie_checker_init+0x68/0x90 drivers/net/wireguard/cookie.c:24
wg_newlink+0xb4/0x740 drivers/net/wireguard/device.c:305
__rtnl_newlink net/core/rtnetlink.c:3501 [inline]
rtnl_newlink+0x14bd/0x2070 net/core/rtnetlink.c:3549
rtnetlink_rcv_msg+0x993/0xee0 net/core/rtnetlink.c:5630
netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2505
netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]
netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1356
netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1924
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2431
___sys_sendmsg+0x252/0x2e0 net/socket.c:2485
__sys_sendmsg net/socket.c:2514 [inline]
__do_sys_sendmsg net/socket.c:2523 [inline]
__se_sys_sendmsg+0x19a/0x260 net/socket.c:2521
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

other info that might help us debug this:

Chain exists of:
(console_sem).lock --> &p->pi_lock --> &rq->__lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock((console_sem).lock);

*** DEADLOCK ***

3 locks held by syz-executor.2/7384:
#0: ffffffff8d9da688 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d9da688 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5627
#1: ffff8880b9b39718 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
#2: ffffffff8c91f220 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:268

stack backtrace:
CPU: 1 PID: 7384 Comm: syz-executor.2 Not tainted 5.15.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
__down_trylock_console_sem+0x105/0x250 kernel/printk/printk.c:239
console_trylock kernel/printk/printk.c:2569 [inline]
console_trylock_spinning+0x8a/0x3f0 kernel/printk/printk.c:1867
vprintk_emit+0xa6/0x150 kernel/printk/printk.c:2267
_printk+0xd1/0x111 kernel/printk/printk.c:2293
fail_dump lib/fault-inject.c:45 [inline]
should_fail+0x36c/0x4c0 lib/fault-inject.c:146
strncpy_from_user+0x32/0x370 lib/strncpy_from_user.c:118
strncpy_from_user_nofault+0x6c/0x130 mm/maccess.c:295
bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:194 [inline]
____bpf_probe_read_user_str kernel/trace/bpf_trace.c:203 [inline]
bpf_probe_read_user_str+0x26/0x70 kernel/trace/bpf_trace.c:200
bpf_prog_b0fe9b75aaebb688+0x38/0xd28
bpf_dispatcher_nop_func include/linux/bpf.h:776 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1921
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6780
irqentry_exit+0x53/0x80 kernel/entry/common.c:426
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:crng_make_state+0x530/0x690 drivers/char/random.c:393
Code: db a9 05 e9 38 fd ff ff e8 ed 00 04 fd e8 c8 5b a0 05 4d 85 e4 0f 84 ff fe ff ff e8 da 00 04 fd fb 48 c7 44 24 40 0e 36 e0 45 <43> c7 44 3d 00 00 00 00 00 4b c7 44 3d 0c 00 00 00 00 66 43 c7 44
RSP: 0018:ffffc900032b6a00 EFLAGS: 00000283
RAX: ffffffff847c2ce6 RBX: 0000000000000000 RCX: 0000000000040000
RDX: ffffc90003b0d000 RSI: 00000000000003fa RDI: 00000000000003fb
RBP: ffffc900032b6b50 R08: ffffffff847c2bc9 R09: fffffbfff1f7a01a
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000200
R13: dffffc0000000000 R14: 0000000000000046 R15: 1ffff92000656d48
_get_random_bytes+0xd3/0x2b0 drivers/char/random.c:405
wg_cookie_checker_init+0x68/0x90 drivers/net/wireguard/cookie.c:24
wg_newlink+0xb4/0x740 drivers/net/wireguard/device.c:305
__rtnl_newlink net/core/rtnetlink.c:3501 [inline]
rtnl_newlink+0x14bd/0x2070 net/core/rtnetlink.c:3549
rtnetlink_rcv_msg+0x993/0xee0 net/core/rtnetlink.c:5630
netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2505
netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]
netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1356
netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1924
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2431
___sys_sendmsg+0x252/0x2e0 net/socket.c:2485
__sys_sendmsg net/socket.c:2514 [inline]
__do_sys_sendmsg net/socket.c:2523 [inline]
__se_sys_sendmsg+0x19a/0x260 net/socket.c:2521
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fddf2c7ada9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fddf11fb0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fddf2da8f80 RCX: 00007fddf2c7ada9
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006
RBP: 00007fddf11fb120 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 000000000000000b R14: 00007fddf2da8f80 R15: 00007ffc87cd7d68
</TASK>
CPU: 1 PID: 7384 Comm: syz-executor.2 Not tainted 5.15.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
fail_dump lib/fault-inject.c:52 [inline]
should_fail+0x38a/0x4c0 lib/fault-inject.c:146
strncpy_from_user+0x32/0x370 lib/strncpy_from_user.c:118
strncpy_from_user_nofault+0x6c/0x130 mm/maccess.c:295
bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:194 [inline]
____bpf_probe_read_user_str kernel/trace/bpf_trace.c:203 [inline]
bpf_probe_read_user_str+0x26/0x70 kernel/trace/bpf_trace.c:200
bpf_prog_b0fe9b75aaebb688+0x38/0xd28
bpf_dispatcher_nop_func include/linux/bpf.h:776 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1921
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6780
irqentry_exit+0x53/0x80 kernel/entry/common.c:426
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:crng_make_state+0x530/0x690 drivers/char/random.c:393
Code: db a9 05 e9 38 fd ff ff e8 ed 00 04 fd e8 c8 5b a0 05 4d 85 e4 0f 84 ff fe ff ff e8 da 00 04 fd fb 48 c7 44 24 40 0e 36 e0 45 <43> c7 44 3d 00 00 00 00 00 4b c7 44 3d 0c 00 00 00 00 66 43 c7 44
RSP: 0018:ffffc900032b6a00 EFLAGS: 00000283
RAX: ffffffff847c2ce6 RBX: 0000000000000000 RCX: 0000000000040000
RDX: ffffc90003b0d000 RSI: 00000000000003fa RDI: 00000000000003fb
RBP: ffffc900032b6b50 R08: ffffffff847c2bc9 R09: fffffbfff1f7a01a
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000200
R13: dffffc0000000000 R14: 0000000000000046 R15: 1ffff92000656d48
_get_random_bytes+0xd3/0x2b0 drivers/char/random.c:405
wg_cookie_checker_init+0x68/0x90 drivers/net/wireguard/cookie.c:24
wg_newlink+0xb4/0x740 drivers/net/wireguard/device.c:305
__rtnl_newlink net/core/rtnetlink.c:3501 [inline]
rtnl_newlink+0x14bd/0x2070 net/core/rtnetlink.c:3549
rtnetlink_rcv_msg+0x993/0xee0 net/core/rtnetlink.c:5630
netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2505
netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]
netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1356
netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1924
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2431
___sys_sendmsg+0x252/0x2e0 net/socket.c:2485
__sys_sendmsg net/socket.c:2514 [inline]
__do_sys_sendmsg net/socket.c:2523 [inline]
__se_sys_sendmsg+0x19a/0x260 net/socket.c:2521
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fddf2c7ada9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fddf11fb0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fddf2da8f80 RCX: 00007fddf2c7ada9
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006
RBP: 00007fddf11fb120 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 000000000000000b R14: 00007fddf2da8f80 R15: 00007ffc87cd7d68
</TASK>
----------------
Code disassembly (best guess), 3 bytes skipped:
0: e9 38 fd ff ff jmp 0xfffffd3d
5: e8 ed 00 04 fd call 0xfd0400f7
a: e8 c8 5b a0 05 call 0x5a05bd7
f: 4d 85 e4 test %r12,%r12
12: 0f 84 ff fe ff ff je 0xffffff17
18: e8 da 00 04 fd call 0xfd0400f7
1d: fb sti
1e: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
25: e0 45
* 27: 43 c7 44 3d 00 00 00 movl $0x0,0x0(%r13,%r15,1) <-- trapping instruction
2e: 00 00
30: 4b c7 44 3d 0c 00 00 movq $0x0,0xc(%r13,%r15,1)
37: 00 00
39: 66 data16
3a: 43 rex.XB
3b: c7 .byte 0xc7
3c: 44 rex.R


