============================= WARNING: suspicious RCU usage 4.15.0-rc9+ #214 Not tainted ----------------------------- ./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 0 3 locks held by syz-executor1/6090: #0: (&mm->mmap_sem){++++}, at: [<0000000069911e62>] __do_page_fault+0x32d/0xc90 arch/x86/mm/fault.c:1359 #1: (&p->pi_lock){-.-.}, at: [<00000000981a9e0e>] try_to_wake_up+0xbc/0x1600 kernel/sched/core.c:1988 #2: (rcu_read_lock){....}, at: [<0000000027a526a3>] select_task_rq_fair+0x37a/0x2770 kernel/sched/fair.c:6323 stack backtrace: CPU: 1 PID: 6090 Comm: syz-executor1 Not tainted 4.15.0-rc9+ #214 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4585 rcu_preempt_sleep_check include/linux/rcupdate.h:301 [inline] ___might_sleep+0x385/0x470 kernel/sched/core.c:6025 clear_huge_page+0x24f/0x730 mm/memory.c:4601 __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline] do_huge_pmd_anonymous_page+0x59c/0x1b00 mm/huge_memory.c:728 create_huge_pmd mm/memory.c:3834 [inline] __handle_mm_fault+0x1a0c/0x3ce0 mm/memory.c:4038 handle_mm_fault+0x334/0x8d0 mm/memory.c:4104 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1430 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1505 page_fault+0x4c/0x60 arch/x86/entry/entry_64.S:1260 RIP: 0033:0x405ad1 RSP: 002b:0000000000a2f460 EFLAGS: 00010246 RAX: 0000000020c9b2ac RBX: 000000000071bea0 RCX: 0000000000000058 RDX: d8069f16ec848a7e RSI: 0000000000000000 RDI: 0000000002718848 RBP: 0000000000000006 R08: 0000000000000000 R09: 000000000000003a R10: 0000000000a2f460 R11: 0000000000000206 R12: 0000000000000004 R13: fffffffffffffffe R14: 000000000071ca20 R15: ffffffffffffffff ================================ WARNING: inconsistent lock state 4.15.0-rc9+ #214 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz-executor6/6091 [HC0[0]:SC1[1]:HE1:SE0] takes: (&(&est->lock)->rlock){+.?.}, at: [<000000000f6afe30>] spin_lock include/linux/spinlock.h:310 [inline] (&(&est->lock)->rlock){+.?.}, at: [<000000000f6afe30>] est_fetch_counters+0x4f/0x150 net/core/gen_estimator.c:70 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:310 [inline] est_fetch_counters+0x4f/0x150 net/core/gen_estimator.c:70 gen_new_estimator+0x317/0x770 net/core/gen_estimator.c:162 xt_rateest_tg_checkentry+0x487/0xaa0 net/netfilter/xt_RATEEST.c:135 xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:845 check_target net/ipv6/netfilter/ip6_tables.c:538 [inline] find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:580 translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:749 do_replace net/ipv6/netfilter/ip6_tables.c:1165 [inline] do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1691 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1422 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2978 SYSC_setsockopt net/socket.c:1849 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1828 entry_SYSCALL_64_fastpath+0x29/0xa0 irq event stamp: 1242 hardirqs last enabled at (1242): [<000000007a65ae8f>] restore_regs_and_return_to_kernel+0x0/0x21 hardirqs last disabled at (1241): [<00000000dc7b7283>] reschedule_interrupt+0xa4/0xb0 arch/x86/entry/entry_64.S:961 softirqs last enabled at (1164): [<000000003b0bab99>] __do_softirq+0x7a0/0xb85 kernel/softirq.c:311 softirqs last disabled at (1237): [<000000005093db43>] invoke_softirq kernel/softirq.c:365 [inline] softirqs last disabled at (1237): [<000000005093db43>] irq_exit+0x1cc/0x200 kernel/softirq.c:405 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&est->lock)->rlock); lock(&(&est->lock)->rlock); *** DEADLOCK *** 2 locks held by syz-executor6/6091: #0: (&mm->mmap_sem){++++}, at: [<0000000069911e62>] __do_page_fault+0x32d/0xc90 arch/x86/mm/fault.c:1359 #1: ((&est->timer)){+.-.}, at: [<00000000c4a2a3d8>] lockdep_copy_map include/linux/lockdep.h:178 [inline] #1: ((&est->timer)){+.-.}, at: [<00000000c4a2a3d8>] call_timer_fn+0x1c6/0x820 kernel/time/timer.c:1308 stack backtrace: CPU: 0 PID: 6091 Comm: syz-executor6 Not tainted 4.15.0-rc9+ #214 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_usage_bug+0x377/0x38c kernel/locking/lockdep.c:2537 valid_state kernel/locking/lockdep.c:2550 [inline] mark_lock_irq kernel/locking/lockdep.c:2744 [inline] mark_lock+0xf61/0x1430 kernel/locking/lockdep.c:3142 mark_irqflags kernel/locking/lockdep.c:3020 [inline] __lock_acquire+0x173a/0x3e00 kernel/locking/lockdep.c:3383 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:310 [inline] est_fetch_counters+0x4f/0x150 net/core/gen_estimator.c:70 est_timer+0x97/0x7c0 net/core/gen_estimator.c:85 call_timer_fn+0x228/0x820 kernel/time/timer.c:1318 expire_timers kernel/time/timer.c:1355 [inline] __run_timers+0x7ee/0xb70 kernel/time/timer.c:1658 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1684 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285 invoke_softirq kernel/softirq.c:365 [inline] irq_exit+0x1cc/0x200 kernel/softirq.c:405 exiting_irq arch/x86/include/asm/apic.h:541 [inline] smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052 apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:937 RIP: 0010:debug_lockdep_rcu_enabled+0x5a/0x90 kernel/rcu/update.c:300 RSP: 0018:ffff8801bfb27618 EFLAGS: 00000a02 ORIG_RAX: ffffffffffffff11 RAX: ffffffff86cf69a0 RBX: 1ffff10037f64ec5 RCX: ffffffff819cdaec RDX: 0000000000000004 RSI: ffffffff86b41580 RDI: ffffffff86cf69a0 RBP: ffff8801bfb27618 R08: 1ffff10037f64e47 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffffffff85f18cc0 R14: 00000000000011f6 R15: ffffffff85f18cc0 ___might_sleep+0x74/0x470 kernel/sched/core.c:6025 clear_huge_page+0x19b/0x730 mm/memory.c:4598 __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline] do_huge_pmd_anonymous_page+0x59c/0x1b00 mm/huge_memory.c:728 create_huge_pmd mm/memory.c:3834 [inline] __handle_mm_fault+0x1a0c/0x3ce0 mm/memory.c:4038 handle_mm_fault+0x334/0x8d0 mm/memory.c:4104 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1430 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1505 page_fault+0x4c/0x60 arch/x86/entry/entry_64.S:1260 RIP: 0033:0x43a6d1 RSP: 002b:0000000000a2f498 EFLAGS: 00010202 RAX: 0000000020beb000 RBX: 000000000071bea0 RCX: 0000000000000017 RDX: 0000000000000001 RSI: 0000000000720490 RDI: 0000000020beb000 RBP: 0000000000000006 R08: 0000000000a2f510 R09: 0000000000000004 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000003 R13: fffffffffffffffe R14: 000000000071ca20 R15: 0000000000000002 device syz5 entered promiscuous mode device syz5 left promiscuous mode xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables xt_CT: No such timeout policy "syz1" xt_CT: No such timeout policy "syz1" x_tables: ip_tables: TCPMSS target: only valid for protocol 6 device syz1 entered promiscuous mode x_tables: ip_tables: TCPMSS target: only valid for protocol 6 device syz1 left promiscuous mode sock: sock_set_timeout: `syz-executor0' (pid 6386) tries to set negative timeout sock: sock_set_timeout: `syz-executor0' (pid 6386) tries to set negative timeout kauditd_printk_skb: 23 callbacks suppressed audit: type=1400 audit(1517215419.800:45): avc: denied { create } for pid=6447 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 audit: type=1400 audit(1517215419.853:46): avc: denied { write } for pid=6447 comm="syz-executor5" path="socket:[15815]" dev="sockfs" ino=15815 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 rdma_op 000000001ca686ec conn xmit_rdma (null) rdma_op 00000000f8a18a10 conn xmit_rdma (null) device lo entered promiscuous mode audit: type=1400 audit(1517215420.059:47): avc: denied { listen } for pid=6557 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 dccp_close: ABORT with 20 bytes unread nla_parse: 1 callbacks suppressed netlink: 11 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor1'. xt_hashlimit: overflow, rate too high: 0 xt_hashlimit: overflow, rate too high: 0 openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) openvswitch: netlink: Flow get message rejected, Key attribute missing. TCP: request_sock_TCPv6: Possible SYN flooding on port 20022. Sending cookies. Check SNMP counters. openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) openvswitch: netlink: Flow get message rejected, Key attribute missing. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27339 sclass=netlink_route_socket pig=6887 comm=syz-executor6 dccp_invalid_packet: P.Data Offset(4) too small SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27339 sclass=netlink_route_socket pig=6900 comm=syz-executor6 dccp_invalid_packet: P.Data Offset(4) too small sock: sock_set_timeout: `syz-executor0' (pid 6949) tries to set negative timeout device lo entered promiscuous mode netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 'syz-executor1': attribute type 1 has an invalid length. netlink: 'syz-executor1': attribute type 1 has an invalid length. netlink: 17 bytes leftover after parsing attributes in process `syz-executor4'. audit: type=1400 audit(1517215422.150:48): avc: denied { getopt } for pid=7275 comm="syz-executor6" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 audit: type=1400 audit(1517215422.451:49): avc: denied { map } for pid=7373 comm="syz-executor4" path="socket:[17551]" dev="sockfs" ino=17551 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=socket permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27011 sclass=netlink_route_socket pig=7395 comm=syz-executor5 audit: type=1400 audit(1517215422.575:50): avc: denied { map } for pid=7418 comm="syz-executor6" path="socket:[16937]" dev="sockfs" ino=16937 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=rawip_socket permissive=1 sctp: [Deprecated]: syz-executor6 (pid 7424) Use of int in maxseg socket option. Use struct sctp_assoc_value instead syz-executor6: vmalloc: allocation failure: 17179344896 bytes, mode:0x14080c0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) syz-executor6 cpuset=/ mems_allowed=0 CPU: 1 PID: 7548 Comm: syz-executor6 Not tainted 4.15.0-rc9+ #214 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 warn_alloc+0x19a/0x2b0 mm/page_alloc.c:3299 __vmalloc_node_range+0x4f0/0x650 mm/vmalloc.c:1775 __vmalloc_node mm/vmalloc.c:1804 [inline] __vmalloc_node_flags_caller+0x50/0x60 mm/vmalloc.c:1826 kvmalloc_node+0x82/0xd0 mm/util.c:406 kvmalloc include/linux/mm.h:541 [inline] kvmalloc_array include/linux/mm.h:557 [inline] xt_alloc_entry_offsets+0x21/0x30 net/netfilter/x_tables.c:774 translate_table+0x235/0x1690 net/ipv6/netfilter/ip6_tables.c:704 do_replace net/ipv6/netfilter/ip6_tables.c:1165 [inline] do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1691 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2896 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2978 SYSC_setsockopt net/socket.c:1849 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1828 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007f9a0407bc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00000000000005ca R08: 0000000000000004 R09: 0000000000000000 R10: 0000000020001fde R11: 0000000000000212 R12: 00000000006f7b90 R13: 00000000ffffffff R14: 00007f9a0407c6d4 R15: 0000000000000000 Mem-Info: active_anon:53905 inactive_anon:63 isolated_anon:0 active_file:3459 inactive_file:8341 isolated_file:0 unevictable:0 dirty:6390 writeback:0 unstable:0 slab_reclaimable:7786 slab_unreclaimable:87890 mapped:24171 shmem:70 pagetables:667 bounce:0 free:1442467 free_pcp:499 free_cma:0 Node 0 active_anon:217672kB inactive_anon:252kB active_file:13836kB inactive_file:33364kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:96684kB dirty:25560kB writeback:0kB shmem:280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 100352kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2868 6378 6378 Node 0 DMA32 free:2939312kB min:30320kB low:37900kB high:45480kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2940016kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:704kB local_pcp:44kB free_cma:0kB lowmem_reserve[]: 0 0 3510 3510 Node 0 Normal free:2825640kB min:37096kB low:46368kB high:55640kB active_anon:205196kB inactive_anon:252kB active_file:13836kB inactive_file:33364kB unevictable:0kB writepending:25560kB present:4718592kB managed:3594332kB mlocked:0kB kernel_stack:3840kB pagetables:2520kB bounce:0kB free_pcp:1280kB local_pcp:552kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB Node 0 DMA32: 2*4kB (M) 3*8kB (M) 3*16kB (M) 1*32kB (M) 1*64kB (M) 2*128kB (M) 2*256kB (M) 3*512kB (M) 2*1024kB (M) 1*2048kB (M) 716*4096kB (M) = 2939312kB Node 0 Normal: 134*4kB (UM) 21*8kB (M) 8*16kB (UME) 525*32kB (UE) 163*64kB (UM) 48*128kB (UM) 6*256kB (UM) 15*512kB (UME) 7*1024kB (UE) 7*2048kB (UM) 674*4096kB (M) = 2825632kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 11869 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 328415 pages reserved audit: type=1400 audit(1517215423.495:51): avc: denied { net_broadcast } for pid=7603 comm="syz-executor0" capability=11 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 netlink: 'syz-executor6': attribute type 1 has an invalid length. netlink: 'syz-executor6': attribute type 1 has an invalid length. netlink: 5 bytes leftover after parsing attributes in process `syz-executor4'. audit: type=1400 audit(1517215424.300:52): avc: denied { setopt } for pid=7929 comm="syz-executor6" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1517215424.513:53): avc: denied { map } for pid=8009 comm="syz-executor5" path="socket:[18051]" dev="sockfs" ino=18051 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=packet_socket permissive=1 audit: type=1400 audit(1517215424.559:54): avc: denied { map } for pid=8015 comm="syz-executor1" path="socket:[17387]" dev="sockfs" ino=17387 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=1 RDS: rds_bind could not find a transport for 172.20.0.14, load rds_tcp or rds_rdma? RDS: rds_bind could not find a transport for 172.20.0.14, load rds_tcp or rds_rdma? netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. sctp: [Deprecated]: syz-executor4 (pid 8345) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor4 (pid 8345) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead net_ratelimit: 1 callbacks suppressed dccp_v4_rcv: dropped packet with invalid checksum netlink: 'syz-executor5': attribute type 3 has an invalid length. netlink: 'syz-executor5': attribute type 3 has an invalid length. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 netlink: 20 bytes leftover after parsing attributes in process `syz-executor7'. tc_dump_action: action bad kind netlink: 20 bytes leftover after parsing attributes in process `syz-executor7'. tc_dump_action: action bad kind CPU: 0 PID: 8664 Comm: syz-executor0 Not tainted 4.15.0-rc9+ #214 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 kmalloc_node include/linux/slab.h:537 [inline] kzalloc_node include/linux/slab.h:699 [inline] __get_vm_area_node+0xae/0x340 mm/vmalloc.c:1402 __vmalloc_node_range+0xa3/0x650 mm/vmalloc.c:1754 __vmalloc_node mm/vmalloc.c:1804 [inline] __vmalloc+0x45/0x50 mm/vmalloc.c:1810 bpf_prog_alloc+0xaa/0x350 kernel/bpf/core.c:84 bpf_prog_load+0x2e3/0x1bb0 kernel/bpf/syscall.c:1209 SYSC_bpf kernel/bpf/syscall.c:1881 [inline] SyS_bpf+0xe10/0x4860 kernel/bpf/syscall.c:1843 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007f8a7d8f8c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f8a7d8f8aa0 RCX: 0000000000453299 RDX: 0000000000000048 RSI: 0000000020cd2fb8 RDI: 0000000000000005 RBP: 00007f8a7d8f8a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007f8a7d8f8bc8 R14: 00000000004b8096 R15: 0000000000000000 syz-executor0: vmalloc: allocation failure: 4096 bytes, mode:0x14280c0(GFP_USER|__GFP_ZERO), nodemask=(null) syz-executor0 cpuset=/ mems_allowed=0 CPU: 0 PID: 8664 Comm: syz-executor0 Not tainted 4.15.0-rc9+ #214 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 warn_alloc+0x19a/0x2b0 mm/page_alloc.c:3299 __vmalloc_node_range+0x4f0/0x650 mm/vmalloc.c:1775 __vmalloc_node mm/vmalloc.c:1804 [inline] __vmalloc+0x45/0x50 mm/vmalloc.c:1810 bpf_prog_alloc+0xaa/0x350 kernel/bpf/core.c:84 bpf_prog_load+0x2e3/0x1bb0 kernel/bpf/syscall.c:1209 SYSC_bpf kernel/bpf/syscall.c:1881 [inline] SyS_bpf+0xe10/0x4860 kernel/bpf/syscall.c:1843 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007f8a7d8f8c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f8a7d8f8aa0 RCX: 0000000000453299 RDX: 0000000000000048 RSI: 0000000020cd2fb8 RDI: 0000000000000005 RBP: 00007f8a7d8f8a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007f8a7d8f8bc8 R14: 00000000004b8096 R15: 0000000000000000 Mem-Info: active_anon:52340 inactive_anon:63 isolated_anon:0 active_file:3462 inactive_file:8348 isolated_file:0 unevictable:0 dirty:6333 writeback:0 unstable:0 slab_reclaimable:8462 slab_unreclaimable:84774 mapped:24156 shmem:70 pagetables:621 bounce:0 free:1446610 free_pcp:494 free_cma:0 Node 0 active_anon:209360kB inactive_anon:252kB active_file:13848kB inactive_file:33392kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:96624kB dirty:25332kB writeback:0kB shmem:280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 83968kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2868 6378 6378 Node 0 DMA32 free:2939312kB min:30320kB low:37900kB high:45480kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2940016kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:704kB local_pcp:44kB free_cma:0kB lowmem_reserve[]: 0 0 3510 3510 Node 0 Normal free:2831220kB min:37096kB low:46368kB high:55640kB active_anon:209360kB inactive_anon:252kB active_file:13848kB inactive_file:33392kB unevictable:0kB writepending:25332kB present:4718592kB managed:3594332kB mlocked:0kB kernel_stack:3808kB pagetables:2484kB bounce:0kB free_pcp:1268kB local_pcp:604kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB Node 0 DMA32: 2*4kB (M) 3*8kB (M) 3*16kB (M) 1*32kB (M) 1*64kB (M) 2*128kB (M) 2*256kB (M) 3*512kB (M) 2*1024kB (M) 1*2048kB (M) 716*4096kB (M) = 2939312kB Node 0 Normal: 95*4kB (UME) 81*8kB (UM) 11*16kB (UM) 78*32kB (UME) 217*64kB (UM) 54*128kB (U) 10*256kB (UE) 19*512kB (UME) 13*1024kB (U) 8*2048kB (UME) 675*4096kB (UM) = 2831284kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 11885 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 328415 pages reserved netlink: 'syz-executor5': attribute type 1 has an invalid length. sock: process `syz-executor1' is using obsolete setsockopt SO_BSDCOMPAT audit: type=1400 audit(1517215427.598:55): avc: denied { setopt } for pid=8845 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1