syzbot

[   4923]     0  4923     4459     4209    73728        0          1000 syz-executor379
[   4927]     0  4927     4459     4176    73728        0          1000 syz-executor379
[   4931]     0  4931     4459     4176    73728        0          1000 syz-executor379
[   4932]     0  4932     4426     2010    57344        0          1000 syz-executor379
oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0-1,global_oom,task_memcg=/,task=syz-executor379,pid=4923,uid=0
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:577
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3606, name: sshd
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
3 locks held by sshd/3606:
 #0: ffff88801a040f88 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:832 [inline]
 #0: ffff88801a040f88 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_fault+0x1622/0x22b0 mm/filemap.c:3137
 #1: ffffffff8bc640a8 (oom_lock){+.+.}-{3:3}, at: __alloc_pages_may_oom mm/page_alloc.c:4278 [inline]
 #1: ffffffff8bc640a8 (oom_lock){+.+.}-{3:3}, at: __alloc_pages_slowpath.constprop.0+0xd80/0x2080 mm/page_alloc.c:5058
 #2: ffff88801eb426a0 (&p->alloc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
 #2: ffff88801eb426a0 (&p->alloc_lock){+.+.}-{2:2}, at: task_lock include/linux/sched/task.h:178 [inline]
 #2: ffff88801eb426a0 (&p->alloc_lock){+.+.}-{2:2}, at: find_lock_task_mm+0xe3/0x2b0 mm/oom_kill.c:144
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 3606 Comm: sshd Not tainted 5.16.0-rc5-next-20211215-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9583
 __mutex_lock_common kernel/locking/mutex.c:577 [inline]
 __mutex_lock+0x9f/0x12f0 kernel/locking/mutex.c:733
 futex_cleanup_begin kernel/futex/core.c:1058 [inline]
 futex_exit_release+0x26/0x220 kernel/futex/core.c:1110
 __oom_kill_process+0x373/0xf90 mm/oom_kill.c:893
 oom_kill_process+0xd7/0x5b0 mm/oom_kill.c:1003
 out_of_memory+0x358/0x1460 mm/oom_kill.c:1132
 __alloc_pages_may_oom mm/page_alloc.c:4329 [inline]
 __alloc_pages_slowpath.constprop.0+0x1ac0/0x2080 mm/page_alloc.c:5058
 __alloc_pages+0x412/0x500 mm/page_alloc.c:5389
 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2271
 folio_alloc+0x1c/0x70 mm/mempolicy.c:2281
 filemap_alloc_folio mm/filemap.c:1000 [inline]
 __filemap_get_folio+0x5f4/0xe50 mm/filemap.c:2003
 filemap_fault+0x166d/0x22b0 mm/filemap.c:3140
 __do_fault+0x10d/0x790 mm/memory.c:3846
 do_read_fault mm/memory.c:4161 [inline]
 do_fault mm/memory.c:4290 [inline]
 handle_pte_fault mm/memory.c:4548 [inline]
 __handle_mm_fault+0x2761/0x4160 mm/memory.c:4683
 handle_mm_fault+0x1c8/0x790 mm/memory.c:4781
 do_user_addr_fault+0x489/0x11c0 arch/x86/mm/fault.c:1397
 handle_page_fault arch/x86/mm/fault.c:1484 [inline]
 exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1540
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7f3da66fdb90
Code: Unable to access opcode bytes at RIP 0x7f3da66fdb66.
