FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
======================================================
WARNING: possible circular locking dependency detected
6.11.0-syzkaller-04557-g2f27fce67173 #0 Not tainted
------------------------------------------------------
syz.2.826/9781 is trying to acquire lock:
ffffffff8e6140d8 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
but task is already holding lock:
ffff8880b893e718 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:560
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&rq->__lock){-.-.}-{2:2}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:560
raw_spin_rq_lock kernel/sched/sched.h:1415 [inline]
rq_lock kernel/sched/sched.h:1714 [inline]
task_fork_fair+0x61/0x1e0 kernel/sched/fair.c:12710
sched_cgroup_fork+0x37c/0x410 kernel/sched/core.c:4633
copy_process+0x2217/0x3dc0 kernel/fork.c:2483
kernel_clone+0x223/0x880 kernel/fork.c:2781
user_mode_thread+0x132/0x1a0 kernel/fork.c:2859
rest_init+0x23/0x300 init/main.c:712
start_kernel+0x47f/0x500 init/main.c:1105
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0x9f/0xa0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x147
-> #1 (&p->pi_lock){-.-.}-{2:2}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0xb0/0x1470 kernel/sched/core.c:4051
up+0x72/0x90 kernel/locking/semaphore.c:191
__up_console_sem kernel/printk/printk.c:343 [inline]
__console_unlock+0x123/0x1f0 kernel/printk/printk.c:2844
__console_flush_and_unlock kernel/printk/printk.c:3241 [inline]
console_unlock+0x18f/0x3b0 kernel/printk/printk.c:3279
vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2407
_printk+0xd5/0x120 kernel/printk/printk.c:2432
bt_warn+0x127/0x180 net/bluetooth/lib.c:276
hci_cc_func net/bluetooth/hci_event.c:4179 [inline]
hci_cmd_complete_evt+0x3ef/0x8b0 net/bluetooth/hci_event.c:4203
hci_event_func net/bluetooth/hci_event.c:7443 [inline]
hci_event_packet+0xa55/0x1540 net/bluetooth/hci_event.c:7498
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4023
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x870/0xd30 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 ((console_sem).lock){-...}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3158 [inline]
check_prevs_add kernel/locking/lockdep.c:3277 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3901
__lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5199
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x109/0x250 kernel/printk/printk.c:326
console_trylock kernel/printk/printk.c:2827 [inline]
console_trylock_spinning kernel/printk/printk.c:1990 [inline]
vprintk_emit+0x3d7/0xa10 kernel/printk/printk.c:2406
_printk+0xd5/0x120 kernel/printk/printk.c:2432
fail_dump lib/fault-inject.c:45 [inline]
should_fail_ex+0x391/0x4e0 lib/fault-inject.c:153
strncpy_from_user+0x36/0x2e0 lib/strncpy_from_user.c:118
strncpy_from_user_nofault+0x71/0x140 mm/maccess.c:186
bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:216 [inline]
____bpf_probe_read_user_str kernel/trace/bpf_trace.c:225 [inline]
bpf_probe_read_user_str+0x2a/0x70 kernel/trace/bpf_trace.c:222
bpf_prog_bc7c5c6b9645592f+0x3d/0x3f
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:691 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
bpf_trace_run4+0x334/0x590 kernel/trace/bpf_trace.c:2449
__traceiter_sched_switch+0x98/0xd0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x253f/0x4a10 kernel/sched/core.c:6526
preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:6851
irqentry_exit+0x5e/0x90 kernel/entry/common.c:354
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
__kasan_check_read+0x0/0x20
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_long_read include/linux/atomic/atomic-instrumented.h:3188 [inline]
zone_page_state include/linux/vmstat.h:213 [inline]
__zone_watermark_unusable_free mm/page_alloc.c:3080 [inline]
__zone_watermark_ok+0x94/0x400 mm/page_alloc.c:3100
zone_watermark_fast+0x170/0x240 mm/page_alloc.c:3202
get_page_from_freelist+0x4ee/0x2f10 mm/page_alloc.c:3397
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4702
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2263
skb_page_frag_refill+0x158/0x2f0 net/core/sock.c:3009
mptcp_page_frag_refill net/mptcp/protocol.c:1090 [inline]
