[syzbot] inconsistent lock state in try_to_wake_up

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    bbed346d5a96 Merge branch 'for-next/core' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=127ad626880000
kernel config:  https://syzkaller.appspot.com/x/.config?x=3a4a45d2d827c1e
dashboard link: https://syzkaller.appspot.com/bug?extid=9d232b8025fff95ea41e
compiler:       Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8e91bc79312/disk-bbed346d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c1cb3fb3b77e/vmlinux-bbed346d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9d232b8025fff95ea41e@xxxxxxxxxxxxxxxxxxxxxxxxx

================================
WARNING: inconsistent lock state
6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/1/0 [HC0[0]:SC1[1]:HE0:SE0] takes:
ffff00011a938948 (kn->active#5){+.?.}-{0:0}, at: try_to_wake_up+0x5c/0x514 kernel/sched/core.c:4082
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666
  kernfs_drain fs/kernfs/dir.c:478 [inline]
  __kernfs_remove+0x514/0x7d8 fs/kernfs/dir.c:1386
  kernfs_remove_by_name_ns+0x68/0xb8 fs/kernfs/dir.c:1589
  kernfs_remove_by_name include/linux/kernfs.h:615 [inline]
  remove_files fs/sysfs/group.c:28 [inline]
  sysfs_remove_group+0x68/0x160 fs/sysfs/group.c:288
  sysfs_remove_groups+0x3c/0x78 fs/sysfs/group.c:312
  driver_remove_groups+0x28/0x38 drivers/base/driver.c:211
  bus_remove_driver+0x7c/0x110 drivers/base/bus.c:673
  driver_unregister+0x3c/0x6c drivers/base/driver.c:274
  pci_unregister_driver+0x28/0xc4 drivers/pci/pci-driver.c:1452
  ipmi_si_pci_shutdown+0x2c/0x40 drivers/char/ipmi/ipmi_si_pci.c:159
  cleanup_ipmi_si+0x2c/0x10c drivers/char/ipmi/ipmi_si_intf.c:2272
  init_ipmi_si+0x2bc/0x2d0 drivers/char/ipmi/ipmi_si_intf.c:2146
  do_one_initcall+0x118/0x22c init/main.c:1296
  do_initcall_level+0xac/0xe4 init/main.c:1369
  do_initcalls+0x58/0xa8 init/main.c:1385
  do_basic_setup+0x20/0x2c init/main.c:1404
  kernel_init_freeable+0xb8/0x148 init/main.c:1623
  kernel_init+0x24/0x290 init/main.c:1512
  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 2262087
hardirqs last  enabled at (2262086): [<ffff80000bfc8a34>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last  enabled at (2262086): [<ffff80000bfc8a34>] _raw_spin_unlock_irq+0x3c/0x70 kernel/locking/spinlock.c:202
hardirqs last disabled at (2262087): [<ffff80000bfc87f0>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (2262087): [<ffff80000bfc87f0>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last  enabled at (2262028): [<ffff8000080102e4>] _stext+0x2e4/0x37c
softirqs last disabled at (2262083): [<ffff800008017c14>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(kn->active#5);
  <Interrupt>
    lock(kn->active#5);

 *** DEADLOCK ***

1 lock held by swapper/1/0:
 #0: ffff80000800be20 ((&sci->sc_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:31 [inline]
 #0: ffff80000800be20 ((&sci->sc_timer)){+.-.}-{0:0}, at: call_timer_fn+0x54/0x144 kernel/time/timer.c:1464

stack backtrace:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
 show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 print_usage_bug+0x39c/0x3cc kernel/locking/lockdep.c:3961
 mark_lock_irq+0x4a8/0x4b4
 mark_lock+0x154/0x1b4 kernel/locking/lockdep.c:4632
 __lock_acquire+0x5a0/0x30a4 kernel/locking/lockdep.c:5007
 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
 try_to_wake_up+0x5c/0x514 kernel/sched/core.c:4082
 wake_up_process+0x18/0x24 kernel/sched/core.c:4314
 nilfs_construction_timeout+0x20/0x30 fs/nilfs2/segment.c:2403
 call_timer_fn+0x90/0x144 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers+0x280/0x374 kernel/time/timer.c:1790
 run_timer_softirq+0x34/0x5c kernel/time/timer.c:1803
 _stext+0x168/0x37c
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:889
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84
 invoke_softirq+0x70/0xbc kernel/softirq.c:452
 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650
 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662
 __el1_irq arch/arm64/kernel/entry-common.c:471 [inline]
 el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:485
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:490
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:577
 arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
 default_idle_call+0x48/0xb8 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:191 [inline]
 do_idle+0x108/0x2d8 kernel/sched/idle.c:303
 cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:400
 secondary_start_kernel+0x154/0x17c arch/arm64/kernel/smp.c:265
 __secondary_switched+0xb0/0xb4 arch/arm64/kernel/head.S:618


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.