============================================
WARNING: possible recursive locking detected
6.10.0-rc4-syzkaller-00802-ga6ec08beec9e #0 Not tainted
--------------------------------------------
kworker/0:1/9 is trying to acquire lock:
ffff88802e6031d8 (&qs->lock){-.-.}-{2:2}, at: queue_stack_map_push_elem+0x1b2/0x660 kernel/bpf/queue_stack_maps.c:210
but task is already holding lock:
ffff88802c5431d8 (&qs->lock){-.-.}-{2:2}, at: __queue_map_get+0x14b/0x4d0 kernel/bpf/queue_stack_maps.c:105
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&qs->lock);
lock(&qs->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
7 locks held by kworker/0:1/9:
#0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
#0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
#1: ffffc900000e7d00 ((work_completion)(&w->work)#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
#1: ffffc900000e7d00 ((work_completion)(&w->work)#2){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
#2: ffffffff8f65afe8 (nf_conntrack_mutex){+.+.}-{3:3}, at: nf_ct_iterate_cleanup+0x41/0x4f0 net/netfilter/nf_conntrack_core.c:2403
#3: ffffffff8e334060 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#3: ffffffff8e334060 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2529 [inline]
#3: ffffffff8e334060 (rcu_callback){....}-{0:0}, at: rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2809
#4: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#4: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#4: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2402 [inline]
#4: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run3+0x24c/0x5a0 kernel/trace/bpf_trace.c:2445
#5: ffff88802c5431d8 (&qs->lock){-.-.}-{2:2}, at: __queue_map_get+0x14b/0x4d0 kernel/bpf/queue_stack_maps.c:105
#6: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#6: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#6: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2402 [inline]
#6: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1fc/0x540 kernel/trace/bpf_trace.c:2444
stack backtrace:
CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.10.0-rc4-syzkaller-00802-ga6ec08beec9e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events iterate_cleanup_work
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
check_deadlock kernel/locking/lockdep.c:3062 [inline]
validate_chain+0x15d3/0x5900 kernel/locking/lockdep.c:3856
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
queue_stack_map_push_elem+0x1b2/0x660 kernel/bpf/queue_stack_maps.c:210
bpf_prog_216c997a1f42e404+0x3f/0x43
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:691 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline]
bpf_trace_run2+0x2ec/0x540 kernel/trace/bpf_trace.c:2444
trace_contention_end+0x114/0x140 include/trace/events/lock.h:122
__pv_queued_spin_lock_slowpath+0xb81/0xdc0 kernel/locking/qspinlock.c:557
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0xe1/0x120 kernel/locking/spinlock.c:162
__queue_map_get+0x14b/0x4d0 kernel/bpf/queue_stack_maps.c:105
bpf_prog_94b194d4ebfffdd5+0x45/0x49
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:691 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline]
bpf_trace_run3+0x33a/0x5a0 kernel/trace/bpf_trace.c:2445
trace_kmem_cache_free include/trace/events/kmem.h:114 [inline]
kmem_cache_free+0x2a9/0x350 mm/slub.c:4511
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:nf_ct_iterate_cleanup+0x94/0x4f0 net/netfilter/nf_conntrack_core.c:2404
Code: 24 10 48 89 44 24 20 49 8d 44 24 14 48 89 44 24 18 89 e8 89 eb 25 ff 03 00 00 48 c1 e0 06 48 8d 80 00 4d 06 8e 48 89 44 24 10 <48> 89 1c 24 48 8d 2c dd 00 00 00 00 48 03 2d 61 29 0d 06 49 89 ed
RSP: 0018:ffffc900000e7a98 EFLAGS: 00000206
RAX: ffffffff8e071900 RBX: 000000000003df30 RCX: ffff8880172c0000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 000000000003df30 R08: ffffffff89a11ac0 R09: 1ffffffff25f64c0
R10: dffffc0000000000 R11: fffffbfff25f64c1 R12: ffffc900000e7b20
R13: 1ffff110054fdf2f R14: dffffc0000000000 R15: ffffc900000e7b28
iterate_cleanup_work+0x146/0x260 net/netfilter/nf_nat_masquerade.c:87
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
----------------
Code disassembly (best guess):
0: 24 10 and $0x10,%al
2: 48 89 44 24 20 mov %rax,0x20(%rsp)
7: 49 8d 44 24 14 lea 0x14(%r12),%rax
c: 48 89 44 24 18 mov %rax,0x18(%rsp)
11: 89 e8 mov %ebp,%eax
13: 89 eb mov %ebp,%ebx
15: 25 ff 03 00 00 and $0x3ff,%eax
1a: 48 c1 e0 06 shl $0x6,%rax
1e: 48 8d 80 00 4d 06 8e lea -0x71f9b300(%rax),%rax
25: 48 89 44 24 10 mov %rax,0x10(%rsp)
* 2a: 48 89 1c 24 mov %rbx,(%rsp) <-- trapping instruction
2e: 48 8d 2c dd 00 00 00 lea 0x0(,%rbx,8),%rbp
35: 00
36: 48 03 2d 61 29 0d 06 add 0x60d2961(%rip),%rbp # 0x60d299e
3d: 49 89 ed mov %rbp,%r13