./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1903945318 <...> Warning: Permanently added '10.128.1.17' (ED25519) to the list of known hosts. execve("./syz-executor1903945318", ["./syz-executor1903945318"], 0x7ffce380ce10 /* 10 vars */) = 0 brk(NULL) = 0x55555e367000 brk(0x55555e367d00) = 0x55555e367d00 arch_prctl(ARCH_SET_FS, 0x55555e367380) = 0 set_tid_address(0x55555e367650) = 5842 set_robust_list(0x55555e367660, 24) = 0 rseq(0x55555e367ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1903945318", 4096) = 28 getrandom("\x7a\xf6\x95\x2f\x40\x85\x74\xbc", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555e367d00 brk(0x55555e388d00) = 0x55555e388d00 brk(0x55555e389000) = 0x55555e389000 mprotect(0x7f159fb1c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5843 attached , child_tidptr=0x55555e367650) = 5843 [pid 5843] set_robust_list(0x55555e367660, 24) = 0 [pid 5843] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5843] setpgid(0, 0) = 0 [pid 5843] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "1000", 4) = 4 [pid 5843] close(3) = 0 executing program [pid 5843] write(1, "executing program\n", 18) = 18 [pid 5843] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_UNSPEC, insn_cnt=12, insns=0x20000440, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=4294966948, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = -1 EFAULT (Bad address) [pid 5843] socketpair(AF_TIPC, SOCK_DGRAM, 0, [3, 4]) = 0 [pid 5843] close(3) = 0 [pid 5843] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_LPM_TRIE, key_size=7, value_size=65537, max_entries=8, map_flags=BPF_F_NO_PREALLOC, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 3 [pid 5843] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_UNSPEC, insn_cnt=12, insns=0x20000440, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = -1 EFAULT (Bad address) [pid 5843] close(3) = 0 [pid 5843] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_LPM_TRIE, key_size=7, value_size=3983, max_entries=9, map_flags=BPF_F_NO_PREALLOC, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 3 [pid 5843] bpf(BPF_MAP_UPDATE_ELEM, {map_fd=3, key=0x20000340, value=0x20000200, flags=BPF_ANY}, 32) = 0 [pid 5843] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000440, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 5 [pid 5843] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="timer_start", prog_fd=5}}, 16) = 6 [ 57.482726][ C0] [ 57.485068][ C0] ====================================================== [ 57.492064][ C0] WARNING: possible circular locking dependency detected [ 57.499066][ C0] 6.12.0-rc6-syzkaller-01236-gcf6d9fe09185 #0 Not tainted [ 57.506194][ C0] ------------------------------------------------------ [ 57.513187][ C0] ksoftirqd/0/16 is trying to acquire lock: [ 57.519059][ C0] ffff8880b8629430 (krc.lock){..-.}-{2:2}, at: kvfree_call_rcu+0x18a/0x790 [ 57.527673][ C0] [ 57.527673][ C0] but task is already holding lock: [ 57.535021][ C0] ffff8880b862a718 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x112/0x240 [ 57.543898][ C0] [ 57.543898][ C0] which lock already depends on the new lock. [ 57.543898][ C0] [ 57.554290][ C0] [ 57.554290][ C0] the existing dependency chain (in reverse order) is: [ 57.563281][ C0] [ 57.563281][ C0] -> #1 (&base->lock){-.-.}-{2:2}: [ 57.570558][ C0] lock_acquire+0x1ed/0x550 [ 57.575571][ C0] _raw_spin_lock_irqsave+0xd5/0x120 [ 57.581375][ C0] lock_timer_base+0x112/0x240 [ 57.586643][ C0] __mod_timer+0x1ca/0xeb0 [ 57.591558][ C0] queue_delayed_work_on+0x1ca/0x390 [ 57.597345][ C0] kvfree_call_rcu+0x47f/0x790 [ 57.602622][ C0] pwq_release_workfn+0x664/0x800 [ 57.608148][ C0] kthread_worker_fn+0x500/0xb70 [ 57.613587][ C0] kthread+0x2f0/0x390 [ 57.618166][ C0] ret_from_fork+0x4b/0x80 [ 57.623082][ C0] ret_from_fork_asm+0x1a/0x30 [ 57.628348][ C0] [ 57.628348][ C0] -> #0 (krc.lock){..-.}-{2:2}: [ 57.635392][ C0] validate_chain+0x18ef/0x5920 [ 57.640740][ C0] __lock_acquire+0x1384/0x2050 [ 57.646090][ C0] lock_acquire+0x1ed/0x550 [ 57.651094][ C0] _raw_spin_lock+0x2e/0x40 [ 57.656100][ C0] kvfree_call_rcu+0x18a/0x790 [ 57.661376][ C0] trie_delete_elem+0x546/0x6a0 [ 57.666732][ C0] bpf_prog_2c29ac5cdc6b1842+0x43/0x47 [ 57.672698][ C0] bpf_trace_run2+0x2ec/0x540 [ 57.677880][ C0] enqueue_timer+0x3ce/0x570 [ 57.682971][ C0] __mod_timer+0x953/0xeb0 [ 57.687886][ C0] sk_reset_timer+0x23/0xc0 [ 57.692884][ C0] tcp_schedule_loss_probe+0x451/0x5c0 [ 57.698861][ C0] tcp_write_xmit+0x4477/0x6bf0 [ 57.704209][ C0] tcp_tsq_handler+0x12d/0x200 [ 57.709471][ C0] tcp_tasklet_func+0x4f3/0x570 [ 57.714821][ C0] tasklet_action_common+0x321/0x4d0 [ 57.720613][ C0] handle_softirqs+0x2c5/0x980 [ 57.725906][ C0] run_ksoftirqd+0xca/0x130 [ 57.730915][ C0] smpboot_thread_fn+0x544/0xa30 [ 57.736351][ C0] kthread+0x2f0/0x390 [ 57.740915][ C0] ret_from_fork+0x4b/0x80 [ 57.745833][ C0] ret_from_fork_asm+0x1a/0x30 [ 57.751101][ C0] [ 57.751101][ C0] other info that might help us debug this: [ 57.751101][ C0] [ 57.761305][ C0] Possible unsafe locking scenario: [ 57.761305][ C0] [ 57.768732][ C0] CPU0 CPU1 [ 57.774086][ C0] ---- ---- [ 57.779432][ C0] lock(&base->lock); [ 57.783483][ C0] lock(krc.lock); [ 57.789806][ C0] lock(&base->lock); [ 57.796391][ C0] lock(krc.lock); [ 57.800194][ C0] [ 57.800194][ C0] *** DEADLOCK *** [ 57.800194][ C0] [ 57.808318][ C0] 3 locks held by ksoftirqd/0/16: [ 57.813318][ C0] #0: ffff88802b449b58 (slock-AF_INET){+.-.}-{2:2}, at: tcp_tsq_handler+0x20/0x200 [ 57.822692][ C0] #1: ffff8880b862a718 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x112/0x240 [ 57.831984][ C0] #2: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1fc/0x540 [ 57.841372][ C0] [ 57.841372][ C0] stack backtrace: [ 57.847254][ C0] CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc6-syzkaller-01236-gcf6d9fe09185 #0 [ 57.857816][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 57.867857][ C0] Call Trace: [ 57.871118][ C0] [ 57.874029][ C0] dump_stack_lvl+0x241/0x360 [ 57.878688][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 57.883881][ C0] ? __pfx__printk+0x10/0x10 [ 57.888472][ C0] print_circular_bug+0x13a/0x1b0 [ 57.893491][ C0] check_noncircular+0x36a/0x4a0 [ 57.898417][ C0] ? __pfx_check_noncircular+0x10/0x10 [ 57.903991][ C0] ? lockdep_lock+0x123/0x2b0 [ 57.908663][ C0] ? unwind_next_frame+0x18e6/0x22d0 [ 57.913958][ C0] ? __bfs+0x368/0x6f0 [ 