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,
Mar 25, 2024, 11:59:24 PMMar 25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: b95c01af2113 Linux 5.15.152
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15764191180000
kernel config: https://syzkaller.appspot.com/x/.config?x=b26cb65e5b8ad5c7
dashboard link: https://syzkaller.appspot.com/bug?extid=463efc4f92134aef1adc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145c3191180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17b05165180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2fc98856fcae/disk-b95c01af.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3186db0dfe08/vmlinux-b95c01af.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0df136a3e808/bzImage-b95c01af.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+463efc...@syzkaller.appspotmail.com

------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
5.15.152-syzkaller #0 Not tainted
------------------------------------------------------
swapper/1/0 is trying to acquire lock:
ffffffff8c7fbf78 ((console_sem).lock){....}-{2:2}, at: down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138

but task is already holding lock:
ffff8880b9b3a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
dev_vprintk_emit+0x2aa/0x323 drivers/base/core.c:4595
dev_printk_emit+0xd9/0x118 drivers/base/core.c:4606
_dev_warn+0x11e/0x165 drivers/base/core.c:4662
_request_firmware+0xf2b/0x1200 drivers/base/firmware_loader/main.c:844
request_firmware_work_func+0x126/0x270 drivers/base/firmware_loader/main.c:1097
process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
kthread+0x3f6/0x4f0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

-> #0 ((console_sem).lock){....}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
__down_trylock_console_sem+0x105/0x250 kernel/printk/printk.c:239
console_trylock kernel/printk/printk.c:2569 [inline]
console_trylock_spinning+0x8a/0x3f0 kernel/printk/printk.c:1867
vprintk_emit+0xa6/0x150 kernel/printk/printk.c:2267
_printk+0xd1/0x111 kernel/printk/printk.c:2293
report_bug+0x1e5/0x2e0 lib/bug.c:195
handle_bug+0x3d/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x16/0x40 arch/x86/kernel/traps.c:259
asm_exc_invalid_op+0x16/0x20 arch/x86/include/asm/idtentry.h:566
__local_bh_enable_ip+0x1b3/0x1f0
__sock_map_delete net/core/sock_map.c:426 [inline]
sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
bpf_prog_2c29ac5cdc6b1842+0x3a/0x49c
bpf_dispatcher_nop_func include/linux/bpf.h:780 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
schedule_idle+0x4a/0x90 kernel/sched/core.c:6487
do_idle+0x61e/0x670 kernel/sched/idle.c:334
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403
start_secondary+0x371/0x500 arch/x86/kernel/smpboot.c:281
secondary_startup_64_no_verify+0xb1/0xbb

other info that might help us debug this:

Chain exists of:
(console_sem).lock --> &p->pi_lock --> &rq->__lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock((console_sem).lock);

*** DEADLOCK ***

2 locks held by swapper/1/0:
#0: ffff8880b9b3a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
#1: ffffffff8c91f720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:268

stack backtrace:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.152-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
__down_trylock_console_sem+0x105/0x250 kernel/printk/printk.c:239
console_trylock kernel/printk/printk.c:2569 [inline]
console_trylock_spinning+0x8a/0x3f0 kernel/printk/printk.c:1867
vprintk_emit+0xa6/0x150 kernel/printk/printk.c:2267
_printk+0xd1/0x111 kernel/printk/printk.c:2293
report_bug+0x1e5/0x2e0 lib/bug.c:195
handle_bug+0x3d/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x16/0x40 arch/x86/kernel/traps.c:259
asm_exc_invalid_op+0x16/0x20 arch/x86/include/asm/idtentry.h:566
RIP: 0010:__local_bh_enable_ip+0x1b3/0x1f0 kernel/softirq.c:363
Code: 04 25 28 00 00 00 48 3b 44 24 60 75 4a 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b e9 d0 fe ff ff e8 3f 00 00 00 eb a2 <0f> 0b e9 02 ff ff ff 48 c7 c1 44 c1 e3 8d 80 e1 07 80 c1 03 38 c1
RSP: 0018:ffffc90000d67940 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff920001acf2c RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff884e8deb
RBP: ffffc90000d679f8 R08: dffffc0000000000 R09: ffffed100f266cb6
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8880161be100 R14: ffffc90000d67980 R15: 0000000000000201
__sock_map_delete net/core/sock_map.c:426 [inline]
sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
bpf_prog_2c29ac5cdc6b1842+0x3a/0x49c
bpf_dispatcher_nop_func include/linux/bpf.h:780 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
schedule_idle+0x4a/0x90 kernel/sched/core.c:6487
do_idle+0x61e/0x670 kernel/sched/idle.c:334
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403
start_secondary+0x371/0x500 arch/x86/kernel/smpboot.c:281
secondary_startup_64_no_verify+0xb1/0xbb
</TASK>
WARNING: CPU: 1 PID: 0 at kernel/softirq.c:363 __local_bh_enable_ip+0x1b3/0x1f0
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.152-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
RIP: 0010:__local_bh_enable_ip+0x1b3/0x1f0 kernel/softirq.c:363
Code: 04 25 28 00 00 00 48 3b 44 24 60 75 4a 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b e9 d0 fe ff ff e8 3f 00 00 00 eb a2 <0f> 0b e9 02 ff ff ff 48 c7 c1 44 c1 e3 8d 80 e1 07 80 c1 03 38 c1
RSP: 0018:ffffc90000d67940 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff920001acf2c RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff884e8deb
RBP: ffffc90000d679f8 R08: dffffc0000000000 R09: ffffed100f266cb6
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8880161be100 R14: ffffc90000d67980 R15: 0000000000000201
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555639eca8 CR3: 0000000019cf0000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__sock_map_delete net/core/sock_map.c:426 [inline]
sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
bpf_prog_2c29ac5cdc6b1842+0x3a/0x49c
bpf_dispatcher_nop_func include/linux/bpf.h:780 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
schedule_idle+0x4a/0x90 kernel/sched/core.c:6487
do_idle+0x61e/0x670 kernel/sched/idle.c:334
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403
start_secondary+0x371/0x500 arch/x86/kernel/smpboot.c:281
secondary_startup_64_no_verify+0xb1/0xbb
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages