kmem_cache_node 51KB 51KB
kmem_cache 82KB 82KB
oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz6,mems_allowed=0,global_oom,task_memcg=/syz6,task=syz-executor.6,pid=13194,uid=0
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:577
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 13194, name: syz-executor.6
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
3 locks held by syz-executor.6/13194:
#0: ffff888019e26a28 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline]
#0: ffff888019e26a28 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x346/0x12a0 arch/x86/mm/fault.c:1338
#1: ffffffff85279268 (oom_lock){+.+.}-{3:3}, at: __alloc_pages_may_oom mm/page_alloc.c:4281 [inline]
#1: ffffffff85279268 (oom_lock){+.+.}-{3:3}, at: __alloc_pages_slowpath.constprop.0+0xcc9/0x1f10 mm/page_alloc.c:5063
#2: ffff8880431a2360 (&p->alloc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
#2: ffff8880431a2360 (&p->alloc_lock){+.+.}-{2:2}, at: task_lock include/linux/sched/task.h:170 [inline]
#2: ffff8880431a2360 (&p->alloc_lock){+.+.}-{2:2}, at: find_lock_task_mm+0xe3/0x2b0 mm/oom_kill.c:144
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 13194 Comm: syz-executor.6 Not tainted 5.16.0-rc8-next-20220107 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
__might_resched.cold+0x222/0x26b kernel/sched/core.c:9583
__mutex_lock_common kernel/locking/mutex.c:577 [inline]
__mutex_lock+0x9e/0x1480 kernel/locking/mutex.c:733
futex_cleanup_begin kernel/futex/core.c:1058 [inline]
futex_exit_release+0x2d/0x220 kernel/futex/core.c:1110
__oom_kill_process+0x373/0xf90 mm/oom_kill.c:893
oom_kill_process+0xd7/0x5c0 mm/oom_kill.c:1003
out_of_memory+0x1198/0x1460 mm/oom_kill.c:1114
__alloc_pages_may_oom mm/page_alloc.c:4332 [inline]
__alloc_pages_slowpath.constprop.0+0x1972/0x1f10 mm/page_alloc.c:5063
__alloc_pages+0x403/0x4e0 mm/page_alloc.c:5394
alloc_pages_vma+0xde/0x500 mm/mempolicy.c:2232
wp_page_copy+0xe51/0x2720 mm/memory.c:2985
do_wp_page+0x285/0x1d50 mm/memory.c:3300
handle_pte_fault mm/memory.c:4566 [inline]
__handle_mm_fault+0x1183/0x3570 mm/memory.c:4683
handle_mm_fault+0x2e6/0xa20 mm/memory.c:4781
do_user_addr_fault+0x54a/0x12a0 arch/x86/mm/fault.c:1397
handle_page_fault arch/x86/mm/fault.c:1484 [inline]
exc_page_fault+0xa2/0x1a0 arch/x86/mm/fault.c:1540
asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7f15d17e1d30
Code: Unable to access opcode bytes at RIP 0x7f15d17e1d06.
