=====================================================
WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
5.15.153-syzkaller #0 Not tainted
-----------------------------------------------------
syz-executor.2/3846 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire:
ffff88805fe54968 (&htab->buckets[i].lock){+...}-{2:2}, at: sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:937
and this task is already holding:
ffff8880b9a3a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
which would create a new lock dependency:
(&rq->__lock){-.-.}-{2:2} -> (&htab->buckets[i].lock){+...}-{2:2}
but this new dependency connects a HARDIRQ-irq-safe lock:
(&rq->__lock){-.-.}-{2:2}
... which became HARDIRQ-irq-safe at:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
_raw_spin_lock_nested+0x2d/0x40 kernel/locking/spinlock.c:368
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
rq_lock kernel/sched/sched.h:1621 [inline]
scheduler_tick+0x97/0x500 kernel/sched/core.c:5296
update_process_times+0x1ca/0x200 kernel/time/timer.c:1793
tick_periodic+0x197/0x210 kernel/time/tick-common.c:100
tick_handle_periodic+0x46/0x150 kernel/time/tick-common.c:112
timer_interrupt+0x4d/0x60 arch/x86/kernel/time.c:57
__handle_irq_event_percpu+0x292/0xa70 kernel/irq/handle.c:156
handle_irq_event_percpu kernel/irq/handle.c:196 [inline]
handle_irq_event+0xff/0x2b0 kernel/irq/handle.c:213
handle_edge_irq+0x245/0xbf0 kernel/irq/chip.c:822
generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
handle_irq arch/x86/kernel/irq.c:231 [inline]
__common_interrupt+0xd7/0x1f0 arch/x86/kernel/irq.c:250
common_interrupt+0x9f/0xc0 arch/x86/kernel/irq.c:240
asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:629
console_unlock+0xe53/0x12b0 kernel/printk/printk.c:2743
vprintk_emit+0xbf/0x150 kernel/printk/printk.c:2268
_printk+0xd1/0x111 kernel/printk/printk.c:2293
cpu_select_mitigations+0x38/0x8f arch/x86/kernel/cpu/bugs.c:150
arch_cpu_finalize_init+0xf/0x81 arch/x86/kernel/cpu/common.c:2253
start_kernel+0x419/0x535 init/main.c:1105
secondary_startup_64_no_verify+0xb1/0xbb
to a HARDIRQ-irq-unsafe lock:
(&htab->buckets[i].lock){+...}-{2:2}
... which became HARDIRQ-irq-unsafe at:
...
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_update_common+0x20c/0xa30 net/core/sock_map.c:1005
sock_map_update_elem_sys+0x485/0x770 net/core/sock_map.c:587
map_update_elem+0x6a0/0x7c0 kernel/bpf/syscall.c:1185
__sys_bpf+0x2fd/0x670 kernel/bpf/syscall.c:4639
__do_sys_bpf kernel/bpf/syscall.c:4755 [inline]
__se_sys_bpf kernel/bpf/syscall.c:4753 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4753
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&htab->buckets[i].lock);
local_irq_disable();
lock(&rq->__lock);
lock(&htab->buckets[i].lock);
<Interrupt>
lock(&rq->__lock);
*** DEADLOCK ***
2 locks held by syz-executor.2/3846:
#0: ffff8880b9a3a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
#1: ffffffff8c91f720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
the dependencies between HARDIRQ-irq-safe lock and the holding lock:
-> (&rq->__lock){-.-.}-{2:2} {
IN-HARDIRQ-W at:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
_raw_spin_lock_nested+0x2d/0x40 kernel/locking/spinlock.c:368
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
rq_lock kernel/sched/sched.h:1621 [inline]
scheduler_tick+0x97/0x500 kernel/sched/core.c:5296
update_process_times+0x1ca/0x200 kernel/time/timer.c:1793
tick_periodic+0x197/0x210 kernel/time/tick-common.c:100
tick_handle_periodic+0x46/0x150 kernel/time/tick-common.c:112
timer_interrupt+0x4d/0x60 arch/x86/kernel/time.c:57
__handle_irq_event_percpu+0x292/0xa70 kernel/irq/handle.c:156
handle_irq_event_percpu kernel/irq/handle.c:196 [inline]
handle_irq_event+0xff/0x2b0 kernel/irq/handle.c:213
handle_edge_irq+0x245/0xbf0 kernel/irq/chip.c:822
generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
handle_irq arch/x86/kernel/irq.c:231 [inline]
__common_interrupt+0xd7/0x1f0 arch/x86/kernel/irq.c:250
common_interrupt+0x9f/0xc0 arch/x86/kernel/irq.c:240
asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:629
console_unlock+0xe53/0x12b0 kernel/printk/printk.c:2743
vprintk_emit+0xbf/0x150 kernel/printk/printk.c:2268
_printk+0xd1/0x111 kernel/printk/printk.c:2293
cpu_select_mitigations+0x38/0x8f arch/x86/kernel/cpu/bugs.c:150
arch_cpu_finalize_init+0xf/0x81 arch/x86/kernel/cpu/common.c:2253
start_kernel+0x419/0x535 init/main.c:1105
secondary_startup_64_no_verify+0xb1/0xbb
IN-SOFTIRQ-W at:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
_raw_spin_lock_nested+0x2d/0x40 kernel/locking/spinlock.c:368
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
rq_lock kernel/sched/sched.h:1621 [inline]
ttwu_queue kernel/sched/core.c:3821 [inline]
try_to_wake_up+0x6dd/0x1300 kernel/sched/core.c:4146
call_timer_fn+0x16d/0x560 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1737
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1750
__do_softirq+0x3b3/0x93a kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:637
irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1096
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
default_idle+0xb/0x10 arch/x86/kernel/process.c:717
default_idle_call+0x81/0xc0 kernel/sched/idle.c:112
cpuidle_idle_call kernel/sched/idle.c:194 [inline]
do_idle+0x271/0x670 kernel/sched/idle.c:306
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403
start_kernel+0x48c/0x535 init/main.c:1138
secondary_startup_64_no_verify+0xb1/0xbb
INITIAL USE at:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
_raw_spin_lock_nested+0x2d/0x40 kernel/locking/spinlock.c:368
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
_raw_spin_rq_lock_irqsave kernel/sched/sched.h:1345 [inline]
rq_attach_root+0xec/0x440 kernel/sched/topology.c:470
sched_init+0x6a4/0xbdd kernel/sched/core.c:9502
start_kernel+0x1b6/0x535 init/main.c:1007
secondary_startup_64_no_verify+0xb1/0xbb
}
... key at: [<ffffffff8f5dcc40>] sched_init.__key+0x0/0x20
the dependencies between the lock to be acquired
and HARDIRQ-irq-unsafe lock:
-> (&htab->buckets[i].lock){+...}-{2:2} {
HARDIRQ-ON-W at:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_update_common+0x20c/0xa30 net/core/sock_map.c:1005
sock_map_update_elem_sys+0x485/0x770 net/core/sock_map.c:587
map_update_elem+0x6a0/0x7c0 kernel/bpf/syscall.c:1185
__sys_bpf+0x2fd/0x670 kernel/bpf/syscall.c:4639
__do_sys_bpf kernel/bpf/syscall.c:4755 [inline]
__se_sys_bpf kernel/bpf/syscall.c:4753 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4753
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
INITIAL USE at:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_update_common+0x20c/0xa30 net/core/sock_map.c:1005
sock_map_update_elem_sys+0x485/0x770 net/core/sock_map.c:587
map_update_elem+0x6a0/0x7c0 kernel/bpf/syscall.c:1185
__sys_bpf+0x2fd/0x670 kernel/bpf/syscall.c:4639
__do_sys_bpf kernel/bpf/syscall.c:4755 [inline]
__se_sys_bpf kernel/bpf/syscall.c:4753 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4753
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
}
... key at: [<ffffffff9178a740>] sock_hash_alloc.__key+0x0/0x20
... acquired at:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:937
bpf_prog_2c29ac5cdc6b1842+0x3a/0x59c
bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
preempt_schedule_common+0x83/0xd0 kernel/sched/core.c:6552
preempt_schedule+0xd9/0xe0 kernel/sched/core.c:6577
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
try_to_wake_up+0x8a8/0x1300 kernel/sched/core.c:4152
wake_up_process kernel/sched/core.c:4215 [inline]
wake_up_q+0x8b/0xd0 kernel/sched/core.c:950
futex_wake+0x607/0x750 kernel/futex/core.c:1702
do_futex+0x1394/0x1810 kernel/futex/core.c:3987
__do_sys_futex kernel/futex/core.c:4059 [inline]
__se_sys_futex+0x407/0x490 kernel/futex/core.c:4040
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
stack backtrace:
CPU: 0 PID: 3846 Comm: syz-executor.2 Not tainted 5.15.153-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_bad_irq_dependency kernel/locking/lockdep.c:2567 [inline]
check_irq_usage kernel/locking/lockdep.c:2806 [inline]
check_prev_add kernel/locking/lockdep.c:3057 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x4d01/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:178
sock_hash_delete_elem+0xac/0x2f0 net/core/sock_map.c:937
bpf_prog_2c29ac5cdc6b1842+0x3a/0x59c
bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
preempt_schedule_common+0x83/0xd0 kernel/sched/core.c:6552
preempt_schedule+0xd9/0xe0 kernel/sched/core.c:6577
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
try_to_wake_up+0x8a8/0x1300 kernel/sched/core.c:4152
wake_up_process kernel/sched/core.c:4215 [inline]
wake_up_q+0x8b/0xd0 kernel/sched/core.c:950
futex_wake+0x607/0x750 kernel/futex/core.c:1702
do_futex+0x1394/0x1810 kernel/futex/core.c:3987
__do_sys_futex kernel/futex/core.c:4059 [inline]
__se_sys_futex+0x407/0x490 kernel/futex/core.c:4040
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fea967d0e69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fea94d43178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007fea968fef88 RCX: 00007fea967d0e69
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fea968fef8c
RBP: 00007fea968fef80 R08: 0000000000000010 R09: 00007fea94d436c0
R10: 0000000000000009 R11: 0000000000000246 R12: 00007fea968fef8c
R13: 000000000000000b R14: 00007ffc8fe744d0 R15: 00007ffc8fe745b8
</TASK>