====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.5.5372/24496 is trying to acquire lock: ffff888066ba9a38 (&trie->lock){-.-.}-{2:2}, at: trie_delete_elem+0x90/0x690 kernel/bpf/lpm_trie.c:467 but task is already holding lock: ffffffff96c26b08 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x6a/0x490 lib/debugobjects.c:698 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&obj_hash[i].lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162 __debug_check_no_obj_freed lib/debugobjects.c:968 [inline] debug_check_no_obj_freed+0x136/0x530 lib/debugobjects.c:1009 slab_free_hook mm/slub.c:1704 [inline] slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1755 slab_free mm/slub.c:3687 [inline] __kmem_cache_free+0xb6/0x1f0 mm/slub.c:3700 trie_update_elem+0x6c1/0xe90 kernel/bpf/lpm_trie.c:444 bpf_map_update_value+0x59e/0x670 kernel/bpf/syscall.c:228 generic_map_update_batch+0x569/0x850 kernel/bpf/syscall.c:1709 bpf_map_do_batch+0x466/0x600 kernel/bpf/syscall.c:-1 __sys_bpf+0x65f/0x6d0 kernel/bpf/syscall.c:-1 __do_sys_bpf kernel/bpf/syscall.c:5134 [inline] __se_sys_bpf kernel/bpf/syscall.c:5132 [inline] __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5132 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #0 (&trie->lock){-.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain kernel/locking/lockdep.c:3825 [inline] __lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049 lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162 trie_delete_elem+0x90/0x690 kernel/bpf/lpm_trie.c:467 bpf_prog_5186c38a4019a4cb+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1012 [inline] __bpf_prog_run include/linux/filter.h:596 [inline] bpf_prog_run include/linux/filter.h:614 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline] bpf_trace_run2+0x30a/0x3d0 kernel/trace/bpf_trace.c:2324 trace_contention_end+0x13f/0x190 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0x7e8/0x9c0 kernel/locking/qspinlock.c:560 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline] queued_spin_lock_slowpath+0x43/0x50 arch/x86/include/asm/qspinlock.h:51 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x217/0x280 kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0xb0/0xf0 kernel/locking/spinlock.c:162 debug_object_activate+0x6a/0x490 lib/debugobjects.c:698 debug_hrtimer_activate kernel/time/hrtimer.c:448 [inline] debug_activate kernel/time/hrtimer.c:503 [inline] enqueue_hrtimer+0x30/0x3f0 kernel/time/hrtimer.c:1105 __hrtimer_start_range_ns kernel/time/hrtimer.c:1287 [inline] hrtimer_start_range_ns+0xaea/0xfc0 kernel/time/hrtimer.c:1348 cpu_clock_event_add+0x32/0x40 kernel/events/core.c:11024 event_sched_in+0x6a1/0xe20 kernel/events/core.c:2581 group_sched_in kernel/events/core.c:2617 [inline] merge_sched_in+0x25f/0x1130 kernel/events/core.c:3808 visit_groups_merge+0xb58/0x1400 kernel/events/core.c:3752 ctx_flexible_sched_in+0x52/0x80 kernel/events/core.c:3850 perf_event_sched_in kernel/events/core.c:-1 [inline] perf_event_context_sched_in+0x334/0x5d0 kernel/events/core.c:3947 __perf_event_task_sched_in+0xcd/0x1d0 kernel/events/core.c:3980 perf_event_task_sched_in include/linux/perf_event.h:1289 [inline] finish_task_switch+0x60c/0x8f0 kernel/sched/core.c:5119 context_switch kernel/sched/core.c:5248 [inline] __schedule+0x10f4/0x40b0 kernel/sched/core.c:6562 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:6731 preempt_schedule+0xa7/0xb0 kernel/sched/core.c:6755 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xf6/0x100 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:988 [inline] debug_check_no_obj_freed+0x515/0x530 lib/debugobjects.c:1009 slab_free_hook mm/slub.c:1704 [inline] slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1755 slab_free mm/slub.c:3687 [inline] __kmem_cache_free+0xb6/0x1f0 mm/slub.c:3700 free_func_state kernel/bpf/verifier.c:1094 [inline] free_verifier_state+0xd8/0x220 kernel/bpf/verifier.c:1110 pop_stack kernel/bpf/verifier.c:1212 [inline] do_check kernel/bpf/verifier.c:12722 [inline] do_check_common+0x8baa/0xc6a0 kernel/bpf/verifier.c:14937 do_check_main kernel/bpf/verifier.c:15000 [inline] bpf_check+0x3ee1/0x10ca0 kernel/bpf/verifier.c:15577 bpf_prog_load+0x1072/0x15a0 kernel/bpf/syscall.c:2651 __sys_bpf+0x520/0x6d0 kernel/bpf/syscall.c:5030 __do_sys_bpf kernel/bpf/syscall.c:5134 [inline] __se_sys_bpf kernel/bpf/syscall.c:5132 [inline] __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5132 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&obj_hash[i].lock); lock(&trie->lock); lock(&obj_hash[i].lock); lock(&trie->lock); *** DEADLOCK *** 5 locks held by syz.5.5372/24496: #0: ffff8880b8f40c20 (&cpuctx_lock){-.-.}-{2:2}, at: perf_ctx_lock kernel/events/core.c:167 [inline] #0: ffff8880b8f40c20 (&cpuctx_lock){-.