__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0xa5/0x8c0 mm/slab.c:2677
fallback_alloc+0x204/0x2e0 mm/slab.c:3219
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
__do_cache_alloc mm/slab.c:3356 [inline]
slab_alloc mm/slab.c:3384 [inline]
kmem_cache_alloc+0x1f8/0x730 mm/slab.c:3552
kmem_cache_zalloc include/linux/slab.h:731 [inline]
ext4_init_io_end+0x96/0x220 fs/ext4/page-io.c:253
INFO: task syz-executor2:17950 blocked for more than 140 seconds.
ext4_writepages+0x15af/0x4150 fs/ext4/inode.c:2849
Not tainted 4.20.0-rc1-next-20181109+ #110
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2 D19208 17950 12893 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
do_writepages+0x9a/0x1a0 mm/page-writeback.c:2328
__writeback_single_inode+0x205/0x1650 fs/fs-writeback.c:1316
writeback_sb_inodes+0x71f/0x1210 fs/fs-writeback.c:1580
schedule+0xef/0x370 kernel/sched/core.c:3516
__writeback_inodes_wb+0x1b9/0x340 fs/fs-writeback.c:1649
wb_writeback+0xa5d/0xfa0 fs/fs-writeback.c:1758
__lock_sock+0x1fb/0x350 net/core/sock.c:2254
lock_sock_nested+0xfe/0x120 net/core/sock.c:2776
lock_sock include/net/sock.h:1492 [inline]
sctp_wait_for_connect+0x3ae/0x640 net/sctp/socket.c:8642
wb_check_background_flush fs/fs-writeback.c:1826 [inline]
wb_do_writeback fs/fs-writeback.c:1914 [inline]
wb_workfn+0xd5b/0x1780 fs/fs-writeback.c:1942
sctp_sendmsg_to_asoc+0x1627/0x1a20 net/sctp/socket.c:1967
process_one_work+0xc8b/0x1c40 kernel/workqueue.c:2153
sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2113
inet_sendmsg+0x19c/0x690 net/ipv4/af_inet.c:798
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:632
__sys_sendto+0x3d7/0x670 net/socket.c:1789
worker_thread+0x17f/0x1390 kernel/workqueue.c:2296
kthread+0x35a/0x440 kernel/kthread.c:246
__do_sys_sendto net/socket.c:1801 [inline]
__se_sys_sendto net/socket.c:1797 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1797
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
Mem-Info:
active_anon:154560 inactive_anon:199 isolated_anon:0
active_file:23 inactive_file:24 isolated_file:0
unevictable:0 dirty:27 writeback:1 unstable:0
slab_reclaimable:12492 slab_unreclaimable:1339104
mapped:49158 shmem:250 pagetables:1097 bounce:0
free:24336 free_pcp:99 free_cma:0
Node 0 active_anon:618240kB inactive_anon:796kB active_file:144kB inactive_file:280kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:196632kB dirty:108kB writeback:4kB shmem:1000kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 569344kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 2818 6321 6321
Node 0 DMA32 free:44016kB min:30052kB low:37564kB high:45076kB active_anon:28kB inactive_anon:4kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888772kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 0 3503 3503
Node 0 Normal free:37200kB min:37364kB low:46704kB high:56044kB active_anon:618212kB inactive_anon:792kB active_file:92kB inactive_file:72kB unevictable:0kB writepending:112kB present:4718592kB managed:3587820kB mlocked:0kB kernel_stack:7200kB pagetables:4388kB bounce:0kB free_pcp:248kB local_pcp:0kB free_cma:0kB
entry_SYSCALL_64_after_hwframe+0x49/0xbe
lowmem_reserve[]: 0 0 0 0
RIP: 0033:0x457569
Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB
Code: Bad RIP value.
