------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.3.410/6614 is trying to acquire lock:
ffff80001528cb60 (console_owner){..-.}-{0:0}, at: console_lock_spinning_enable+0x88/0xec kernel/printk/printk.c:1814
but task is already holding lock:
ffff00019f6bd798 (&base->lock){-.-.}-{2:2}, at: __run_timers+0xf4/0x6d8 kernel/time/timer.c:2004
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #5 (&base->lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
lock_timer_base+0x11c/0x224 kernel/time/timer.c:999
__mod_timer+0xe4/0xb4c kernel/time/timer.c:1080
add_timer+0x6c/0x8c kernel/time/timer.c:1244
__queue_delayed_work kernel/workqueue.c:1679 [inline]
queue_delayed_work_on+0x1e4/0x314 kernel/workqueue.c:1704
queue_delayed_work include/linux/workqueue.h:527 [inline]
schedule_delayed_work include/linux/workqueue.h:679 [inline]
psi_group_change+0xdb8/0x1344 kernel/sched/psi.c:885
psi_task_change+0xec/0x244 kernel/sched/psi.c:924
psi_enqueue kernel/sched/stats.h:143 [inline]
enqueue_task kernel/sched/core.c:2055 [inline]
activate_task+0x224/0x244 kernel/sched/core.c:2087
wake_up_new_task+0x390/0xae8 kernel/sched/core.c:4741
kernel_clone+0x4a4/0x8fc kernel/fork.c:2788
user_mode_thread+0xc8/0x11c kernel/fork.c:2833
rest_init+0x30/0x2f0 init/main.c:710
start_kernel+0x0/0x554 init/main.c:905
start_kernel+0x4a4/0x554 init/main.c:1152
__primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468
-> #4 (&rq->__lock){-.-.}-{2:2}:
_raw_spin_lock_nested+0x5c/0x78 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x2c/0x44 kernel/sched/core.c:537
raw_spin_rq_lock kernel/sched/sched.h:1355 [inline]
rq_lock kernel/sched/sched.h:1645 [inline]
task_fork_fair+0x78/0x228 kernel/sched/fair.c:11901
sched_cgroup_fork+0x360/0x438 kernel/sched/core.c:4685
copy_process+0x2500/0x3670 kernel/fork.c:2459
kernel_clone+0x1d8/0x8fc kernel/fork.c:2757
user_mode_thread+0xc8/0x11c kernel/fork.c:2833
rest_init+0x30/0x2f0 init/main.c:710
start_kernel+0x0/0x554 init/main.c:905
start_kernel+0x4a4/0x554 init/main.c:1152
__primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468
-> #3 (&p->pi_lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
try_to_wake_up+0x60/0xc74 kernel/sched/core.c:4111
default_wake_function+0x4c/0x60 kernel/sched/core.c:6885
woken_wake_function+0x48/0x78 kernel/sched/wait.c:484
__wake_up_common+0x224/0x3b0 kernel/sched/wait.c:107
__wake_up_common_lock kernel/sched/wait.c:138 [inline]
__wake_up+0x104/0x174 kernel/sched/wait.c:160
tty_wakeup+0xd8/0xec drivers/tty/tty_io.c:528
n_tty_check_unthrottle+0x268/0x2d8 drivers/tty/n_tty.c:277
n_tty_read+0x268/0xf9c drivers/tty/n_tty.c:2180
iterate_tty_read drivers/tty/tty_io.c:852 [inline]
tty_read+0x210/0x4a8 drivers/tty/tty_io.c:927
call_read_iter include/linux/fs.h:2259 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x5ac/0x7c4 fs/read_write.c:470
ksys_read+0x120/0x210 fs/read_write.c:613
__do_sys_read fs/read_write.c:623 [inline]
__se_sys_read fs/read_write.c:621 [inline]
__arm64_sys_read+0x7c/0x90 fs/read_write.c:621
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
-> #2 (&tty->write_wait){....}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
__wake_up_common_lock kernel/sched/wait.c:137 [inline]
__wake_up+0xe4/0x174 kernel/sched/wait.c:160
tty_wakeup+0xd8/0xec drivers/tty/tty_io.c:528
tty_port_default_wakeup+0xb0/0x124 drivers/tty/tty_port.c:71
tty_port_tty_wakeup+0x64/0x78 drivers/tty/tty_port.c:435
uart_write_wakeup+0x4c/0x64 drivers/tty/serial/serial_core.c:117