57.918007][ C0] validate_chain+0x18ef/0x5920 [ 57.922840][ C0] ? __pfx___bfs+0x10/0x10 [ 57.927238][ C0] ? mark_lock_irq+0x8e1/0xc20 [ 57.931981][ C0] ? __pfx_validate_chain+0x10/0x10 [ 57.937161][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 57.942518][ C0] ? do_raw_spin_unlock+0x13c/0x8b0 [ 57.947697][ C0] ? lockdep_unlock+0x16a/0x300 [ 57.952616][ C0] ? __pfx_lockdep_unlock+0x10/0x10 [ 57.957796][ C0] ? stack_trace_save+0x118/0x1d0 [ 57.962974][ C0] ? mark_lock+0x9a/0x360 [ 57.967283][ C0] __lock_acquire+0x1384/0x2050 [ 57.972116][ C0] lock_acquire+0x1ed/0x550 [ 57.976599][ C0] ? kvfree_call_rcu+0x18a/0x790 [ 57.981531][ C0] ? __pfx_lock_acquire+0x10/0x10 [ 57.986547][ C0] ? __phys_addr+0xba/0x170 [ 57.991033][ C0] _raw_spin_lock+0x2e/0x40 [ 57.995522][ C0] ? kvfree_call_rcu+0x18a/0x790 [ 58.000436][ C0] kvfree_call_rcu+0x18a/0x790 [ 58.005183][ C0] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 58.011067][ C0] ? __pfx_kvfree_call_rcu+0x10/0x10 [ 58.016334][ C0] ? longest_prefix_match+0x49f/0x650 [ 58.021725][ C0] trie_delete_elem+0x546/0x6a0 [ 58.026560][ C0] ? bpf_trace_run2+0x1fc/0x540 [ 58.031392][ C0] bpf_prog_2c29ac5cdc6b1842+0x43/0x47 [ 58.036840][ C0] bpf_trace_run2+0x2ec/0x540 [ 58.041498][ C0] ? __pfx_bpf_trace_run2+0x10/0x10 [ 58.046680][ C0] ? __pfx_debug_object_activate+0x10/0x10 [ 58.052505][ C0] enqueue_timer+0x3ce/0x570 [ 58.057079][ C0] __mod_timer+0x953/0xeb0 [ 58.061478][ C0] ? __pfx___mod_timer+0x10/0x10 [ 58.066423][ C0] ? ktime_get+0x3c/0xb0 [ 58.070649][ C0] ? __asan_memset+0x23/0x50 [ 58.075229][ C0] sk_reset_timer+0x23/0xc0 [ 58.079838][ C0] tcp_schedule_loss_probe+0x451/0x5c0 [ 58.085281][ C0] tcp_write_xmit+0x4477/0x6bf0 [ 58.090142][ C0] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 58.096121][ C0] ? tcp_tsq_write+0x1f5/0x320 [ 58.100880][ C0] tcp_tsq_handler+0x12d/0x200 [ 58.105720][ C0] tcp_tasklet_func+0x4f3/0x570 [ 58.110576][ C0] ? __pfx_tcp_tasklet_func+0x10/0x10 [ 58.115931][ C0] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 58.121903][ C0] ? __pfx_wake_up_var+0x10/0x10 [ 58.126829][ C0] ? rcu_is_watching+0x15/0xb0 [ 58.131576][ C0] tasklet_action_common+0x321/0x4d0 [ 58.136848][ C0] ? __pfx_tasklet_action_common+0x10/0x10 [ 58.142637][ C0] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 58.148948][ C0] ? workqueue_softirq_action+0xce/0x140 [ 58.154569][ C0] handle_softirqs+0x2c5/0x980 [ 58.159326][ C0] ? run_ksoftirqd+0xca/0x130 [ 58.163985][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 58.169275][ C0] run_ksoftirqd+0xca/0x130 [ 58.173760][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 58.178860][ C0] ? kasan_check_range+0x86/0x290 [ 58.183867][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 58.188960][ C0] smpboot_thread_fn+0x544/0xa30 [ 58.193903][ C0] ? smpboot_thread_fn+0x4e/0xa30 [ 58.198937][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 58.204378][ C0] kthread+0x2f0/0x390 [ 58.208426][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 58.213868][ C0] ? __pfx_kthread+0x10/0x10 [ 58.218437][ C0] ret_from_fork+0x4b/0x80 [ 58.222837][ C0] ? __pfx_kthread+0x10/0x10 [ 58.227406][ C0] ret_from_fork_asm+0x1a/0x30 [ 58.232155][ C0]