RSP: 002b:00007fff0e2f3378 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000080 RCX: 0000000000000004
RDX: 00007fff0e2f3458 RSI: 00007fff0e2f33d8 RDI: 0000000000000001
RBP: 00007f3da6e090b0 R08: 00007f3da6df5c40 R09: 00007fff0e315080
R10: 00007fff0e3150f0 R11: 000000000000532a R12: 0000000000000004
R13: 0000000000000001 R14: 00007fff0e2f33d8 R15: 00007fff0e2f3458
 </TASK>

=============================
[ BUG: Invalid wait context ]
5.16.0-rc5-next-20211215-syzkaller #0 Tainted: G        W        
-----------------------------
sshd/3606 is trying to lock:
ffff88801eb430c0 (&tsk->futex_exit_mutex){+.+.}-{3:3}, at: futex_cleanup_begin kernel/futex/core.c:1058 [inline]
ffff88801eb430c0 (&tsk->futex_exit_mutex){+.+.}-{3:3}, at: futex_exit_release+0x26/0x220 kernel/futex/core.c:1110
other info that might help us debug this:
context-{4:4}
3 locks held by sshd/3606:
 #0: ffff88801a040f88 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:832 [inline]
 #0: ffff88801a040f88 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_fault+0x1622/0x22b0 mm/filemap.c:3137
 #1: ffffffff8bc640a8 (oom_lock){+.+.}-{3:3}, at: __alloc_pages_may_oom mm/page_alloc.c:4278 [inline]
 #1: ffffffff8bc640a8 (oom_lock){+.+.}-{3:3}, at: __alloc_pages_slowpath.constprop.0+0xd80/0x2080 mm/page_alloc.c:5058
 #2: ffff88801eb426a0 (&p->alloc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
 #2: ffff88801eb426a0 (&p->alloc_lock){+.+.}-{2:2}, at: task_lock include/linux/sched/task.h:178 [inline]
 #2: ffff88801eb426a0 (&p->alloc_lock){+.+.}-{2:2}, at: find_lock_task_mm+0xe3/0x2b0 mm/oom_kill.c:144
stack backtrace:
CPU: 1 PID: 3606 Comm: sshd Tainted: G        W         5.16.0-rc5-next-20211215-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4678 [inline]
 check_wait_context kernel/locking/lockdep.c:4739 [inline]
 __lock_acquire.cold+0x213/0x3ab kernel/locking/lockdep.c:4977
 lock_acquire kernel/locking/lockdep.c:5639 [inline]
 lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
 __mutex_lock_common kernel/locking/mutex.c:600 [inline]
 __mutex_lock+0x12f/0x12f0 kernel/locking/mutex.c:733
 futex_cleanup_begin kernel/futex/core.c:1058 [inline]
 futex_exit_release+0x26/0x220 kernel/futex/core.c:1110
 __oom_kill_process+0x373/0xf90 mm/oom_kill.c:893
 oom_kill_process+0xd7/0x5b0 mm/oom_kill.c:1003
 out_of_memory+0x358/0x1460 mm/oom_kill.c:1132
 __alloc_pages_may_oom mm/page_alloc.c:4329 [inline]
 __alloc_pages_slowpath.constprop.0+0x1ac0/0x2080 mm/page_alloc.c:5058
 __alloc_pages+0x412/0x500 mm/page_alloc.c:5389
 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2271
 folio_alloc+0x1c/0x70 mm/mempolicy.c:2281
 filemap_alloc_folio mm/filemap.c:1000 [inline]
 __filemap_get_folio+0x5f4/0xe50 mm/filemap.c:2003
 filemap_fault+0x166d/0x22b0 mm/filemap.c:3140
 __do_fault+0x10d/0x790 mm/memory.c:3846
 do_read_fault mm/memory.c:4161 [inline]
 do_fault mm/memory.c:4290 [inline]
 handle_pte_fault mm/memory.c:4548 [inline]
 __handle_mm_fault+0x2761/0x4160 mm/memory.c:4683
 handle_mm_fault+0x1c8/0x790 mm/memory.c:4781
 do_user_addr_fault+0x489/0x11c0 arch/x86/mm/fault.c:1397
 handle_page_fault arch/x86/mm/fault.c:1484 [inline]
 exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1540
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7f3da66fdb90
Code: Unable to access opcode bytes at RIP 0x7f3da66fdb66.
RSP: 002b:00007fff0e2f3378 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000080 RCX: 0000000000000004
RDX: 00007fff0e2f3458 RSI: 00007fff0e2f33d8 RDI: 0000000000000001
RBP: 00007f3da6e090b0 R08: 00007f3da6df5c40 R09: 00007fff0e315080
R10: 00007fff0e3150f0 R11: 000000000000532a R12: 0000000000000004
R13: 0000000000000001 R14: 00007fff0e2f33d8 R15: 00007fff0e2f3458
 </TASK>
Out of memory: Killed process 4923 (syz-executor379) total-vm:17836kB, anon-rss:16836kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000