[v6.1] inconsistent lock state in htab_lock_bucket

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f6e38ae624cf Linux 6.1.158
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1207fe92580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7eb38bd5021fec61
dashboard link: https://syzkaller.appspot.com/bug?extid=743d77affd179ca0ad40
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14fb14b4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=112ec112580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0d8305ca1c94/disk-f6e38ae6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8bc85383c07b/vmlinux-f6e38ae6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d337081bce56/bzImage-f6e38ae6.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+743d77...@syzkaller.appspotmail.com

================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
syz.0.17/4425 [HC1[1]:SC0[0]:HE0:SE1] takes:
ffff88802f89da18 (&htab->lockdep_key){....}-{2:2}, at: htab_lock_bucket+0x17d/0x300 kernel/bpf/hashtab.c:166
{INITIAL USE} state was registered at:
lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
htab_lock_bucket+0x17d/0x300 kernel/bpf/hashtab.c:166
htab_map_delete_elem+0x19e/0x5b0 kernel/bpf/hashtab.c:1402
bpf_prog_653fb3e4a9309dc2+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1012 [inline]
__bpf_prog_run include/linux/filter.h:603 [inline]
bpf_prog_run include/linux/filter.h:610 [inline]
bpf_overflow_handler+0x525/0x7b0 kernel/events/core.c:10286
__perf_event_overflow+0x448/0x610 kernel/events/core.c:9496
perf_swevent_overflow kernel/events/core.c:9572 [inline]
perf_swevent_event+0x4ad/0x530 kernel/events/core.c:9610
perf_bp_event+0x23a/0x2a0 kernel/events/core.c:10478
hw_breakpoint_handler arch/x86/kernel/hw_breakpoint.c:555 [inline]
hw_breakpoint_exceptions_notify+0x152/0x470 arch/x86/kernel/hw_breakpoint.c:586
notifier_call_chain kernel/notifier.c:87 [inline]
atomic_notifier_call_chain+0x17a/0x2b0 kernel/notifier.c:225
notify_die+0x12d/0x180 kernel/notifier.c:593
notify_debug+0x20/0x30 arch/x86/kernel/traps.c:1018
exc_debug_user arch/x86/kernel/traps.c:1144 [inline]
noist_exc_debug+0x73/0x120 arch/x86/kernel/traps.c:1181
asm_exc_debug+0x2f/0x40 arch/x86/include/asm/idtentry.h:648
irq event stamp: 2388
hardirqs last enabled at (2387): [<ffffffff8a17a5c0>] exc_debug_kernel arch/x86/kernel/traps.c:1093 [inline]
hardirqs last enabled at (2387): [<ffffffff8a17a5c0>] exc_debug+0xf0/0x130 arch/x86/kernel/traps.c:1175
hardirqs last disabled at (2388): [<ffffffff8a17a53e>] exc_debug_kernel arch/x86/kernel/traps.c:1039 [inline]
hardirqs last disabled at (2388): [<ffffffff8a17a53e>] exc_debug+0x6e/0x130 arch/x86/kernel/traps.c:1175
softirqs last enabled at (2044): [<ffffffff818f072f>] bpf_prog_load+0x117f/0x15a0 kernel/bpf/syscall.c:2674
softirqs last disabled at (2042): [<ffffffff818d4a79>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (2042): [<ffffffff818d4a79>] bpf_ksym_add+0x29/0x340 kernel/bpf/core.c:649

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&htab->lockdep_key);
<Interrupt>
lock(&htab->lockdep_key);

*** DEADLOCK ***

no locks held by syz.0.17/4425.

