363837 pages reserved
0 pages cma reserved
Out of memory: Kill process 27103 (syz-executor.1) score 1007 or sacrifice child
Killed process 27103 (syz-executor.1) total-vm:93680kB, anon-rss:18160kB, file-rss:34816kB, shmem-rss:0kB
oom_reaper: reaped process 27103 (syz-executor.1), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
INFO: task syz-executor.1:32250 blocked for more than 140 seconds.
Not tainted 4.14.203-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1 D27064 32250 8010 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2808 [inline]
__schedule+0x88b/0x1de0 kernel/sched/core.c:3384
schedule+0x8d/0x1b0 kernel/sched/core.c:3428
__rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline]
rwsem_down_read_failed+0x1e6/0x350 kernel/locking/rwsem-xadd.c:309
call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94
__down_read arch/x86/include/asm/rwsem.h:66 [inline]
down_read+0x44/0x80 kernel/locking/rwsem.c:26
ext4_da_map_blocks fs/ext4/inode.c:1832 [inline]
ext4_da_get_block_prep+0x8d3/0xfc0 fs/ext4/inode.c:1964
__block_write_begin_int+0x35c/0x1090 fs/buffer.c:2038
ext4_da_write_begin+0x402/0xe70 fs/ext4/inode.c:3108
generic_perform_write+0x1c9/0x420 mm/filemap.c:3055
__generic_file_write_iter+0x227/0x590 mm/filemap.c:3180
ext4_file_write_iter+0x276/0xd20 fs/ext4/file.c:270
call_write_iter include/linux/fs.h:1778 [inline]
new_sync_write fs/read_write.c:469 [inline]
__vfs_write+0x44c/0x630 fs/read_write.c:482
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45deb9
RSP: 002b:00007fa0a0abdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000000003ac00 RCX: 000000000045deb9
RDX: 00000000175d900f RSI: 0000000020000200 RDI: 0000000000000006
RBP: 000000000118c200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118c1cc
R13: 00007ffd58dfda5f R14: 00007fa0a0abe9c0 R15: 000000000118c1cc
Showing all locks held in the system:
2 locks held by systemd/1:
#0: (&mm->mmap_sem){++++}, at: [<ffffffff8124d149>] __do_page_fault+0x2b9/0xad0 arch/x86/mm/fault.c:1371
#1: (&ei->i_mmap_sem){++++}, at: [<ffffffff81bf2dec>] ext4_filemap_fault+0x7c/0xb0 fs/ext4/inode.c:6237
3 locks held by kworker/u4:1/22:
#0: ("%s"wiphy_name(local->hw.wiphy)){+.+.}, at: [<ffffffff81373630>] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2087
#1: ((&sdata->work)){+.+.}, at: [<ffffffff81373666>] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2091
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1d188>] sdata_lock net/mac80211/ieee80211_i.h:986 [inline]
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1d188>] ieee80211_ibss_rx_queued_mgmt+0xc8/0x1680 net/mac80211/ibss.c:1623
3 locks held by kworker/u4:3/292:
#0: ("%s"wiphy_name(local->hw.wiphy)){+.+.}, at: [<ffffffff81373630>] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2087
#1: ((&sdata->work)){+.+.}, at: [<ffffffff81373666>] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2091
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1d188>] sdata_lock net/mac80211/ieee80211_i.h:986 [inline]
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1d188>] ieee80211_ibss_rx_queued_mgmt+0xc8/0x1680 net/mac80211/ibss.c:1623
1 lock held by khungtaskd/1528:
#0: (tasklist_lock){.+.+}, at: [<ffffffff81430c94>] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548
2 locks held by syz-executor.1/8010:
