TITLE: possible deadlock in io_timeout_fn
TYPE: LOCKDEP

[ 1137.662954][ T6133] =====================================================
[ 1137.669884][ T6133] WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
[ 1137.677342][ T6133] 5.11.0-rc1-syzkaller #0 Not tainted
[ 1137.682718][ T6133] -----------------------------------------------------
[ 1137.689658][ T6133] syz-executor.2/6133 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
[ 1137.697666][ T6133] ffff888026df22b8 (&new->fa_lock){.+.+}-{2:2}, at: kill_fasync+0x14b/0x460
[ 1137.706507][ T6133] 
[ 1137.748709][ T6133] ... which became HARDIRQ-irq-safe at:
[ 1137.762151][ T6133]   lock_acquire+0x29d/0x740
[ 1137.766837][ T6133]   _raw_spin_lock_irqsave+0x39/0x50
[ 1137.772222][ T6133]   io_timeout_fn+0x6f/0x3d0
[ 1137.776843][ T6133]   __hrtimer_run_queues+0x693/0xea0
[ 1137.782156][ T6133]   hrtimer_interrupt+0x334/0x940
[ 1137.787209][ T6133]   __sysvec_apic_timer_interrupt+0x146/0x540
[ 1137.793335][ T6133]   asm_call_irq_on_stack+0xf/0x20
[ 1137.798471][ T6133]   sysvec_apic_timer_interrupt+0xbd/0x100
[ 1137.804322][ T6133]   asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 1137.810413][ T6133]   _raw_spin_unlock_irq+0x25/0x40
[ 1137.815545][ T6133]   io_issue_sqe+0x1cf3/0x4490
[ 1137.820329][ T6133]   __io_queue_sqe+0x228/0x10c0
[ 1137.825189][ T6133]   io_queue_sqe+0x631/0x10d0
[ 1137.829887][ T6133]   io_submit_sqes+0xac1/0x2720
[ 1137.834748][ T6133]   __do_sys_io_uring_enter+0x6d1/0x1e70
[ 1137.840488][ T6133]   do_syscall_64+0x2d/0x70
[ 1137.845022][ T6133]   entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1137.851046][ T6133] 
[ 1137.851046][ T6133] to a HARDIRQ-irq-unsafe lock:
[ 1137.858085][ T6133]  (&new->fa_lock){.+.+}-{2:2}
[ 1137.858119][ T6133] 
[ 1137.858119][ T6133] ... which became HARDIRQ-irq-unsafe at:
[ 1137.870745][ T6133] ...
[ 1137.870754][ T6133]   lock_acquire+0x29d/0x740
[ 1137.877969][ T6133]   _raw_read_lock+0x5b/0x70
[ 1137.882570][ T6133]   kill_fasync+0x14b/0x460
[ 1137.887107][ T6133]   pipe_write+0xb7a/0x1ac0
[ 1137.891681][ T6133]   new_sync_write+0x426/0x650
[ 1137.896504][ T6133]   vfs_write+0x791/0xa30
[ 1137.900842][ T6133]   ksys_write+0x1ee/0x250
[ 1137.905271][ T6133]   do_syscall_64+0x2d/0x70
[ 1137.909871][ T6133]   entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1137.915864][ T6133] 
[ 1137.915864][ T6133] other info that might help us debug this:
[ 1137.915864][ T6133] 
[ 1137.926117][ T6133]  Possible interrupt unsafe locking scenario:
[ 1137.926117][ T6133] 
[ 1137.934446][ T6133]        CPU0                    CPU1
[ 1137.939808][ T6133]        ----                    ----
[ 1137.945198][ T6133]   lock(&new->fa_lock);
[ 1137.949445][ T6133]                                local_irq_disable();
[ 1137.956243][ T6133]                                lock(&ctx->completion_lock#2);
[ 1137.963886][ T6133]                                lock(&new->fa_lock);
[ 1137.970653][ T6133]   <Interrupt>
[ 1137.974102][ T6133]     lock(&ctx->completion_lock#2);
[ 1137.979426][ T6133] 
[ 1137.979426][ T6133]  *** DEADLOCK ***
[ 1137.979426][ T6133] 
[ 1137.987570][ T6133] 3 locks held by syz-executor.2/6133:
[ 1137.993037][ T6133]  #0: ffff888022a483e8 (&ctx->uring_lock){+.+.}-{3:3}, at: __do_sys_io_uring_enter+0x6c6/0x1e70
[ 1138.003602][ T6133]  #1: ffff888022a48498 (&ctx->completion_lock#2){-...}-{2:2}, at: io_submit_flush_completions+0x4d/0x3a0
[ 1138.014952][ T6133]  #2: ffffffff8b363860 (rcu_read_lock){....}-{1:2}, at: kill_fasync+0x3d/0x460
[ 1138.024060][ T6133] 
[ 1138.024060][ T6133] the dependencies between HARDIRQ-irq-safe lock and the holding lock:
[ 1138.034512][ T6133] -> (&ctx->completion_lock#2){-...}-{2:2} {
[ 1138.040530][ T6133]    IN-HARDIRQ-W at:
[ 1138.044520][ T6133]                     lock_acquire+0x29d/0x740
[ 1138.050687][ T6133]                     _raw_spin_lock_irqsave+0x39/0x50
[ 1138.057548][ T6133]                     io_timeout_fn+0x6f/0x3d0
[ 1138.063712][ T6133]                     __hrtimer_run_queues+0x693/0xea0
[ 1138.070579][ T6133]                     hrtimer_interrupt+0x334/0x940
[ 1138.077179][ T6133]                     __sysvec_apic_timer_interrupt+0x146/0x540
[ 1138.084855][ T6133]                     asm_call_irq_on_stack+0xf/0x20
[ 1138.091574][ T6133]                     sysvec_apic_timer_interrupt+0xbd/0x100
[ 1138.098984][ T6133]                     asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 1138.106627][ T6133]                     _raw_spin_unlock_irq+0x25/0x40
[ 1138.113314][ T6133]                     io_issue_sqe+0x1cf3/0x4490
[ 1138.119657][ T6133]                     __io_queue_sqe+0x228/0x10c0
[ 1138.126092][ T6133]                     io_queue_sqe+0x631/0x10d0
[ 1138.132362][ T6133]                     io_submit_sqes+0xac1/0x2720
[ 1138.138797][ T6133]                     __do_sys_io_uring_enter+0x6d1/0x1e70
[ 1138.146017][ T6133]                     do_syscall_64+0x2d/0x70
[ 1138.152098][ T6133]                     entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1138.159670][ T6133]    INITIAL USE at:
[ 1138.163569][ T6133]                    lock_acquire+0x29d/0x740
[ 1138.169651][ T6133]                    _raw_spin_lock_irq+0x32/0x50
[ 1138.176081][ T6133]                    io_submit_flush_completions+0x4d/0x3a0
[ 1138.183383][ T6133]                    __io_req_complete+0x209/0x310
[ 1138.189904][ T6133]                    io_issue_sqe+0x1234/0x4490
[ 1138.196166][ T6133]                    __io_queue_sqe+0x228/0x10c0
[ 1138.202536][ T6133]                    io_queue_sqe+0x631/0x10d0
[ 1138.208702][ T6133]                    io_submit_sqes+0x1495/0x2720
[ 1138.215128][ T6133]                    __do_sys_io_uring_enter+0x6d1/0x1e70
[ 1138.222258][ T6133]                    do_syscall_64+0x2d/0x70
[ 1138.228248][ T6133]                    entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1138.235720][ T6133]  }
[ 1138.238217][ T6133]  ... key      at: [<ffffffff8ef91a60>] __key.10+0x0/0x40
[ 1138.245506][ T6133]  ... acquired at:
[ 1138.249306][ T6133]    lock_acquire+0x29d/0x740
[ 1138.253996][ T6133]    _raw_read_lock+0x5b/0x70
[ 1138.258688][ T6133]    kill_fasync+0x14b/0x460
[ 1138.263286][ T6133]    io_commit_cqring+0x34e/0xa90
[ 1138.268329][ T6133]    io_submit_flush_completions+0x269/0x3a0
[ 1138.274324][ T6133]    __io_req_complete+0x209/0x310
[ 1138.279450][ T6133]    io_issue_sqe+0x1234/0x4490
[ 1138.284313][ T6133]    __io_queue_sqe+0x228/0x10c0
[ 1138.289263][ T6133]    io_queue_sqe+0x631/0x10d0
[ 1138.294039][ T6133]    io_submit_sqes+0x1495/0x2720
[ 1138.299080][ T6133]    __do_sys_io_uring_enter+0x6d1/0x1e70
[ 1138.304822][ T6133]    do_syscall_64+0x2d/0x70
[ 1138.309433][ T6133]    entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1138.315524][ T6133] 
[ 1138.317846][ T6133] 
[ 1138.317846][ T6133] the dependencies between the lock to be acquired
[ 1138.317857][ T6133]  and HARDIRQ-irq-unsafe lock:
[ 1138.331377][ T6133] -> (&new->fa_lock){.+.+}-{2:2} {
[ 1138.336520][ T6133]    HARDIRQ-ON-R at:
[ 1138.340514][ T6133]                     lock_acquire+0x29d/0x740
[ 1138.346689][ T6133]                     _raw_read_lock+0x5b/0x70
[ 1138.352882][ T6133]                     kill_fasync+0x14b/0x460
[ 1138.358994][ T6133]                     pipe_write+0xb7a/0x1ac0
[ 1138.365175][ T6133]                     new_sync_write+0x426/0x650
[ 1138.371519][ T6133]                     vfs_write+0x791/0xa30
[ 1138.377426][ T6133]                     ksys_write+0x1ee/0x250
[ 1138.383420][ T6133]                     do_syscall_64+0x2d/0x70
[ 1138.389500][ T6133]                     entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1138.397065][ T6133]    SOFTIRQ-ON-R at:
[ 1138.401048][ T6133]                     lock_acquire+0x29d/0x740
[ 1138.407222][ T6133]                     _raw_read_lock+0x5b/0x70
[ 1138.413388][ T6133]                     kill_fasync+0x14b/0x460
[ 1138.419471][ T6133]                     pipe_write+0xb7a/0x1ac0
[ 1138.425591][ T6133]                     new_sync_write+0x426/0x650
[ 1138.431909][ T6133]                     vfs_write+0x791/0xa30
[ 1138.437807][ T6133]                     ksys_write+0x1ee/0x250
[ 1138.443797][ T6133]                     do_syscall_64+0x2d/0x70
[ 1138.449853][ T6133]                     entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1138.457408][ T6133]    INITIAL USE at:
[ 1138.461286][ T6133]                    lock_acquire+0x29d/0x740
[ 1138.467342][ T6133]                    _raw_write_lock_irq+0x32/0x50
[ 1138.473850][ T6133]                    fasync_insert_entry+0x1d8/0x2b0
[ 1138.480531][ T6133]                    lease_setup+0x9d/0x160
[ 1138.486488][ T6133]                    generic_setlease+0x10b7/0x1a20
[ 1138.493069][ T6133]                    vfs_setlease+0xfd/0x120
[ 1138.499043][ T6133]                    fcntl_setlease+0x134/0x2c0
[ 1138.505275][ T6133]                    do_fcntl+0x2b6/0x1070
[ 1138.511070][ T6133]                    __x64_sys_fcntl+0x165/0x1e0
[ 1138.517403][ T6133]                    do_syscall_64+0x2d/0x70
[ 1138.523377][ T6133]                    entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1138.530827][ T6133]    INITIAL READ USE at:
[ 1138.535154][ T6133]                         lock_acquire+0x29d/0x740
[ 1138.541649][ T6133]                         _raw_read_lock+0x5b/0x70
[ 1138.548139][ T6133]                         kill_fasync+0x14b/0x460
[ 1138.554553][ T6133]                         pipe_write+0xb7a/0x1ac0
[ 1138.560957][ T6133]                         new_sync_write+0x426/0x650
[ 1138.567621][ T6133]                         vfs_write+0x791/0xa30
[ 1138.573850][ T6133]                         ksys_write+0x1ee/0x250
[ 1138.580167][ T6133]                         do_syscall_64+0x2d/0x70
[ 1138.586583][ T6133]                         entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1138.594470][ T6133]  }
[ 1138.596949][ T6133]  ... key      at: [<ffffffff8ef8d980>] __key.0+0x0/0x40
[ 1138.604050][ T6133]  ... acquired at:
[ 1138.607847][ T6133]    lock_acquire+0x29d/0x740
[ 1138.612512][ T6133]    _raw_read_lock+0x5b/0x70
[ 1138.617173][ T6133]    kill_fasync+0x14b/0x460
[ 1138.621745][ T6133]    io_commit_cqring+0x34e/0xa90
[ 1138.626764][ T6133]    io_submit_flush_completions+0x269/0x3a0
[ 1138.632738][ T6133]    __io_req_complete+0x209/0x310
[ 1138.638115][ T6133]    io_issue_sqe+0x1234/0x4490
[ 1138.642951][ T6133]    __io_queue_sqe+0x228/0x10c0
[ 1138.647896][ T6133]    io_queue_sqe+0x631/0x10d0
[ 1138.652654][ T6133]    io_submit_sqes+0x1495/0x2720
[ 1138.657669][ T6133]    __do_sys_io_uring_enter+0x6d1/0x1e70
[ 1138.663380][ T6133]    do_syscall_64+0x2d/0x70
[ 1138.667959][ T6133]    entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1138.674034][ T6133] 
[ 1138.676339][ T6133] 
[ 1138.676339][ T6133] stack backtrace:
[ 1138.682204][ T6133] CPU: 0 PID: 6133 Comm: syz-executor.2 Not tainted 5.11.0-rc1-syzkaller #0
[ 1138.690860][ T6133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1138.700902][ T6133] Call Trace:
[ 1138.704171][ T6133]  dump_stack+0x107/0x163
[ 1138.708526][ T6133]  check_irq_usage.cold+0x4f5/0x6c8
[ 1138.713738][ T6133]  ? print_shortest_lock_dependencies+0x80/0x80
[ 1138.719977][ T6133]  ? check_path.constprop.0+0x22/0x40
[ 1138.725371][ T6133]  ? lockdep_lock+0xc6/0x200
[ 1138.729946][ T6133]  ? call_rcu_zapped+0xb0/0xb0
[ 1138.734700][ T6133]  __lock_acquire+0x2af6/0x5500
[ 1138.739545][ T6133]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 1138.745518][ T6133]  lock_acquire+0x29d/0x740
[ 1138.750052][ T6133]  ? kill_fasync+0x14b/0x460
[ 1138.754628][ T6133]  ? lock_release+0x710/0x710
[ 1138.759303][ T6133]  ? lock_release+0x710/0x710
[ 1138.763963][ T6133]  ? _raw_spin_unlock_irqrestore+0x2f/0x50
[ 1138.769755][ T6133]  ? __wake_up_common_lock+0xde/0x130
[ 1138.775161][ T6133]  ? __wake_up_common+0x650/0x650
[ 1138.780188][ T6133]  _raw_read_lock+0x5b/0x70
[ 1138.784678][ T6133]  ? kill_fasync+0x14b/0x460
[ 1138.789265][ T6133]  kill_fasync+0x14b/0x460
