======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.1348/9675 is trying to acquire lock:
ffff0000d32483b8 (clock-AF_INET6){++--}-{2:2}, at: sk_psock_drop+0x38/0x300 net/core/skmsg.c:887

but task is already holding lock:
ffff0000f4248338 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_hash_delete_from_link net/core/sock_map.c:917 [inline]
ffff0000f4248338 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_map_unlink net/core/sock_map.c:1561 [inline]
ffff0000f4248338 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_map_remove_links+0x14c/0x528 net/core/sock_map.c:1573

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&htab->buckets[i].lock){+.-.}-{2:2}:
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
       _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
       sock_hash_delete_elem+0xd0/0x314 net/core/sock_map.c:942
       0xffff800021a0e320
       bpf_dispatcher_nop_func include/linux/bpf.h:1013 [inline]
       __bpf_prog_run include/linux/filter.h:608 [inline]
       bpf_prog_run include/linux/filter.h:615 [inline]
       bpf_prog_run_pin_on_cpu include/linux/filter.h:632 [inline]
       bpf_prog_run_clear_cb+0xa8/0x244 include/linux/filter.h:786
       run_filter+0x148/0x264 net/packet/af_packet.c:2157
       packet_rcv+0x304/0x1084 net/packet/af_packet.c:2230
       dev_queue_xmit_nit+0x94c/0x9c0 net/core/dev.c:2366
       xmit_one net/core/dev.c:3691 [inline]
       dev_hard_start_xmit+0xf8/0x8c8 net/core/dev.c:3711
       __dev_queue_xmit+0x1590/0x3154 net/core/dev.c:4375
       dev_queue_xmit include/linux/netdevice.h:3056 [inline]
       neigh_resolve_output+0x568/0x664 net/core/neighbour.c:1568
       neigh_output include/net/neighbour.h:549 [inline]
       ip6_finish_output2+0xe4c/0x19ac net/ipv6/ip6_output.c:140
       __ip6_finish_output net/ipv6/ip6_output.c:207 [inline]
       ip6_finish_output+0x598/0x930 net/ipv6/ip6_output.c:218
       NF_HOOK_COND include/linux/netfilter.h:291 [inline]
       ip6_output+0x274/0x500 net/ipv6/ip6_output.c:239
       dst_output include/net/dst.h:456 [inline]
       NF_HOOK include/linux/netfilter.h:302 [inline]
       ip6_xmit+0x11e4/0x1b74 net/ipv6/ip6_output.c:362
       inet6_csk_xmit+0x374/0x5cc net/ipv6/inet6_connection_sock.c:135
       __tcp_transmit_skb+0x17bc/0x2bcc net/ipv4/tcp_output.c:1407
       __tcp_send_ack+0x240/0x4e8 net/ipv4/tcp_output.c:4064
       tcp_send_ack+0x4c/0x68 net/ipv4/tcp_output.c:4070
       __tcp_cleanup_rbuf+0x294/0x3d0 net/ipv4/tcp.c:1644
       tcp_cleanup_rbuf net/ipv4/tcp.c:1655 [inline]
       __tcp_read_sock+0x63c/0x798 net/ipv4/tcp.c:1778
       tcp_read_sock+0x3c/0x50 net/ipv4/tcp.c:1787
       rds_tcp_read_sock net/rds/tcp_recv.c:276 [inline]
       rds_tcp_data_ready+0x264/0x5a0 net/rds/tcp_recv.c:325
       tcp_data_ready+0x220/0x438 net/ipv4/tcp_input.c:5107
       tcp_data_queue+0x1c38/0x4e48 net/ipv4/tcp_input.c:5181
       tcp_rcv_established+0xa50/0x1d84 net/ipv4/tcp_input.c:6116
       tcp_v6_do_rcv+0x47c/0x1168 net/ipv6/tcp_ipv6.c:1474
       sk_backlog_rcv include/net/sock.h:1138 [inline]
       __release_sock+0x1b0/0x3b0 net/core/sock.c:2953
       release_sock+0x60/0x1bc net/core/sock.c:3519
       tcp_sock_set_cork+0x100/0x188 net/ipv4/tcp.c:3398
       rds_tcp_xmit_path_prepare+0x7c/0x8c net/rds/tcp_send.c:45
       rds_send_xmit+0x364/0x2224 net/rds/send.c:201
       rds_send_worker+0x80/0x364 net/rds/threads.c:200
       process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
       worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
       kthread+0x254/0x2e0 kernel/kthread.c:376
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

