syzbot


INFO: task hung in __alloc_pages_slowpath

Status: auto-closed as invalid on 2019/05/16 01:27
Subsystems: mm
[Documentation on labels]
First crash: 1995d, last: 1979d

Sample crash report:
 oom_kill_process.cold.27+0x10/0x903 mm/oom_kill.c:953
INFO: task syz-executor1:18278 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc2+ #338
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 out_of_memory+0xa84/0x1430 mm/oom_kill.c:1120
syz-executor1   D19208 18278  16470 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 __alloc_pages_may_oom mm/page_alloc.c:3519 [inline]
 __alloc_pages_slowpath+0x2354/0x2e10 mm/page_alloc.c:4240
 __alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4395
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 __alloc_pages include/linux/gfp.h:473 [inline]
 __alloc_pages_node include/linux/gfp.h:486 [inline]
 kmem_getpages mm/slab.c:1409 [inline]
 cache_grow_begin+0xa5/0x8c0 mm/slab.c:2677
 fallback_alloc+0x204/0x2e0 mm/slab.c:3219
 ____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
 slab_alloc_node mm/slab.c:3327 [inline]
 kmem_cache_alloc_node_trace+0xe7/0x740 mm/slab.c:3661
 __do_kmalloc_node mm/slab.c:3683 [inline]
 __kmalloc_node_track_caller+0x3c/0x70 mm/slab.c:3698
 __kmalloc_reserve.isra.40+0x41/0xe0 net/core/skbuff.c:137
 __alloc_skb+0x155/0x770 net/core/skbuff.c:205
 alloc_skb include/linux/skbuff.h:997 [inline]
 _sctp_make_chunk+0x58/0x280 net/sctp/sm_make_chunk.c:1402
 sctp_make_data net/sctp/sm_make_chunk.c:1434 [inline]
 sctp_make_datafrag_empty+0x1d2/0x2e0 net/sctp/sm_make_chunk.c:748
 sctp_datamsg_from_user+0x7ca/0x1310 net/sctp/chunk.c:275
 __lock_sock+0x1fb/0x350 net/core/sock.c:2252
 sctp_sendmsg_to_asoc+0x5ca/0x1a20 net/sctp/socket.c:1941
 lock_sock_nested+0xfe/0x120 net/core/sock.c:2774
 lock_sock include/net/sock.h:1492 [inline]
 sctp_wait_for_connect+0x3ae/0x640 net/sctp/socket.c:8642
 sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2113
 sctp_sendmsg_to_asoc+0x1627/0x1a20 net/sctp/socket.c:1967
 inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
 sock_write_iter+0x35e/0x5c0 net/socket.c:900
 call_write_iter include/linux/fs.h:1857 [inline]
 new_sync_write fs/read_write.c:474 [inline]
 __vfs_write+0x6b8/0x9f0 fs/read_write.c:487
 vfs_write+0x1fc/0x560 fs/read_write.c:549
 ksys_write+0x101/0x260 fs/read_write.c:598
 __do_sys_write fs/read_write.c:610 [inline]
 __se_sys_write fs/read_write.c:607 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:607
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: Bad RIP value.
 sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2113
RSP: 002b:00007fcddd1ebc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569
RDX: 000000000001fef0 RSI: 0000000020000240 RDI: 000000000000000a
RBP: 000000000072c040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcddd1ec6d4
R13: 00000000004c58a6 R14: 00000000004d95b8 R15: 00000000ffffffff
Mem-Info:
active_anon:191260 inactive_anon:192 isolated_anon:0
 active_file:10 inactive_file:40 isolated_file:0
 unevictable:1 dirty:0 writeback:0 unstable:0
 slab_reclaimable:17185 slab_unreclaimable:1294326
 mapped:49154 shmem:246 pagetables:1860 bounce:0
 free:24294 free_pcp:31 free_cma:0
Node 0 active_anon:765040kB inactive_anon:768kB active_file:40kB inactive_file:160kB unevictable:4kB isolated(anon):0kB isolated(file):0kB mapped:196616kB dirty:0kB writeback:0kB shmem:984kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 329728kB writeback_tmp:0kB unstable:0kB all_unreclaimable? yes
 inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 2818 6321 6321
Node 0 DMA32 free:43884kB min:30052kB low:37564kB high:45076kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888776kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 0 3503 3503
Node 0 Normal free:37556kB min:37364kB low:46704kB high:56044kB active_anon:765040kB inactive_anon:768kB active_file:40kB inactive_file:20kB unevictable:4kB writepending:0kB present:4718592kB managed:3587816kB mlocked:0kB kernel_stack:8256kB pagetables:7440kB bounce:0kB free_pcp:428kB local_pcp:428kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB
 __sys_sendto+0x3d7/0x670 net/socket.c:1788
Node 0 DMA32: 5*4kB (UM) 1*8kB (M) 1*16kB (M) 4*32kB (UM) 3*64kB (M) 2*128kB (M) 3*256kB (UM) 3*512kB (UM) 4*1024kB (UM) 2*2048kB (M) 8*4096kB (M) = 43884kB
Node 0 Normal: 2958*4kB (UMEH) 1639*8kB (UME) 585*16kB (UM) 89*32kB (UM) 4*64kB (U) 0*128kB 1*256kB (U) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 37664kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
280 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap  = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
342854 pages reserved
0 pages cma reserved
Unreclaimable slab info:
Name                      Used          Total
pid_3                      0KB          3KB
pid_2                    221KB        372KB
TIPC                      10KB         21KB
rds_connection             0KB          3KB
SCTPv6                    14KB         30KB
sctp_chunk           1119198KB    1119198KB
sctp_bind_bucket           0KB          3KB
DCCPv6                    17KB         29KB
DCCP                      16KB         27KB
dccp_bind_bucket           0KB          4KB
bridge_fdb_cache          11KB         39KB
fib6_nodes                79KB        120KB
ip6_dst_cache            237KB        266KB
RAWv6                     78KB         78KB
UDPv6                      3KB          3KB
TCPv6                     23KB         23KB
nf_conntrack               5KB         18KB
ashmem_area_cache          0KB          3KB
sd_ext_cdb                 0KB          3KB
 __do_sys_sendto net/socket.c:1800 [inline]
 __se_sys_sendto net/socket.c:1796 [inline]
 __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1796
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
scsi_sense_cache        1056KB       1060KB
virtio_scsi_cmd           16KB         16KB
sgpool-128                 8KB          8KB
sgpool-64                  4KB          6KB
sgpool-32                  2KB          7KB
sgpool-16                  1KB          3KB
sgpool-8                   0KB          3KB
mqueue_inode_cache         10KB         28KB
bio_post_read_ctx         14KB         15KB
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
bio-2                     14KB         15KB
RIP: 0033:0x457569
jfs_mp                     7KB          7KB
Code: Bad RIP value.
nfs_commit_data            3KB          7KB
RSP: 002b:00007fcddd22dc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
nfs_write_data            32KB         32KB
ext4_system_zone           0KB          3KB
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457569
kioctx                     2KB         14KB
RDX: 0000000000000001 RSI: 0000000020000000 RDI: 000000000000000a
RBP: 000000000072bf00 R08: 000000002005ffe4 R09: 000000000000001c
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcddd22e6d4
aio_kiocb                  0KB          4KB
bio-1                      1KB          3KB
fasync_cache               0KB          4KB
R13: 00000000004c3c1d R14: 00000000004d5e98 R15: 00000000ffffffff

