================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
dhcpcd-run-hook/5670 is leaving the kernel with locks still held!
5 locks held by dhcpcd-run-hook/5670:
#0: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: do_fault_around mm/memory.c:5850 [inline]
#0: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: do_read_fault mm/memory.c:5884 [inline]
#0: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: do_fault+0x8b4/0x1750 mm/memory.c:6027
#1: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#1: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: filemap_map_pages+0x1c5/0x2140 mm/filemap.c:3895
#2: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#2: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290
#3: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#3: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: lruvec_stat_mod_folio+0x76/0x2b0 mm/memcontrol.c:974
#4: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: lruvec_stat_mod_folio+0x76/0x2b0 mm/memcontrol.c:974
BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:323
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5670, name: dhcpcd-run-hook
preempt_count: 0, expected: 0
RCU nest depth: 5, expected: 0
INFO: lockdep is turned off.
CPU: 2 UID: 0 PID: 5670 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
__might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9162
might_alloc include/linux/sched/mm.h:323 [inline]
prepare_alloc_pages+0x44a/0x5f0 mm/page_alloc.c:4995
__alloc_frozen_pages_noprof+0x19a/0x2bc0 mm/page_alloc.c:5215
alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490
folio_alloc_mpol_noprof+0x36/0x260 mm/mempolicy.c:2509
vma_alloc_folio_noprof+0xed/0x1d0 mm/mempolicy.c:2544
folio_prealloc mm/memory.c:1191 [inline]
alloc_anon_folio mm/memory.c:5282 [inline]
do_anonymous_page+0xb46/0x2050 mm/memory.c:5376
do_pte_missing mm/memory.c:4548 [inline]
handle_pte_fault mm/memory.c:6411 [inline]
__handle_mm_fault+0x1d2c/0x2a00 mm/memory.c:6549
handle_mm_fault+0x36d/0xa20 mm/memory.c:6718
do_user_addr_fault+0x5a3/0x12f0 arch/x86/mm/fault.c:1334
handle_page_fault arch/x86/mm/fault.c:1474 [inline]
exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fe544e18d34
Code: 8d 34 19 49 39 d0 49 89 70 60 0f 95 c2 48 29 d8 48 83 c1 10 0f b6 d2 48 83 c8 01 48 c1 e2 02 48 09 da 48 83 ca 01 48 89 51 f8 <48> 89 46 08 48 89 cf 4c 89 e6 48 89 4c 24 08 e8 18 c7 ff ff 48 8b
RSP: 002b:00007ffcc6945410 EFLAGS: 00010206
RAX: 000000000001fe51 RBX: 0000000000000410 RCX: 0000564e7ee79db0
RDX: 0000000000000411 RSI: 0000564e7ee7a1b0 RDI: 0000000000000000
RBP: ffffffffffffffc0 R08: 00007fe544f51ac0 R09: 0000000000000410
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000400
R13: 0000000000000410 R14: 000000000000003f R15: 00007fe544f51b20
</TASK>
------------[ cut here ]------------
Voluntary context switch within RCU read-side critical section!
WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332, CPU#2: dhcpcd-run-hook/5670
Modules linked in:
CPU: 2 UID: 0 PID: 5670 Comm: dhcpcd-run-hook Tainted: G W syzkaller #0 PREEMPT(full)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332
Code: c1 ea 03 80 3c 02 00 0f 85 9b 0b 00 00 48 8b 53 28 b9 01 00 00 00 4c 89 ef e8 a3 cf fe ff e9 1d f9 ff ff 48 8d 3d 17 e9 ec 0e <67> 48 0f b9 3a e9 99 f8 ff ff 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0000:ffffc9000333fcf0 EFLAGS: 00010006
RAX: 0000000000000005 RBX: ffff88806a63c280 RCX: ffffffff81edab71
RDX: 0000000000000000 RSI: ffffffff8c1c1c00 RDI: ffffffff90db08b0
RBP: ffff88802615ca00 R08: 0000000000000000 R09: fffffbfff21aeeaa
R10: ffffffff90d77557 R11: 0000000000000014 R12: 0000000000000000
R13: ffff88802615cec4 R14: ffff88806a63b240 R15: ffffffff90d7a8e4
FS: 00007fe544cb7c80(0000) GS:ffff8880d657c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe544fd3feb CR3: 0000000038dc4000 CR4: 0000000000352ef0
Call Trace:
<TASK>
__schedule+0x276/0x6820 kernel/sched/core.c:7043
__schedule_loop kernel/sched/core.c:7267 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7282
__exit_to_user_mode_loop kernel/entry/common.c:54 [inline]
exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:252 [inline]
irqentry_exit_to_user_mode include/linux/irq-entry-common.h:323 [inline]
irqentry_exit+0x359/0x790 kernel/entry/common.c:162
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0033:0x7fe544fa2f32
Code: 00 74 05 e8 c0 d6 fc ff 48 83 c4 10 5b 5d 41 5c c3 41 55 41 54 41 89 f4 55 48 89 fd 53 51 0f b6 07 48 89 f9 c1 e0 04 0f b6 11 <84> d2 74 07 48 ff c1 01 d0 eb f2 6a 1f 25 ff 7f 00 00 59 31 d2 f7
RSP: 002b:00007ffcc6944980 EFLAGS: 00000206
RAX: 000000000000076f RBX: 0000564e7ee792c0 RCX: 0000564e7ee82333
RDX: 000000000000006d RSI: 0000000000000000 RDI: 0000564e7ee82330
RBP: 0000564e7ee82330 R08: 0000000000000001 R09: 0000000000000000
R10: 00007fe544ef7fe0 R11: 00007fe544ef88e0 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 00007fe54501e240
</TASK>
----------------
Code disassembly (best guess):
0: c1 ea 03 shr $0x3,%edx
3: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
7: 0f 85 9b 0b 00 00 jne 0xba8
d: 48 8b 53 28 mov 0x28(%rbx),%rdx
11: b9 01 00 00 00 mov $0x1,%ecx
16: 4c 89 ef mov %r13,%rdi
19: e8 a3 cf fe ff call 0xfffecfc1
1e: e9 1d f9 ff ff jmp 0xfffff940
23: 48 8d 3d 17 e9 ec 0e lea 0xeece917(%rip),%rdi # 0xeece941
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: e9 99 f8 ff ff jmp 0xfffff8cd
34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3b: fc ff df
3e: 48 rex.W
3f: 8d .byte 0x8d