======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
udevd/3561 is trying to acquire lock:
ffff888078fe1238 (&trie->lock){..-.}-{2:2}, at: trie_delete_elem+0x90/0x710 kernel/bpf/lpm_trie.c:467
but task is already holding lock:
ffff8880b90280d8 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x123/0x270 kernel/time/timer.c:946
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&base->lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162
lock_timer_base+0x123/0x270 kernel/time/timer.c:946
__mod_timer+0x117/0xd20 kernel/time/timer.c:1019
queue_delayed_work_on+0x126/0x1e0 kernel/workqueue.c:1715
queue_delayed_work include/linux/workqueue.h:527 [inline]
schedule_delayed_work include/linux/workqueue.h:631 [inline]
kvfree_call_rcu+0x4a9/0x7c0 kernel/rcu/tree.c:3629
rtnl_register_internal+0x489/0x590 net/core/rtnetlink.c:225
rtnl_register+0x2e/0x70 net/core/rtnetlink.c:275
ip_rt_init+0x2e0/0x3a0 net/ipv4/route.c:3798
ip_init+0xa/0x20 net/ipv4/ip_output.c:1749
inet_init+0x28b/0x3a0 net/ipv4/af_inet.c:2007
do_one_initcall+0x1ee/0x680 init/main.c:1316
do_initcall_level+0x137/0x1f0 init/main.c:1389
do_initcalls+0x4b/0x90 init/main.c:1405
kernel_init_freeable+0x3ce/0x560 init/main.c:1629
kernel_init+0x19/0x1b0 init/main.c:1520
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
-> #1 (krc.lock){..-.}-{2:2}:
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
krc_this_cpu_lock kernel/rcu/tree.c:3203 [inline]
add_ptr_to_bulk_krc_lock kernel/rcu/tree.c:3510 [inline]
kvfree_call_rcu+0x186/0x7c0 kernel/rcu/tree.c:3601
trie_delete_elem+0x58c/0x710 kernel/bpf/lpm_trie.c:-1
bpf_prog_c0188993c79ab9c8+0x65a/0xb88
bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x15b/0x2d0 kernel/trace/bpf_trace.c:1915
__bpf_trace_sys_enter+0x60/0x70 include/trace/events/syscalls.h:18
trace_sys_enter+0x65/0x80 include/trace/events/syscalls.h:18
syscall_trace_enter+0x115/0x180 kernel/entry/common.c:77
do_syscall_64+0x24/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #0 (&trie->lock){..-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162
trie_delete_elem+0x90/0x710 kernel/bpf/lpm_trie.c:467
bpf_prog_c0188993c79ab9c8+0x3d/0xc2c
bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run3+0x17e/0x320 kernel/trace/bpf_trace.c:1916
trace_timer_start include/trace/events/timer.h:52 [inline]
enqueue_timer+0x394/0x520 kernel/time/timer.c:586
internal_add_timer kernel/time/timer.c:611 [inline]
__mod_timer+0x8e1/0xd20 kernel/time/timer.c:1062
call_timer_fn+0x16c/0x530 kernel/time/timer.c:1451
expire_timers kernel/time/timer.c:1496 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1767
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
debug_lockdep_rcu_enabled+0x28/0x30 kernel/rcu/update.c:281
rcu_read_lock include/linux/rcupdate.h:741 [inline]
dput+0x3a/0x1a0 fs/dcache.c:879
step_into+0x31d/0xd00 fs/namei.c:1823
link_path_walk+0x662/0xd40 fs/namei.c:-1
path_lookupat+0x9d/0x440 fs/namei.c:2462
filename_lookup+0x1e2/0x4f0 fs/namei.c:2492
user_path_at_empty+0x40/0x190 fs/namei.c:2891
user_path_at include/linux/namei.h:57 [inline]
vfs_statx+0x102/0x4d0 fs/stat.c:221
vfs_fstatat fs/stat.c:243 [inline]
__do_sys_newfstatat fs/stat.c:411 [inline]
__se_sys_newfstatat fs/stat.c:405 [inline]
__x64_sys_newfstatat+0x12c/0x1b0 fs/stat.c:405
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
other info that might help us debug this:
Chain exists of:
&trie->lock --> krc.lock --> &base->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&base->lock);
lock(krc.lock);
