syzbot

================================
WARNING: inconsistent lock state
4.17.0-rc2+ #24 Not tainted
--------------------------------
inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
sshd/4441 [HC1[1]:SC0[0]:HE0:SE1] takes:
        (ptrval) (fs_reclaim){?.+.}, at: fs_reclaim_acquire.part.82+0x0/0x30 mm/page_alloc.c:463
{HARDIRQ-ON-W} state was registered at:
  lock_acquire+0x1dc/0x520 kernel/locking/lockdep.c:3920
  fs_reclaim_acquire.part.82+0x24/0x30 mm/page_alloc.c:3739
  fs_reclaim_acquire+0x14/0x20 mm/page_alloc.c:3740
  slab_pre_alloc_hook mm/slab.h:418 [inline]
  slab_alloc_node mm/slab.c:3299 [inline]
  kmem_cache_alloc_node_trace+0x39/0x770 mm/slab.c:3661
  kmalloc_node include/linux/slab.h:550 [inline]
  kzalloc_node include/linux/slab.h:712 [inline]
  alloc_worker+0xbd/0x2e0 kernel/workqueue.c:1704
  init_rescuer.part.25+0x1f/0x190 kernel/workqueue.c:4000
  init_rescuer kernel/workqueue.c:3997 [inline]
  workqueue_init+0x51f/0x7d0 kernel/workqueue.c:5732
  kernel_init_freeable+0x2ad/0x58e init/main.c:1115
  kernel_init+0x11/0x1b3 init/main.c:1053
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
irq event stamp: 516314
hardirqs last  enabled at (516313): [<ffffffff81b54f10>] kmem_cache_free+0xa0/0x2d0 mm/slab.c:3757
hardirqs last disabled at (516314): [<ffffffff87800905>] interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625
softirqs last  enabled at (516308): [<ffffffff85d5fd2b>] spin_unlock_bh include/linux/spinlock.h:355 [inline]
softirqs last  enabled at (516308): [<ffffffff85d5fd2b>] __release_sock+0xcb/0x3a0 net/core/sock.c:2335
softirqs last disabled at (516306): [<ffffffff85d60074>] spin_lock_bh include/linux/spinlock.h:315 [inline]
softirqs last disabled at (516306): [<ffffffff85d60074>] release_sock+0x74/0x2b0 net/core/sock.c:2855

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(fs_reclaim);
  <Interrupt>
    lock(fs_reclaim);

 *** DEADLOCK ***

1 lock held by sshd/4441:
 #0:         (ptrval) (sk_lock-AF_INET){+.+.}, at: lock_sock include/net/sock.h:1469 [inline]
 #0:         (ptrval) (sk_lock-AF_INET){+.+.}, at: tcp_sendmsg+0x21/0x50 net/ipv4/tcp.c:1445

stack backtrace:
CPU: 0 PID: 4441 Comm: sshd Not tainted 4.17.0-rc2+ #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 print_usage_bug.cold.59+0x320/0x41a kernel/locking/lockdep.c:2542
 valid_state kernel/locking/lockdep.c:2555 [inline]
 mark_lock_irq kernel/locking/lockdep.c:2749 [inline]
 mark_lock+0x1034/0x19e0 kernel/locking/lockdep.c:3147
 mark_irqflags kernel/locking/lockdep.c:3022 [inline]
 __lock_acquire+0x1595/0x5140 kernel/locking/lockdep.c:3388
 lock_acquire+0x1dc/0x520 kernel/locking/lockdep.c:3920
 fs_reclaim_acquire.part.82+0x24/0x30 mm/page_alloc.c:3739
 fs_reclaim_acquire+0x14/0x20 mm/page_alloc.c:3740
 slab_pre_alloc_hook mm/slab.h:418 [inline]
 slab_alloc mm/slab.c:3378 [inline]
 __do_kmalloc mm/slab.c:3716 [inline]
 __kmalloc+0x45/0x760 mm/slab.c:3727
 kmalloc_array include/linux/slab.h:631 [inline]
 kcalloc include/linux/slab.h:642 [inline]
 numa_crng_init drivers/char/random.c:798 [inline]
 crng_reseed+0x427/0x920 drivers/char/random.c:923
 credit_entropy_bits+0x98d/0xa30 drivers/char/random.c:708
 add_interrupt_randomness+0x494/0x860 drivers/char/random.c:1254
 handle_irq_event_percpu+0xf9/0x1c0 kernel/irq/handle.c:191
 handle_irq_event+0xa7/0x135 kernel/irq/handle.c:206
 handle_edge_irq+0x20f/0x870 kernel/irq/chip.c:791
 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline]
 handle_irq+0x18c/0x2e7 arch/x86/kernel/irq_64.c:77
 do_IRQ+0x78/0x190 arch/x86/kernel/irq.c:245
 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:642
 </IRQ>
RIP: 0010:skb_zcopy include/linux/skbuff.h:1291 [inline]
RIP: 0010:skb_zcopy_clear include/linux/skbuff.h:1308 [inline]
RIP: 0010:skb_release_data+0x549/0x860 net/core/skbuff.c:569
RSP: 0018:ffff8801caf271d0 EFLAGS: 00000293 ORIG_RAX: ffffffffffffffd5
RAX: 0000000000000000 RBX: ffff8801d9612740 RCX: ffff8801b0af3d4c
RDX: 0000000000000003 RSI: ffffffff85d842cb RDI: ffff8801d9612743
RBP: ffff8801caf272f0 R08: ffff8801c47aa380 R09: fffff94000dfcdc3
R10: fffff94000dfcdc3 R11: ffffea0006fe6e1f R12: dffffc0000000000
R13: 0000000000000000 R14: ffff8801d9612780 R15: 0000000000000001
 skb_release_all+0x4a/0x60 net/core/skbuff.c:627
 __kfree_skb+0x15/0x20 net/core/skbuff.c:641
 sk_wmem_free_skb include/net/sock.h:1425 [inline]
 tcp_rtx_queue_unlink_and_free include/net/tcp.h:1677 [inline]
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3111 [inline]
 tcp_ack+0x2021/0x5510 net/ipv4/tcp_input.c:3621
 tcp_rcv_established+0x1419/0x2010 net/ipv4/tcp_input.c:5417
 tcp_v4_do_rcv+0x615/0x8c0 net/ipv4/tcp_ipv4.c:1477
 sk_backlog_rcv include/net/sock.h:909 [inline]
 __release_sock+0x12f/0x3a0 net/core/sock.c:2342
 release_sock+0xa4/0x2b0 net/core/sock.c:2857
 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1447
 inet_sendmsg+0x19f/0x690 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:639
 sock_write_iter+0x35a/0x5a0 net/socket.c:908
 call_write_iter include/linux/fs.h:1784 [inline]
 new_sync_write fs/read_write.c:474 [inline]
 __vfs_write+0x64d/0x960 fs/read_write.c:487
 vfs_write+0x1f8/0x560 fs/read_write.c:549
 ksys_write+0xf9/0x250 fs/read_write.c:598
 __do_sys_write fs/read_write.c:610 [inline]
 __se_sys_write fs/read_write.c:607 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:607
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2747812370
RSP: 002b:00007ffeef458508 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000000001a8 RCX: 00007f2747812370
RDX: 00000000000001a8 RSI: 0000556a1fb37420 RDI: 0000000000000003
RBP: 0000556a1fb37420 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffeef45856c
R13: 0000556a1e22efb4 R14: 0000000000000028 R15: 0000556a1e230ca0
BUG: sleeping function called from invalid context at mm/slab.h:421
in_atomic(): 1, irqs_disabled(): 1, pid: 4441, name: sshd
INFO: lockdep is turned off.
irq event stamp: 516314
