list_del corruption, ffff88803d6efa18->next is LIST_POISON1 (dead000000000100)
syz-executor.2 invoked oom-killer: gfp_mask=0x6000c0(GFP_KERNEL), nodemask=(null), order=0, oom_score_adj=1000
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:45!
syz-executor.2 cpuset=syz2 mems_allowed=0-1
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 31630 Comm: syz-executor.2 Not tainted 4.19.100-syzkaller #0
CPU: 1 PID: 31588 Comm: syz-executor.0 Not tainted 4.19.100-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
RIP: 0010:__list_del_entry_valid.cold+0x23/0x4f lib/list_debug.c:45
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
Code: e8 85 79 eb fd 0f 0b 4c 89 f6 48 c7 c7 20 fe ea 87 e8 74 79 eb fd 0f 0b 4c 89 ea 4c 89 f6 48 c7 c7 60 fd ea 87 e8 60 79 eb fd <0f> 0b 4c 89 e2 4c 89 f6 48 c7 c7 c0 fd ea 87 e8 4c 79 eb fd 0f 0b
dump_header+0x15e/0xa55 mm/oom_kill.c:441
RSP: 0018:ffff88803d6ef8d8 EFLAGS: 00010086
RAX: 000000000000004e RBX: ffff88803d6efa00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81557a66 RDI: ffffed1007addf0d
RBP: ffff88803d6ef8f0 R08: 000000000000004e R09: ffffed1015d25079
oom_kill_process.cold+0x10/0x6ef mm/oom_kill.c:954
R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: dead000000000200
R13: dead000000000100 R14: ffff88803d6efa18 R15: ffff88803d6efa20
FS: 00007f937b4f6700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
out_of_memory mm/oom_kill.c:1130 [inline]
out_of_memory+0x362/0x1330 mm/oom_kill.c:1062
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000013bacd0 CR3: 0000000088e88000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry include/linux/list.h:117 [inline]
list_del include/linux/list.h:125 [inline]
__remove_wait_queue include/linux/wait.h:184 [inline]
remove_wait_queue+0x2f/0x190 kernel/sched/wait.c:44
mem_cgroup_out_of_memory+0x1d2/0x240 mm/memcontrol.c:1416
__tipc_sendstream+0x3db/0xaa0 net/tipc/socket.c:1446
mem_cgroup_oom mm/memcontrol.c:1742 [inline]
try_charge+0xec5/0x1490 mm/memcontrol.c:2313
tipc_sendstream+0x53/0x80 net/tipc/socket.c:1411
mem_cgroup_try_charge+0x259/0x6b0 mm/memcontrol.c:5991
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:632
mem_cgroup_try_charge_delay+0x1f/0xa0 mm/memcontrol.c:6006
sock_write_iter+0x2cb/0x400 net/socket.c:901
wp_page_copy+0x430/0x16a0 mm/memory.c:2520
do_wp_page+0x57d/0x10b0 mm/memory.c:2799
call_write_iter include/linux/fs.h:1820 [inline]
new_sync_write fs/read_write.c:474 [inline]
__vfs_write+0x587/0x810 fs/read_write.c:487
handle_pte_fault mm/memory.c:4057 [inline]
__handle_mm_fault+0x2305/0x3f80 mm/memory.c:4165
vfs_write+0x20c/0x560 fs/read_write.c:549
ksys_write+0x14f/0x2d0 fs/read_write.c:599
handle_mm_fault+0x1b5/0x690 mm/memory.c:4202
__do_page_fault+0x62a/0xe90 arch/x86/mm/fault.c:1390
__do_sys_write fs/read_write.c:611 [inline]
__se_sys_write fs/read_write.c:608 [inline]
__x64_sys_write+0x73/0xb0 fs/read_write.c:608
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
do_page_fault+0x71/0x57d arch/x86/mm/fault.c:1465
RIP: 0033:0x45b349
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1204
RSP: 002b:00007f937b4f5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RIP: 0033:0x410398
RAX: ffffffffffffffda RBX: 00007f937b4f66d4 RCX: 000000000045b349
Code: 8b 34 c6 4a 8d 04 2e 48 3d ff ff ff 7e 0f 86 77 ff ff ff bf 75 0c 4c 00 31 c0 e8 13 1b ff ff 31 ff e8 5c 17 ff ff 0f 1f 40 00 <89> 3c b5 00 00 73 00 eb b6 31 ed 0f 1f 44 00 00 80 3d ae 22 66 00
RDX: 00000000fffffd6d RSI: 00000000200015c0 RDI: 0000000000000003
RSP: 002b:00007fff694dbc20 EFLAGS: 00010246
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
RAX: 00000000ed3764ca RBX: 00000000c68a3309 RCX: 0000001b32820000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
RDX: 0000000000000000 RSI: 00000000000004ca RDI: ffffffffed3764ca
R13: 0000000000000c9f R14: 00000000004cd777 R15: 000000000075bfd4
Modules linked in:
RBP: 0000000000000004 R08: 00000000ed3764ca R09: 00000000ed3764ce
---[ end trace 36a4e8a0a202c165 ]---
R10: 00007fff694dbdc0 R11: 0000000000000246 R12: 000000000075bfa8
RIP: 0010:__list_del_entry_valid.cold+0x23/0x4f lib/list_debug.c:45
R13: 0000000080000000 R14: 00007f91746fb008 R15: 0000000000000004
Code: e8 85 79 eb fd 0f 0b 4c 89 f6 48 c7 c7 20 fe ea 87 e8 74 79 eb fd 0f 0b 4c 89 ea 4c 89 f6 48 c7 c7 60 fd ea 87 e8 60 79 eb fd <0f> 0b 4c 89 e2 4c 89 f6 48 c7 c7 c0 fd ea 87 e8 4c 79 eb fd 0f 0b
Task in /syz2 killed as a result of limit of /syz2
RSP: 0018:ffff88803d6ef8d8 EFLAGS: 00010086
RAX: 000000000000004e RBX: ffff88803d6efa00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81557a66 RDI: ffffed1007addf0d
RBP: ffff88803d6ef8f0 R08: 000000000000004e R09: ffffed1015d25079
R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: dead000000000200
R13: dead000000000100 R14: ffff88803d6efa18 R15: ffff88803d6efa20
memory: usage 307200kB, limit 307200kB, failcnt 572
FS: 00007f937b4f6700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000013bacd0 CR3: 0000000088e88000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400