RSP: 002b:00007ffe24628620 EFLAGS: 00010246
RAX: 0000000041e0af8d RBX: 00007f15d13ab008 RCX: 0000001b2dd20000
RDX: 0000001b2dd20018 RSI: ffffffff8149e6e7 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000041e0af8d R09: 0000001b2dd2001c
R10: 0000000000000f8d R11: 0000000041e0af91 R12: 0000000000000000
R13: 00007f15d193b000 R14: ffffffff8149e6e7 R15: 00007f15d19470b0
=============================
[ BUG: Invalid wait context ]
5.16.0-rc8-next-20220107 #1 Tainted: G W
-----------------------------
syz-executor.6/13194 is trying to lock:
ffff8880431a2d70 (&tsk->futex_exit_mutex){+.+.}-{3:3}, at: futex_cleanup_begin kernel/futex/core.c:1058 [inline]
ffff8880431a2d70 (&tsk->futex_exit_mutex){+.+.}-{3:3}, at: futex_exit_release+0x2d/0x220 kernel/futex/core.c:1110
other info that might help us debug this:
context-{4:4}
3 locks held by syz-executor.6/13194:
#0: ffff888019e26a28 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline]
#0: ffff888019e26a28 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x346/0x12a0 arch/x86/mm/fault.c:1338
#1: ffffffff85279268 (oom_lock){+.+.}-{3:3}, at: __alloc_pages_may_oom mm/page_alloc.c:4281 [inline]
#1: ffffffff85279268 (oom_lock){+.+.}-{3:3}, at: __alloc_pages_slowpath.constprop.0+0xcc9/0x1f10 mm/page_alloc.c:5063
#2: ffff8880431a2360 (&p->alloc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
#2: ffff8880431a2360 (&p->alloc_lock){+.+.}-{2:2}, at: task_lock include/linux/sched/task.h:170 [inline]
#2: ffff8880431a2360 (&p->alloc_lock){+.+.}-{2:2}, at: find_lock_task_mm+0xe3/0x2b0 mm/oom_kill.c:144
stack backtrace:
CPU: 1 PID: 13194 Comm: syz-executor.6 Tainted: G W 5.16.0-rc8-next-20220107 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
print_lock_invalid_wait_context kernel/locking/lockdep.c:4678 [inline]
check_wait_context kernel/locking/lockdep.c:4739 [inline]
__lock_acquire.cold+0xc8/0x3b4 kernel/locking/lockdep.c:4977
lock_acquire kernel/locking/lockdep.c:5639 [inline]
lock_acquire+0x1a2/0x4d0 kernel/locking/lockdep.c:5604
__mutex_lock_common kernel/locking/mutex.c:600 [inline]
__mutex_lock+0x136/0x1480 kernel/locking/mutex.c:733
futex_cleanup_begin kernel/futex/core.c:1058 [inline]
futex_exit_release+0x2d/0x220 kernel/futex/core.c:1110
__oom_kill_process+0x373/0xf90 mm/oom_kill.c:893
oom_kill_process+0xd7/0x5c0 mm/oom_kill.c:1003
out_of_memory+0x1198/0x1460 mm/oom_kill.c:1114
__alloc_pages_may_oom mm/page_alloc.c:4332 [inline]
__alloc_pages_slowpath.constprop.0+0x1972/0x1f10 mm/page_alloc.c:5063
__alloc_pages+0x403/0x4e0 mm/page_alloc.c:5394
alloc_pages_vma+0xde/0x500 mm/mempolicy.c:2232
wp_page_copy+0xe51/0x2720 mm/memory.c:2985
do_wp_page+0x285/0x1d50 mm/memory.c:3300
handle_pte_fault mm/memory.c:4566 [inline]
__handle_mm_fault+0x1183/0x3570 mm/memory.c:4683
handle_mm_fault+0x2e6/0xa20 mm/memory.c:4781
do_user_addr_fault+0x54a/0x12a0 arch/x86/mm/fault.c:1397
handle_page_fault arch/x86/mm/fault.c:1484 [inline]
exc_page_fault+0xa2/0x1a0 arch/x86/mm/fault.c:1540
asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7f15d17e1d30
Code: Unable to access opcode bytes at RIP 0x7f15d17e1d06.
RSP: 002b:00007ffe24628620 EFLAGS: 00010246
RAX: 0000000041e0af8d RBX: 00007f15d13ab008 RCX: 0000001b2dd20000
RDX: 0000001b2dd20018 RSI: ffffffff8149e6e7 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000041e0af8d R09: 0000001b2dd2001c
R10: 0000000000000f8d R11: 0000000041e0af91 R12: 0000000000000000
R13: 00007f15d193b000 R14: ffffffff8149e6e7 R15: 00007f15d19470b0
Out of memory (oom_kill_allocating_task): Killed process 13194 (syz-executor.6) total-vm:93544kB, anon-rss:400kB, file-rss:34060kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000
oom_reaper: reaped process 13194 (syz-executor.6), now anon-rss:0kB, file-rss:34056kB, shmem-rss:0kB
syz-executor.0 invoked oom-killer: gfp_mask=0x1100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0
CPU: 1 PID: 13198 Comm: syz-executor.0 Tainted: G W 5.16.0-rc8-next-20220107 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
dump_header+0x106/0x60f mm/oom_kill.c:464
oom_kill_process.cold+0x10/0x15 mm/oom_kill.c:994
out_of_memory+0x1198/0x1460 mm/oom_kill.c:1114
__alloc_pages_may_oom mm/page_alloc.c:4332 [inline]
__alloc_pages_slowpath.constprop.0+0x1972/0x1f10 mm/page_alloc.c:5063
__alloc_pages+0x403/0x4e0 mm/page_alloc.c:5394
alloc_pages_vma+0xde/0x500 mm/mempolicy.c:2232
wp_page_copy+0x1b7/0x2720 mm/memory.c:2990
do_wp_page+0x285/0x1d50 mm/memory.c:3300
handle_pte_fault mm/memory.c:4566 [inline]
__handle_mm_fault+0x1183/0x3570 mm/memory.c:4683
handle_mm_fault+0x2e6/0xa20 mm/memory.c:4781
do_user_addr_fault+0x54a/0x12a0 arch/x86/mm/fault.c:1397
handle_page_fault arch/x86/mm/fault.c:1484 [inline]
exc_page_fault+0xa2/0x1a0 arch/x86/mm/fault.c:1540
asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0010:__put_user_nocheck_4+0x3/0x11
Code: 00 00 48 39 d9 73 54 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 0f 1f 44 00 00 48 bb fd ef ff ff ff 7f 00 00 48 39 d9 73 34 0f 01 cb <89> 01 31 c9 0f 01 ca c3 66 0f 1f 44 00 00 48 bb f9 ef ff ff ff 7f
RSP: 0018:ffff888015d3ff38 EFLAGS: 00050293
RAX: 00000000000003bf RBX: 00007fffffffeffd RCX: 000055555593a6d0
RDX: 1ffff1100300d7e3 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 000055555593a6d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
schedule_tail+0xaa/0xd0 kernel/sched/core.c:4926
ret_from_fork+0x8/0x30 arch/x86/entry/entry_64.S:280
Mem-Info:
active_anon:3240 inactive_anon:59680 isolated_anon:0
active_file:28 inactive_file:23 isolated_file:0
unevictable:0 dirty:9 writeback:0
slab_reclaimable:7570 slab_unreclaimable:64619
mapped:69660 shmem:114 pagetables:3655 bounce:0
kernel_misc_reclaimable:0
free:3455 free_pcp:0 free_cma:0
Node 0 active_anon:12960kB inactive_anon:238720kB active_file:112kB inactive_file:92kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:278640kB dirty:36kB writeback:0kB shmem:456kB writeback_tmp:0kB kernel_stack:7072kB pagetables:14620kB all_unreclaimable? no
