wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 ====================================================== WARNING: possible circular locking dependency detected 6.12.0-rc3-next-20241016-syzkaller #0 Not tainted ------------------------------------------------------ kworker/u8:0/11 is trying to acquire lock: ffff8880b8729430 (krc.lock){..-.}-{2:2}, at: krc_this_cpu_lock kernel/rcu/tree.c:3312 [inline] ffff8880b8729430 (krc.lock){..-.}-{2:2}, at: add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3725 [inline] ffff8880b8729430 (krc.lock){..-.}-{2:2}, at: kvfree_call_rcu+0x18a/0x790 kernel/rcu/tree.c:3811 but task is already holding lock: ffff8880b872a718 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x744/0xeb0 kernel/time/timer.c:1163 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&base->lock){-.-.}-{2:2}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 lock_timer_base+0x112/0x240 kernel/time/timer.c:1050 __mod_timer+0x1ca/0xeb0 kernel/time/timer.c:1131 queue_delayed_work_on+0x1ca/0x390 kernel/workqueue.c:2552 kvfree_call_rcu+0x47f/0x790 kernel/rcu/tree.c:3839 pwq_release_workfn+0x664/0x800 kernel/workqueue.c:5078 kthread_worker_fn+0x500/0xb70 kernel/kthread.c:844 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #0 (krc.lock){..-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 krc_this_cpu_lock kernel/rcu/tree.c:3312 [inline] add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3725 [inline] kvfree_call_rcu+0x18a/0x790 kernel/rcu/tree.c:3811 trie_delete_elem+0x546/0x6a0 kernel/bpf/lpm_trie.c:540 bpf_prog_d46ba5bef82912c0+0x46/0x4a bpf_dispatcher_nop_func include/linux/bpf.h:1257 [inline] __bpf_prog_run include/linux/filter.h:701 [inline] bpf_prog_run include/linux/filter.h:708 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2318 [inline] bpf_trace_run2+0x2ec/0x540 kernel/trace/bpf_trace.c:2359 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x3ce/0x570 kernel/time/timer.c:662 internal_add_timer kernel/time/timer.c:687 [inline] __mod_timer+0xa0e/0xeb0 kernel/time/timer.c:1182 queue_delayed_work_on+0x1ca/0x390 kernel/workqueue.c:2552 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&base->lock); lock(krc.lock); lock(&base->lock); lock(krc.lock); *** DEADLOCK *** 4 locks held by kworker/u8:0/11: #0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc90000107d00 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90000107d00 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffff8880b872a718 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x744/0xeb0 kernel/time/timer.c:1163 #3: ffffffff8e939e20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #3: ffffffff8e939e20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8e939e20 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2317 [inline] #3: ffffffff8e939e20 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1fc/0x540 kernel/trace/bpf_trace.c:2359 stack backtrace: CPU: 1 UID: 0 PID: 11 Comm: kworker/u8:0 Not tainted 6.12.0-rc3-next-20241016-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_unbound nsim_dev_trap_report_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206 check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 krc_this_cpu_lock kernel/rcu/tree.c:3312 [inline] add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3725 [inline] kvfree_call_rcu+0x18a/0x790 kernel/rcu/tree.c:3811 trie_delete_elem+0x546/0x6a0 kernel/bpf/lpm_trie.c:540 bpf_prog_d46ba5bef82912c0+0x46/0x4a bpf_dispatcher_nop_func include/linux/bpf.h:1257 [inline] __bpf_prog_run include/linux/filter.h:701 [inline] bpf_prog_run include/linux/filter.h:708 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2318 [inline] bpf_trace_run2+0x2ec/0x540 kernel/trace/bpf_trace.c:2359 trace_timer_start include/trace/events/timer.h:52 [inline] enqueue_timer+0x3ce/0x570 kernel/time/timer.c:662 internal_add_timer kernel/time/timer.c:687 [inline] __mod_timer+0xa0e/0xeb0 kernel/time/timer.c:1182 queue_delayed_work_on+0x1ca/0x390 kernel/workqueue.c:2552 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244