================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
syz.2.3661/20477 [HC1[1]:SC0[0]:HE0:SE1] takes:
ffffe8ffffd3bf98 (&l->lock#2){....}-{2:2}, at: bpf_percpu_lru_push_free kernel/bpf/bpf_lru_list.c:541 [inline]
ffffe8ffffd3bf98 (&l->lock#2){....}-{2:2}, at: bpf_lru_push_free+0xcb/0xbb0 kernel/bpf/bpf_lru_list.c:551
{INITIAL USE} state was registered at:
  lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
  __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
  _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
  bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:322 [inline]
  bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:444 [inline]
  bpf_lru_pop_free+0x1ef/0x1ca0 kernel/bpf/bpf_lru_list.c:496
  prealloc_lru_pop kernel/bpf/hashtab.c:301 [inline]
  __htab_lru_percpu_map_update_elem+0x198/0x790 kernel/bpf/hashtab.c:1447
  bpf_percpu_hash_update+0x119/0x200 kernel/bpf/hashtab.c:2519
  bpf_map_update_value+0x45a/0x920 kernel/bpf/syscall.c:273
  map_update_elem+0x5fa/0x9d0 kernel/bpf/syscall.c:1805
  __sys_bpf+0x6fa/0x950 kernel/bpf/syscall.c:6262
  __do_sys_bpf kernel/bpf/syscall.c:6387 [inline]
  __se_sys_bpf kernel/bpf/syscall.c:6385 [inline]
  __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6385
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
irq event stamp: 646
hardirqs last  enabled at (645): [<ffffffff8ba72eb8>] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:507 [inline]
hardirqs last  enabled at (645): [<ffffffff8ba72eb8>] irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:542 [inline]
hardirqs last  enabled at (645): [<ffffffff8ba72eb8>] irqentry_exit+0x218/0x8b0 kernel/entry/common.c:164
hardirqs last disabled at (646): [<ffffffff8ba6e2e0>] exc_debug_kernel+0x60/0x140 arch/x86/kernel/traps.c:1235
softirqs last  enabled at (616): [<ffffffff816c41f3>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last  enabled at (616): [<ffffffff816c41f3>] fpregs_lock arch/x86/include/asm/fpu/api.h:69 [inline]
softirqs last  enabled at (616): [<ffffffff816c41f3>] fpu_clone+0x353/0xb90 arch/x86/kernel/fpu/core.c:715
softirqs last disabled at (614): [<ffffffff816c41f3>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (614): [<ffffffff816c41f3>] fpregs_lock arch/x86/include/asm/fpu/api.h:69 [inline]
softirqs last disabled at (614): [<ffffffff816c41f3>] fpu_clone+0x353/0xb90 arch/x86/kernel/fpu/core.c:715

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&l->lock#2);
  <Interrupt>
    lock(&l->lock#2);

 *** DEADLOCK ***

no locks held by syz.2.3661/20477.

stack backtrace:
CPU: 1 UID: 0 PID: 20477 Comm: syz.2.3661 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <#DB>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_usage_bug+0x28b/0x2e0 kernel/locking/lockdep.c:4042
 lock_acquire+0x1cc/0x350 kernel/locking/lockdep.c:5859
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
 _raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:166
 bpf_percpu_lru_push_free kernel/bpf/bpf_lru_list.c:541 [inline]
 bpf_lru_push_free+0xcb/0xbb0 kernel/bpf/bpf_lru_list.c:551
 htab_lru_push_free kernel/bpf/hashtab.c:1275 [inline]
 htab_lru_map_delete_elem+0x3d3/0x440 kernel/bpf/hashtab.c:1565
 bpf_prog_464bc2be3fc7c272+0x43/0x4b
 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline]
 __bpf_prog_run include/linux/filter.h:722 [inline]
 bpf_prog_run include/linux/filter.h:729 [inline]
 bpf_overflow_handler kernel/events/core.c:10641 [inline]
 __perf_event_overflow+0x3b7/0xec0 kernel/events/core.c:10740
 perf_swevent_overflow kernel/events/core.c:10881 [inline]
 perf_swevent_event+0x410/0x7e0 kernel/events/core.c:-1
 perf_bp_event+0x318/0x430 kernel/events/core.c:11773
 hw_breakpoint_handler arch/x86/kernel/hw_breakpoint.c:556 [inline]
 hw_breakpoint_exceptions_notify+0x300/0x680 arch/x86/kernel/hw_breakpoint.c:587
 notifier_call_chain+0x1ad/0x3d0 kernel/notifier.c:85
 atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
 notify_die+0x144/0x1a0 kernel/notifier.c:588
 notify_debug+0x2e/0x50 arch/x86/kernel/traps.c:1210
 exc_debug_kernel+0xb1/0x140 arch/x86/kernel/traps.c:1272
 asm_exc_debug+0x1e/0x40 arch/x86/include/asm/idtentry.h:654
RIP: 0010:__put_user_4+0xf/0x20 arch/x86/lib/putuser.S:95
Code: 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb 89 01 <31> c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90006247a18 EFLAGS: 00040206
RAX: 0000000000000011 RBX: 0000000000000000 RCX: 0000200000000300
RDX: 0000000000000000 RSI: ffffffff8e215c09 RDI: ffffffff8c28b7e0
RBP: ffffc90006247c10 R08: ffffffff82188faf R09: ffff888035f41bb8
R10: dffffc0000000000 R11: ffffed100f949ca5 R12: ffff8880571d6668
R13: ffff88802747e680 R14: 0000000000000000 R15: ffffc90006247df0
 </#DB>
 <TASK>
 copy_process+0x265d/0x4440 kernel/fork.c:2310
 kernel_clone+0x284/0x8f0 kernel/fork.c:2721
 __do_sys_clone kernel/fork.c:2862 [inline]
 __se_sys_clone kernel/fork.c:2846 [inline]
 __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2846
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f199599ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f19967b0fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f1995c16090 RCX: 00007f199599ce59
RDX: 0000200000000300 RSI: 00002000000001c0 RDI: 0000000000001000
RBP: 00007f1995a32d6f R08: 0000200000000380 R09: 0000200000000380
R10: 0000200000000340 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f1995c16128 R14: 00007f1995c16090 R15: 00007ffe6ccb6be8
 </TASK>
----------------
Code disassembly (best guess):
   0:	01 31                	add    %esi,(%rcx)
   2:	c9                   	leave
   3:	0f 01 ca             	clac
   6:	c3                   	ret
   7:	cc                   	int3
   8:	cc                   	int3
   9:	cc                   	int3
   a:	cc                   	int3
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	48 89 cb             	mov    %rcx,%rbx
  1e:	48 c1 fb 3f          	sar    $0x3f,%rbx
  22:	48 09 d9             	or     %rbx,%rcx
  25:	0f 01 cb             	stac
  28:	89 01                	mov    %eax,(%rcx)
* 2a:	31 c9                	xor    %ecx,%ecx <-- trapping instruction
  2c:	0f 01 ca             	clac
  2f:	c3                   	ret
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	cc                   	int3
  34:	90                   	nop
  35:	90                   	nop
  36:	90                   	nop
  37:	90                   	nop
  38:	90                   	nop
  39:	90                   	nop
  3a:	90                   	nop
  3b:	90                   	nop
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop