============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz.6.551/8577 is trying to acquire lock: ffff88805904d038 (rhashtable_bucket){-.-.}-{0:0}, at: rht_lock+0x8b/0x180 include/linux/rhashtable.h:331 but task is already holding lock: ffff888068aa2838 (rhashtable_bucket){-.-.}-{0:0}, at: rht_lock+0x8b/0x180 include/linux/rhashtable.h:331 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(rhashtable_bucket); lock(rhashtable_bucket); *** DEADLOCK *** May be due to missing lock nesting notation 7 locks held by syz.6.551/8577: #0: ffffffff9001eb08 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4e2/0x720 net/core/net_namespace.c:575 #1: ffff88805405a260 (k-sk_lock-AF_NETLINK){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #1: ffff88805405a260 (k-sk_lock-AF_NETLINK){+.+.}-{0:0}, at: netlink_insert+0xcb/0x1360 net/netlink/af_netlink.c:558 #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: __rhashtable_insert_fast include/linux/rhashtable.h:774 [inline] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rhashtable_lookup_insert_key include/linux/rhashtable.h:1020 [inline] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: __netlink_insert net/netlink/af_netlink.c:508 [inline] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: netlink_insert+0x2b3/0x1360 net/netlink/af_netlink.c:569 #3: ffff888068aa2838 (rhashtable_bucket){-.-.}-{0:0}, at: rht_lock+0x8b/0x180 include/linux/rhashtable.h:331 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: trace_call_bpf+0xb6/0xb80 kernel/trace/bpf_trace.c:-1 #5: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #5: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #5: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline] #5: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rhtab_map_delete_elem+0x21/0x190 kernel/bpf/hashtab.c:2979 #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: __rhashtable_remove_fast include/linux/rhashtable.h:1137 [inline] #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rhashtable_remove_fast include/linux/rhashtable.h:1175 [inline] #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rhtab_delete_elem+0x15c/0x1b30 kernel/bpf/hashtab.c:-1 stack backtrace: CPU: 1 UID: 0 PID: 8577 Comm: syz.6.551 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041 check_deadlock kernel/locking/lockdep.c:3093 [inline] validate_chain kernel/locking/lockdep.c:3895 [inline] __lock_acquire+0x24df/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 rht_lock+0xa3/0x180 include/linux/rhashtable.h:331 __rhashtable_remove_fast_one include/linux/rhashtable.h:1065 [inline] __rhashtable_remove_fast include/linux/rhashtable.h:1146 [inline] rhashtable_remove_fast include/linux/rhashtable.h:1175 [inline] rhtab_delete_elem+0x404/0x1b30 kernel/bpf/hashtab.c:2954 rhtab_map_delete_elem+0xe2/0x190 kernel/bpf/hashtab.c:2985 bpf_prog_a4f1e23443ac9f8e+0x4e/0x56 bpf_dispatcher_nop_func include/linux/bpf.h:1453 [inline] __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run include/linux/filter.h:731 [inline] bpf_prog_run_array include/linux/bpf.h:2605 [inline] trace_call_bpf+0x3f0/0xb80 kernel/trace/bpf_trace.c:147 perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:11398 do_perf_trace_lock include/trace/events/lock.h:49 [inline] perf_trace_lock+0x32d/0x410 include/trace/events/lock.h:49 __do_trace_lock_release include/trace/events/lock.h:68 [inline] trace_lock_release include/trace/events/lock.h:68 [inline] lock_release+0x38e/0x3c0 kernel/locking/lockdep.c:5879 rht_assign_unlock include/linux/rhashtable.h:431 [inline] __rhashtable_insert_fast include/linux/rhashtable.h:850 [inline] rhashtable_lookup_insert_key include/linux/rhashtable.h:1020 [inline] __netlink_insert net/netlink/af_netlink.c:508 [inline] netlink_insert+0xa4a/0x1360 net/netlink/af_netlink.c:569 __netlink_kernel_create+0x2bb/0x720 net/netlink/af_netlink.c:2042 netlink_kernel_create include/linux/netlink.h:62 [inline] uevent_net_init+0xf9/0x2d0 lib/kobject_uevent.c:786 ops_init+0x35d/0x5d0 net/core/net_namespace.c:137 setup_net+0x118/0x350 net/core/net_namespace.c:446 copy_net_ns+0x4f9/0x720 net/core/net_namespace.c:579 create_new_namespaces+0x3f0/0x6b0 kernel/nsproxy.c:132 copy_namespaces+0x432/0x4b0 kernel/nsproxy.c:195 copy_process+0x1e89/0x4390 kernel/fork.c:2292 kernel_clone+0x2d7/0x940 kernel/fork.c:2748 __do_sys_clone kernel/fork.c:2889 [inline] __se_sys_clone kernel/fork.c:2873 [inline] __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2873 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2ad379e019 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2ad46c5fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007f2ad3a25fa0 RCX: 00007f2ad379e019 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000e50c1600 RBP: 00007f2ad383500c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007f2ad3a26038 R14: 00007f2ad3a25fa0 R15: 00007fffda837878