kernel BUG at mm/page

[upstream] kernel BUG at mm/page_alloc.c:LINE!
Status: upstream: reported on 2019/01/17 02:33
Reported-by: syzbot+80dd4798c16c634daf15@syzkaller.appspotmail.com
First crash: 36d, last: 3d21h

Sample crash report:

raw: ffff888061c78a80 ffff888061c78480 00000000ffffffff 0000000000000000
Enabling of bearer <udp:syz1> rejected, already enabled
Unknown ioctl 35075
page dumped because: VM_BUG_ON_PAGE(compound && compound_order(page) != order)
------------[ cut here ]------------
kernel BUG at mm/page_alloc.c:1042!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7871 Comm: kworker/1:3 Not tainted 5.0.0-rc6+ #68
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events cache_reap
kobject: 'tx-0' (000000008309d7c0): kobject_uevent_env
RIP: 0010:free_pages_prepare mm/page_alloc.c:1042 [inline]
RIP: 0010:__free_pages_ok+0xb48/0xda0 mm/page_alloc.c:1296
Code: 0c 00 0f 0b e8 79 aa 1a 00 e9 0b fa ff ff 48 89 df e8 6c aa 1a 00 e9 23 fa ff ff 48 c7 c6 e0 5f 72 87 4c 89 e7 e8 48 1f 0c 00 <0f> 0b 4c 89 ef e8 4e aa 1a 00 e9 df f4 ff ff 4c 89 f7 e8 41 aa 1a
kobject: 'loop4' (00000000a1bf92e0): kobject_uevent_env
RSP: 0018:ffff88806fec7ba0 EFLAGS: 00010293
RAX: ffff88806febe3c0 RBX: ffff8880a90acb00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81986367 RDI: ffffea0001871e38
RBP: ffff88806fec7bf0 R08: 000000000000004e R09: ffffed1015d25021
R10: ffffed1015d25020 R11: ffff8880ae928107 R12: ffffea0001871e00
R13: ffffea0001871e08 R14: 0000000000000002 R15: 0000000000000004
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f70a6f2cdb8 CR3: 0000000097929000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kobject: 'tx-0' (000000008309d7c0): fill_kobj_path: path = '/devices/virtual/net/lo/queues/tx-0'
 free_the_page mm/page_alloc.c:4597 [inline]
 __free_pages mm/page_alloc.c:4603 [inline]
 __free_pages+0x85/0xb0 mm/page_alloc.c:4600
 kmem_freepages.isra.0+0x436/0x660 mm/slab.c:1445
 slab_destroy+0x24/0x60 mm/slab.c:1699
 drain_freelist+0xa4/0xe0 mm/slab.c:2274
 cache_reap+0x168/0x280 mm/slab.c:4070
 process_one_work+0x98e/0x1790 kernel/workqueue.c:2173
kobject: 'loop4' (00000000a1bf92e0): fill_kobj_path: path = '/devices/virtual/block/loop4'
 worker_thread+0x98/0xe40 kernel/workqueue.c:2319
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
kobject: 'gre0' (000000002b0a7701): kobject_cleanup, parent           (null)
kobject: 'loop2' (00000000416c7721): kobject_uevent_env
kobject: 'loop2' (00000000416c7721): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'gre0' (000000002b0a7701): auto cleanup 'remove' event
kobject: 'tunl0' (00000000d2b5390c): kobject_add_internal: parent: 'net', set: 'devices'
kobject: 'gre0' (000000002b0a7701): kobject_uevent_env
kobject: 'gre0' (000000002b0a7701): kobject_uevent_env: uevent_suppress caused the event to drop!
kobject: 'loop3' (00000000e4c67386): kobject_uevent_env
Unknown ioctl 35075
kobject: 'loop3' (00000000e4c67386): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'kvm' (00000000a41f7246): kobject_uevent_env
kobject: 'gre0' (000000002b0a7701): calling ktype release
kobject: 'kvm' (00000000a41f7246): fill_kobj_path: path = '/devices/virtual/misc/kvm'
kobject: 'tunl0' (00000000d2b5390c): kobject_uevent_env
kobject: 'gre0': free name
kobject: 'loop1' (00000000ed189ebe): kobject_uevent_env
kobject: 'loop1' (00000000ed189ebe): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'tunl0' (00000000d2b5390c): fill_kobj_path: path = '/devices/virtual/net/tunl0'
kobject: 'kvm' (00000000a41f7246): kobject_uevent_env
kobject: 'queues' (0000000043226e6d): kobject_add_internal: parent: 'tunl0', set: '<NULL>'
kobject: 'kvm' (00000000a41f7246): fill_kobj_path: path = '/devices/virtual/misc/kvm'
kobject: 'queues' (0000000043226e6d): kobject_uevent_env
kobject: 'queues' (0000000043226e6d): kobject_uevent_env: filter function caused the event to drop!
kobject: 'rx-0' (0000000006a42645): kobject_add_internal: parent: 'queues', set: 'queues'
kobject: 'rx-0' (0000000006a42645): kobject_uevent_env
kobject: 'loop5' (000000005e2bfea2): kobject_uevent_env
---[ end trace 92d97401be72699a ]---
RIP: 0010:free_pages_prepare mm/page_alloc.c:1042 [inline]
RIP: 0010:__free_pages_ok+0xb48/0xda0 mm/page_alloc.c:1296
Code: 0c 00 0f 0b e8 79 aa 1a 00 e9 0b fa ff ff 48 89 df e8 6c aa 1a 00 e9 23 fa ff ff 48 c7 c6 e0 5f 72 87 4c 89 e7 e8 48 1f 0c 00 <0f> 0b 4c 89 ef e8 4e aa 1a 00 e9 df f4 ff ff 4c 89 f7 e8 41 aa 1a
kobject: 'loop5' (000000005e2bfea2): fill_kobj_path: path = '/devices/virtual/block/loop5'
RSP: 0018:ffff88806fec7ba0 EFLAGS: 00010293
kobject: 'rx-0' (0000000006a42645): fill_kobj_path: path = '/devices/virtual/net/tunl0/queues/rx-0'
kobject: 'tx-0' (000000006ecde995): kobject_add_internal: parent: 'queues', set: 'queues'
kobject: 'tx-0' (000000006ecde995): kobject_uevent_env
RAX: ffff88806febe3c0 RBX: ffff8880a90acb00 RCX: 0000000000000000
kobject: 'tx-0' (000000006ecde995): fill_kobj_path: path = '/devices/virtual/net/tunl0/queues/tx-0'
RDX: 0000000000000000 RSI: ffffffff81986367 RDI: ffffea0001871e38
Enabling of bearer <udp:syz1> rejected, already enabled
kobject: 'gre0' (0000000093becfd3): kobject_add_internal: parent: 'net', set: 'devices'
RBP: ffff88806fec7bf0 R08: 000000000000004e R09: ffffed1015d25021
R10: ffffed1015d25020 R11: ffff8880ae928107 R12: ffffea0001871e00
R13: ffffea0001871e08 R14: 0000000000000002 R15: 0000000000000004
kobject: 'loop2' (00000000416c7721): kobject_uevent_env
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000070d6b4 CR3: 000000005e81b000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

