[v5.15] possible deadlock in __bpf_ringbuf_reserve
0 views
Skip to first unread message
syzbot
Sep 4, 2025, 6:27:29 PM (3 days ago) Sep 4
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 7a6c2d093c45 Linux 5.15.191
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1332087c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4aee9f779ad20a6a
dashboard link: https://syzkaller.appspot.com/bug?extid=1721567745130669e3fd
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/078b980da028/disk-7a6c2d09.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4b282618f251/vmlinux-7a6c2d09.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5bbee0fdcc8e/bzImage-7a6c2d09.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+172156...@syzkaller.appspotmail.com
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.8.8479/30288 is trying to acquire lock:
ffffc900012b8098 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1d0/0x590 kernel/bpf/ringbuf.c:328
but task is already holding lock:
ffffc90003511098 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1d0/0x590 kernel/bpf/ringbuf.c:328
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&rb->spinlock);
lock(&rb->spinlock);
*** DEADLOCK ***
May be due to missing lock nesting notation
8 locks held by syz.8.8479/30288:
#0: ffffffff8c15c0c8 (tracepoints_mutex){+.+.}-{3:3}, at: tracepoint_probe_register_prio_may_exist+0x40/0x90 kernel/tracepoint.c:478
#1: ffffffff8bfbabd0 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0xe/0x20 kernel/jump_label.c:189
#2: ffffffff8c1a80e8 (jump_label_mutex){+.+.}-{3:3}, at: jump_label_lock kernel/jump_label.c:27 [inline]
#2: ffffffff8c1a80e8 (jump_label_mutex){+.+.}-{3:3}, at: static_key_enable_cpuslocked+0xc2/0x240 kernel/jump_label.c:174
#3: ffffffff8bfd1c88 (text_mutex){+.+.}-{3:3}, at: arch_jump_label_transform_apply+0xe/0x20 arch/x86/kernel/jump_label.c:145
#4: ffff888016866078 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
#4: ffff888016866078 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: __get_locked_pte+0x162/0x1b0 mm/memory.c:1760
#5: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
#6: ffffc90003511098 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1d0/0x590 kernel/bpf/ringbuf.c:328
#7: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
stack backtrace:
CPU: 0 PID: 30288 Comm: syz.8.8479 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
__lock_acquire+0x1227/0x7c60 kernel/locking/lockdep.c:-1
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162
__bpf_ringbuf_reserve+0x1d0/0x590 kernel/bpf/ringbuf.c:328
____bpf_ringbuf_reserve kernel/bpf/ringbuf.c:379 [inline]
bpf_ringbuf_reserve+0x58/0x70 kernel/bpf/ringbuf.c:371
bpf_prog_c774ff1dac8de29c+0x2d/0x80
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
BPF_PROG_RUN_ARRAY include/linux/bpf.h:1341 [inline]
trace_call_bpf+0x2ab/0x5a0 kernel/trace/bpf_trace.c:127
perf_trace_run_bpf_submit+0x79/0x1c0 kernel/events/core.c:10016
perf_trace_lock+0x2ec/0x370 include/trace/events/lock.h:39
trace_lock_release include/trace/events/lock.h:58 [inline]
lock_release+0x823/0x870 kernel/locking/lockdep.c:5634
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_unlock_irqrestore+0x6d/0x100 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:418 [inline]
__bpf_ringbuf_reserve+0x452/0x590 kernel/bpf/ringbuf.c:366
____bpf_ringbuf_output kernel/bpf/ringbuf.c:454 [inline]
bpf_ringbuf_output+0x65/0x1e0 kernel/bpf/ringbuf.c:444
bpf_prog_2e407e2e07a4c796+0x6a/0xec
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x15b/0x2d0 kernel/trace/bpf_trace.c:1915
trace_tlb_flush+0xe6/0x110 include/trace/events/tlb.h:38
switch_mm_irqs_off+0x6e3/0x9a0 arch/x86/mm/tlb.c:-1
unuse_temporary_mm arch/x86/kernel/alternative.c:1276 [inline]
__text_poke+0x5a3/0x7b0 arch/x86/kernel/alternative.c:1372
text_poke arch/x86/kernel/alternative.c:1413 [inline]
text_poke_bp_batch+0x138/0x7c0 arch/x86/kernel/alternative.c:1639
text_poke_flush arch/x86/kernel/alternative.c:1833 [inline]
text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1840
arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146
static_key_enable_cpuslocked+0x11f/0x240 kernel/jump_label.c:177
static_key_enable+0x16/0x20 kernel/jump_label.c:190
tracepoint_add_func+0x83b/0x9a0 kernel/tracepoint.c:361
tracepoint_probe_register_prio_may_exist+0x5c/0x90 kernel/tracepoint.c:482
bpf_raw_tracepoint_open+0x69d/0x780 kernel/bpf/syscall.c:3113
__sys_bpf+0x48b/0x670 kernel/bpf/syscall.c:4693
__do_sys_bpf kernel/bpf/syscall.c:4755 [inline]
__se_sys_bpf kernel/bpf/syscall.c:4753 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4753
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7ff0f5a3cbe9
Code: Unable to access opcode bytes at RIP 0x7ff0f5a3cbbf.
RSP: 002b:00007ff0f3ca4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007ff0f5c73fa0 RCX: 00007ff0f5a3cbe9
RDX: 0000000000000010 RSI: 0000200000000080 RDI: 0000000000000011
RBP: 00007ff0f5abfe19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff0f5c74038 R14: 00007ff0f5c73fa0 R15: 00007ffd45dad0d8
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 7a6c2d093c45 Linux 5.15.191
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1332087c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4aee9f779ad20a6a
dashboard link: https://syzkaller.appspot.com/bug?extid=1721567745130669e3fd
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/078b980da028/disk-7a6c2d09.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4b282618f251/vmlinux-7a6c2d09.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5bbee0fdcc8e/bzImage-7a6c2d09.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+172156...@syzkaller.appspotmail.com
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.8.8479/30288 is trying to acquire lock:
ffffc900012b8098 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1d0/0x590 kernel/bpf/ringbuf.c:328
but task is already holding lock:
ffffc90003511098 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1d0/0x590 kernel/bpf/ringbuf.c:328
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&rb->spinlock);
lock(&rb->spinlock);
*** DEADLOCK ***
May be due to missing lock nesting notation
8 locks held by syz.8.8479/30288:
#0: ffffffff8c15c0c8 (tracepoints_mutex){+.+.}-{3:3}, at: tracepoint_probe_register_prio_may_exist+0x40/0x90 kernel/tracepoint.c:478
#1: ffffffff8bfbabd0 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0xe/0x20 kernel/jump_label.c:189
#2: ffffffff8c1a80e8 (jump_label_mutex){+.+.}-{3:3}, at: jump_label_lock kernel/jump_label.c:27 [inline]
#2: ffffffff8c1a80e8 (jump_label_mutex){+.+.}-{3:3}, at: static_key_enable_cpuslocked+0xc2/0x240 kernel/jump_label.c:174
#3: ffffffff8bfd1c88 (text_mutex){+.+.}-{3:3}, at: arch_jump_label_transform_apply+0xe/0x20 arch/x86/kernel/jump_label.c:145
#4: ffff888016866078 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
#4: ffff888016866078 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: __get_locked_pte+0x162/0x1b0 mm/memory.c:1760
#5: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
#6: ffffc90003511098 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1d0/0x590 kernel/bpf/ringbuf.c:328
#7: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
stack backtrace:
CPU: 0 PID: 30288 Comm: syz.8.8479 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
__lock_acquire+0x1227/0x7c60 kernel/locking/lockdep.c:-1
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162
__bpf_ringbuf_reserve+0x1d0/0x590 kernel/bpf/ringbuf.c:328
____bpf_ringbuf_reserve kernel/bpf/ringbuf.c:379 [inline]
bpf_ringbuf_reserve+0x58/0x70 kernel/bpf/ringbuf.c:371
bpf_prog_c774ff1dac8de29c+0x2d/0x80
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
BPF_PROG_RUN_ARRAY include/linux/bpf.h:1341 [inline]
trace_call_bpf+0x2ab/0x5a0 kernel/trace/bpf_trace.c:127
perf_trace_run_bpf_submit+0x79/0x1c0 kernel/events/core.c:10016
perf_trace_lock+0x2ec/0x370 include/trace/events/lock.h:39
trace_lock_release include/trace/events/lock.h:58 [inline]
lock_release+0x823/0x870 kernel/locking/lockdep.c:5634
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_unlock_irqrestore+0x6d/0x100 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:418 [inline]
__bpf_ringbuf_reserve+0x452/0x590 kernel/bpf/ringbuf.c:366
____bpf_ringbuf_output kernel/bpf/ringbuf.c:454 [inline]
bpf_ringbuf_output+0x65/0x1e0 kernel/bpf/ringbuf.c:444
bpf_prog_2e407e2e07a4c796+0x6a/0xec
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x15b/0x2d0 kernel/trace/bpf_trace.c:1915
trace_tlb_flush+0xe6/0x110 include/trace/events/tlb.h:38
switch_mm_irqs_off+0x6e3/0x9a0 arch/x86/mm/tlb.c:-1
unuse_temporary_mm arch/x86/kernel/alternative.c:1276 [inline]
__text_poke+0x5a3/0x7b0 arch/x86/kernel/alternative.c:1372
text_poke arch/x86/kernel/alternative.c:1413 [inline]
text_poke_bp_batch+0x138/0x7c0 arch/x86/kernel/alternative.c:1639
text_poke_flush arch/x86/kernel/alternative.c:1833 [inline]
text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1840
arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146
static_key_enable_cpuslocked+0x11f/0x240 kernel/jump_label.c:177
static_key_enable+0x16/0x20 kernel/jump_label.c:190
tracepoint_add_func+0x83b/0x9a0 kernel/tracepoint.c:361
tracepoint_probe_register_prio_may_exist+0x5c/0x90 kernel/tracepoint.c:482
bpf_raw_tracepoint_open+0x69d/0x780 kernel/bpf/syscall.c:3113
__sys_bpf+0x48b/0x670 kernel/bpf/syscall.c:4693
__do_sys_bpf kernel/bpf/syscall.c:4755 [inline]
__se_sys_bpf kernel/bpf/syscall.c:4753 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4753
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7ff0f5a3cbe9
Code: Unable to access opcode bytes at RIP 0x7ff0f5a3cbbf.
RSP: 002b:00007ff0f3ca4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007ff0f5c73fa0 RCX: 00007ff0f5a3cbe9
RDX: 0000000000000010 RSI: 0000200000000080 RDI: 0000000000000011
RBP: 00007ff0f5abfe19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff0f5c74038 R14: 00007ff0f5c73fa0 R15: 00007ffd45dad0d8
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages