================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {INITIAL USE} -> {IN-NMI} usage. syz.3.4309/21590 [HC1[1]:SC0[0]:HE0:SE1] takes: ffff888078a026a0 (&htab->lockdep_key){....}-{2:2}, at: htab_lock_bucket+0x17d/0x300 kernel/bpf/hashtab.c:166 {INITIAL USE} state was registered at: lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 htab_lock_bucket+0x17d/0x300 kernel/bpf/hashtab.c:166 htab_lru_map_delete_elem+0x19f/0x640 kernel/bpf/hashtab.c:1478 bpf_prog_69bf374aa003a95d+0x46/0x4a bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline] __bpf_prog_run include/linux/filter.h:617 [inline] bpf_prog_run include/linux/filter.h:624 [inline] bpf_overflow_handler+0x1fc/0x510 kernel/events/core.c:10576 __perf_event_overflow+0x461/0x660 kernel/events/core.c:9712 perf_swevent_overflow kernel/events/core.c:9795 [inline] perf_swevent_event+0x319/0x570 kernel/events/core.c:9846 perf_bp_event+0x319/0x430 kernel/events/core.c:10773 hw_breakpoint_handler arch/x86/kernel/hw_breakpoint.c:555 [inline] hw_breakpoint_exceptions_notify+0x23e/0x670 arch/x86/kernel/hw_breakpoint.c:586 notifier_call_chain+0x18f/0x380 kernel/notifier.c:93 atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:231 notify_die+0x145/0x1a0 kernel/notifier.c:596 notify_debug+0x2e/0x50 arch/x86/kernel/traps.c:1042 exc_debug_user arch/x86/kernel/traps.c:1168 [inline] noist_exc_debug+0x77/0x120 arch/x86/kernel/traps.c:1205 asm_exc_debug+0x33/0x40 arch/x86/include/asm/idtentry.h:644 irq event stamp: 1528 hardirqs last enabled at (1527): [] mod_lruvec_page_state include/linux/vmstat.h:569 [inline] hardirqs last enabled at (1527): [] __kmalloc_large_node+0x112/0x1f0 mm/slab_common.c:1151 hardirqs last disabled at (1528): [] exc_debug_kernel arch/x86/kernel/traps.c:1063 [inline] hardirqs last disabled at (1528): [] exc_debug+0x73/0x140 arch/x86/kernel/traps.c:1199 softirqs last enabled at (1316): [] __do_softirq kernel/softirq.c:612 [inline] softirqs last enabled at (1316): [] invoke_softirq kernel/softirq.c:452 [inline] softirqs last enabled at (1316): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 softirqs last disabled at (1119): [] __do_softirq kernel/softirq.c:612 [inline] softirqs last disabled at (1119): [] invoke_softirq kernel/softirq.c:452 [inline] softirqs last disabled at (1119): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&htab->lockdep_key); lock(&htab->lockdep_key); *** DEADLOCK *** no locks held by syz.3.4309/21590. stack backtrace: CPU: 0 PID: 21590 Comm: syz.3.4309 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: <#DB> dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 lock_acquire+0x2c2/0x420 kernel/locking/lockdep.c:5745 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 htab_lock_bucket+0x17d/0x300 kernel/bpf/hashtab.c:166 htab_lru_map_delete_elem+0x19f/0x640 kernel/bpf/hashtab.c:1478 bpf_prog_69bf374aa003a95d+0x46/0x4a bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline] __bpf_prog_run include/linux/filter.h:617 [inline] bpf_prog_run include/linux/filter.h:624 [inline] bpf_overflow_handler+0x1fc/0x510 kernel/events/core.c:10576 __perf_event_overflow+0x461/0x660 kernel/events/core.c:9712 perf_swevent_overflow kernel/events/core.c:9795 [inline] perf_swevent_event+0x319/0x570 kernel/events/core.c:9846 perf_bp_event+0x319/0x430 kernel/events/core.c:10773 hw_breakpoint_handler arch/x86/kernel/hw_breakpoint.c:555 [inline] hw_breakpoint_exceptions_notify+0x23e/0x670 arch/x86/kernel/hw_breakpoint.c:586 notifier_call_chain+0x18f/0x380 kernel/notifier.c:93 atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:231 notify_die+0x145/0x1a0 kernel/notifier.c:596 notify_debug+0x2e/0x50 arch/x86/kernel/traps.c:1042 exc_debug_kernel arch/x86/kernel/traps.c:1099 [inline] exc_debug+0xde/0x140 arch/x86/kernel/traps.c:1199 asm_exc_debug+0x1e/0x40 arch/x86/include/asm/idtentry.h:644 RIP: 0010:copy_iovec_from_user lib/iov_iter.c:1383 [inline] RIP: 0010:iovec_from_user+0x102/0x240 lib/iov_iter.c:1424 Code: 01 e3 0f 88 2a 01 00 00 4c 39 e3 0f 82 21 01 00 00 0f 01 cb 0f ae e8 49 ff cf 48 8b 1c 24 49 89 dd 49 8b 6c 24 08 4d 8b 34 24 <31> ff 48 89 ee e8 d4 30 55 fd 48 85 ed 0f 88 ce 00 00 00 4c 89 e8 RSP: 0018:ffffc90003947ad8 EFLAGS: 00040286 RAX: ffffffff843245ea RBX: ffff888036920200 RCX: 0000000000080000 RDX: ffffc9000d037000 RSI: 00000000000001ad RDI: 00000000000001ae RBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff R10: ffffed1006d24630 R11: fffffbfff1d18ee6 R12: 0000200000000300 R13: ffff888036920200 R14: 00006370692f736e R15: 00000000000002f7 __import_iovec+0x13d/0x850 lib/iov_iter.c:1470 import_iovec+0x73/0xa0 lib/iov_iter.c:1535 copy_msghdr_from_user net/socket.c:2532 [inline] recvmsg_copy_msghdr net/socket.c:2780 [inline] ___sys_recvmsg+0x4b6/0x590 net/socket.c:2852 __sys_recvmsg net/socket.c:2886 [inline] __do_sys_recvmsg net/socket.c:2896 [inline] __se_sys_recvmsg net/socket.c:2893 [inline] __x64_sys_recvmsg+0x21e/0x2f0 net/socket.c:2893 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f75a559e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f75a6454028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00007f75a5825fa0 RCX: 00007f75a559e0d9 RDX: 0000000000003f01 RSI: 0000200000000500 RDI: 0000000000000003 RBP: 00007f75a5635024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f75a5826038 R14: 00007f75a5825fa0 R15: 00007ffc490c39a8 ---------------- Code disassembly (best guess): 0: 01 e3 add %esp,%ebx 2: 0f 88 2a 01 00 00 js 0x132 8: 4c 39 e3 cmp %r12,%rbx b: 0f 82 21 01 00 00 jb 0x132 11: 0f 01 cb stac 14: 0f ae e8 lfence 17: 49 ff cf dec %r15 1a: 48 8b 1c 24 mov (%rsp),%rbx 1e: 49 89 dd mov %rbx,%r13 21: 49 8b 6c 24 08 mov 0x8(%r12),%rbp 26: 4d 8b 34 24 mov (%r12),%r14 * 2a: 31 ff xor %edi,%edi <-- trapping instruction 2c: 48 89 ee mov %rbp,%rsi 2f: e8 d4 30 55 fd call 0xfd553108 34: 48 85 ed test %rbp,%rbp 37: 0f 88 ce 00 00 00 js 0x10b 3d: 4c 89 e8 mov %r13,%rax