============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz-executor/9666 is trying to acquire lock: ffffc9000f90d0d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:425 but task is already holding lock: ffffc9000f8290d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:425 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&rb->spinlock); lock(&rb->spinlock); *** DEADLOCK *** May be due to missing lock nesting notation 6 locks held by syz-executor/9666: #0: ffff8880785b5b68 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:669 [inline] #0: ffff8880785b5b68 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x23b/0x650 mm/memory.c:5509 #1: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #1: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #1: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x2c0 mm/pgtable-generic.c:287 #2: ffff8880562c29d8 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #2: ffff8880562c29d8 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x107/0x1e0 mm/pgtable-generic.c:375 #3: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #3: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #3: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2321 [inline] #3: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xde/0x3c0 kernel/trace/bpf_trace.c:2361 #4: ffffc9000f8290d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:425 #5: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #5: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #5: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xc3/0x690 kernel/trace/bpf_trace.c:142 stack backtrace: CPU: 1 PID: 9666 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 check_deadlock kernel/locking/lockdep.c:3062 [inline] validate_chain kernel/locking/lockdep.c:3856 [inline] __lock_acquire+0x5d40/0x7c80 kernel/locking/lockdep.c:5137 lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa8/0xf0 kernel/locking/spinlock.c:162 __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:425 ____bpf_ringbuf_reserve kernel/bpf/ringbuf.c:476 [inline] bpf_ringbuf_reserve+0x5c/0x70 kernel/bpf/ringbuf.c:468 bpf_prog_df2ea1bb7efca089+0x35/0x4f bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline] __bpf_prog_run include/linux/filter.h:612 [inline] bpf_prog_run include/linux/filter.h:619 [inline] bpf_prog_run_array include/linux/bpf.h:1994 [inline] trace_call_bpf+0x321/0x690 kernel/trace/bpf_trace.c:143 perf_trace_run_bpf_submit+0x7a/0x1c0 kernel/events/core.c:10263 perf_trace_contention_begin+0x254/0x2f0 include/trace/events/lock.h:95 trace_contention_begin+0xe9/0x110 include/trace/events/lock.h:95 __pv_queued_spin_lock_slowpath+0xe0/0x9d0 kernel/locking/qspinlock.c:405 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:586 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x24e/0x2c0 kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0xb4/0xf0 kernel/locking/spinlock.c:162 __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:425 ____bpf_ringbuf_reserve kernel/bpf/ringbuf.c:476 [inline] bpf_ringbuf_reserve+0x5c/0x70 kernel/bpf/ringbuf.c:468 bpf_prog_6f19b9d3205a8c76+0x3c/0x8c bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline] __bpf_prog_run include/linux/filter.h:612 [inline] bpf_prog_run include/linux/filter.h:619 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2322 [inline] bpf_trace_run2+0x1d1/0x3c0 kernel/trace/bpf_trace.c:2361 __bpf_trace_tlb_flush+0xf6/0x150 include/trace/events/tlb.h:38 trace_tlb_flush+0xea/0x110 include/trace/events/tlb.h:38 flush_tlb_func+0x51b/0x650 arch/x86/mm/tlb.c:899 flush_tlb_mm_range+0x49e/0x690 arch/x86/mm/tlb.c:1082 flush_tlb_page arch/x86/include/asm/tlbflush.h:255 [inline] ptep_clear_flush+0x120/0x170 mm/pgtable-generic.c:101 wp_page_copy mm/memory.c:3162 [inline] do_wp_page+0x1e12/0x3630 mm/memory.c:3469 handle_pte_fault mm/memory.c:5063 [inline] __handle_mm_fault mm/memory.c:5188 [inline] handle_mm_fault+0x12d4/0x4920 mm/memory.c:5353 do_user_addr_fault+0xad0/0x12e0 arch/x86/mm/fault.c:1324 handle_page_fault arch/x86/mm/fault.c:1465 [inline] exc_page_fault+0x67/0x110 arch/x86/mm/fault.c:1521 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608 RIP: 0033:0x7f9e2ad85d16 Code: fd ff ff 90 e8 7b 01 00 00 41 89 c4 85 c0 0f 84 82 fd ff ff 49 c7 c5 a8 ff ff ff 48 83 3d b9 df 22 00 00 64 45 8b 75 00 74 05 c5 84 fc ff e8 d0 f5 fb ff e9 d9 fc ff ff 0f 1f 00 48 8d 7e 58 RSP: 002b:00007ffc668b4710 EFLAGS: 00010202 RAX: 000000000000015f RBX: 0000000000000000 RCX: 00007f9e2ad85e93 RDX: 000000000000015f RSI: 0000000000000000 RDI: 0000000001200011 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 R10: 000055555d3647d0 R11: 0000000000000246 R12: 000000000000015f R13: ffffffffffffffa8 R14: 0000000000000006 R15: 00007ffc668b48a0