All crashes (8):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Maintainers
ci-upstream-kasan-gce	2019/02/12 00:23	upstream	aa0c38cf	65a0d619	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2019/01/13 20:10	linux-next	b808822a	c3f3344c	.config	log	report	akpm@linux-foundation.org, iamjoonsoo.kim@lge.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mgorman@techsingularity.net, mhocko@suse.com, sfr@canb.auug.org.au, vbabka@suse.cz
ci-upstream-linux-next-kasan-gce-root	2019/02/15 21:51	linux-next	7a92eb7c	f6f233c0	.config	log	report	akpm@linux-foundation.org, iamjoonsoo.kim@lge.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mgorman@techsingularity.net, mhocko@suse.com, sfr@canb.auug.org.au, vbabka@suse.cz
ci-upstream-linux-next-kasan-gce-root	2019/02/05 05:19	linux-next	dc4c8999	d672172c	.config	log	report	akpm@linux-foundation.org, iamjoonsoo.kim@lge.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mgorman@techsingularity.net, mhocko@suse.com, sfr@canb.auug.org.au, vbabka@suse.cz
ci-upstream-linux-next-kasan-gce-root	2019/02/04 05:57	linux-next	dc4c8999	c198d5dd	.config	log	report	akpm@linux-foundation.org, iamjoonsoo.kim@lge.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mgorman@techsingularity.net, mhocko@suse.com, sfr@canb.auug.org.au, vbabka@suse.cz
ci-upstream-linux-next-kasan-gce-root	2019/02/03 08:24	linux-next	dc4c8999	c198d5dd	.config	log	report	akpm@linux-foundation.org, iamjoonsoo.kim@lge.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mgorman@techsingularity.net, mhocko@suse.com, sfr@canb.auug.org.au, vbabka@suse.cz
ci-upstream-linux-next-kasan-gce-root	2019/01/16 22:38	linux-next	cbeb3db6	d538790b	.config	log	report	akpm@linux-foundation.org, iamjoonsoo.kim@lge.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mgorman@techsingularity.net, mhocko@suse.com, sfr@canb.auug.org.au, vbabka@suse.cz
ci-upstream-linux-next-kasan-gce-root	2019/01/14 18:23	linux-next	8ce4d582	95485883	.config	log	report	akpm@linux-foundation.org, iamjoonsoo.kim@lge.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mgorman@techsingularity.net, mhocko@suse.com, sfr@canb.auug.org.au, vbabka@suse.cz