#0: (&mm->mmap_sem){++++}, at: [<ffffffff8124d149>] __do_page_fault+0x2b9/0xad0 arch/x86/mm/fault.c:1371
#1: (&ei->i_mmap_sem){++++}, at: [<ffffffff81bf2dec>] ext4_filemap_fault+0x7c/0xb0 fs/ext4/inode.c:6237
2 locks held by syz-executor.5/8012:
#0: (&mm->mmap_sem){++++}, at: [<ffffffff8124d149>] __do_page_fault+0x2b9/0xad0 arch/x86/mm/fault.c:1371
#1: (&ei->i_mmap_sem){++++}, at: [<ffffffff81bf2dec>] ext4_filemap_fault+0x7c/0xb0 fs/ext4/inode.c:6237
4 locks held by kworker/u4:8/9552:
#0: ("%s"wiphy_name(local->hw.wiphy)){+.+.}, at: [<ffffffff81373630>] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2087
#1: ((&sdata->work)){+.+.}, at: [<ffffffff81373666>] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2091
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1e7b2>] sdata_lock net/mac80211/ieee80211_i.h:986 [inline]
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1e7b2>] ieee80211_ibss_work+0x72/0xc90 net/mac80211/ibss.c:1675
#3: (&local->sta_mtx){+.+.}, at: [<ffffffff86d1eb20>] ieee80211_ibss_sta_expire net/mac80211/ibss.c:1261 [inline]
#3: (&local->sta_mtx){+.+.}, at: [<ffffffff86d1eb20>] ieee80211_sta_merge_ibss net/mac80211/ibss.c:1297 [inline]
#3: (&local->sta_mtx){+.+.}, at: [<ffffffff86d1eb20>] ieee80211_ibss_work+0x3e0/0xc90 net/mac80211/ibss.c:1703
3 locks held by kworker/u4:12/9758:
#0: ("%s"wiphy_name(local->hw.wiphy)){+.+.}, at: [<ffffffff81373630>] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2087
#1: ((&sdata->work)){+.+.}, at: [<ffffffff81373666>] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2091
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1d188>] sdata_lock net/mac80211/ieee80211_i.h:986 [inline]
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1d188>] ieee80211_ibss_rx_queued_mgmt+0xc8/0x1680 net/mac80211/ibss.c:1623
4 locks held by kworker/u4:13/31033:
#0: ("%s"wiphy_name(local->hw.wiphy)){+.+.}, at: [<ffffffff81373630>] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2087
#1: ((&sdata->work)){+.+.}, at: [<ffffffff81373666>] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2091
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1e7b2>] sdata_lock net/mac80211/ieee80211_i.h:986 [inline]
#2: (&wdev->mtx){+.+.}, at: [<ffffffff86d1e7b2>] ieee80211_ibss_work+0x72/0xc90 net/mac80211/ibss.c:1675
#3: (&local->sta_mtx){+.+.}, at: [<ffffffff86d1eb20>] ieee80211_ibss_sta_expire net/mac80211/ibss.c:1261 [inline]
#3: (&local->sta_mtx){+.+.}, at: [<ffffffff86d1eb20>] ieee80211_sta_merge_ibss net/mac80211/ibss.c:1297 [inline]
#3: (&local->sta_mtx){+.+.}, at: [<ffffffff86d1eb20>] ieee80211_ibss_work+0x3e0/0xc90 net/mac80211/ibss.c:1703
4 locks held by syz-executor.1/32250:
#0: (&f->f_pos_lock){+.+.}, at: [<ffffffff818f8b6b>] __fdget_pos+0x1fb/0x2b0 fs/file.c:769
#1: (sb_writers#3){.+.+}, at: [<ffffffff818925f8>] file_start_write include/linux/fs.h:2712 [inline]
#1: (sb_writers#3){.+.+}, at: [<ffffffff818925f8>] vfs_write+0x3d8/0x4d0 fs/read_write.c:543
#2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [<ffffffff81ba781c>] inode_trylock include/linux/fs.h:739 [inline]
#2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [<ffffffff81ba781c>] ext4_file_write_iter+0x1cc/0xd20 fs/ext4/file.c:236
#3: (&ei->i_data_sem){++++}, at: [<ffffffff81bd12c3>] ext4_da_map_blocks fs/ext4/inode.c:1832 [inline]