Showing all locks held in the system:
pid_namespace              2KB         11KB
posix_timers_cache          0KB          3KB
rpc_buffers               17KB         19KB
1 lock held by khungtaskd/1019:
rpc_tasks                  2KB          3KB
 #0: 000000008a06fb28 (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4379
UNIX                      18KB         21KB
2 locks held by udevd/3716:
2 locks held by rsyslogd/5941:
2 locks held by getty/6031:
 #0: 0000000098bfc807 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 0000000037cb72d1 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
tcp_bind_bucket           21KB         24KB
2 locks held by getty/6032:
 #0: 000000004f57dedc (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000c1865483 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/6033:
 #0: 
inet_peer_cache            0KB          4KB
000000008268227d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
ip_fib_trie               11KB         19KB
 #1: 00000000130dceb9 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/6034:
 #0: 00000000d32406eb (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 0000000062ab0c05 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
ip_fib_alias              53KB         83KB
2 locks held by getty/6035:
 #0: 00000000054d84cc (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
ip_dst_cache             114KB        124KB
 #1: 0000000058bba832 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
RAW                       46KB         57KB
UDP                       17KB         32KB
TCP                        8KB         11KB
hugetlbfs_inode_cache          2KB          7KB
2 locks held by getty/6036:
fscache_cookie_jar          1KB         11KB
eventpoll_pwq              3KB         23KB
 #0: 0000000095e0c705 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
eventpoll_epi              5KB         23KB
inotify_inode_mark          5KB         23KB
request_queue            153KB        153KB
blkdev_requests            1KB          3KB
blkdev_ioc               158KB        277KB
 #1: 00000000bb44b75a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
bio-0                   3810KB       4755KB
biovec-max             17275KB      17275KB
2 locks held by getty/6037:
biovec-64                252KB        252KB
 #0: 0000000070955de5 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
biovec-16                 90KB         90KB
bio_integrity_payload          1KB          3KB
khugepaged_mm_slot         29KB         58KB
user_namespace             0KB          3KB
 #1: 0000000037dab48e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
dmaengine-unmap-256          2KB          6KB
dmaengine-unmap-128          1KB          3KB
dmaengine-unmap-16          0KB          4KB
dmaengine-unmap-2          0KB          3KB
2 locks held by syz-fuzzer/6056:
skbuff_fclone_cache        476KB        791KB
skbuff_head_cache    1121013KB    1121013KB
configfs_dir_cache          0KB          4KB
file_lock_cache            0KB          3KB
file_lock_ctx              1KB          3KB
fsnotify_mark_connector          3KB         19KB
net_namespace             60KB         60KB
shmem_inode_cache       4484KB       4581KB
task_delay_info          115KB        203KB
4 locks held by syz-fuzzer/6061:
taskstats                207KB        382KB
proc_dir_entry           669KB        746KB
pde_opener                 8KB         11KB
6 locks held by syz-executor1/18292:
seq_file                 111KB        141KB