[ 1138.793675][ T6133]  io_commit_cqring+0x34e/0xa90
[ 1138.798509][ T6133]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 1138.804786][ T6133]  io_submit_flush_completions+0x269/0x3a0
[ 1138.810605][ T6133]  ? stack_trace_save+0x8c/0xc0
[ 1138.815510][ T6133]  __io_req_complete+0x209/0x310
[ 1138.820437][ T6133]  io_issue_sqe+0x1234/0x4490
[ 1138.825112][ T6133]  ? ____kasan_kmalloc.constprop.0+0x82/0xa0
[ 1138.831144][ T6133]  ? kmem_cache_alloc_bulk+0x1ce/0x450
[ 1138.836610][ T6133]  ? io_submit_sqes+0x1313/0x2720
[ 1138.841632][ T6133]  ? __do_sys_io_uring_enter+0x6d1/0x1e70
[ 1138.847343][ T6133]  ? do_syscall_64+0x2d/0x70
[ 1138.851914][ T6133]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1138.857968][ T6133]  ? io_write+0xe40/0xe40
[ 1138.862297][ T6133]  ? mark_lock+0xf7/0x1730
[ 1138.866700][ T6133]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 1138.872663][ T6133]  ? lock_chain_count+0x20/0x20
[ 1138.877497][ T6133]  __io_queue_sqe+0x228/0x10c0
[ 1138.882247][ T6133]  ? io_issue_sqe+0x4490/0x4490
[ 1138.887082][ T6133]  ? __io_splice_prep+0x530/0x530
[ 1138.892104][ T6133]  ? mark_held_locks+0x9f/0xe0
[ 1138.896861][ T6133]  io_queue_sqe+0x631/0x10d0
[ 1138.901438][ T6133]  io_submit_sqes+0x1495/0x2720
[ 1138.906298][ T6133]  ? io_queue_sqe+0x10d0/0x10d0
[ 1138.911145][ T6133]  ? __do_sys_io_uring_enter+0x6c6/0x1e70
[ 1138.916847][ T6133]  ? xa_store+0x3c/0x50
[ 1138.921059][ T6133]  ? do_raw_spin_unlock+0x171/0x230
[ 1138.926276][ T6133]  ? _raw_spin_unlock+0x24/0x40
[ 1138.931110][ T6133]  ? xa_store+0x3c/0x50
[ 1138.935261][ T6133]  ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 1138.941489][ T6133]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 1138.947715][ T6133]  __do_sys_io_uring_enter+0x6d1/0x1e70
[ 1138.953251][ T6133]  ? io_sq_thread+0x19e0/0x19e0
[ 1138.958087][ T6133]  ? _copy_to_user+0xdc/0x150
[ 1138.962830][ T6133]  ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70
[ 1138.969056][ T6133]  ? put_timespec64+0xcb/0x120
[ 1138.973825][ T6133]  ? ns_to_timespec64+0xc0/0xc0
[ 1138.978657][ T6133]  ? __do_sys_futex+0x2a2/0x470
[ 1138.983487][ T6133]  ? __do_sys_futex+0x2ab/0x470
[ 1138.988323][ T6133]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 1138.994202][ T6133]  do_syscall_64+0x2d/0x70
[ 1138.998600][ T6133]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1139.004480][ T6133] RIP: 0033:0x45e219
[ 1139.008356][ T6133] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 1139.027966][ T6133] RSP: 002b:00007f3ebf1e9c68 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
[ 1139.036368][ T6133] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e219
[ 1139.044323][ T6133] RDX: 0000000000000000 RSI: 000000000000450c RDI: 0000000000000003
[ 1139.052279][ T6133] RBP: 000000000119c080 R08: 0000000000000000 R09: 0000000000000000
[ 1139.060235][ T6133] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119c034
[ 1139.068187][ T6133] R13: 00000000016afb5f R14: 00007f3ebf1ea9c0 R15: 000000000119c034
