============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz-executor/4267 is trying to acquire lock: ffffc900054c90d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1c4/0x5a0 kernel/bpf/ringbuf.c:413 but task is already holding lock: ffffc900055a70d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1c4/0x5a0 kernel/bpf/ringbuf.c:413 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&rb->spinlock); lock(&rb->spinlock); *** DEADLOCK *** May be due to missing lock nesting notation 10 locks held by syz-executor/4267: #0: ffffffff8cbc5010 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap kernel/fork.c:593 [inline] #0: ffffffff8cbc5010 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1541 [inline] #0: ffffffff8cbc5010 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x2a9/0x15c0 kernel/fork.c:1590 #1: ffff88807d0ecc58 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #1: ffff88807d0ecc58 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:594 [inline] #1: ffff88807d0ecc58 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1541 [inline] #1: ffff88807d0ecc58 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2c3/0x15c0 kernel/fork.c:1590 #2: ffff88801d7bcc58 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:78 [inline] #2: ffff88801d7bcc58 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap kernel/fork.c:603 [inline] #2: ffff88801d7bcc58 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mm kernel/fork.c:1541 [inline] #2: ffff88801d7bcc58 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ad/0x15c0 kernel/fork.c:1590 #3: ffff888026aa00d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #3: ffff888026aa00d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pte_range mm/memory.c:1042 [inline] #3: ffff888026aa00d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pmd_range mm/memory.c:1177 [inline] #3: ffff888026aa00d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_pud_range mm/memory.c:1214 [inline] #3: ffff888026aa00d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_p4d_range mm/memory.c:1238 [inline] #3: ffff888026aa00d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: copy_page_range+0x1041/0x39e0 mm/memory.c:1336 #4: ffff88802ff00498 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pte_range mm/memory.c:1049 [inline] #4: ffff88802ff00498 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pmd_range mm/memory.c:1177 [inline] #4: ffff88802ff00498 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_pud_range mm/memory.c:1214 [inline] #4: ffff88802ff00498 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_p4d_range mm/memory.c:1238 [inline] #4: ffff88802ff00498 (ptlock_ptr(page)#2/1){+.+.}-{2:2}, at: copy_page_range+0x1124/0x39e0 mm/memory.c:1336 #5: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #5: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #5: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: page_ext_get+0x1e/0x2a0 mm/page_ext.c:157 #6: ffffffff8cb2adc0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #6: ffffffff8cb2adc0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2291 [inline] #6: ffffffff8cb2adc0 (rcu_callback){....}-{0:0}, at: rcu_core+0x94e/0x16a0 kernel/rcu/tree.c:2557 #7: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #7: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #7: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2284 [inline] #7: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run3+0xf0/0x400 kernel/trace/bpf_trace.c:2325 #8: ffffc900055a70d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1c4/0x5a0 kernel/bpf/ringbuf.c:413 #9: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #9: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #9: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2284 [inline] #9: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xda/0x3b0 kernel/trace/bpf_trace.c:2324 stack backtrace: CPU: 0 PID: 4267 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106 __lock_acquire+0x122f/0x7c50 kernel/locking/lockdep.c:-1 lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162 __bpf_ringbuf_reserve+0x1c4/0x5a0 kernel/bpf/ringbuf.c:413 ____bpf_ringbuf_reserve kernel/bpf/ringbuf.c:464 [inline] bpf_ringbuf_reserve+0x58/0x70 