last executing test programs: 21.534408116s ago: executing program 1 (id=2): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00000027f0007000000000002"], 0x18) 17.698738217s ago: executing program 0 (id=1): write(0xffffffffffffffff, &(0x7f0000000040)="3a03000019002551075c0165ff0ffc0280200003031e000500e1000c0400", 0x1e) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@decl_tag={0x5, 0x0, 0x0, 0x11, 0x1, 0x4}]}}, 0x0, 0x2a, 0x0, 0x1, 0x10000}, 0x28) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000200)={'lo\x00', 0x2000}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00000027f0007000000000002"], 0x18) 7.236243182s ago: executing program 1 (id=3): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000010000104fcfffffffbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="431f07000b02000008000a00", @ANYRES32=r1, @ANYBLOB="080005", @ANYRES32=r1], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x240408d4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="e8000000190001002dbd7000fbdbdf2502202000ff02ff020018000008000100ac1414aac10009"], 0xe8}, 0x1, 0x0, 0x0, 0x44050}, 0x1000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20040040) 5.65297272s ago: executing program 0 (id=4): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000080)={0x58, 0x1, 0x2, 0x801, 0x0, 0x0, {0xa, 0x0, 0x8043}, [@CTA_EXPECT_MASTER={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x4e}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x26, 0x3, @mcast1}, {0x14, 0x4, @loopback}}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20}, 0x20000800) 1.485827323s ago: executing program 1 (id=5): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0x1}}, 0x20) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/vlan/vlan0\x00') preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000000)=""/196, 0xc4}], 0x1, 0xa3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='blkio.throttle.read_bps_device\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)=ANY=[], 0x6a) 0s ago: executing program 0 (id=6): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000002000010000000000000000000a00204000000007000000001400110076657468305f746f5f6272696467650008000a00fbffffff140002"], 0x4c}, 0x1, 0x0, 0x0, 0x24040804}, 0x8014) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00'], 0x5c}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:13234' (ED25519) to the list of known hosts. syzkaller login: [ 562.826361][ T3204] cgroup: Unknown subsys name 'net' [ 563.512772][ T3204] cgroup: Unknown subsys name 'cpuset' [ 563.712170][ T3204] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 653.542517][ T3204] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 822.551516][ T3215] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 822.777735][ T3215] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 826.863289][ T3218] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 827.126299][ T3218] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 840.171230][ T3215] hsr_slave_0: entered promiscuous mode [ 840.234909][ T3215] hsr_slave_1: entered promiscuous mode [ 846.620677][ T3218] hsr_slave_0: entered promiscuous mode [ 846.796513][ T3218] hsr_slave_1: entered promiscuous mode [ 846.842350][ T3218] debugfs: 'hsr0' already exists in 'hsr' [ 846.847010][ T3218] Cannot create hsr debugfs directory [ 858.207181][ T3215] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 858.880015][ T3215] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 859.057300][ T3215] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 859.521947][ T3215] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 859.652181][ T3215] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 859.861793][ T3215] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 860.488942][ T3215] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 860.906834][ T3215] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 864.532300][ T3218] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 865.209152][ T3218] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 865.398246][ T3218] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 865.810539][ T3218] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 866.012744][ T3218] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 866.232823][ T3218] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 867.114562][ T3218] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 867.291309][ T3218] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 893.328763][ T3215] 8021q: adding VLAN 0 to HW filter on device bond0 [ 898.390601][ T3218] 8021q: adding VLAN 0 to HW filter on device bond0 [ 972.783114][ T3215] veth0_vlan: entered promiscuous mode [ 973.917718][ T3215] veth1_vlan: entered promiscuous mode [ 977.991003][ T3218] veth0_vlan: entered promiscuous mode [ 980.415938][ T3215] veth0_macvtap: entered promiscuous mode [ 980.861031][ T3218] veth1_vlan: entered promiscuous mode [ 981.421992][ T3215] veth1_macvtap: entered promiscuous mode [ 986.311961][ T3218] veth0_macvtap: entered promiscuous mode [ 987.311346][ T3406] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 987.477802][ T3406] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 987.511739][ T3406] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 987.596609][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 987.887416][ T3218] veth1_macvtap: entered promiscuous mode [ 996.370808][ T3566] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 996.417241][ T42] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 996.870572][ T3566] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 997.196449][ T988] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 998.784856][ T3215] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1018.388336][ T3843] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3'. [ 1024.230099][ T3848] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6'. [ 1025.681765][ T3849] [ 1025.683011][ T3849] ====================================================== [ 1025.684184][ T3849] WARNING: possible circular locking dependency detected [ 1025.685728][ T3849] syzkaller #0 Not tainted [ 1025.686829][ T3849] ------------------------------------------------------ [ 1025.687759][ T3849] syz.1.5/3849 is trying to acquire lock: [ 1025.688739][ T3849] ffffffff88bb84c0 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0xd5e/0x2472 [ 1025.693602][ T3849] [ 1025.693602][ T3849] but task is already holding lock: [ 1025.694521][ T3849] ffffaf801a860d28 (&q->blkcg_mutex){+.+.}-{4:4}, at: blkg_conf_prep+0xa4/0xf44 [ 1025.697005][ T3849] [ 1025.697005][ T3849] which lock already depends on the new lock. [ 1025.697005][ T3849] [ 1025.698003][ T3849] [ 1025.698003][ T3849] the existing dependency chain (in reverse order) is: [ 1025.699007][ T3849] [ 1025.699007][ T3849] -> #3 (&q->blkcg_mutex){+.+.}-{4:4}: [ 1025.701059][ T3849] lock_acquire+0x23c/0x4f0 [ 1025.702607][ T3849] __mutex_lock+0x164/0x1924 [ 1025.703753][ T3849] mutex_lock_nested+0x14/0x1c [ 1025.704875][ T3849] blkcg_activate_policy+0x304/0x8a8 [ 1025.706262][ T3849] blk_throtl_init+0x2f4/0x4c4 [ 1025.707295][ T3849] tg_set_conf.isra.0+0x22e/0x4a8 [ 1025.708419][ T3849] tg_set_conf_u64+0x28/0x36 [ 1025.709431][ T3849] cgroup_file_write+0x190/0x70e [ 1025.710674][ T3849] kernfs_fop_write_iter+0x37c/0x530 [ 1025.712007][ T3849] vfs_write+0x81a/0x1020 [ 1025.713321][ T3849] ksys_write+0x126/0x244 [ 1025.714549][ T3849] __riscv_sys_write+0x6e/0xa0 [ 1025.715918][ T3849] syscall_handler+0x92/0x114 [ 1025.717357][ T3849] do_trap_ecall_u+0x4ca/0x658 [ 1025.718743][ T3849] handle_exception+0x168/0x174 [ 1025.720382][ T3849] [ 1025.720382][ T3849] -> #2 (&q->q_usage_counter(io)#17){++++}-{0:0}: [ 1025.722924][ T3849] lock_acquire+0x23c/0x4f0 [ 1025.724220][ T3849] blk_alloc_queue+0x5b4/0x6f4 [ 1025.725660][ T3849] blk_mq_alloc_queue+0x15e/0x250 [ 1025.726976][ T3849] __blk_mq_alloc_disk+0x2a/0xd8 [ 1025.728289][ T3849] loop_add+0x43a/0xa90 [ 1025.729465][ T3849] loop_init+0x304/0x33c [ 1025.730585][ T3849] do_one_initcall+0x18a/0xc82 [ 1025.731668][ T3849] kernel_init_freeable+0x6d2/0x7b8 [ 1025.733148][ T3849] kernel_init+0x30/0x244 [ 1025.734530][ T3849] ret_from_fork_kernel+0x94/0xe74 [ 1025.735834][ T3849] ret_from_fork_kernel_asm+0x16/0x18 [ 1025.737428][ T3849] [ 1025.737428][ T3849] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 1025.739339][ T3849] lock_acquire+0x23c/0x4f0 [ 1025.740593][ T3849] fs_reclaim_acquire+0xbe/0xf6 [ 1025.741802][ T3849] __kmalloc_noprof+0xb0/0x8cc [ 1025.743176][ T3849] pcpu_mem_zalloc+0x90/0xa2 [ 1025.744635][ T3849] pcpu_create_chunk+0x2a/0x666 [ 1025.746046][ T3849] pcpu_alloc_noprof+0x1af2/0x2472 [ 1025.747493][ T3849] xt_percpu_counter_alloc+0x138/0x194 [ 1025.749192][ T3849] find_check_entry.isra.0+0xe8/0x87e [ 1025.750656][ T3849] translate_table+0xb0c/0x142a [ 1025.752042][ T3849] ip6t_register_table+0x118/0x294 [ 1025.753462][ T3849] ip6table_raw_table_init+0x6a/0x94 [ 1025.754842][ T3849] xt_find_table_lock+0x292/0x4be [ 1025.756120][ T3849] xt_request_find_table_lock+0x28/0xfa [ 1025.757677][ T3849] get_info+0x164/0x52c [ 1025.758820][ T3849] do_ip6t_get_ctl+0x1f6/0x9be [ 1025.759996][ T3849] nf_getsockopt+0x6e/0xd2 [ 1025.760991][ T3849] ipv6_getsockopt+0x412/0x954 [ 1025.762373][ T3849] tcp_getsockopt+0x8c/0xde [ 1025.763814][ T3849] sock_common_getsockopt+0x86/0xb8 [ 1025.765271][ T3849] do_sock_getsockopt+0x686/0x81e [ 1025.766541][ T3849] __sys_getsockopt+0xd6/0x16e [ 1025.767786][ T3849] __riscv_sys_getsockopt+0xa6/0x114 [ 1025.769083][ T3849] syscall_handler+0x92/0x114 [ 1025.770203][ T3849] do_trap_ecall_u+0x4ca/0x658 [ 1025.771442][ T3849] handle_exception+0x168/0x174 [ 1025.772819][ T3849] [ 1025.772819][ T3849] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 1025.774883][ T3849] check_noncircular+0x138/0x14c [ 1025.776075][ T3849] __lock_acquire+0xe9c/0x25aa [ 1025.777244][ T3849] lock_acquire+0x23c/0x4f0 [ 1025.778339][ T3849] __mutex_lock+0x164/0x1924 [ 1025.779348][ T3849] _mutex_lock_killable+0x16/0x1e [ 1025.780583][ T3849] pcpu_alloc_noprof+0xd5e/0x2472 [ 1025.782101][ T3849] percpu_ref_init+0x34/0x362 [ 1025.783350][ T3849] blkg_alloc+0xcc/0x986 [ 1025.784641][ T3849] blkg_conf_prep+0x404/0xf44 [ 1025.785901][ T3849] tg_set_conf.isra.0+0x1e2/0x4a8 [ 1025.786963][ T3849] tg_set_conf_u64+0x28/0x36 [ 1025.787990][ T3849] cgroup_file_write+0x190/0x70e [ 1025.789284][ T3849] kernfs_fop_write_iter+0x37c/0x530 [ 1025.790438][ T3849] vfs_write+0x81a/0x1020 [ 1025.791554][ T3849] ksys_write+0x126/0x244 [ 1025.792771][ T3849] __riscv_sys_write+0x6e/0xa0 [ 1025.794104][ T3849] syscall_handler+0x92/0x114 [ 1025.795375][ T3849] do_trap_ecall_u+0x4ca/0x658 [ 1025.796840][ T3849] handle_exception+0x168/0x174 [ 1025.798274][ T3849] [ 1025.798274][ T3849] other info that might help us debug this: [ 1025.798274][ T3849] [ 1025.799488][ T3849] Chain exists of: [ 1025.799488][ T3849] pcpu_alloc_mutex --> &q->q_usage_counter(io)#17 --> &q->blkcg_mutex [ 1025.799488][ T3849] [ 1025.802878][ T3849] Possible unsafe locking scenario: [ 1025.802878][ T3849] [ 1025.803779][ T3849] CPU0 CPU1 [ 1025.804544][ T3849] ---- ---- [ 1025.805291][ T3849] lock(&q->blkcg_mutex); [ 1025.806422][ T3849] lock(&q->q_usage_counter(io)#17); [ 1025.807967][ T3849] lock(&q->blkcg_mutex); [ 1025.809199][ T3849] lock(pcpu_alloc_mutex); [ 1025.810264][ T3849] [ 1025.810264][ T3849] *** DEADLOCK *** [ 1025.810264][ T3849] [ 1025.811149][ T3849] locks held by syz.1.5/3849: 6, last CPU#0: [ 1025.812306][ T3849] #0: ffffaf801bde7430 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x28c/0x32c [ 1025.815047][ T3849] #1: ffffaf8012fe0460 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0xa7a/0x1020 [ 1025.817906][ T3849] #2: ffffaf801a73e480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x29c/0x530 [ 1025.820726][ T3849] #3: ffffaf802b6d5878 (kn->active#11){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2f6/0x530 [ 1025.823839][ T3849] #4: ffffaf801a860ba8 (&q->rq_qos_mutex){+.+.}-{4:4}, at: blkg_conf_open_bdev+0x22a/0x3c4 [ 1025.826639][ T3849] #5: ffffaf801a860d28 (&q->blkcg_mutex){+.+.}-{4:4}, at: blkg_conf_prep+0xa4/0xf44 [ 1025.829273][ T3849] [ 1025.829273][ T3849] stack backtrace: [ 1025.830789][ T3849] CPU: 0 UID: 0 PID: 3849 Comm: syz.1.5 Not tainted syzkaller #0 PREEMPT [ 1025.831432][ T3849] Hardware name: riscv-virtio,qemu (DT) [ 1025.832042][ T3849] Call Trace: [ 1025.832481][ T3849] [] dump_backtrace+0x2e/0x3c [ 1025.833226][ T3849] [] show_stack+0x30/0x3c [ 1025.833760][ T3849] [] dump_stack_lvl+0x114/0x1aa [ 1025.834287][ T3849] [] dump_stack+0x1c/0x24 [ 1025.834793][ T3849] [] print_circular_bug+0x250/0x29c [ 1025.835439][ T3849] [] check_noncircular+0x138/0x14c [ 1025.836070][ T3849] [] __lock_acquire+0xe9c/0x25aa [ 1025.836705][ T3849] [] lock_acquire+0x23c/0x4f0 [ 1025.837279][ T3849] [] __mutex_lock+0x164/0x1924 [ 1025.837780][ T3849] [] _mutex_lock_killable+0x16/0x1e [ 1025.838291][ T3849] [] pcpu_alloc_noprof+0xd5e/0x2472 [ 1025.838956][ T3849] [] percpu_ref_init+0x34/0x362 [ 1025.839429][ T3849] [] blkg_alloc+0xcc/0x986 [ 1025.840128][ T3849] [] blkg_conf_prep+0x404/0xf44 [ 1025.840861][ T3849] [] tg_set_conf.isra.0+0x1e2/0x4a8 [ 1025.841394][ T3849] [] tg_set_conf_u64+0x28/0x36 [ 1025.841946][ T3849] [] cgroup_file_write+0x190/0x70e [ 1025.842651][ T3849] [] kernfs_fop_write_iter+0x37c/0x530 [ 1025.843271][ T3849] [] vfs_write+0x81a/0x1020 [ 1025.843837][ T3849] [] ksys_write+0x126/0x244 [ 1025.844400][ T3849] [] __riscv_sys_write+0x6e/0xa0 [ 1025.844948][ T3849] [] syscall_handler+0x92/0x114 [ 1025.845534][ T3849] [] do_trap_ecall_u+0x4ca/0x658 [ 1025.846179][ T3849] [] handle_exception+0x168/0x174 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1032.837893][ T3566] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1035.132342][ T3566] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1036.800734][ T3566] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1039.042619][ T3566] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0