syzbot

 sign-in | mailing list | source | docs
🐞 Open [810]
🐞 Fixed [135]
🐞 Invalid [933]
⬇ Missing Backports [78]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

possible deadlock in lock_timer_base

Status: upstream: reported C repro on 2023/06/17 18:14
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+1e90d72fb78c8c8fae1d@syzkaller.appspotmail.com
First crash: 878d, last: 581d
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2024/05/05 linux-6.1.y (ToT) 909ba1f1b414 C [report] INFO: rcu detected stall in corrupted
2024/05/05 upstream (ToT) 7367539ad4b0 C Didn't crash
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in lock_timer_base bpf trace 4 C 142 300d 1774d 1/29 upstream: reported C repro on 2021/01/03 06:59
linux-5.15 possible deadlock in lock_timer_base origin:lts-only 4 C done 184 278d 901d 0/3 upstream: reported C repro on 2023/05/25 21:57
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2024/05/11 00:37 7h10m fix candidate upstream OK (1) job log
2023/10/09 13:49 2h28m fix candidate upstream OK (0) job log

Sample crash report:
=====================================================
WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
6.1.84-syzkaller #0 Not tainted
-----------------------------------------------------
kworker/1:0/22 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire:
ffff888026111d68 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:932

and this task is already holding:
ffff8880b9928358 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x120/0x260 kernel/time/timer.c:999
which would create a new lock dependency:
 (&base->lock){-.-.}-{2:2} -> (&htab->buckets[i].lock){+.-.}-{2:2}

but this new dependency connects a HARDIRQ-irq-safe lock:
 (&base->lock){-.-.}-{2:2}

... which became HARDIRQ-irq-safe at:
  lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
  __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
  _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
  lock_timer_base+0x120/0x260 kernel/time/timer.c:999
  add_timer_on+0x1eb/0x580 kernel/time/timer.c:1239
  handle_irq_event_percpu kernel/irq/handle.c:195 [inline]
  handle_irq_event+0xa9/0x1e0 kernel/irq/handle.c:210
  handle_edge_irq+0x245/0xbf0 kernel/irq/chip.c:819
  generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
  handle_irq arch/x86/kernel/irq.c:231 [inline]
  __common_interrupt+0xd7/0x1f0 arch/x86/kernel/irq.c:250
  common_interrupt+0x9f/0xc0 arch/x86/kernel/irq.c:240
  asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:644
  console_emit_next_record+0xd67/0x1000 kernel/printk/printk.c:2786
  console_unlock+0x278/0x7c0 kernel/printk/printk.c:2906
  vprintk_emit+0x523/0x740 kernel/printk/printk.c:2303
  _printk+0xd1/0x111 kernel/printk/printk.c:2328
  calibrate_delay+0x158f/0x16a0 init/calibrate.c:308
  start_kernel+0x41e/0x53f init/main.c:1104
  secondary_startup_64_no_verify+0xcf/0xdb

to a HARDIRQ-irq-unsafe lock:
 (&htab->buckets[i].lock){+.-.}-{2:2}

... which became HARDIRQ-irq-unsafe at:
...
  lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
  __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
  _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
  sock_hash_free+0x160/0x820 net/core/sock_map.c:1149
  process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
  worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
  kthread+0x28d/0x320 kernel/kthread.c:376
  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307

other info that might help us debug this:

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&htab->buckets[i].lock);
                               local_irq_disable();
                               lock(&base->lock);
                               lock(&htab->buckets[i].lock);
  <Interrupt>
    lock(&base->lock);

 *** DEADLOCK ***

4 locks held by kworker/1:0/22:
 #0: ffff888012472138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc900001c7d20 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffff8880b9928358 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x120/0x260 kernel/time/timer.c:999
 #3: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #3: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #3: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2272 [inline]
 #3: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x16a/0x470 kernel/trace/bpf_trace.c:2314