kernel/bpf/ringbuf.c:456 bpf_prog_fe0ed97373b08409+0x25/0x42 bpf_dispatcher_nop_func include/linux/bpf.h:1012 [inline] __bpf_prog_run include/linux/filter.h:603 [inline] bpf_prog_run include/linux/filter.h:610 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline] bpf_trace_run2+0x1cd/0x3b0 kernel/trace/bpf_trace.c:2324 trace_contention_end+0x13f/0x190 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0x7e8/0x9c0 kernel/locking/qspinlock.c:560 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline] queued_spin_lock_slowpath+0x43/0x50 arch/x86/include/asm/qspinlock.h:51 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x217/0x280 kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0xb0/0xf0 kernel/locking/spinlock.c:162 __bpf_ringbuf_reserve+0x1c4/0x5a0 kernel/bpf/ringbuf.c:413 ____bpf_ringbuf_reserve kernel/bpf/ringbuf.c:464 [inline] bpf_ringbuf_reserve+0x58/0x70 kernel/bpf/ringbuf.c:456 bpf_prog_fe0ed97373b08409+0x25/0x42 bpf_dispatcher_nop_func include/linux/bpf.h:1012 [inline] __bpf_prog_run include/linux/filter.h:603 [inline] bpf_prog_run include/linux/filter.h:610 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline] bpf_trace_run3+0x1e3/0x400 kernel/trace/bpf_trace.c:2325 __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:114 trace_kmem_cache_free include/trace/events/kmem.h:114 [inline] kmem_cache_free+0x1ef/0x290 mm/slub.c:3708 rcu_do_batch kernel/rcu/tree.c:2297 [inline] rcu_core+0x9c0/0x16a0 kernel/rcu/tree.c:2557 handle_softirqs+0x2a1/0x920 kernel/softirq.c:596 __do_softirq kernel/softirq.c:630 [inline] invoke_softirq kernel/softirq.c:470 [inline] __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:679 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:lock_acquire+0x20f/0x490 kernel/locking/lockdep.c:5666 Code: 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 0f 85 f5 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 66 43 c7 44 3d 09 00 00 43 c6 44 3d 0b RSP: 0018:ffffc90003c473a0 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 0000000000000000 RCX: e9bdb31a58110100 RDX: 0000000000000000 RSI: ffffffff8a8c1700 RDI: ffffffff8adef3a0 RBP: ffffc90003c474c0 R08: dffffc0000000000 R09: fffffbfff215c449 R10: fffffbfff215c449 R11: 1ffffffff215c448 R12: 0000000000000000 R13: 1ffff92000788e80 R14: 0000000000000246 R15: dffffc0000000000 rcu_lock_acquire include/linux/rcupdate.h:350 [inline] rcu_read_lock include/linux/rcupdate.h:791 [inline] page_ext_get+0x3a/0x2a0 mm/page_ext.c:157 page_table_check_set+0x51/0x6d0 mm/page_table_check.c:112 page_table_check_pte_set include/linux/page_table_check.h:83 [inline] set_pte_at arch/x86/include/asm/pgtable.h:1009 [inline] copy_present_pte mm/memory.c:1000 [inline] copy_pte_range mm/memory.c:1091 [inline] copy_pmd_range mm/memory.c:1177 [inline] copy_pud_range mm/memory.c:1214 [inline] copy_p4d_range mm/memory.c:1238 [inline] copy_page_range+0x26b3/0x39e0 mm/memory.c:1336 dup_mmap kernel/fork.c:697 [inline] dup_mm kernel/fork.c:1541 [inline] copy_mm+0xde3/0x15c0 kernel/fork.c:1590 copy_process+0x1953/0x4020 kernel/fork.c:2351 kernel_clone+0x225/0x8b0 kernel/fork.c:2757 __do_sys_clone kernel/fork.c:2898 [inline] __se_sys_clone kernel/fork.c:2882 [inline] __x64_sys_clone+0x17c/0x1d0 kernel/fork.c:2882 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f49cd985713 Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00 RSP: 002b:00007ffc27fdb558 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f49cd985713 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 R10: 000055556babd7d0 R11: 0000000000000246 R12: 0000000000000000 R13: 00000000000927c0 R14: 0000000000030e7c R15: 00007ffc27fdb6f0 ---------------- Code disassembly (best guess): 0: 00 9c 8f 84 24 80 00 add %bl,0x802484(%rdi,%rcx,4) 7: 00 00 add %al,(%rax) 9: f6 84 24 81 00 00 00 testb $0x2,0x81(%rsp) 10: 02 11: 0f 85 f5 00 00 00 jne 0x10c 17: 41 f7 c6 00 02 00 00 test $0x200,%r14d 1e: 74 01 je 0x21 20: fb sti 21: 48 c7 44 24 60 0e 36 movq $0x45e0360e,0x60(%rsp) 28: e0 45 * 2a: 4b c7 44 3d 00 00 00 movq $0x0,0x0(%r13,%r15,1) <-- trapping instruction 31: 00 00 33: 66 43 c7 44 3d 09 00 movw $0x0,0x9(%r13,%r15,1) 3a: 00 3b: 43 rex.XB 3c: c6 .byte 0xc6 3d: 44 rex.R 3e: 3d .byte 0x3d 3f: 0b .byte 0xb