Node 0 DMA32: 8*4kB (UM) 4*8kB (UM) 3*16kB (M) 4*32kB (M) 4*64kB (UM) 4*128kB (UM) 4*256kB (UM) 4*512kB (UM) 3*1024kB (UM) 2*2048kB (M) 8*4096kB (M) = 44016kB
RSP: 002b:00007ff66bb40c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
Node 0 Normal: 1323*4kB (UMEH) 1216*8kB (UMEH) 647*16kB (UMEH) 241*32kB (MEH) 34*64kB (UMH) 0*128kB 1*256kB (U) 1*512kB (U) 1*1024kB (U) 0*2048kB 0*4096kB = 37052kB
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457569
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000008
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
296 total pagecache pages
0 pages in swap cache
RBP: 000000000072bf00 R08: 000000002005ffe4 R09: 000000000000001c
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
1965979 pages RAM
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff66bb416d4
0 pages HighMem/MovableOnly
342854 pages reserved
0 pages cma reserved
Unreclaimable slab info:
R13: 00000000004c3c1d R14: 00000000004d5e98 R15: 00000000ffffffff
Name Used Total
Showing all locks held in the system:
pid_4 0KB 3KB
pid_3 1KB 7KB
pid_2 107KB 156KB
TIPC 12KB 21KB
rds_connection 0KB 3KB
9 locks held by kworker/u4:1/21:
SCTPv6 14KB 18KB
sctp_chunk 1157711KB 1157711KB
1 lock held by khungtaskd/1010:
sctp_bind_bucket 6KB 11KB
DCCPv6 17KB 21KB
DCCP 16KB 20KB
dccp_bind_bucket 1KB 4KB
#0: 00000000e53e8d08 (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4379
kcm_mux_cache 1KB 7KB
bridge_fdb_cache 10KB 15KB
2 locks held by udevd/3700:
nf-frags 0KB 7KB
fib6_nodes 73KB 92KB
2 locks held by rs:main Q:Reg/5853:
#0: 00000000e7e9159f (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline]
#0: 00000000e7e9159f (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489
ip6_dst_cache 245KB 326KB
#1: 000000002b13e3d6 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291
RAWv6 68KB 71KB
2 locks held by rsyslogd/5856:
UDPv6 3KB 3KB
#0: 00000000e7e9159f (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline]
#0: 00000000e7e9159f (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489
TCPv6 23KB 29KB
#1: 000000009b2ec841 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291
nf_conntrack 54KB 86KB
2 locks held by getty/5945:
#0: 000000000e43697f (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
ashmem_area_cache 1KB 7KB
#1: 000000004775a30c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
sd_ext_cdb 0KB 3KB
2 locks held by getty/5946:
scsi_sense_cache 1056KB 1060KB
#0: 00000000db23fa06 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
virtio_scsi_cmd 16KB 16KB
#1: 00000000c94732a2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
sgpool-128 8KB 8KB
2 locks held by getty/5947:
sgpool-64 4KB 6KB
sgpool-32 2KB 7KB
#0: 00000000b91bcce7 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
sgpool-16 1KB 3KB
sgpool-8 0KB 3KB
#1: 000000005ad25108 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
mqueue_inode_cache 10KB 14KB
bio_post_read_ctx 14KB 15KB
2 locks held by getty/5948:
xfs_buf 0KB 3KB
bio-2 14KB 15KB
#0: 00000000cbb77631 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
jfs_mp 7KB 7KB
#1: 00000000e2a8a93a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5949:
nfs_commit_data 3KB 7KB
#0: 00000000a9f5b910 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
nfs_write_data 32KB 32KB
#1: 00000000e56f31ba (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
ext4_system_zone 0KB 3KB
2 locks held by getty/5950:
#0: 00000000ae7eb403 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
kioctx 44KB 89KB
#1: 00000000dd1b0e3c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
aio_kiocb 9KB 24KB
2 locks held by getty/5951:
#0: 0000000026ed438f (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
userfaultfd_ctx_cache 0KB 3KB
#1: 00000000b55698d0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
fanotify_event_info 0KB 3KB
3 locks held by syz-fuzzer/5969:
bio-1 1KB 3KB
#0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline]
#0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489
fasync_cache 0KB 4KB
#1: 00000000e2433c97 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291
pid_namespace 5KB 15KB
#2: 000000000617d65f (fs_reclaim){+.+.}, at: fs_reclaim_acquire.part.97+0x0/0x30 mm/page_alloc.c:4806
posix_timers_cache 3KB 7KB
3 locks held by syz-fuzzer/5970:
#0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline]
#0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489
rpc_buffers 17KB 19KB
rpc_tasks 2KB 3KB
#1: 00000000e2433c97 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291
UNIX 9KB 14KB
tcp_bind_bucket 3KB 8KB
#2: 000000008a08da11 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1126 [inline]