sigqueue                  24KB         35KB
=============================================

kernfs_node_cache      12017KB      12048KB
NMI backtrace for cpu 0
mnt_cache                 88KB        116KB
CPU: 0 PID: 1019 Comm: khungtaskd Not tainted 4.20.0-rc2+ #338
filp                    2373KB       2531KB
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
names_cache            80108KB      80146KB
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
iint_cache                82KB         87KB
 nmi_cpu_backtrace.cold.2+0x5c/0xa1 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1e8/0x22a lib/nmi_backtrace.c:62
key_jar                   13KB         22KB
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline]
 watchdog+0xb51/0x1060 kernel/hung_task.c:289
uts_namespace              2KB         11KB
nsproxy                  100KB        102KB
vm_area_struct          4369KB       4613KB
mm_struct               1010KB       1053KB
fs_cache                  99KB        116KB
 kthread+0x35a/0x440 kernel/kthread.c:246
files_cache              374KB        397KB
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:
signal_cache             828KB        898KB
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.708 msecs
NMI backtrace for cpu 1
CPU: 1 PID: 18292 Comm: syz-executor1 Not tainted 4.20.0-rc2+ #338
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:debug_lockdep_rcu_enabled+0x53/0x90 kernel/rcu/update.c:248
Code: 38 d0 7c 04 84 d2 75 4c 8b 15 51 7f ad 08 85 d2 74 3e 48 c7 c7 b4 61 16 8a 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1c 8b
RSP: 0000:ffff8881daf07298 EFLAGS: 00000807
RAX: dffffc0000000000 RBX: 1ffff1103b5e0e5a RCX: 0000000000000001
RDX: 1ffffffff142cc36 RSI: 0000000000000001 RDI: ffffffff8a1661b4
RBP: ffff8881daf07298 R08: 0000000000000000 R09: ffffed103b5e0e6d
R10: ffffed103b5e0e6d R11: 0000000000000003 R12: ffff8881cd924600
R13: ffff8881daf073b0 R14: ffff8881da8177c0 R15: 0000000000000000
FS:  00007fcddd1ec700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004044ad CR3: 00000001b6305000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 trace_lock_release include/trace/events/lock.h:58 [inline]
 lock_release+0x689/0xa00 kernel/locking/lockdep.c:3862
 __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
 _raw_spin_unlock+0x1a/0x50 kernel/locking/spinlock.c:176
 spin_unlock include/linux/spinlock.h:369 [inline]
 __queue_work+0xc01/0x1440 kernel/workqueue.c:1413
 queue_work_on+0x19a/0x1e0 kernel/workqueue.c:1486
 queue_work include/linux/workqueue.h:512 [inline]
 schedule_work include/linux/workqueue.h:570 [inline]
 kernfs_notify+0x130/0x170 fs/kernfs/file.c:946
 cgroup_file_notify+0x1d2/0x2f0 kernel/cgroup/cgroup.c:3860
 cgroup_file_notify_timer+0x16/0x20 kernel/cgroup/cgroup.c:3570
 call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
 run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
 __do_softirq+0x308/0xb7e kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x17f/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1061
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:804
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:761 [inline]
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:1688 [inline]
RIP: 0010:vprintk_emit+0x87d/0x990 kernel/printk/printk.c:1921
Code: 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 de 00 00 00 48 83 3d 63 3b ec 07 00 74 34 e8 cc c7 19 00 48 8b bd 90 fe ff ff 57 9d <0f> 1f 44 00 00 e9 aa fe ff ff e8 b4 c7 19 00 0f 0b e8 ad c7 19 00
RSP: 0000:ffff88817b84dd88 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000040000 RBX: 1ffff1102f709bb7 RCX: ffffc90009fe2000
RDX: 0000000000040000 RSI: ffffffff8165c014 RDI: 0000000000000246
RBP: ffff88817b84df00 R08: ffff8881cd924ef0 R09: 0000000000000006
R10: 0000000000000000 R11: ffff8881cd924600 R12: 0000000000000200
R13: 0000000000000000 R14: ffffed102f709bcb R15: ffff88817b84ded8
 vprintk_default+0x28/0x30 kernel/printk/printk.c:1964
 vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
 printk+0xa7/0xcf kernel/printk/printk.c:1997
 dump_unreclaimable_slab.cold.22+0xd8/0xe6 mm/slab_common.c:1392
 dump_header+0x7cc/0xf72 mm/oom_kill.c:447
 oom_kill_process.cold.27+0x10/0x903 mm/oom_kill.c:953
 out_of_memory+0xa84/0x1430 mm/oom_kill.c:1120
 __alloc_pages_may_oom mm/page_alloc.c:3519 [inline]
 __alloc_pages_slowpath+0x2354/0x2e10 mm/page_alloc.c:4240
 __alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4395
 __alloc_pages include/linux/gfp.h:473 [inline]
 __alloc_pages_node include/linux/gfp.h:486 [inline]
 kmem_getpages mm/slab.c:1409 [inline]
 cache_grow_begin+0xa5/0x8c0 mm/slab.c:2677
 fallback_alloc+0x204/0x2e0 mm/slab.c:3219
 ____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
 slab_alloc_node mm/slab.c:3327 [inline]
 kmem_cache_alloc_node_trace+0xe7/0x740 mm/slab.c:3661
 __do_kmalloc_node mm/slab.c:3683 [inline]
 __kmalloc_node_track_caller+0x3c/0x70 mm/slab.c:3698
 __kmalloc_reserve.isra.40+0x41/0xe0 net/core/skbuff.c:137
 __alloc_skb+0x155/0x770 net/core/skbuff.c:205
 ? _copy_to_iter_mcsafe+0x168
Lost 72 message(s)!

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/17 01:09 upstream 1ce80e0fe98e b08ee62a .config console log report ci-upstream-kasan-gce-root
2018/10/31 21:03 bpf-next 44adbac8f721 89781090 .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.