lock(&base->lock);
lock(&trie->lock);
*** DEADLOCK ***
4 locks held by udevd/3561:
#0: ffffffff8c11c760 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#1: ffffc90000007be0 ((&app->join_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#1: ffffc90000007be0 ((&app->join_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbb/0x530 kernel/time/timer.c:1441
#2: ffff8880b90280d8 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x123/0x270 kernel/time/timer.c:946
#3: ffffffff8c11c760 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 0 PID: 3561 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162
trie_delete_elem+0x90/0x710 kernel/bpf/lpm_trie.c:467
bpf_prog_c0188993c79ab9c8+0x3d/0xc2c
bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run3+0x17e/0x320 kernel/trace/bpf_trace.c:1916
trace_timer_start include/trace/events/timer.h:52 [inline]
enqueue_timer+0x394/0x520 kernel/time/timer.c:586
internal_add_timer kernel/time/timer.c:611 [inline]
__mod_timer+0x8e1/0xd20 kernel/time/timer.c:1062
call_timer_fn+0x16c/0x530 kernel/time/timer.c:1451
expire_timers kernel/time/timer.c:1496 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1767
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:debug_lockdep_rcu_enabled+0x28/0x30 kernel/rcu/update.c:280
Code: cc 00 31 c0 83 3d ab 2a c0 03 00 74 1d 83 3d 22 5d c0 03 00 74 14 65 48 8b 0d 14 fc 58 76 31 c0 83 b9 ec 0a 00 00 00 0f 94 c0 00 00 cc cc 00 00 cc 41 56 53 89 fb e8 16 0a 00 00 41 89 c6 83
RSP: 0018:ffffc90002e3f7a0 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff888016eb9be8 RCX: ffff88807dadd940
RDX: 0000000000000000 RSI: ffffffff8a0b2f00 RDI: ffffffff8a59e580
RBP: ffffc90002e3f8d0 R08: dffffc0000000000 R09: fffffbfff1ff7c19
R10: fffffbfff1ff7c19 R11: 1ffffffff1ff7c18 R12: dffffc0000000000
R13: 1ffff920005c7f63 R14: 0000000000000000 R15: 0000000000200000
rcu_read_lock include/linux/rcupdate.h:741 [inline]
dput+0x3a/0x1a0 fs/dcache.c:879
step_into+0x31d/0xd00 fs/namei.c:1823
link_path_walk+0x662/0xd40 fs/namei.c:-1
path_lookupat+0x9d/0x440 fs/namei.c:2462
filename_lookup+0x1e2/0x4f0 fs/namei.c:2492
user_path_at_empty+0x40/0x190 fs/namei.c:2891
user_path_at include/linux/namei.h:57 [inline]
vfs_statx+0x102/0x4d0 fs/stat.c:221
vfs_fstatat fs/stat.c:243 [inline]
__do_sys_newfstatat fs/stat.c:411 [inline]
__se_sys_newfstatat fs/stat.c:405 [inline]
__x64_sys_newfstatat+0x12c/0x1b0 fs/stat.c:405
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9665a5fb0a
Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
RSP: 002b:00007fff999771a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007fff99977640 RCX: 00007f9665a5fb0a
RDX: 00007fff999771b0 RSI: 00007fff99977640 RDI: 00000000ffffff9c
RBP: 0000559bff71e910 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff99977240
R13: 0000559bd54bf100 R14: 0000559bff73ec90 R15: 00007fff99977c60
----------------
Code disassembly (best guess):
0: cc int3
1: 00 31 add %dh,(%rcx)
3: c0 83 3d ab 2a c0 03 rolb $0x3,-0x3fd554c3(%rbx)
a: 00 74 1d 83 add %dh,-0x7d(%rbp,%rbx,1)
e: 3d 22 5d c0 03 cmp $0x3c05d22,%eax
13: 00 74 14 65 add %dh,0x65(%rsp,%rdx,1)
17: 48 8b 0d 14 fc 58 76 mov 0x7658fc14(%rip),%rcx # 0x7658fc32
1e: 31 c0 xor %eax,%eax
20: 83 b9 ec 0a 00 00 00 cmpl $0x0,0xaec(%rcx)
27: 0f 94 c0 sete %al
* 2a: c3 ret <-- trapping instruction
2b: 00 00 add %al,(%rax)
2d: cc int3
2e: cc int3
2f: 00 00 add %al,(%rax)
31: cc int3
32: 41 56 push %r14
34: 53 push %rbx
35: 89 fb mov %edi,%ebx
37: e8 16 0a 00 00 call 0xa52
3c: 41 89 c6 mov %eax,%r14d
3f: 83 .byte 0x83