pl011_tx_chars+0x9d8/0x11f8 drivers/tty/serial/amba-pl011.c:1496
pl011_start_tx_pio drivers/tty/serial/amba-pl011.c:1342 [inline]
pl011_start_tx+0x544/0xb68 drivers/tty/serial/amba-pl011.c:1384
__uart_start drivers/tty/serial/serial_core.c:139 [inline]
uart_write+0x568/0x7ec drivers/tty/serial/serial_core.c:601
process_output_block drivers/tty/n_tty.c:586 [inline]
n_tty_write+0xab0/0xeb4 drivers/tty/n_tty.c:2377
do_tty_write drivers/tty/tty_io.c:1018 [inline]
file_tty_write+0x3e0/0x6c4 drivers/tty/tty_io.c:1089
tty_write drivers/tty/tty_io.c:1110 [inline]
redirected_tty_write+0xbc/0xf0 drivers/tty/tty_io.c:1133
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x5ac/0x7c4 fs/read_write.c:584
ksys_write+0x120/0x210 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
-> #1 (&port_lock_key){..-.}-{2:2}:
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
uart_port_lock include/linux/serial_core.h:593 [inline]
pl011_console_write+0x1b8/0x754 drivers/tty/serial/amba-pl011.c:2337
call_console_driver kernel/printk/printk.c:1977 [inline]
console_emit_next_record+0x758/0x954 kernel/printk/printk.c:2777
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x240/0x57c kernel/printk/printk.c:2906
register_console+0x590/0x8a0 kernel/printk/printk.c:3259
uart_configure_port drivers/tty/serial/serial_core.c:2616 [inline]
uart_add_one_port+0x10e8/0x1928 drivers/tty/serial/serial_core.c:3135
pl011_register_port+0x190/0x434 drivers/tty/serial/amba-pl011.c:2776
sbsa_uart_probe+0x418/0x528 drivers/tty/serial/amba-pl011.c:2935
platform_probe+0x13c/0x1b4 drivers/base/platform.c:1400
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x39c/0xae0 drivers/base/dd.c:639
__driver_probe_device+0x180/0x314 drivers/base/dd.c:785
driver_probe_device+0x78/0x330 drivers/base/dd.c:815
__device_attach_driver+0x290/0x4e0 drivers/base/dd.c:943
bus_for_each_drv+0x150/0x1d8 drivers/base/bus.c:429
__device_attach+0x2a8/0x3d4 drivers/base/dd.c:1015
device_initial_probe+0x24/0x34 drivers/base/dd.c:1064
bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489
device_add+0xb04/0xf94 drivers/base/core.c:3697
platform_device_add+0x3f8/0x6ec drivers/base/platform.c:717
platform_device_register_full+0x4f0/0x610 drivers/base/platform.c:844
acpi_create_platform_device+0x44c/0x588 drivers/acpi/acpi_platform.c:152
acpi_default_enumeration+0x6c/0xdc drivers/acpi/scan.c:2116
acpi_bus_attach+0x80c/0xa08 drivers/acpi/scan.c:2225
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1090
device_for_each_child+0xec/0x174 drivers/base/core.c:4028
acpi_dev_for_each_child+0x94/0xd8 drivers/acpi/bus.c:1102
acpi_bus_attach+0x2cc/0xa08 drivers/acpi/scan.c:2230
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1090
device_for_each_child+0xec/0x174 drivers/base/core.c:4028
acpi_dev_for_each_child+0x94/0xd8 drivers/acpi/bus.c:1102
acpi_bus_attach+0x2cc/0xa08 drivers/acpi/scan.c:2230
acpi_bus_scan+0xb8/0x1b8 drivers/acpi/scan.c:2441
acpi_scan_init+0x1b8/0x5d0 drivers/acpi/scan.c:2611
acpi_init+0x16c/0x220 drivers/acpi/bus.c:1411
do_one_initcall+0x24c/0x9cc init/main.c:1310
do_initcall_level+0x154/0x214 init/main.c:1383
do_initcalls+0x58/0xac init/main.c:1399
do_basic_setup+0x8c/0xa0 init/main.c:1418
kernel_init_freeable+0x35c/0x4f8 init/main.c:1638
kernel_init+0x24/0x1d8 init/main.c:1526
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
-> #0 (console_owner){..-.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x293c/0x6544 kernel/locking/lockdep.c:5049