hardirqs last  enabled at (516313): [<ffffffff81b54f10>] kmem_cache_free+0xa0/0x2d0 mm/slab.c:3757
hardirqs last disabled at (516314): [<ffffffff87800905>] interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625
softirqs last  enabled at (516308): [<ffffffff85d5fd2b>] spin_unlock_bh include/linux/spinlock.h:355 [inline]
softirqs last  enabled at (516308): [<ffffffff85d5fd2b>] __release_sock+0xcb/0x3a0 net/core/sock.c:2335
softirqs last disabled at (516306): [<ffffffff85d60074>] spin_lock_bh include/linux/spinlock.h:315 [inline]
softirqs last disabled at (516306): [<ffffffff85d60074>] release_sock+0x74/0x2b0 net/core/sock.c:2855
CPU: 0 PID: 4441 Comm: sshd Not tainted 4.17.0-rc2+ #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 ___might_sleep.cold.87+0x11f/0x13a kernel/sched/core.c:6188
 __might_sleep+0x95/0x190 kernel/sched/core.c:6141
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc mm/slab.c:3378 [inline]
 __do_kmalloc mm/slab.c:3716 [inline]
 __kmalloc+0x2b9/0x760 mm/slab.c:3727
 kmalloc_array include/linux/slab.h:631 [inline]
 kcalloc include/linux/slab.h:642 [inline]
 numa_crng_init drivers/char/random.c:798 [inline]
 crng_reseed+0x427/0x920 drivers/char/random.c:923
 credit_entropy_bits+0x98d/0xa30 drivers/char/random.c:708
 add_interrupt_randomness+0x494/0x860 drivers/char/random.c:1254
 handle_irq_event_percpu+0xf9/0x1c0 kernel/irq/handle.c:191
 handle_irq_event+0xa7/0x135 kernel/irq/handle.c:206
 handle_edge_irq+0x20f/0x870 kernel/irq/chip.c:791
 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline]
 handle_irq+0x18c/0x2e7 arch/x86/kernel/irq_64.c:77
 do_IRQ+0x78/0x190 arch/x86/kernel/irq.c:245
 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:642
 </IRQ>
RIP: 0010:skb_zcopy include/linux/skbuff.h:1291 [inline]
RIP: 0010:skb_zcopy_clear include/linux/skbuff.h:1308 [inline]
RIP: 0010:skb_release_data+0x549/0x860 net/core/skbuff.c:569
RSP: 0018:ffff8801caf271d0 EFLAGS: 00000293 ORIG_RAX: ffffffffffffffd5
RAX: 0000000000000000 RBX: ffff8801d9612740 RCX: ffff8801b0af3d4c
RDX: 0000000000000003 RSI: ffffffff85d842cb RDI: ffff8801d9612743
RBP: ffff8801caf272f0 R08: ffff8801c47aa380 R09: fffff94000dfcdc3
R10: fffff94000dfcdc3 R11: ffffea0006fe6e1f R12: dffffc0000000000
R13: 0000000000000000 R14: ffff8801d9612780 R15: 0000000000000001
 skb_release_all+0x4a/0x60 net/core/skbuff.c:627
 __kfree_skb+0x15/0x20 net/core/skbuff.c:641
 sk_wmem_free_skb include/net/sock.h:1425 [inline]
 tcp_rtx_queue_unlink_and_free include/net/tcp.h:1677 [inline]
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3111 [inline]
 tcp_ack+0x2021/0x5510 net/ipv4/tcp_input.c:3621
 tcp_rcv_established+0x1419/0x2010 net/ipv4/tcp_input.c:5417
 tcp_v4_do_rcv+0x615/0x8c0 net/ipv4/tcp_ipv4.c:1477
 sk_backlog_rcv include/net/sock.h:909 [inline]
 __release_sock+0x12f/0x3a0 net/core/sock.c:2342
 release_sock+0xa4/0x2b0 net/core/sock.c:2857
 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1447
 inet_sendmsg+0x19f/0x690 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:639
 sock_write_iter+0x35a/0x5a0 net/socket.c:908
 call_write_iter include/linux/fs.h:1784 [inline]
 new_sync_write fs/read_write.c:474 [inline]
 __vfs_write+0x64d/0x960 fs/read_write.c:487
 vfs_write+0x1f8/0x560 fs/read_write.c:549
 ksys_write+0xf9/0x250 fs/read_write.c:598
 __do_sys_write fs/read_write.c:610 [inline]
 __se_sys_write fs/read_write.c:607 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:607
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2747812370
RSP: 002b:00007ffeef458508 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000000001a8 RCX: 00007f2747812370
RDX: 00000000000001a8 RSI: 0000556a1fb37420 RDI: 0000000000000003
RBP: 0000556a1fb37420 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffeef45856c
R13: 0000556a1e22efb4 R14: 0000000000000028 R15: 0000556a1e230ca0
random: crng init done