#3: (&ei->i_data_sem){++++}, at: [<ffffffff81bd12c3>] ext4_da_get_block_prep+0x8d3/0xfc0 fs/ext4/inode.c:1964
4 locks held by syz-executor.5/32257:
#0: (&f->f_pos_lock){+.+.}, at: [<ffffffff818f8b6b>] __fdget_pos+0x1fb/0x2b0 fs/file.c:769
#1: (sb_writers#3){.+.+}, at: [<ffffffff818925f8>] file_start_write include/linux/fs.h:2712 [inline]
#1: (sb_writers#3){.+.+}, at: [<ffffffff818925f8>] vfs_write+0x3d8/0x4d0 fs/read_write.c:543
#2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [<ffffffff81ba781c>] inode_trylock include/linux/fs.h:739 [inline]
#2: (&sb->s_type->i_mutex_key#10){+.+.}, at: [<ffffffff81ba781c>] ext4_file_write_iter+0x1cc/0xd20 fs/ext4/file.c:236
#3: (pcpu_drain_mutex){+.+.}, at: [<ffffffff816c8aea>] drain_all_pages+0x4a/0x570 mm/page_alloc.c:2500
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 1528 Comm: khungtaskd Not tainted 4.14.203-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x13a/0x17f lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
watchdog+0x5b9/0xb40 kernel/hung_task.c:274
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 7651 Comm: in:imklog Not tainted 4.14.203-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88809cc1c180 task.stack: ffff888094580000
RIP: 0010:__lock_acquire+0x0/0x3f20 kernel/locking/lockdep.c:3348
RSP: 0000:ffff8880945874a8 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff88809cc1c180 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880455bb498
RBP: ffff8880455bb498 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88809cc1c180 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
FS: 00007f437f7d8700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000505c48 CR3: 00000000958bd000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
__list_lru_count_one mm/list_lru.c:167 [inline]
list_lru_count_one+0x7f/0x1d0 mm/list_lru.c:178
list_lru_shrink_count include/linux/list_lru.h:118 [inline]
super_cache_count+0x131/0x2b0 fs/super.c:143
do_shrink_slab mm/vmscan.c:328 [inline]
shrink_slab+0x389/0xb60 mm/vmscan.c:504
shrink_node.isra.0+0x818/0xb30 mm/vmscan.c:2672
shrink_zones mm/vmscan.c:2819 [inline]
do_try_to_free_pages+0x34b/0xde0 mm/vmscan.c:2877
try_to_free_pages+0x203/0x6e0 mm/vmscan.c:3084
__perform_reclaim mm/page_alloc.c:3588 [inline]
__alloc_pages_direct_reclaim mm/page_alloc.c:3609 [inline]
__alloc_pages_slowpath mm/page_alloc.c:3996 [inline]
__alloc_pages_nodemask+0xc84/0x2720 mm/page_alloc.c:4205
alloc_pages_current+0x155/0x260 mm/mempolicy.c:2113
alloc_pages include/linux/gfp.h:520 [inline]
__page_cache_alloc mm/filemap.c:871 [inline]
page_cache_read mm/filemap.c:2296 [inline]
filemap_fault+0xe12/0x18d0 mm/filemap.c:2480
ext4_filemap_fault+0x84/0xb0 fs/ext4/inode.c:6238
__do_fault+0xfa/0x380 mm/memory.c:3316
do_read_fault mm/memory.c:3726 [inline]
do_fault mm/memory.c:3852 [inline]
handle_pte_fault mm/memory.c:4082 [inline]
__handle_mm_fault+0x2497/0x4620 mm/memory.c:4206
handle_mm_fault+0x306/0x7a0 mm/memory.c:4243
__do_page_fault+0x549/0xad0 arch/x86/mm/fault.c:1442
page_fault+0x45/0x50 arch/x86/entry/entry_64.S:1123
RIP: 1fa0:0x1f9f
RSP: 0000:00005646c1c849d0 EFLAGS: 7f437f7b7da0
Code: 00 e9 5a ff ff ff 48 c7 c7 40 a9 f9 8b e8 59 81 3e 00 eb 96 0f 1f 80 00 00 00 00 48 8b 3c 24 e9 77 fa ff ff 0f 1f 80 00 00 00 00 <41> 57 41 56 41 55 41 54 49 89 fc 55 89 cd 53 89 d3 48 ba 00 00