TITLE: inconsistent lock state in __io_req_aux_free
TYPE: LOCKDEP

[   28.141875] ================================
[   28.146298] WARNING: inconsistent lock state
[   28.150699] 4.15.0-syzkaller #0 Not tainted
[   28.154995] --------------------------------
[   28.159376] inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
[   28.165515] syz-executor644/3715 [HC1[1]:SC0[0]:HE0:SE1] takes:
[   28.171568] ffff8801da554020 (&(&fs->lock)->rlock){?.+.}, at: __io_req_aux_free+0x402/0xf30
[   28.180068] {HARDIRQ-ON-W} state was registered at:
[   28.185074]   lock_acquire+0x18f/0x770
[   28.188967]   _raw_spin_lock+0x2b/0x40
[   28.192844]   set_fs_pwd+0x89/0x1e0
[   28.196557]   ksys_chdir+0x131/0x1f0
[   28.200342]   devtmpfsd+0x1b1/0x4c0
[   28.203950]   kthread+0x450/0x6e0
[   28.207403]   ret_from_fork+0x3f/0x50
[   28.211178]   0xffffffffffffffff
[   28.214515] irq event stamp: 93704
[   28.218055] hardirqs last  enabled at (93703): [<ffffffff8100f338>] _raw_spin_unlock_irq+0x28/0x40
[   28.227400] hardirqs last disabled at (93704): [<ffffffff8101153e>] trace_hardirqs_off_thunk+0x1a/0x1c
[   28.236940] softirqs last  enabled at (93576): [<ffffffff8451cd12>] unix_create1+0x432/0x500
[   28.245525] softirqs last disabled at (93574): [<ffffffff8451cc58>] unix_create1+0x378/0x500
[   28.254089] 
[   28.254089] other info that might help us debug this:
[   28.260831]  Possible unsafe locking scenario:
[   28.260831] 
[   28.269054]        CPU0
[   28.271628]        ----
[   28.274197]   lock(&(&fs->lock)->rlock);
[   28.278247]   <Interrupt>
[   28.280988]     lock(&(&fs->lock)->rlock);
[   28.285197] 
[   28.285197]  *** DEADLOCK ***
[   28.285197] 
[   28.291245] 1 lock held by syz-executor644/3715:
[   28.295972]  #0: ffff8801ee8775a0 (&ctx->uring_lock){+.+.}, at: SyS_io_uring_enter+0x8bf/0x17a0
[   28.304819] 
[   28.304819] stack backtrace:
[   28.309301] CPU: 0 PID: 3715 Comm: syz-executor644 Not tainted 4.15.0-syzkaller #0
[   28.317094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   28.326427] Call Trace:
[   28.328990]  <IRQ>
[   28.331128]  [<ffffffff84a13737>] dump_stack+0xd8/0x147
[   28.336481]  [<ffffffff848334b3>] print_usage_bug.part.0+0x34a/0x359
[   28.342970]  [<ffffffff848334e9>] mark_lock.cold+0x27/0x92
[   28.348670]  [<ffffffff815dfba7>] __lock_acquire+0x1477/0x5ed0
[   28.384342]  [<ffffffff815e5daf>] lock_acquire+0x18f/0x770
[   28.420340]  [<ffffffff8100edab>] _raw_spin_lock+0x2b/0x40
[   28.432194]  [<ffffffff81d18322>] __io_req_aux_free+0x402/0xf30
[   28.438247]  [<ffffffff81d18e71>] __io_free_req+0x21/0x5b0
[   28.449825]  [<ffffffff81d194ba>] io_free_req+0xba/0x1e0
[   28.474067]  [<ffffffff81d19650>] io_put_req+0x70/0xa0
[   28.479341]  [<ffffffff81d1c467>] io_link_timeout_fn+0x387/0x530
[   28.485506]  [<ffffffff81673bae>] __hrtimer_run_queues+0x45e/0xe40
[   28.504953]  [<ffffffff8167642d>] hrtimer_interrupt+0x30d/0x900
[   28.511020]  [<ffffffff84c04a69>] smp_apic_timer_interrupt+0x159/0x580
[   28.517691]  [<ffffffff84c019a3>] apic_timer_interrupt+0x93/0xa0
[   28.523845]  </IRQ>
[   28.526076] RIP: 0010:_raw_spin_unlock_irq+0x2f/0x40
[   28.531172] RSP: 0018:ffff8801f3bff940 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12
[   28.538863] RAX: 0000000000000007 RBX: 0000000000000000 RCX: 0000000000000006
[   28.546116] RDX: 0000000000000000 RSI: ffff8801f3d88b38 RDI: ffff8801f3d88b34
[   28.553427] RBP: ffff8801f3bff948 R08: ffff8801f3d88180 R09: 0000000000000000
[   28.560695] R10: ffff8801f3d88b58 R11: 0000000000000000 R12: ffff8801ee877640
[   28.567952] R13: ffff8801ee877640 R14: 0000000000000001 R15: ffff8801efb05080
[   28.575331]  [<ffffffff81d1982c>] io_queue_linked_timeout+0x1ac/0x210
[   28.581919]  [<ffffffff81d19c42>] io_queue_async_work+0x3b2/0xbb0
[   28.588153]  [<ffffffff81d2e662>] __io_queue_sqe+0x522/0x1160
[   28.618773]  [<ffffffff81d2f648>] io_queue_sqe+0x3a8/0xd80
[   28.624398]  [<ffffffff81d30f94>] io_submit_sqes+0xf74/0x27f0
[   28.661561]  [<ffffffff81d35153>] SyS_io_uring_enter+0x8d3/0x17a0
[   28.737974]  [<ffffffff8101642f>] do_syscall_64+0x1ff/0x310
[   28.743675]  [<ffffffff84c00076>] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[   28.750668] RIP: 0033:0x44bb09
[   28.753834] RSP: 002b:00007ffce56c6c58 EFLAGS: 00000212 ORIG_RAX: 00000000000001aa
[   28.761521] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000044bb09
[   28.768773] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003
[   28.776025] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[   28.783278] R10: 0000000000000000 R11: 0000000000000212 R12: 00007ffce56c6c90
[   28.790530] R13: 00007ffce56