stack backtrace:
CPU: 0 PID: 4425 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
<#DB>
dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
lock_acquire+0x2ce/0x490 kernel/locking/lockdep.c:5653
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
htab_lock_bucket+0x17d/0x300 kernel/bpf/hashtab.c:166
htab_map_delete_elem+0x19e/0x5b0 kernel/bpf/hashtab.c:1402
bpf_prog_653fb3e4a9309dc2+0x42/0x46
bpf_dispatcher_nop_func include/linux/bpf.h:1012 [inline]
__bpf_prog_run include/linux/filter.h:603 [inline]
bpf_prog_run include/linux/filter.h:610 [inline]
bpf_overflow_handler+0x525/0x7b0 kernel/events/core.c:10286
__perf_event_overflow+0x448/0x610 kernel/events/core.c:9496
perf_swevent_overflow kernel/events/core.c:9572 [inline]
perf_swevent_event+0x4ad/0x530 kernel/events/core.c:9610
perf_bp_event+0x23a/0x2a0 kernel/events/core.c:10478
hw_breakpoint_handler arch/x86/kernel/hw_breakpoint.c:555 [inline]
hw_breakpoint_exceptions_notify+0x152/0x470 arch/x86/kernel/hw_breakpoint.c:586
notifier_call_chain kernel/notifier.c:87 [inline]
atomic_notifier_call_chain+0x17a/0x2b0 kernel/notifier.c:225
notify_die+0x12d/0x180 kernel/notifier.c:593
notify_debug+0x20/0x30 arch/x86/kernel/traps.c:1018
exc_debug_kernel arch/x86/kernel/traps.c:1075 [inline]
exc_debug+0xd9/0x130 arch/x86/kernel/traps.c:1175
asm_exc_debug+0x1a/0x40 arch/x86/include/asm/idtentry.h:648
RIP: 0010:copy_user_short_string+0x26/0x40 arch/x86/lib/copy_user_64.S:244
Code: 90 90 90 90 89 d1 83 e2 07 c1 e9 03 74 12 4c 8b 06 4c 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 89 d1 8a 06 88 07 <48> ff c6 48 ff c7 ff c9 75 f2 31 c0 0f 01 ca c3 8d 14 ca eb 02 89
RSP: 0018:ffffc90004196f88 EFLAGS: 00040202
RAX: ffffffff84072a00 RBX: 0000000000000003 RCX: 0000000000000001
RDX: 0000000000000003 RSI: ffff8880256cc66e RDI: 0000200000000302
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed1004ad98ce
R10: ffffed1004ad98ce R11: 1ffff11004ad98cd R12: 00007fffffffeffd
R13: 0000000000000003 R14: 0000200000000300 R15: ffff8880256cc66c
</#DB>
<TASK>
copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline]
_copy_to_user+0xea/0x130 lib/usercopy.c:41
copy_to_user include/linux/uaccess.h:169 [inline]
bpf_verifier_vlog+0x172/0x390 kernel/bpf/log.c:34
verbose+0x1dc/0x2a0 kernel/bpf/verifier.c:303
print_insn_state+0x125/0x1b0 kernel/bpf/verifier.c:930
do_check kernel/bpf/verifier.c:12495 [inline]
do_check_common+0x5589/0xc6a0 kernel/bpf/verifier.c:14937
do_check_main kernel/bpf/verifier.c:15000 [inline]
bpf_check+0x3ee1/0x10ca0 kernel/bpf/verifier.c:15577
bpf_prog_load+0x1072/0x15a0 kernel/bpf/syscall.c:2648
__sys_bpf+0x520/0x6d0 kernel/bpf/syscall.c:5027
__do_sys_bpf kernel/bpf/syscall.c:5131 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5129 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5129
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f59fe38f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd26c8d0e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f59fe5e5fa0 RCX: 00007f59fe38f749
RDX: 0000000000000048 RSI: 0000200000000240 RDI: 0000000000000005
RBP: 00007f59fe413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f59fe5e5fa0 R14: 00007f59fe5e5fa0 R15: 0000000000000003
</TASK>
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 89 d1 mov %edx,%ecx
6: 83 e2 07 and $0x7,%edx
9: c1 e9 03 shr $0x3,%ecx
c: 74 12 je 0x20
e: 4c 8b 06 mov (%rsi),%r8
11: 4c 89 07 mov %r8,(%rdi)
14: 48 8d 76 08 lea 0x8(%rsi),%rsi
18: 48 8d 7f 08 lea 0x8(%rdi),%rdi
1c: ff c9 dec %ecx
1e: 75 ee jne 0xe
20: 21 d2 and %edx,%edx
22: 74 10 je 0x34
24: 89 d1 mov %edx,%ecx
26: 8a 06 mov (%rsi),%al
28: 88 07 mov %al,(%rdi)
* 2a: 48 ff c6 inc %rsi <-- trapping instruction
2d: 48 ff c7 inc %rdi
30: ff c9 dec %ecx
32: 75 f2 jne 0x26
34: 31 c0 xor %eax,%eax
36: 0f 01 ca clac
39: c3 ret
3a: 8d 14 ca lea (%rdx,%rcx,8),%edx
3d: eb 02 jmp 0x41
3f: 89 .byte 0x89


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1e89a1be4fe9 Linux 6.6.117
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=120e3912580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=0057e0c996f6b53410fd

compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17860192580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=160e3912580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0841ff5925b8/disk-1e89a1be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b5c591b98846/vmlinux-1e89a1be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c863ab0f2374/bzImage-1e89a1be.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+0057e0...@syzkaller.appspotmail.com

================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.

syz.0.17/5959 [HC1[1]:SC0[0]:HE0:SE1] takes:
ffff8880774448b0 (&htab->lockdep_key){....}-{2:2}, at: htab_lock_bucket+0x181/0x300 kernel/bpf/hashtab.c:166

{INITIAL USE} state was registered at:

lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
htab_lock_bucket+0x181/0x300 kernel/bpf/hashtab.c:166
htab_map_delete_elem+0x1a4/0x630 kernel/bpf/hashtab.c:1443
bpf_prog_653fb3e4a9309dc2+0x4a/0x4e
bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline]
__bpf_prog_run include/linux/filter.h:612 [inline]
bpf_prog_run include/linux/filter.h:619 [inline]
bpf_overflow_handler+0x1f9/0x4f0 kernel/events/core.c:10547
__perf_event_overflow+0x447/0x630 kernel/events/core.c:9718
perf_swevent_overflow kernel/events/core.c:9794 [inline]
perf_swevent_event+0x4de/0x5c0 kernel/events/core.c:9832
perf_bp_event+0x252/0x300 kernel/events/core.c:10739
hw_breakpoint_handler arch/x86/kernel/hw_breakpoint.c:555 [inline]
hw_breakpoint_exceptions_notify+0x23e/0x670 arch/x86/kernel/hw_breakpoint.c:586
notifier_call_chain+0x197/0x390 kernel/notifier.c:93
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:231
notify_die+0x131/0x180 kernel/notifier.c:596
notify_debug+0x2e/0x50 arch/x86/kernel/traps.c:1042
exc_debug_user arch/x86/kernel/traps.c:1168 [inline]
noist_exc_debug+0x77/0x120 arch/x86/kernel/traps.c:1205
asm_exc_debug+0x33/0x40 arch/x86/include/asm/idtentry.h:644
irq event stamp: 2664
hardirqs last enabled at (2663): [<ffffffff8a6f0bdd>] exc_debug_kernel arch/x86/kernel/traps.c:1117 [inline]
hardirqs last enabled at (2663): [<ffffffff8a6f0bdd>] exc_debug+0xfd/0x140 arch/x86/kernel/traps.c:1199
hardirqs last disabled at (2664): [<ffffffff8a6f0b5b>] exc_debug_kernel arch/x86/kernel/traps.c:1063 [inline]
hardirqs last disabled at (2664): [<ffffffff8a6f0b5b>] exc_debug+0x7b/0x140 arch/x86/kernel/traps.c:1199
softirqs last enabled at (2278): [<ffffffff8194b312>] bpf_prog_load+0x12f2/0x16d0 kernel/bpf/syscall.c:2776
softirqs last disabled at (2276): [<ffffffff8192c0cd>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (2276): [<ffffffff8192c0cd>] bpf_ksym_add+0x2d/0x340 kernel/bpf/core.c:655

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&htab->lockdep_key);
<Interrupt>
lock(&htab->lockdep_key);

*** DEADLOCK ***

no locks held by syz.0.17/5959.

stack backtrace:
CPU: 1 PID: 5959 Comm: syz.0.17 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
<#DB>

dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
lock_acquire+0x2b1/0x410 kernel/locking/lockdep.c:5745
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
htab_lock_bucket+0x181/0x300 kernel/bpf/hashtab.c:166
htab_map_delete_elem+0x1a4/0x630 kernel/bpf/hashtab.c:1443
bpf_prog_653fb3e4a9309dc2+0x4a/0x4e
bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline]
__bpf_prog_run include/linux/filter.h:612 [inline]
bpf_prog_run include/linux/filter.h:619 [inline]
bpf_overflow_handler+0x1f9/0x4f0 kernel/events/core.c:10547
__perf_event_overflow+0x447/0x630 kernel/events/core.c:9718
perf_swevent_overflow kernel/events/core.c:9794 [inline]
perf_swevent_event+0x4de/0x5c0 kernel/events/core.c:9832
perf_bp_event+0x252/0x300 kernel/events/core.c:10739
hw_breakpoint_handler arch/x86/kernel/hw_breakpoint.c:555 [inline]
hw_breakpoint_exceptions_notify+0x23e/0x670 arch/x86/kernel/hw_breakpoint.c:586
notifier_call_chain+0x197/0x390 kernel/notifier.c:93
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:231
notify_die+0x131/0x180 kernel/notifier.c:596
notify_debug+0x2e/0x50 arch/x86/kernel/traps.c:1042
exc_debug_kernel arch/x86/kernel/traps.c:1099 [inline]
exc_debug+0xe6/0x140 arch/x86/kernel/traps.c:1199
asm_exc_debug+0x1e/0x40 arch/x86/include/asm/idtentry.h:644
RIP: 0010:rep_movs_alternative+0x17/0x90 arch/x86/lib/copy_user_64.S:45
Code: 24 4c 8b 64 24 08 48 83 c4 10 c3 cc cc cc cc cc cc cc cc f3 0f 1e fa 48 83 f9 40 73 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 <48> ff c7 48 ff c6 48 ff c9 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00
RSP: 0018:ffffc900031c6f50 EFLAGS: 00040202
RAX: ffffffff841f4e00 RBX: 0000000000000003 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffff88806449068e RDI: 0000200000000302
RBP: 0000000000000003 R08: ffff88806449068e R09: 1ffff1100c8920d1
R10: dffffc0000000000 R11: ffffed100c8920d2 R12: 0000200000000303
R13: 0000000000000000 R14: 0000200000000300 R15: ffff88806449068c
</#DB>
<TASK>
copy_user_generic arch/x86/include/asm/uaccess_64.h:112 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:133 [inline]
_copy_to_user+0x85/0xa0 lib/usercopy.c:41
copy_to_user include/linux/uaccess.h:191 [inline]
bpf_verifier_vlog+0x2fa/0x870 kernel/bpf/log.c:124
verbose+0x10b/0x180 kernel/bpf/verifier.c:370
print_insn_state+0x130/0x160 kernel/bpf/verifier.c:1548
do_check+0x4fc9/0xdbe0 kernel/bpf/verifier.c:17133
do_check_common+0xadb/0x13e0 kernel/bpf/verifier.c:19706
do_check_main kernel/bpf/verifier.c:19769 [inline]
bpf_check+0x649f/0xe970 kernel/bpf/verifier.c:20437
bpf_prog_load+0x11cb/0x16d0 kernel/bpf/syscall.c:2750
__sys_bpf+0x55a/0x800 kernel/bpf/syscall.c:5473
__do_sys_bpf kernel/bpf/syscall.c:5577 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5575 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5575
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1ea698f749

Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007ffe28fa1b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f1ea6be5fa0 RCX: 00007f1ea698f749

RDX: 0000000000000048 RSI: 0000200000000240 RDI: 0000000000000005

RBP: 00007f1ea6a13f91 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f1ea6be5fa0 R14: 00007f1ea6be5fa0 R15: 0000000000000003

</TASK>
----------------
Code disassembly (best guess):

0: 24 4c and $0x4c,%al
2: 8b 64 24 08 mov 0x8(%rsp),%esp
6: 48 83 c4 10 add $0x10,%rsp
a: c3 ret
b: cc int3
c: cc int3
d: cc int3
e: cc int3
f: cc int3
10: cc int3
11: cc int3
12: cc int3
13: f3 0f 1e fa endbr64
17: 48 83 f9 40 cmp $0x40,%rcx
1b: 73 40 jae 0x5d
1d: 83 f9 08 cmp $0x8,%ecx
20: 73 21 jae 0x43
22: 85 c9 test %ecx,%ecx
24: 74 0f je 0x35

26: 8a 06 mov (%rsi),%al
28: 88 07 mov %al,(%rdi)

* 2a: 48 ff c7 inc %rdi <-- trapping instruction
2d: 48 ff c6 inc %rsi
30: 48 ff c9 dec %rcx
33: 75 f1 jne 0x26
35: c3 ret
36: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
3d: 00 00 00