Node 0 DMA free:6508kB boost:0kB min:44kB low:56kB high:68kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 1617 1617 1617
Node 0 DMA32 free:7312kB boost:2048kB min:7168kB low:8824kB high:10480kB reserved_highatomic:2048KB active_anon:12960kB inactive_anon:238972kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:372kB present:2080640kB managed:1660808kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0
Node 0 DMA: 0*4kB 2*8kB (U) 0*16kB 1*32kB (U) 1*64kB (U) 0*128kB 1*256kB (U) 0*512kB 0*1024kB 1*2048kB (M) 1*4096kB (M) = 6512kB
Node 0 DMA32: 1023*4kB (UMH) 198*8kB (UMEH) 32*16kB (UME) 24*32kB (UMH) 5*64kB (H) 1*128kB (H) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 7404kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
193 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
524158 pages RAM
0 pages HighMem/MovableOnly
105116 pages reserved
Unreclaimable slab info:
Name Used Total
pid_4 15KB 15KB
pid_3 11KB 11KB
pid_2 83KB 97KB
IEEE-802.15.4-MAC 63KB 63KB
IEEE-802.15.4-RAW 63KB 63KB
fib6_nodes 28KB 28KB
ip6_dst_cache 37KB 37KB
PINGv6 31KB 31KB
RAWv6 189KB 189KB
UDPLITEv6 62KB 62KB
UDPv6 62KB 62KB
tw_sock_TCPv6 15KB 15KB
TCPv6 62KB 62KB
scsi_sense_cache 8KB 8KB
sd_ext_cdb 3KB 3KB
virtio_scsi_cmd 16KB 16KB
bio-96 7KB 7KB
sgpool-128 119KB 297KB
sgpool-64 63KB 63KB
sgpool-32 193KB 252KB
sgpool-16 120KB 120KB
sgpool-8 116KB 131KB
bio-224 7KB 7KB
mqueue_inode_cache 60KB 60KB
nfs_commit_data 15KB 15KB
nfs_write_data 47KB 47KB
jbd2_inode 7KB 7KB
ext4_system_zone 7KB 7KB
ext4_io_end_vec 15KB 15KB
ext4_bio_post_read_ctx 15KB 15KB
io_kiocb 35KB 52KB
kioctx 31KB 31KB
aio_kiocb 7KB 7KB
dio 30KB 30KB
fasync_cache 7KB 7KB
pid_namespace 15KB 15KB
posix_timers_cache 7KB 7KB
rpc_buffers 31KB 31KB
rpc_tasks 3KB 3KB
UNIX-STREAM 135KB 217KB
UNIX 195KB 279KB
UDP-Lite 63KB 63KB
tcp_bind_bucket 8KB 8KB
inet_peer_cache 4KB 4KB
xfrm_state 32KB 32KB
ip_fib_trie 12KB 12KB
ip_fib_alias 15KB 15KB
ip_dst_cache 16KB 16KB
PING 62KB 62KB
RAW 125KB 125KB
UDP 283KB 283KB
request_sock_TCP 15KB 15KB
TCP 58KB 58KB
hugetlbfs_inode_cache 31KB 31KB
bio-216 11KB 11KB
ep_head 8KB 8KB
eventpoll_pwq 19KB 19KB
eventpoll_epi 47KB 47KB
inotify_inode_mark 58KB 58KB
request_queue 62KB 62KB
blkdev_ioc 8KB 8KB
bio-160 44KB 44KB
biovec-max 1398KB 1538KB
biovec-128 31KB 31KB
biovec-64 554KB 645KB
biovec-16 67KB 67KB
user_namespace 30KB 30KB
uid_cache 7KB 7KB
dmaengine-unmap-2 4KB 4KB
audit_buffer 7KB 7KB
skbuff_fclone_cache 97KB 97KB
skbuff_head_cache 133KB 146KB
configfs_dir_cache 4KB 4KB
file_lock_cache 63KB 63KB
file_lock_ctx 7KB 7KB
fsnotify_mark_connector 32KB 32KB
net_namespace 93KB 93KB
taskstats 53KB 53KB
proc_dir_entry 385KB 408KB
pde_opener 27KB 27KB
seq_file 52KB 52KB
sigqueue 35KB 35KB
shmem_inode_cache 1576KB 1623KB
kernfs_iattrs_cache 231KB 231KB
kernfs_node_cache 5264KB 5280KB
mnt_cache 291KB 307KB