-> #0 (clock-AF_INET6){++--}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3162 [inline]
       check_prevs_add kernel/locking/lockdep.c:3281 [inline]
       validate_chain kernel/locking/lockdep.c:3897 [inline]
       __lock_acquire+0x3504/0x7280 kernel/locking/lockdep.c:5171
       lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790
       __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline]
       _raw_write_lock_bh+0x54/0x6c kernel/locking/spinlock.c:334
       sk_psock_drop+0x38/0x300 net/core/skmsg.c:887
       sk_psock_put include/linux/skmsg.h:470 [inline]
       sock_map_unref+0x3e8/0x4ac net/core/sock_map.c:185
       sock_hash_delete_from_link net/core/sock_map.c:922 [inline]
       sock_map_unlink net/core/sock_map.c:1561 [inline]
       sock_map_remove_links+0x418/0x528 net/core/sock_map.c:1573
       sock_map_close+0x170/0x3b8 net/core/sock_map.c:1634
       inet_release+0x154/0x1cc net/ipv4/af_inet.c:430
       inet6_release+0x5c/0x78 net/ipv6/af_inet6.c:491
       __sock_release net/socket.c:654 [inline]
       sock_close+0xac/0x1ec net/socket.c:1400
       __fput+0x1b4/0x7b0 fs/file_table.c:320
       ____fput+0x20/0x30 fs/file_table.c:348
       task_work_run+0x1f4/0x280 kernel/task_work.c:203
       get_signal+0x1140/0x133c kernel/signal.c:2661
       do_signal arch/arm64/kernel/signal.c:1095 [inline]
       do_notify_resume+0x364/0x2c84 arch/arm64/kernel/signal.c:1148
       prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
       exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
       el0_svc+0x9c/0x12c arch/arm64/kernel/entry-common.c:638
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&htab->buckets[i].lock);
                               lock(clock-AF_INET6);
                               lock(&htab->buckets[i].lock);
  lock(clock-AF_INET6);

 *** DEADLOCK ***

4 locks held by syz.0.1348/9675:
 #0: ffff0000e198f410 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:764 [inline]
 #0: ffff0000e198f410 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline]
 #0: ffff0000e198f410 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: sock_close+0x74/0x1ec net/socket.c:1400
 #1: ffff0000d3248130 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
 #1: ffff0000d3248130 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sock_map_close+0x30/0x3b8 net/core/sock_map.c:1629
 #2: ffff8000165f7500 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349
 #3: ffff0000f4248338 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_hash_delete_from_link net/core/sock_map.c:917 [inline]
 #3: ffff0000f4248338 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_map_unlink net/core/sock_map.c:1561 [inline]
 #3: ffff0000f4248338 (&htab->buckets[i].lock){+.-.}-{2:2}, at: sock_map_remove_links+0x14c/0x528 net/core/sock_map.c:1573

stack backtrace:
CPU: 1 PID: 9675 Comm: syz.0.1348 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2088
 check_noncircular+0x290/0x370 kernel/locking/lockdep.c:2215
 check_prev_add kernel/locking/lockdep.c:3162 [inline]
 check_prevs_add kernel/locking/lockdep.c:3281 [inline]
 validate_chain kernel/locking/lockdep.c:3897 [inline]
 __lock_acquire+0x3504/0x7280 kernel/locking/lockdep.c:5171
 lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790
 __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline]
 _raw_write_lock_bh+0x54/0x6c kernel/locking/spinlock.c:334
 sk_psock_drop+0x38/0x300 net/core/skmsg.c:887
 sk_psock_put include/linux/skmsg.h:470 [inline]
 sock_map_unref+0x3e8/0x4ac net/core/sock_map.c:185
 sock_hash_delete_from_link net/core/sock_map.c:922 [inline]
 sock_map_unlink net/core/sock_map.c:1561 [inline]
 sock_map_remove_links+0x418/0x528 net/core/sock_map.c:1573
 sock_map_close+0x170/0x3b8 net/core/sock_map.c:1634
 inet_release+0x154/0x1cc net/ipv4/af_inet.c:430
 inet6_release+0x5c/0x78 net/ipv6/af_inet6.c:491
 __sock_release net/socket.c:654 [inline]
 sock_close+0xac/0x1ec net/socket.c:1400
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 get_signal+0x1140/0x133c kernel/signal.c:2661
 do_signal arch/arm64/kernel/signal.c:1095 [inline]
 do_notify_resume+0x364/0x2c84 arch/arm64/kernel/signal.c:1148
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x9c/0x12c arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585