mptcp_sendmsg+0x94b/0x1b10 net/mptcp/protocol.c:1852
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x1a6/0x270 net/socket.c:745
__sys_sendto+0x398/0x4f0 net/socket.c:2210
__do_sys_sendto net/socket.c:2222 [inline]
__se_sys_sendto net/socket.c:2218 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2218
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> &p->pi_lock --> &rq->__lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock((console_sem).lock);
*** DEADLOCK ***
3 locks held by syz.2.826/9781:
#0: ffff88804e1c3258 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1609 [inline]
#0: ffff88804e1c3258 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0x153/0x1b10 net/mptcp/protocol.c:1806
#1: ffff8880b893e718 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:560
#2: ffffffff8e738a60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
#2: ffffffff8e738a60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#2: ffffffff8e738a60 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2405 [inline]
#2: ffffffff8e738a60 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x244/0x590 kernel/trace/bpf_trace.c:2449
stack backtrace:
CPU: 1 UID: 0 PID: 9781 Comm: syz.2.826 Not tainted 6.11.0-syzkaller-04557-g2f27fce67173 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2203
check_prev_add kernel/locking/lockdep.c:3158 [inline]
check_prevs_add kernel/locking/lockdep.c:3277 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3901
__lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5199
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
down_trylock+0x20/0xa0 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x109/0x250 kernel/printk/printk.c:326
console_trylock kernel/printk/printk.c:2827 [inline]
console_trylock_spinning kernel/printk/printk.c:1990 [inline]
vprintk_emit+0x3d7/0xa10 kernel/printk/printk.c:2406
_printk+0xd5/0x120 kernel/printk/printk.c:2432
fail_dump lib/fault-inject.c:45 [inline]
should_fail_ex+0x391/0x4e0 lib/fault-inject.c:153
strncpy_from_user+0x36/0x2e0 lib/strncpy_from_user.c:118
strncpy_from_user_nofault+0x71/0x140 mm/maccess.c:186
bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:216 [inline]
____bpf_probe_read_user_str kernel/trace/bpf_trace.c:225 [inline]
bpf_probe_read_user_str+0x2a/0x70 kernel/trace/bpf_trace.c:222
bpf_prog_bc7c5c6b9645592f+0x3d/0x3f
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:691 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
bpf_trace_run4+0x334/0x590 kernel/trace/bpf_trace.c:2449
__traceiter_sched_switch+0x98/0xd0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x253f/0x4a10 kernel/sched/core.c:6526
preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:6851
irqentry_exit+0x5e/0x90 kernel/entry/common.c:354
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:__kasan_check_read+0x0/0x20 mm/kasan/shadow.c:30
Code: 8d 4c 89 fe e8 e1 bd b9 09 31 db eb d0 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 89 f6 48 8b 0c 24 31 d2 e9 6f e6 ff ff 66 2e 0f 1f 84
RSP: 0018:ffffc900167475b0 EFLAGS: 00000246
RAX: 1ffff11027fff5d5 RBX: 0000000000000901 RCX: dffffc0000000000
RDX: ffff88813fffae80 RSI: 0000000000000008 RDI: ffff88813fffb550
RBP: 0000000000000003 R08: 0000000000000901 R09: 0000000000000003
R10: dffffc0000000000 R11: ffffed1027fff6a1 R12: 0000000000000007
R13: ffff88813fffb550 R14: 0000000000000003 R15: 0000000000000003
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_long_read include/linux/atomic/atomic-instrumented.h:3188 [inline]
zone_page_state include/linux/vmstat.h:213 [inline]
__zone_watermark_unusable_free mm/page_alloc.c:3080 [inline]
__zone_watermark_ok+0x94/0x400 mm/page_alloc.c:3100
zone_watermark_fast+0x170/0x240 mm/page_alloc.c:3202
get_page_from_freelist+0x4ee/0x2f10 mm/page_alloc.c:3397
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4702
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2263
skb_page_frag_refill+0x158/0x2f0 net/core/sock.c:3009
mptcp_page_frag_refill net/mptcp/protocol.c:1090 [inline]
mptcp_sendmsg+0x94b/0x1b10 net/mptcp/protocol.c:1852
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x1a6/0x270 net/socket.c:745