-.}-{2:2}, at: perf_event_context_sched_in+0x105/0x5d0 kernel/events/core.c:3928 #1: ffff88802904d820 (&ctx->lock){-.-.}-{2:2}, at: perf_ctx_lock kernel/events/core.c:169 [inline] #1: ffff88802904d820 (&ctx->lock){-.-.}-{2:2}, at: perf_event_context_sched_in+0x11c/0x5d0 kernel/events/core.c:3928 #2: ffff8880b8f2a5d8 (hrtimer_bases.lock){-.-.}-{2:2}, at: lock_hrtimer_base kernel/time/hrtimer.c:180 [inline] #2: ffff8880b8f2a5d8 (hrtimer_bases.lock){-.-.}-{2:2}, at: hrtimer_start_range_ns+0xec/0xfc0 kernel/time/hrtimer.c:1346 #3: ffffffff96c26b08 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x6a/0x490 lib/debugobjects.c:698 #4: ffffffff8c92b1e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #4: ffffffff8c92b1e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #4: ffffffff8c92b1e0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2284 [inline] #4: ffffffff8c92b1e0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xda/0x3d0 kernel/trace/bpf_trace.c:2324 stack backtrace: CPU: 1 PID: 24496 Comm: syz.5.5372 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106 check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2170 check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain kernel/locking/lockdep.c:3825 [inline] __lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049 lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162 trie_delete_elem+0x90/0x690 kernel/bpf/lpm_trie.c:467 bpf_prog_5186c38a4019a4cb+0x42/0x46 bpf_dispatcher_nop_func include/linux/bpf.h:1012 [inline] __bpf_prog_run include/linux/filter.h:596 [inline] bpf_prog_run include/linux/filter.h:614 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline] bpf_trace_run2+0x30a/0x3d0 kernel/trace/bpf_trace.c:2324 trace_contention_end+0x13f/0x190 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0x7e8/0x9c0 kernel/locking/qspinlock.c:560 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline] queued_spin_lock_slowpath+0x43/0x50 arch/x86/include/asm/qspinlock.h:51 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x217/0x280 kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0xb0/0xf0 kernel/locking/spinlock.c:162 debug_object_activate+0x6a/0x490 lib/debugobjects.c:698 debug_hrtimer_activate kernel/time/hrtimer.c:448 [inline] debug_activate kernel/time/hrtimer.c:503 [inline] enqueue_hrtimer+0x30/0x3f0 kernel/time/hrtimer.c:1105 __hrtimer_start_range_ns kernel/time/hrtimer.c:1287 [inline] hrtimer_start_range_ns+0xaea/0xfc0 kernel/time/hrtimer.c:1348 cpu_clock_event_add+0x32/0x40 kernel/events/core.c:11024 event_sched_in+0x6a1/0xe20 kernel/events/core.c:2581 group_sched_in kernel/events/core.c:2617 [inline] merge_sched_in+0x25f/0x1130 kernel/events/core.c:3808 visit_groups_merge+0xb58/0x1400 kernel/events/core.c:3752 ctx_flexible_sched_in+0x52/0x80 kernel/events/core.c:3850 perf_event_sched_in kernel/events/core.c:-1 [inline] perf_event_context_sched_in+0x334/0x5d0 kernel/events/core.c:3947 __perf_event_task_sched_in+0xcd/0x1d0 kernel/events/core.c:3980 perf_event_task_sched_in include/linux/perf_event.h:1289 [inline] finish_task_switch+0x60c/0x8f0 kernel/sched/core.c:5119 context_switch kernel/sched/core.c:5248 [inline] __schedule+0x10f4/0x40b0 kernel/sched/core.c:6562 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:6731 preempt_schedule+0xa7/0xb0 kernel/sched/core.c:6755 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xf6/0x100 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:988 [inline] debug_check_no_obj_freed+0x515/0x530 lib/debugobjects.c:1009 slab_free_hook mm/slub.c:1704 [inline] slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1755 slab_free mm/slub.c:3687 [inline] __kmem_cache_free+0xb6/0x1f0 mm/slub.c:3700 free_func_state kernel/bpf/verifier.c:1094 [inline] free_verifier_state+0xd8/0x220 kernel/bpf/verifier.c:1110 pop_stack kernel/bpf/verifier.c:1212 [inline] do_check kernel/bpf/verifier.c:12722 [inline] do_check_common+0x8baa/0xc6a0 kernel/bpf/verifier.c:14937 do_check_main kernel/bpf/verifier.c:15000 [inline] bpf_check+0x3ee1/0x10ca0 kernel/bpf/verifier.c:15577 bpf_prog_load+0x1072/0x15a0 kernel/bpf/syscall.c:2651 __sys_bpf+0x520/0x6d0 kernel/bpf/syscall.c:5030 __do_sys_bpf kernel/bpf/syscall.c:5134 [inline] __se_sys_bpf kernel/bpf/syscall.c:5132 [inline] __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5132 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fbbc2b8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fbbc3983038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fbbc2de5fa0 RCX: 00007fbbc2b8f749 RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 RBP: 00007fbbc2c13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fbbc2de6038 R14: 00007fbbc2de5fa0 R15: 00007fff909aeb68