#2: 000000008a08da11 (&rq->lock){-.-.}, at: __schedule+0x236/0x21d0 kernel/sched/core.c:3410
inet_peer_cache 2KB 4KB
xfrm_state 10KB 12KB
2 locks held by syz-fuzzer/5971:
#0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline]
#0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489
#1: 00000000e2433c97 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291
ip_fib_trie 10KB 15KB
3 locks held by syz-executor2/17960:
ip_fib_alias 49KB 63KB
=============================================
ip_dst_cache 703KB 740KB
NMI backtrace for cpu 0
CPU: 0 PID: 1010 Comm: khungtaskd Not tainted 4.20.0-rc1-next-20181109+ #110
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x244/0x39d lib/dump_stack.c:113
RAW 40KB 50KB
nmi_cpu_backtrace.cold.2+0x5c/0xa1 lib/nmi_backtrace.c:101
UDP 16KB 19KB
nmi_trigger_cpumask_backtrace+0x1e8/0x22a lib/nmi_backtrace.c:62
TCP 8KB 11KB
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:144 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline]
watchdog+0xb4c/0x1060 kernel/hung_task.c:289
hugetlbfs_inode_cache 2KB 7KB
fscache_cookie_jar 1KB 7KB
eventpoll_pwq 28KB 43KB
eventpoll_epi 53KB 82KB
inotify_inode_mark 52KB 74KB
request_queue 139KB 145KB
kthread+0x35a/0x440 kernel/kthread.c:246
blkdev_ioc 16KB 23KB
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.513 msecs
NMI backtrace for cpu 1
CPU: 1 PID: 17960 Comm: syz-executor2 Not tainted 4.20.0-rc1-next-20181109+ #110
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_del_entry_valid+0x88/0x100 lib/list_debug.c:51
Code: 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f 84 39 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 80 3c 02 00 <75> 5f 49 8b 14 24 48 39 da 0f 85 4e 01 00 00 49 8d 7d 08 48 b8 00
RSP: 0000:ffff88017fbb5890 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: ffffea0006b7f948 RCX: ffffc9001222f000
RDX: 1ffffd4000d5b171 RSI: ffffffff81a79029 RDI: ffffea0006b7f950
RBP: ffff88017fbb58a8 R08: ffff8801b316e0c0 R09: ffffed002ff76aa8
R10: ffffed002ff76aa8 R11: 0000000000000003 R12: ffffea0006ad8b88
R13: ffff8801d9a37220 R14: ffff88017fbb5df0 R15: 0000000000000002
FS: 00007ff66baff700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc08d0e3dd3 CR3: 00000001c1601000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry include/linux/list.h:117 [inline]
list_move include/linux/list.h:170 [inline]
isolate_lru_pages.isra.57+0xdfb/0x19e0 mm/vmscan.c:1708
shrink_inactive_list+0x428/0x1c50 mm/vmscan.c:1942
shrink_list mm/vmscan.c:2276 [inline]
shrink_node_memcg+0x784/0x18d0 mm/vmscan.c:2541
shrink_node+0x3bc/0x16b0 mm/vmscan.c:2756
shrink_zones mm/vmscan.c:2988 [inline]
do_try_to_free_pages+0x3e7/0x1290 mm/vmscan.c:3050
try_to_free_pages+0x4cb/0xb90 mm/vmscan.c:3265
__perform_reclaim mm/page_alloc.c:3769 [inline]
__alloc_pages_direct_reclaim mm/page_alloc.c:3791 [inline]
__alloc_pages_slowpath+0xa14/0x2e30 mm/page_alloc.c:4192
__alloc_pages_nodemask+0xa7b/0xdd0 mm/page_alloc.c:4391
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0xa5/0x8c0 mm/slab.c:2677
fallback_alloc+0x204/0x2e0 mm/slab.c:3219
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
slab_alloc_node mm/slab.c:3327 [inline]
kmem_cache_alloc_node_trace+0xe7/0x740 mm/slab.c:3661
__do_kmalloc_node mm/slab.c:3683 [inline]
__kmalloc_node_track_caller+0x3c/0x70 mm/slab.c:3698
__kmalloc_reserve.isra.38+0x41/0xe0 net/core/skbuff.c:137
__alloc_skb+0x150/0x770 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:997 [inline]
_sctp_make_chunk+0x58/0x280 net/sctp/sm_make_chunk.c:1402
sctp_make_data net/sctp/sm_make_chunk.c:1434 [inline]
sctp_make_datafrag_empty+0x1d2/0x2e0 net/sctp/sm_make_chunk.c:748
sctp_datamsg_from_user+0x7ca/0x1310 net/sctp/chunk.c:275
sctp_sendmsg_to_asoc+0x5ca/0x1a20 net/sctp/socket.c:1941
sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2113
inet_sendmsg+0x19c/0x690 net/ipv4/af_inet.c:798
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:632
sock_write_iter+0x35e/0x5c0 net/socket.c:901
call_write_iter include/linux/fs.h:1867 [inline]
new_sync_write fs/read_write.c:474 [inline]
__vfs_write+0x6b8/0x9f0 fs/read_write.c:487
vfs_write+0x1fc/0x560 fs/read_write.c:549
ksys_write+0x101/0x260 fs/read_write.c:598
__do_sys_write fs/read_write.c:610 [inline]
__se_sys_write fs/read_write.c:607 [inline]
__x64_sys_write+0x73/0xb0 fs/read_write.c:607
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: Bad RIP value.
RSP: 002b:00007ff66bafec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569
RDX: 000000000001fef0 RSI: 00000000200002c0 RDI: 0000000000000008
RBP: 000000000072c040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff66baff6d4
R13: 00000000004c58a6 R14: 00000000004d95b8 R15: 00000000ffffffff