the dependencies between HARDIRQ-irq-safe lock and the holding lock:
-> (&base->lock){-.-.}-{2:2} {
   IN-HARDIRQ-W at:
                    lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
                    __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                    _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
                    lock_timer_base+0x120/0x260 kernel/time/timer.c:999
                    add_timer_on+0x1eb/0x580 kernel/time/timer.c:1239
                    handle_irq_event_percpu kernel/irq/handle.c:195 [inline]
                    handle_irq_event+0xa9/0x1e0 kernel/irq/handle.c:210
                    handle_edge_irq+0x245/0xbf0 kernel/irq/chip.c:819
                    generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
                    handle_irq arch/x86/kernel/irq.c:231 [inline]
                    __common_interrupt+0xd7/0x1f0 arch/x86/kernel/irq.c:250
                    common_interrupt+0x9f/0xc0 arch/x86/kernel/irq.c:240
                    asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:644
                    console_emit_next_record+0xd67/0x1000 kernel/printk/printk.c:2786
                    console_unlock+0x278/0x7c0 kernel/printk/printk.c:2906
                    vprintk_emit+0x523/0x740 kernel/printk/printk.c:2303
                    _printk+0xd1/0x111 kernel/printk/printk.c:2328
                    calibrate_delay+0x158f/0x16a0 init/calibrate.c:308
                    start_kernel+0x41e/0x53f init/main.c:1104
                    secondary_startup_64_no_verify+0xcf/0xdb
   IN-SOFTIRQ-W at:
                    lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
                    __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
                    _raw_spin_lock_irq+0xcf/0x110 kernel/locking/spinlock.c:170
                    __run_timers+0x111/0x890 kernel/time/timer.c:1802
                    run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
                    __do_softirq+0x2e9/0xa4c kernel/softirq.c:571
                    invoke_softirq kernel/softirq.c:445 [inline]
                    __irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
                    irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
                    common_interrupt+0xa4/0xc0 arch/x86/kernel/irq.c:240
                    asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:644
                    console_emit_next_record+0xd67/0x1000 kernel/printk/printk.c:2786
                    console_unlock+0x278/0x7c0 kernel/printk/printk.c:2906
                    vprintk_emit+0x523/0x740 kernel/printk/printk.c:2303
                    _printk+0xd1/0x111 kernel/printk/printk.c:2328
                    spectre_v2_select_mitigation+0x53f/0x7d3 arch/x86/kernel/cpu/bugs.c:1698
                    cpu_select_mitigations+0x3d/0x8f arch/x86/kernel/cpu/bugs.c:148
                    arch_cpu_finalize_init+0xf/0x81 arch/x86/kernel/cpu/common.c:2449
                    start_kernel+0x423/0x53f init/main.c:1106
                    secondary_startup_64_no_verify+0xcf/0xdb
   INITIAL USE at:
                   lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
                   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                   _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
                   lock_timer_base+0x120/0x260 kernel/time/timer.c:999
                   add_timer_on+0x1eb/0x580 kernel/time/timer.c:1239
                   handle_irq_event_percpu kernel/irq/handle.c:195 [inline]
                   handle_irq_event+0xa9/0x1e0 kernel/irq/handle.c:210
                   handle_edge_irq+0x245/0xbf0 kernel/irq/chip.c:819
                   generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
                   handle_irq arch/x86/kernel/irq.c:231 [inline]
                   __common_interrupt+0xd7/0x1f0 arch/x86/kernel/irq.c:250
                   common_interrupt+0x9f/0xc0 arch/x86/kernel/irq.c:240
                   asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:644
                   console_emit_next_record+0xd67/0x1000 kernel/printk/printk.c:2786
                   console_unlock+0x278/0x7c0 kernel/printk/printk.c:2906
                   vprintk_emit+0x523/0x740 kernel/printk/printk.c:2303
                   _printk+0xd1/0x111 kernel/printk/printk.c:2328
                   calibrate_delay+0x158f/0x16a0 init/calibrate.c:308
                   start_kernel+0x41e/0x53f init/main.c:1104
                   secondary_startup_64_no_verify+0xcf/0xdb
 }
 ... key      at: [<ffffffff91cd5480>] init_timer_cpu.__key+0x0/0x20

the dependencies between the lock to be acquired
 and HARDIRQ-irq-unsafe lock:
-> (&htab->buckets[i].lock){+.-.}-{2:2} {
   HARDIRQ-ON-W at:
                    lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
                    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                    _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                    sock_hash_free+0x160/0x820 net/core/sock_map.c:1149
                    process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
                    worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
                    kthread+0x28d/0x320 kernel/kthread.c:376
                    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
   IN-SOFTIRQ-W at:
                    lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
                    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                    _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                    sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:932
                    0xffffffffa0003856
                    bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
                    __bpf_prog_run include/linux/filter.h:603 [inline]
                    bpf_prog_run include/linux/filter.h:610 [inline]
                    __bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
                    bpf_trace_run4+0x253/0x470 kernel/trace/bpf_trace.c:2314
                    __bpf_trace_mm_page_alloc+0xba/0xe0 include/trace/events/kmem.h:177
                    trace_mm_page_alloc include/trace/events/kmem.h:177 [inline]
                    __alloc_pages+0x717/0x770 mm/page_alloc.c:5569
                    skb_page_frag_refill+0x154/0x2e0 net/core/sock.c:2872
                    add_recvbuf_mergeable drivers/net/virtio_net.c:1419 [inline]
                    try_fill_recv+0x546/0x1850 drivers/net/virtio_net.c:1460
                    virtnet_receive drivers/net/virtio_net.c:1574 [inline]
                    virtnet_poll+0x8f7/0x1470 drivers/net/virtio_net.c:1680
                    __napi_poll+0xc7/0x470 net/core/dev.c:6537
                    napi_poll net/core/dev.c:6604 [inline]
                    net_rx_action+0x70f/0xeb0 net/core/dev.c:6718
                    __do_softirq+0x2e9/0xa4c kernel/softirq.c:571
                    invoke_softirq kernel/softirq.c:445 [inline]
                    __irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
                    irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
                    common_interrupt+0xa4/0xc0 arch/x86/kernel/irq.c:240
                    asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:644
                    unwind_next_frame+0xdbf/0x2220 arch/x86/kernel/unwind_orc.c:547
                    arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
                    stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
                    kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45
                    __kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:486
                    call_rcu+0x163/0xa10 kernel/rcu/tree.c:2844
                    __dentry_kill+0x4f4/0x650 fs/dcache.c:621
                    dentry_kill+0xbb/0x290
                    dput+0xfb/0x1d0 fs/dcache.c:914
                    proc_invalidate_siblings_dcache+0x3ff/0x6e0 fs/proc/inode.c:149
                    release_task+0x1553/0x16d0 kernel/exit.c:278
                    wait_task_zombie kernel/exit.c:1205 [inline]
                    wait_consider_task+0x1a64/0x2e90 kernel/exit.c:1432
                    do_wait_thread kernel/exit.c:1495 [inline]
                    do_wait+0x32b/0xb80 kernel/exit.c:1612
                    kernel_wait4+0x29e/0x3e0 kernel/exit.c:1775
                    __do_sys_wait4 kernel/exit.c:1803 [inline]
                    __se_sys_wait4 kernel/exit.c:1799 [inline]
                    __x64_sys_wait4+0x130/0x1e0 kernel/exit.c:1799
                    do_syscall_x64 arch/x86/entry/common.c:51 [inline]
                    do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
                    entry_SYSCALL_64_after_hwframe+0x63/0xcd
   INITIAL USE at:
                   lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
                   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
                   _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
                   sock_hash_free+0x160/0x820 net/core/sock_map.c:1149
                   process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
                   worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
                   kthread+0x28d/0x320 kernel/kthread.c:376
                   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
 }
 ... key      at: [<ffffffff920b1340>] sock_hash_alloc.__key+0x0/0x20
 ... acquired at:
   lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
   __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
   _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
   sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:932
   bpf_prog_a8aaa52f2e199321+0x42/0x46
   bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
   __bpf_prog_run include/linux/filter.h:603 [inline]
   bpf_prog_run include/linux/filter.h:610 [inline]
   __bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
   bpf_trace_run4+0x253/0x470 kernel/trace/bpf_trace.c:2314
   __bpf_trace_mm_page_alloc+0xba/0xe0 include/trace/events/kmem.h:177
   __traceiter_mm_page_alloc+0x35/0x50 include/trace/events/kmem.h:177
   trace_mm_page_alloc include/trace/events/kmem.h:177 [inline]
   __alloc_pages+0x717/0x770 mm/page_alloc.c:5569
   __stack_depot_save+0x372/0x470 lib/stackdepot.c:474
   save_stack+0x104/0x1e0 mm/page_owner.c:128
   __set_page_owner+0x26/0x390 mm/page_owner.c:190
   set_page_owner include/linux/page_owner.h:31 [inline]
   post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2513
   prep_new_page mm/page_alloc.c:2520 [inline]
   get_page_from_freelist+0x31a1/0x3320 mm/page_alloc.c:4279
   __alloc_pages+0x28d/0x770 mm/page_alloc.c:5547
   __stack_depot_save+0x372/0x470 lib/stackdepot.c:474
   kasan_save_stack mm/kasan/common.c:46 [inline]
   kasan_set_track+0x60/0x70 mm/kasan/common.c:52
   __kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:328
   kasan_slab_alloc include/linux/kasan.h:201 [inline]
   slab_post_alloc_hook+0x52/0x3a0 mm/slab.h:737
   slab_alloc_node mm/slub.c:3398 [inline]
   slab_alloc mm/slub.c:3406 [inline]
   __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
   kmem_cache_alloc+0x10c/0x2d0 mm/slub.c:3422
   kmem_cache_zalloc include/linux/slab.h:682 [inline]
   fill_pool lib/debugobjects.c:168 [inline]
   debug_objects_fill_pool+0x5fc/0xa10 lib/debugobjects.c:606
   debug_object_activate+0x32/0x4e0 lib/debugobjects.c:693
   debug_timer_activate kernel/time/timer.c:782 [inline]
   __mod_timer+0x7bf/0xee0 kernel/time/timer.c:1103
   schedule_timeout+0x1b4/0x300 kernel/time/timer.c:1964
   synchronize_rcu_expedited_wait_once kernel/rcu/tree_exp.h:580 [inline]
   synchronize_rcu_expedited_wait kernel/rcu/tree_exp.h:631 [inline]
   rcu_exp_wait_wake kernel/rcu/tree_exp.h:699 [inline]
   rcu_exp_sel_wait_wake+0x764/0x1d50 kernel/rcu/tree_exp.h:733
   process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
   worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
   kthread+0x28d/0x320 kernel/kthread.c:376
   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307