filp 2363KB 2482KB
names_cache 21726KB 22559KB
hashtab_node 274KB 274KB
ebitmap_node 1149KB 1149KB
avtab_node 4976KB 4976KB
avc_node 39KB 39KB
lsm_inode_cache 2709KB 3063KB
lsm_file_cache 122KB 136KB
key_jar 39KB 39KB
uts_namespace 15KB 15KB
nsproxy 15KB 15KB
vm_area_struct 1921KB 2004KB
mm_struct 353KB 409KB
fs_cache 46KB 64KB
files_cache 223KB 223KB
signal_cache 452KB 516KB
sighand_cache 494KB 511KB
task_struct 2126KB 2380KB
cred_jar 174KB 200KB
anon_vma_chain 464KB 519KB
anon_vma 468KB 480KB
pid 60KB 60KB
Acpi-Operand 95KB 158KB
Acpi-ParseExt 31KB 31KB
Acpi-Parse 51KB 67KB
Acpi-State 35KB 51KB
Acpi-Namespace 28KB 28KB
numa_policy 7KB 7KB
perf_event 63KB 63KB
trace_event_file 175KB 175KB
ftrace_event_field 296KB 296KB
pool_workqueue 48KB 48KB
task_group 16KB 16KB
vmap_area 39KB 51KB
page->ptl 433KB 468KB
kmemleak_scan_area 31KB 31KB
kmemleak_object 140472KB 152641KB
kmalloc-cg-8k 96KB 96KB
kmalloc-cg-4k 1200KB 1216KB
kmalloc-cg-2k 1052KB 1152KB
kmalloc-cg-1k 264KB 320KB
kmalloc-cg-512 310KB 352KB
kmalloc-cg-256 32KB 32KB
kmalloc-cg-192 28KB 28KB
kmalloc-cg-128 16KB 16KB
kmalloc-cg-96 44KB 48KB
kmalloc-cg-64 44KB 44KB
kmalloc-cg-32 56KB 76KB
kmalloc-cg-16 16KB 16KB
kmalloc-cg-8 23KB 23KB
kmalloc-8k 4896KB 4896KB
kmalloc-4k 7408KB 7520KB
kmalloc-2k 4212KB 4544KB
kmalloc-1k 2002KB 3456KB
kmalloc-512 1806KB 3360KB
kmalloc-256 1028KB 1072KB
kmalloc-192 419KB 692KB
kmalloc-128 463KB 564KB
kmalloc-96 311KB 500KB
kmalloc-64 994KB 1192KB
kmalloc-32 779KB 808KB
kmalloc-16 326KB 332KB
kmalloc-8 271KB 278KB
kmem_cache_node 51KB 51KB
kmem_cache 82KB 82KB
oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz0,mems_allowed=0,global_oom,task_memcg=/syz0,task=syz-executor.0,pid=13198,uid=0
Out of memory (oom_kill_allocating_task): Killed process 13198 (syz-executor.0) total-vm:93280kB, anon-rss:388kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:108kB oom_score_adj:0
oom_reaper: reaped process 13198 (syz-executor.0), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB
loop6: detected capacity change from 0 to 512
EXT4-fs error (device loop6): __ext4_fill_super:5277: inode #2: comm syz-executor.6: iget: root inode unallocated
EXT4-fs (loop6): get root inode failed
EXT4-fs (loop6): mount failed
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 48 39 d9 cmp %rbx,%rcx
5: 73 54 jae 0x5b
7: 0f 01 cb stac
a: 66 89 01 mov %ax,(%rcx)
d: 31 c9 xor %ecx,%ecx
f: 0f 01 ca clac
12: c3 retq
13: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
18: 48 bb fd ef ff ff ff movabs $0x7fffffffeffd,%rbx
1f: 7f 00 00
22: 48 39 d9 cmp %rbx,%rcx
25: 73 34 jae 0x5b
27: 0f 01 cb stac
* 2a: 89 01 mov %eax,(%rcx) <-- trapping instruction
2c: 31 c9 xor %ecx,%ecx
2e: 0f 01 ca clac
31: c3 retq
32: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
38: 48 rex.W
39: bb f9 ef ff ff mov $0xffffeff9,%ebx
3e: ff (bad)
3f: 7f .byte 0x7f