__sys_sendto+0x398/0x4f0 net/socket.c:2210
__do_sys_sendto net/socket.c:2222 [inline]
__se_sys_sendto net/socket.c:2218 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2218
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efd2ef7def9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efd2fd1a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007efd2f136130 RCX: 00007efd2ef7def9
RDX: 0000000000000006 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00007efd2fd1a090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000004040004 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 00007efd2f136130 R15: 00007ffc9740bf68
CPU: 1 UID: 0 PID: 9781 Comm: syz.2.826 Not tainted 6.11.0-syzkaller-04557-g2f27fce67173 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
fail_dump lib/fault-inject.c:52 [inline]
should_fail_ex+0x3b0/0x4e0 lib/fault-inject.c:153
strncpy_from_user+0x36/0x2e0 lib/strncpy_from_user.c:118
strncpy_from_user_nofault+0x71/0x140 mm/maccess.c:186
bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:216 [inline]
____bpf_probe_read_user_str kernel/trace/bpf_trace.c:225 [inline]
bpf_probe_read_user_str+0x2a/0x70 kernel/trace/bpf_trace.c:222
bpf_prog_bc7c5c6b9645592f+0x3d/0x3f
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:691 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
bpf_trace_run4+0x334/0x590 kernel/trace/bpf_trace.c:2449
__traceiter_sched_switch+0x98/0xd0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x253f/0x4a10 kernel/sched/core.c:6526
preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:6851
irqentry_exit+0x5e/0x90 kernel/entry/common.c:354
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:__kasan_check_read+0x0/0x20 mm/kasan/shadow.c:30
Code: 8d 4c 89 fe e8 e1 bd b9 09 31 db eb d0 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 89 f6 48 8b 0c 24 31 d2 e9 6f e6 ff ff 66 2e 0f 1f 84
RSP: 0018:ffffc900167475b0 EFLAGS: 00000246
RAX: 1ffff11027fff5d5 RBX: 0000000000000901 RCX: dffffc0000000000
RDX: ffff88813fffae80 RSI: 0000000000000008 RDI: ffff88813fffb550
RBP: 0000000000000003 R08: 0000000000000901 R09: 0000000000000003
R10: dffffc0000000000 R11: ffffed1027fff6a1 R12: 0000000000000007
R13: ffff88813fffb550 R14: 0000000000000003 R15: 0000000000000003
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_long_read include/linux/atomic/atomic-instrumented.h:3188 [inline]
zone_page_state include/linux/vmstat.h:213 [inline]
__zone_watermark_unusable_free mm/page_alloc.c:3080 [inline]
__zone_watermark_ok+0x94/0x400 mm/page_alloc.c:3100
zone_watermark_fast+0x170/0x240 mm/page_alloc.c:3202
get_page_from_freelist+0x4ee/0x2f10 mm/page_alloc.c:3397
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4702
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2263
skb_page_frag_refill+0x158/0x2f0 net/core/sock.c:3009
mptcp_page_frag_refill net/mptcp/protocol.c:1090 [inline]
mptcp_sendmsg+0x94b/0x1b10 net/mptcp/protocol.c:1852
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x1a6/0x270 net/socket.c:745
__sys_sendto+0x398/0x4f0 net/socket.c:2210
__do_sys_sendto net/socket.c:2222 [inline]
__se_sys_sendto net/socket.c:2218 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2218
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efd2ef7def9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efd2fd1a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007efd2f136130 RCX: 00007efd2ef7def9
RDX: 0000000000000006 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00007efd2fd1a090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000004040004 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 00007efd2f136130 R15: 00007ffc9740bf68
----------------
Code disassembly (best guess):
0: 8d 4c 89 fe lea -0x2(%rcx,%rcx,4),%ecx
4: e8 e1 bd b9 09 call 0x9b9bdea
9: 31 db xor %ebx,%ebx
b: eb d0 jmp 0xffffffdd
d: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
14: 00 00 00
17: 0f 1f 00 nopl (%rax)
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 90 nop
28: 90 nop
29: 90 nop
* 2a: f3 0f 1e fa endbr64 <-- trapping instruction
2e: 89 f6 mov %esi,%esi
30: 48 8b 0c 24 mov (%rsp),%rcx
34: 31 d2 xor %edx,%edx
36: e9 6f e6 ff ff jmp 0xffffe6aa
3b: 66 data16
3c: 2e cs
3d: 0f .byte 0xf
3e: 1f (bad)
3f: 84 .byte 0x84