stack backtrace:
CPU: 1 PID: 22 Comm: kworker/1:0 Not tainted 6.1.84-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: rcu_gp wait_rcu_exp_gp
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_bad_irq_dependency kernel/locking/lockdep.c:2604 [inline]
 check_irq_usage kernel/locking/lockdep.c:2843 [inline]
 check_prev_add kernel/locking/lockdep.c:3094 [inline]
 check_prevs_add kernel/locking/lockdep.c:3209 [inline]
 validate_chain+0x4d16/0x5950 kernel/locking/lockdep.c:3825
 __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
 _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
 sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:932
 bpf_prog_a8aaa52f2e199321+0x42/0x46
 bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
 __bpf_prog_run include/linux/filter.h:603 [inline]
 bpf_prog_run include/linux/filter.h:610 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
 bpf_trace_run4+0x253/0x470 kernel/trace/bpf_trace.c:2314
 __bpf_trace_mm_page_alloc+0xba/0xe0 include/trace/events/kmem.h:177
 __traceiter_mm_page_alloc+0x35/0x50 include/trace/events/kmem.h:177
 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline]
 __alloc_pages+0x717/0x770 mm/page_alloc.c:5569
 __stack_depot_save+0x372/0x470 lib/stackdepot.c:474
 save_stack+0x104/0x1e0 mm/page_owner.c:128
 __set_page_owner+0x26/0x390 mm/page_owner.c:190
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2513
 prep_new_page mm/page_alloc.c:2520 [inline]
 get_page_from_freelist+0x31a1/0x3320 mm/page_alloc.c:4279
 __alloc_pages+0x28d/0x770 mm/page_alloc.c:5547
 __stack_depot_save+0x372/0x470 lib/stackdepot.c:474
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x60/0x70 mm/kasan/common.c:52
 __kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x52/0x3a0 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x10c/0x2d0 mm/slub.c:3422
 kmem_cache_zalloc include/linux/slab.h:682 [inline]
 fill_pool lib/debugobjects.c:168 [inline]
 debug_objects_fill_pool+0x5fc/0xa10 lib/debugobjects.c:606
 debug_object_activate+0x32/0x4e0 lib/debugobjects.c:693
 debug_timer_activate kernel/time/timer.c:782 [inline]
 __mod_timer+0x7bf/0xee0 kernel/time/timer.c:1103
 schedule_timeout+0x1b4/0x300 kernel/time/timer.c:1964
 synchronize_rcu_expedited_wait_once kernel/rcu/tree_exp.h:580 [inline]
 synchronize_rcu_expedited_wait kernel/rcu/tree_exp.h:631 [inline]
 rcu_exp_wait_wake kernel/rcu/tree_exp.h:699 [inline]
 rcu_exp_sel_wait_wake+0x764/0x1d50 kernel/rcu/tree_exp.h:733
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
 </TASK>
------------[ cut here ]------------
raw_local_irq_restore() called with IRQs enabled
WARNING: CPU: 1 PID: 22 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x1d/0x20 kernel/locking/irqflag-debug.c:10
Modules linked in:
CPU: 1 PID: 22 Comm: kworker/1:0 Not tainted 6.1.84-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: rcu_gp wait_rcu_exp_gp
RIP: 0010:warn_bogus_irq_restore+0x1d/0x20 kernel/locking/irqflag-debug.c:10
Code: 24 48 c7 c7 00 bc ea 8a e8 6c f5 fd ff 80 3d 2f 5b d5 03 00 74 01 c3 c6 05 25 5b d5 03 01 48 c7 c7 60 e6 eb 8a e8 23 64 c8 f6 <0f> 0b c3 41 56 53 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 44
RSP: 0018:ffffc900001c7818 EFLAGS: 00010246
RAX: c9d82a9f70544000 RBX: 1ffff92000038f08 RCX: ffff88801274bb80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001c78b0 R08: ffffffff81527eae R09: fffff52000038e65
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 1ffff92000038f04 R14: ffffc900001c7840 R15: 0000000000000246
FS:  0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555755ca8 CR3: 0000000072d98000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
 _raw_spin_unlock_irqrestore+0x118/0x130 kernel/locking/spinlock.c:194
 __mod_timer+0x956/0xee0 kernel/time/timer.c:1118
 schedule_timeout+0x1b4/0x300 kernel/time/timer.c:1964
 synchronize_rcu_expedited_wait_once kernel/rcu/tree_exp.h:580 [inline]
 synchronize_rcu_expedited_wait kernel/rcu/tree_exp.h:631 [inline]
 rcu_exp_wait_wake kernel/rcu/tree_exp.h:699 [inline]
 rcu_exp_sel_wait_wake+0x764/0x1d50 kernel/rcu/tree_exp.h:733
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
 </TASK>

Crashes (34):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/08 17:13 linux-6.1.y 347385861c50 53df08b6 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/06 23:17 linux-6.1.y 347385861c50 ca620dd8 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/06 22:46 linux-6.1.y 347385861c50 ca620dd8 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/06 19:30 linux-6.1.y 347385861c50 ca620dd8 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2024/04/06 08:23 linux-6.1.y 347385861c50 ca620dd8 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/05 10:35 linux-6.1.y 347385861c50 0ee3535e .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/04 20:56 linux-6.1.y 347385861c50 0ee3535e .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2024/03/31 23:32 linux-6.1.y e5cd595e23c1 6baf5069 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/31 09:02 linux-6.1.y e5cd595e23c1 6baf5069 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/26 16:42 linux-6.1.y d7543167affd bcd9b39f .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/26 10:27 linux-6.1.y d7543167affd bcd9b39f .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/26 09:58 linux-6.1.y d7543167affd bcd9b39f .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/26 09:27 linux-6.1.y d7543167affd bcd9b39f .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/26 05:22 linux-6.1.y d7543167affd bcd9b39f .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/24 00:00 linux-6.1.y d7543167affd 0ea90952 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2023/06/17 18:12 linux-6.1.y ca87e77a2ef8 f3921d4d .config console log report syz [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in lock_timer_base
2024/04/10 08:56 linux-6.1.y 347385861c50 171ec371 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2024/03/19 11:38 linux-6.1.y d7543167affd baa80228 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/10 08:38 linux-6.1.y 347385861c50 171ec371 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/09 20:50 linux-6.1.y 347385861c50 171ec371 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/09 04:48 linux-6.1.y 347385861c50 f3234354 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/09 04:39 linux-6.1.y 347385861c50 f3234354 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2024/04/07 13:27 linux-6.1.y 347385861c50 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/04/06 18:59 linux-6.1.y 347385861c50 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2024/04/05 10:06 linux-6.1.y 347385861c50 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/31 09:30 linux-6.1.y e5cd595e23c1 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2024/03/31 05:23 linux-6.1.y e5cd595e23c1 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2024/03/26 08:27 linux-6.1.y d7543167affd bcd9b39f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2024/03/26 03:54 linux-6.1.y d7543167affd bcd9b39f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2024/03/25 19:47 linux-6.1.y d7543167affd 0ea90952 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/05 04:04 linux-6.1.y a3eb3a74aa8c 5fc53669 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in lock_timer_base
2023/10/25 21:22 linux-6.1.y 32c9cdbe383c 72e794c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2023/10/23 22:04 linux-6.1.y 7d24402875c7 989a3687 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf possible deadlock in lock_timer_base
2024/03/20 14:27 linux-6.1.y d7543167affd a485f239 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in lock_timer_base
* Struck through repros no longer work on HEAD.