lock_acquire+0x20c/0x644 kernel/locking/lockdep.c:5662
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1818
console_emit_next_record+0x680/0x954 kernel/printk/printk.c:2774
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x240/0x57c kernel/printk/printk.c:2906
vprintk_emit+0x14c/0x2dc kernel/printk/printk.c:2303
vprintk_default+0x54/0x80 kernel/printk/printk.c:2318
vprintk+0x1e8/0x284 kernel/printk/printk_safe.c:45
_printk+0xd0/0x118 kernel/printk/printk.c:2328
__report_bug lib/bug.c:195 [inline]
report_bug+0x3a8/0x568 lib/bug.c:219
bug_handler+0x50/0x1fc arch/arm64/kernel/traps.c:983
call_break_hook arch/arm64/kernel/debug-monitors.c:321 [inline]
brk_handler+0x174/0x2dc arch/arm64/kernel/debug-monitors.c:328
do_debug_exception+0x1b8/0x3ac arch/arm64/mm/fault.c:890
el1_dbg+0x64/0x80 arch/arm64/kernel/entry-common.c:407
el1h_64_sync_handler+0x40/0xcc arch/arm64/kernel/entry-common.c:447
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:580
expire_timers kernel/time/timer.c:1738 [inline]
__run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
handle_softirqs+0x318/0xc6c kernel/softirq.c:596
__do_softirq+0x14/0x20 kernel/softirq.c:630
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
invoke_softirq kernel/softirq.c:477 [inline]
__irq_exit_rcu+0x23c/0x43c kernel/softirq.c:679
irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__wake_up_common_lock kernel/sched/wait.c:140 [inline]
__wake_up_sync_key+0x11c/0x178 kernel/sched/wait.c:208
__unix_dgram_recvmsg+0x378/0xae8 net/unix/af_unix.c:2478
unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2548
sock_recvmsg_nosec net/socket.c:1022 [inline]
____sys_recvmsg+0x62c/0x71c net/socket.c:2736
___sys_recvmsg net/socket.c:2780 [inline]
do_recvmmsg+0x364/0x96c net/socket.c:2874
__sys_recvmmsg net/socket.c:2953 [inline]
__do_sys_recvmmsg net/socket.c:2976 [inline]
__se_sys_recvmmsg net/socket.c:2969 [inline]
__arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:2969
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
other info that might help us debug this:
Chain exists of:
console_owner --> &rq->__lock --> &base->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&base->lock);
lock(&rq->__lock);
lock(&base->lock);
lock(console_owner);
*** DEADLOCK ***
3 locks held by syz.3.410/6614:
#0: ffff0000fa88e598 (&u->iolock){+.+.}-{3:3}, at: __unix_dgram_recvmsg+0x16c/0xae8 net/unix/af_unix.c:2448
#1: ffff00019f6bd798 (&base->lock){-.-.}-{2:2}, at: __run_timers+0xf4/0x6d8 kernel/time/timer.c:2004
#2: ffff80001528cc40 (console_lock){+.+.}-{0:0}, at: console_trylock_spinning+0x18/0x2e0 kernel/printk/printk.c:1896
stack backtrace:
CPU: 0 PID: 6614 Comm: syz.3.410 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2048
check_noncircular+0x240/0x2d4 kernel/locking/lockdep.c:2170
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x293c/0x6544 kernel/locking/lockdep.c:5049
lock_acquire+0x20c/0x644 kernel/locking/lockdep.c:5662
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1818
console_emit_next_record+0x680/0x954 kernel/printk/printk.c:2774
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x240/0x57c kernel/printk/printk.c:2906
vprintk_emit+0x14c/0x2dc kernel/printk/printk.c:2303
vprintk_default+0x54/0x80 kernel/printk/printk.c:2318
vprintk+0x1e8/0x284 kernel/printk/printk_safe.c:45
_printk+0xd0/0x118 kernel/printk/printk.c:2328
__report_bug lib/bug.c:195 [inline]
report_bug+0x3a8/0x568 lib/bug.c:219
bug_handler+0x50/0x1fc arch/arm64/kernel/traps.c:983
call_break_hook arch/arm64/kernel/debug-monitors.c:321 [inline]
brk_handler+0x174/0x2dc arch/arm64/kernel/debug-monitors.c:328
do_debug_exception+0x1b8/0x3ac arch/arm64/mm/fault.c:890
el1_dbg+0x64/0x80 arch/arm64/kernel/entry-common.c:407
el1h_64_sync_handler+0x40/0xcc arch/arm64/kernel/entry-common.c:447
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:580
expire_timers kernel/time/timer.c:1738 [inline]
__run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
handle_softirqs+0x318/0xc6c kernel/softirq.c:596
__do_softirq+0x14/0x20 kernel/softirq.c:630
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
invoke_softirq kernel/softirq.c:477 [inline]
__irq_exit_rcu+0x23c/0x43c kernel/softirq.c:679
irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__wake_up_common_lock kernel/sched/wait.c:140 [inline]
__wake_up_sync_key+0x11c/0x178 kernel/sched/wait.c:208
__unix_dgram_recvmsg+0x378/0xae8 net/unix/af_unix.c:2478
unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2548
sock_recvmsg_nosec net/socket.c:1022 [inline]
____sys_recvmsg+0x62c/0x71c net/socket.c:2736
___sys_recvmsg net/socket.c:2780 [inline]
do_recvmmsg+0x364/0x96c net/socket.c:2874
__sys_recvmmsg net/socket.c:2953 [inline]
__do_sys_recvmmsg net/socket.c:2976 [inline]
__se_sys_recvmmsg net/socket.c:2969 [inline]
__arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:2969
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
WARNING: CPU: 0 PID: 6614 at kernel/time/timer.c:1738 expire_timers kernel/time/timer.c:1738 [inline]
WARNING: CPU: 0 PID: 6614 at kernel/time/timer.c:1738 __run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
Modules linked in:
CPU: 0 PID: 6614 Comm: syz.3.410 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 424000c5 (nZcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : expire_timers kernel/time/timer.c:1738 [inline]
pc : __run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
lr : expire_timers kernel/time/timer.c:1738 [inline]
lr : __run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
sp : ffff800008007d20
x29: ffff800008007e50 x28: ffff800008007dd0 x27: 1fffe00033ed7af8
x26: ffff00019f6bd7c0 x25: 00000000ffffba00 x24: ffff0000f53b5a28
x23: 1ffff00001000fba x22: dfff800000000000 x21: ffff00019f6bd7d0
x20: 0000000000000000 x19: ffff00019f6bd780 x18: ffff800011abbcc0
x17: ffff80018a6a7000 x16: ffff8000082e7de8 x15: 0000000000010001
x14: 0000000000000003 x13: 1ffff00002a180b1 x12: 0000000000ff0100
x11: ff008000083af93c x10: 0000000000000000 x9 : ffff8000083af93c
x8 : ffff0000ca068000 x7 : ffff80000a895800 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff8000082e7efc
x2 : 0000000000000001 x1 : ffff800011fa9c20 x0 : 0000000000000001
Call trace:
expire_timers kernel/time/timer.c:1738 [inline]
__run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
handle_softirqs+0x318/0xc6c kernel/softirq.c:596
__do_softirq+0x14/0x20 kernel/softirq.c:630
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
invoke_softirq kernel/softirq.c:477 [inline]
__irq_exit_rcu+0x23c/0x43c kernel/softirq.c:679
irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__wake_up_common_lock kernel/sched/wait.c:140 [inline]
__wake_up_sync_key+0x11c/0x178 kernel/sched/wait.c:208
__unix_dgram_recvmsg+0x378/0xae8 net/unix/af_unix.c:2478
unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2548
sock_recvmsg_nosec net/socket.c:1022 [inline]
____sys_recvmsg+0x62c/0x71c net/socket.c:2736
___sys_recvmsg net/socket.c:2780 [inline]
do_recvmmsg+0x364/0x96c net/socket.c:2874
__sys_recvmmsg net/socket.c:2953 [inline]
__do_sys_recvmmsg net/socket.c:2976 [inline]
__se_sys_recvmmsg net/socket.c:2969 [inline]
__arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:2969
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 9269
hardirqs last enabled at (9268): [<ffff8000081a8d64>] handle_softirqs+0x1e0/0xc6c kernel/softirq.c:580
hardirqs last disabled at (9269): [<ffff800011a483b4>] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:117 [inline]
hardirqs last disabled at (9269): [<ffff800011a483b4>] _raw_spin_lock_irq+0x34/0x9c kernel/locking/spinlock.c:170
softirqs last enabled at (6428): [<ffff8000081a967c>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (6428): [<ffff8000081a967c>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (9267): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 6614 Comm: syz.3.410 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 424000c5 (nZcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __hlist_del include/linux/list.h:884 [inline]
pc : detach_timer+0x130/0x450 kernel/time/timer.c:880
lr : trace_timer_cancel include/trace/events/timer.h:138 [inline]
lr : debug_deactivate kernel/time/timer.c:832 [inline]
lr : detach_timer+0xf0/0x450 kernel/time/timer.c:878
sp : ffff800008007cd0
x29: ffff800008007cd0 x28: ffff800008007dd0 x27: 1fffe00033ed7af8
x26: 1fffe0001ea76b46 x25: 1fffe0001ea76b45 x24: dfff800000000000
x23: dead000000000122 x22: 0000000000000000 x21: ffff0000f53b5a30
x20: 0000000000000001 x19: ffff0000f53b5a28 x18: ffff800011abbcc0
x17: ffff80018a6a7000 x16: ffff8000082e7de8 x15: 0000000000010001
x14: 0000000000000003 x13: 1ffff00002a180b1 x12: 0000000000ff0100
x11: ff008000083af104 x10: 0000000000000000 x9 : ffff8000083af104
x8 : 0000000000000000 x7 : ffff80000a895800 x6 : ffff80000a895800
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082e7efc
x2 : 0000000000000001 x1 : ffff800011fa9c20 x0 : 0000000000000001
Call trace:
__hlist_del include/linux/list.h:884 [inline]
detach_timer+0x130/0x450 kernel/time/timer.c:880
expire_timers kernel/time/timer.c:1734 [inline]
__run_timers+0x408/0x6d8 kernel/time/timer.c:2022
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
handle_softirqs+0x318/0xc6c kernel/softirq.c:596
__do_softirq+0x14/0x20 kernel/softirq.c:630
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
invoke_softirq kernel/softirq.c:477 [inline]
__irq_exit_rcu+0x23c/0x43c kernel/softirq.c:679
irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__wake_up_common_lock kernel/sched/wait.c:140 [inline]
__wake_up_sync_key+0x11c/0x178 kernel/sched/wait.c:208
__unix_dgram_recvmsg+0x378/0xae8 net/unix/af_unix.c:2478
unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2548
sock_recvmsg_nosec net/socket.c:1022 [inline]
____sys_recvmsg+0x62c/0x71c net/socket.c:2736
___sys_recvmsg net/socket.c:2780 [inline]
do_recvmmsg+0x364/0x96c net/socket.c:2874
__sys_recvmmsg net/socket.c:2953 [inline]
__do_sys_recvmmsg net/socket.c:2976 [inline]
__se_sys_recvmmsg net/socket.c:2969 [inline]
__arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:2969
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1503e0 9414a121 f94002b6 d343fec8 (38786908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: aa1503e0 mov x0, x21
4: 9414a121 bl 0x528488
8: f94002b6 ldr x22, [x21]
c: d343fec8 lsr x8, x22, #3
* 10: 38786908 ldrb w8, [x8, x24] <-- trapping instruction