smpboot: CPU 1 is now offline ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ kworker/u32:1/13 is trying to acquire lock: ffff88801cfc65a8 (kn->active#5){++++}-{0:0}, at: __kernfs_remove+0x34c/0xb80 fs/kernfs/dir.c:1579 but task is already holding lock: ffffffff8ec7cb10 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_post_eject+0x146/0x390 drivers/acpi/acpi_processor.c:499 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (cpu_hotplug_lock){++++}-{0:0}: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 percpu_down_write+0x53/0x3e0 kernel/locking/percpu-rwsem.c:232 cpus_write_lock kernel/cpu.c:508 [inline] _cpu_up+0x68/0x960 kernel/cpu.c:1622 cpu_up+0x1ba/0x230 kernel/cpu.c:1706 cpuhp_bringup_mask+0xf8/0x180 kernel/cpu.c:1772 cpuhp_bringup_cpus_parallel kernel/cpu.c:1850 [inline] bringup_nonboot_cpus+0xd9/0x1b0 kernel/cpu.c:1876 smp_init+0x32/0x150 kernel/smp.c:1125 kernel_init_freeable+0x44b/0x7b0 init/main.c:1667 kernel_init+0x21/0x1e0 init/main.c:1565 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #2 (cpu_add_remove_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 cpu_maps_update_begin kernel/cpu.c:468 [inline] cpu_down kernel/cpu.c:1490 [inline] cpu_device_down+0x46/0xc0 kernel/cpu.c:1508 device_offline drivers/base/core.c:4283 [inline] device_offline+0x2f4/0x400 drivers/base/core.c:4267 acpi_bus_offline+0x28b/0x490 drivers/acpi/scan.c:163 acpi_scan_try_to_offline drivers/acpi/scan.c:226 [inline] acpi_scan_hot_remove drivers/acpi/scan.c:328 [inline] acpi_generic_hotplug_event drivers/acpi/scan.c:431 [inline] acpi_device_hotplug+0x657/0xc40 drivers/acpi/scan.c:455 acpi_hotplug_work_fn+0x5e/0x90 drivers/acpi/osl.c:1194 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #1 (&device->physical_node_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 class_mutex_constructor include/linux/mutex.h:253 [inline] acpi_get_first_physical_node drivers/acpi/bus.c:820 [inline] acpi_primary_dev_companion drivers/acpi/bus.c:829 [inline] acpi_companion_match+0xc0/0x180 drivers/acpi/bus.c:883 acpi_device_uevent_modalias+0x19/0x30 drivers/acpi/device_sysfs.c:280 platform_uevent+0x51/0xc0 drivers/base/platform.c:1473 dev_uevent+0x1de/0x870 drivers/base/core.c:2766 kobject_uevent_env+0x6eb/0x18b0 lib/kobject_uevent.c:576 kobject_synth_uevent+0x6f0/0x7d0 lib/kobject_uevent.c:207 uevent_store+0x24/0x50 drivers/base/core.c:2847 dev_attr_store+0x58/0x80 drivers/base/core.c:2509 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (kn->active#5){++++}-{0:0}: check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209 check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 kernfs_drain+0x4f0/0x600 fs/kernfs/dir.c:532 __kernfs_remove+0x34c/0xb80 fs/kernfs/dir.c:1579 kernfs_remove_by_name_ns+0x7c/0x120 fs/kernfs/dir.c:1797 sysfs_remove_file include/linux/sysfs.h:780 [inline] device_remove_file drivers/base/core.c:3146 [inline] device_remove_file drivers/base/core.c:3142 [inline] device_del+0x361/0x9b0 drivers/base/core.c:3963 device_unregister+0x1d/0xe0 drivers/base/core.c:4006 unregister_cpu+0xa0/0x140 drivers/base/cpu.c:101 acpi_processor_post_eject+0x16f/0x390 drivers/acpi/acpi_processor.c:502 acpi_bus_post_eject drivers/acpi/scan.c:300 [inline] acpi_scan_hot_remove drivers/acpi/scan.c:359 [inline] acpi_generic_hotplug_event drivers/acpi/scan.c:431 [inline] acpi_device_hotplug+0xa33/0xc40 drivers/acpi/scan.c:455 acpi_hotplug_work_fn+0x5e/0x90 drivers/acpi/osl.c:1194 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Chain exists of: kn->active#5 --> cpu_add_remove_lock --> cpu_hotplug_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(cpu_hotplug_lock); lock(cpu_add_remove_lock); lock(cpu_hotplug_lock); lock(kn->active#5); *** DEADLOCK *** locks held by kworker/u32:1/13: 6, last CPU#3: #0: ffff888022a1b940 ((wq_completion)kacpi_hotplug){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90000107d08 ((work_completion)(&hpw->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff8fe1d3c0 (device_hotplug_lock){+.+.}-{4:4}, at: acpi_device_hotplug+0x82/0xc40 drivers/acpi/scan.c:441 #3: ffffffff8faf16e0 (acpi_scan_lock){+.+.}-{4:4}, at: acpi_device_hotplug+0x90/0xc40 drivers/acpi/scan.c:442 #4: ffffffff8ec7cbc0 (cpu_add_remove_lock){+.+.}-{4:4}, at: acpi_processor_post_eject+0x141/0x390 drivers/acpi/acpi_processor.c:498 #5: ffffffff8ec7cb10 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_post_eject+0x146/0x390 drivers/acpi/acpi_processor.c:499 stack backtrace: CPU: 3 UID: 0 PID: 13 Comm: kworker/u32:1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: kacpi_hotplug acpi_hotplug_work_fn Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2087 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2219 check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209 check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 kernfs_drain+0x4f0/0x600 fs/kernfs/dir.c:532 __kernfs_remove+0x34c/0xb80 fs/kernfs/dir.c:1579 kernfs_remove_by_name_ns+0x7c/0x120 fs/kernfs/dir.c:1797 sysfs_remove_file include/linux/sysfs.h:780 [inline] device_remove_file drivers/base/core.c:3146 [inline] device_remove_file drivers/base/core.c:3142 [inline] device_del+0x361/0x9b0 drivers/base/core.c:3963 device_unregister+0x1d/0xe0 drivers/base/core.c:4006 unregister_cpu+0xa0/0x140 drivers/base/cpu.c:101 acpi_processor_post_eject+0x16f/0x390 drivers/acpi/acpi_processor.c:502 acpi_bus_post_eject drivers/acpi/scan.c:300 [inline] acpi_scan_hot_remove drivers/acpi/scan.c:359 [inline] acpi_generic_hotplug_event drivers/acpi/scan.c:431 [inline] acpi_device_hotplug+0xa33/0xc40 drivers/acpi/scan.c:455 acpi_hotplug_work_fn+0x5e/0x90 drivers/acpi/osl.c:1194 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed