============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz.3.1585/12554 is trying to acquire lock: ffff888069bbd838 (rhashtable_bucket){..-.}-{0:0}, at: rht_lock+0x8b/0x180 include/linux/rhashtable.h:330 but task is already holding lock: ffff888037058038 (rhashtable_bucket){..-.}-{0:0}, at: rht_lock+0x8b/0x180 include/linux/rhashtable.h:330 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(rhashtable_bucket); lock(rhashtable_bucket); *** DEADLOCK *** May be due to missing lock nesting notation locks held by syz.3.1585/12554: 5, last CPU#0: #0: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: __rhashtable_insert_fast include/linux/rhashtable.h:773 [inline] #0: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rhashtable_insert_fast include/linux/rhashtable.h:886 [inline] #0: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: pidfs_add_pid+0x168/0xc60 fs/pidfs.c:179 #1: ffff888037058038 (rhashtable_bucket){..-.}-{0:0}, at: rht_lock+0x8b/0x180 include/linux/rhashtable.h:330 #2: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: trace_call_bpf+0xb4/0xb80 kernel/trace/bpf_trace.c:-1 #3: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #3: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rhtab_map_delete_elem+0x21/0x190 kernel/bpf/hashtab.c:2989 #4: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #4: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #4: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: __rhashtable_remove_fast include/linux/rhashtable.h:1136 [inline] #4: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rhashtable_remove_fast include/linux/rhashtable.h:1174 [inline] #4: ffffffff8ed5c760 (rcu_read_lock){....}-{1:3}, at: rhtab_delete_elem+0x15f/0x1b00 kernel/bpf/hashtab.c:-1 stack backtrace: CPU: 0 UID: 0 PID: 12554 Comm: syz.3.1585 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_deadlock_bug+0x27a/0x290 kernel/locking/lockdep.c:3085 check_deadlock kernel/locking/lockdep.c:3137 [inline] validate_chain kernel/locking/lockdep.c:3939 [inline] __lock_acquire+0x25db/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 rht_lock+0xa3/0x180 include/linux/rhashtable.h:330 __rhashtable_remove_fast_one include/linux/rhashtable.h:1064 [inline] __rhashtable_remove_fast include/linux/rhashtable.h:1145 [inline] rhashtable_remove_fast include/linux/rhashtable.h:1174 [inline] rhtab_delete_elem+0x407/0x1b00 kernel/bpf/hashtab.c:2965 rhtab_map_delete_elem+0xe2/0x190 kernel/bpf/hashtab.c:2995 bpf_prog_a4f1e23443ac9f8e+0x4e/0x56 bpf_dispatcher_nop_func include/linux/bpf.h:1452 [inline] __bpf_prog_run include/linux/filter.h:779 [inline] bpf_prog_run include/linux/filter.h:786 [inline] bpf_prog_run_array include/linux/bpf.h:2603 [inline] trace_call_bpf+0x3f1/0xb80 kernel/trace/bpf_trace.c:147 perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:11430 do_perf_trace_lock include/trace/events/lock.h:49 [inline] perf_trace_lock+0x32e/0x410 include/trace/events/lock.h:49 __do_trace_lock_release include/trace/events/lock.h:68 [inline] trace_lock_release include/trace/events/lock.h:68 [inline] lock_release+0x396/0x3c0 kernel/locking/lockdep.c:5954 rht_assign_unlock include/linux/rhashtable.h:430 [inline] __rhashtable_insert_fast include/linux/rhashtable.h:849 [inline] rhashtable_insert_fast include/linux/rhashtable.h:886 [inline] pidfs_add_pid+0x64f/0xc60 fs/pidfs.c:179 alloc_pid+0xee0/0x1340 kernel/pid.c:340 copy_process+0x2121/0x43e0 kernel/fork.c:2323 kernel_clone+0x2d7/0x940 kernel/fork.c:2766 __do_sys_clone3 kernel/fork.c:3069 [inline] __se_sys_clone3+0x33c/0x360 kernel/fork.c:3048 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f564a99ef49 Code: 90 b8 01 00 00 00 b9 01 00 00 00 eb ec 0f 1f 40 00 b8 ea ff ff ff 48 85 ff 74 28 48 85 d2 74 23 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 14 74 01 c3 31 ed 4c 89 c7 ff d2 48 89 c7 b8 3c 00 00 RSP: 002b:00007ffd4de77bc8 EFLAGS: 00000202 ORIG_RAX: 00000000000001b3 RAX: ffffffffffffffda RBX: 00007f564a95a4e0 RCX: 00007f564a99ef49 RDX: 00007f564a95a4e0 RSI: 0000000000000058 RDI: 00007ffd4de77c20 RBP: 00007f5648bf66c0 R08: 00007f5648bf66c0 R09: 00007ffd4de77d07 R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffe8 R13: 000000000000000b R14: 00007ffd4de77c20 R15: 00007ffd4de77d08