syzbot


INFO: task hung in console_device

Status: auto-closed as invalid on 2019/05/20 06:11
Reported-by: syzbot+1b490365069fba8a3bbb@syzkaller.appspotmail.com
First crash: 2057d, last: 1983d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 INFO: task hung in console_device C 11 1701d 1839d 0/2 public: reported C repro on 2019/04/14 00:00
android-414 INFO: task hung in console_device (2) 1 1630d 1630d 0/1 auto-closed as invalid on 2020/03/08 16:40
android-49 INFO: task hung in console_device C 150 1636d 1842d 0/3 public: reported C repro on 2019/04/11 08:44

Sample crash report:
Out of memory: Kill process 11603 (syz-executor5) score 1007 or sacrifice child
Killed process 11603 (syz-executor5) total-vm:70732kB, anon-rss:17848kB, file-rss:32768kB, shmem-rss:0kB
oom_reaper: reaped process 11603 (syz-executor5), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=11584 comm=syz-executor2
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=65535 sclass=netlink_tcpdiag_socket pig=11584 comm=syz-executor2
INFO: task init:9111 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
init            D29032  9111      1 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 schedule_timeout+0x710/0xe60 kernel/time/timer.c:1721
 __down_common kernel/locking/semaphore.c:221 [inline]
 __down+0x180/0x2a0 kernel/locking/semaphore.c:238
 down+0x58/0x70 kernel/locking/semaphore.c:62
 console_lock+0x24/0x70 kernel/printk/printk.c:2061
 console_device+0x17/0xb0 kernel/printk/printk.c:2348
 tty_lookup_driver+0x17a/0x210 drivers/tty/tty_io.c:1833
 tty_open_by_driver drivers/tty/tty_io.c:1928 [inline]
 tty_open+0x3b9/0x980 drivers/tty/tty_io.c:2011
 chrdev_open+0x20d/0x570 fs/char_dev.c:417
 do_dentry_open+0x426/0xda0 fs/open.c:764
 vfs_open+0x11c/0x210 fs/open.c:878
 do_last fs/namei.c:3408 [inline]
 path_openat+0x4eb/0x23a0 fs/namei.c:3550
 do_filp_open+0x197/0x270 fs/namei.c:3584
 do_sys_open+0x2ef/0x580 fs/open.c:1071
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f5a7024c120
RSP: 002b:00007ffd8e516bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 000000000201ff40 RCX: 00007f5a7024c120
RDX: 0000000000000010 RSI: 0000000000000902 RDI: 00000000004072c8
RBP: 0000000000000000 R08: 0000000000407370 R09: 0000000000000001
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000902
R13: 0000000000000102 R14: 00007ffd8e516d30 R15: 000000000201ff48
INFO: task init:9112 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
init            D28168  9112      1 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
 tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
 chrdev_open+0x20d/0x570 fs/char_dev.c:417
 do_dentry_open+0x426/0xda0 fs/open.c:764
 vfs_open+0x11c/0x210 fs/open.c:878
 do_last fs/namei.c:3408 [inline]
 path_openat+0x4eb/0x23a0 fs/namei.c:3550
 do_filp_open+0x197/0x270 fs/namei.c:3584
 do_sys_open+0x2ef/0x580 fs/open.c:1071
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f5a7024c120
RSP: 002b:00007ffd8e516bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000002020010 RCX: 00007f5a7024c120
RDX: 0000000000000010 RSI: 0000000000000902 RDI: 00000000004072c8
RBP: 0000000000000000 R08: 0000000000407370 R09: 0000000000000001
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000902
R13: 0000000000000102 R14: 00007ffd8e516d30 R15: 0000000002020018
INFO: task init:9114 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
init            D27096  9114      1 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
 tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
 chrdev_open+0x20d/0x570 fs/char_dev.c:417
 do_dentry_open+0x426/0xda0 fs/open.c:764
 vfs_open+0x11c/0x210 fs/open.c:878
 do_last fs/namei.c:3408 [inline]
 path_openat+0x4eb/0x23a0 fs/namei.c:3550
 do_filp_open+0x197/0x270 fs/namei.c:3584
 do_sys_open+0x2ef/0x580 fs/open.c:1071
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f5a7024c120
RSP: 002b:00007ffd8e516bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00000000020200e0 RCX: 00007f5a7024c120
RDX: 0000000000000010 RSI: 0000000000000902 RDI: 00000000004072c8
RBP: 0000000000000000 R08: 0000000000407370 R09: 0000000000000001
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000902
R13: 0000000000000102 R14: 00007ffd8e516d30 R15: 00000000020200e8
INFO: task init:9115 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
init            D28712  9115      1 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
 tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
 chrdev_open+0x20d/0x570 fs/char_dev.c:417
 do_dentry_open+0x426/0xda0 fs/open.c:764
 vfs_open+0x11c/0x210 fs/open.c:878
 do_last fs/namei.c:3408 [inline]
 path_openat+0x4eb/0x23a0 fs/namei.c:3550
 do_filp_open+0x197/0x270 fs/namei.c:3584
 do_sys_open+0x2ef/0x580 fs/open.c:1071
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f5a7024c120
RSP: 002b:00007ffd8e516bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00000000020201b0 RCX: 00007f5a7024c120
RDX: 0000000000000010 RSI: 0000000000000902 RDI: 00000000004072c8
RBP: 0000000000000000 R08: 0000000000407370 R09: 0000000000000001
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000902
R13: 0000000000000102 R14: 00007ffd8e516d30 R15: 00000000020201b8
INFO: task init:9118 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
init            D27000  9118      1 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
 tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
 chrdev_open+0x20d/0x570 fs/char_dev.c:417
 do_dentry_open+0x426/0xda0 fs/open.c:764
 vfs_open+0x11c/0x210 fs/open.c:878
 do_last fs/namei.c:3408 [inline]
 path_openat+0x4eb/0x23a0 fs/namei.c:3550
 do_filp_open+0x197/0x270 fs/namei.c:3584
 do_sys_open+0x2ef/0x580 fs/open.c:1071
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f5a7024c120
RSP: 002b:00007ffd8e516bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000002020280 RCX: 00007f5a7024c120
RDX: 0000000000000010 RSI: 0000000000000902 RDI: 00000000004072c8
RBP: 0000000000000000 R08: 0000000000407370 R09: 0000000000000001
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000902
R13: 0000000000000102 R14: 00007ffd8e516d30 R15: 0000000002020288
INFO: task init:9121 blocked for more than 140 seconds.
      Not tainted 4.14.81+ #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
init            D29032  9121      1 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
 tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
 chrdev_open+0x20d/0x570 fs/char_dev.c:417
 do_dentry_open+0x426/0xda0 fs/open.c:764
 vfs_open+0x11c/0x210 fs/open.c:878
 do_last fs/namei.c:3408 [inline]
 path_openat+0x4eb/0x23a0 fs/namei.c:3550
 do_filp_open+0x197/0x270 fs/namei.c:3584
 do_sys_open+0x2ef/0x580 fs/open.c:1071
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f5a7024c120
RSP: 002b:00007ffd8e516bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000002020350 RCX: 00007f5a7024c120
RDX: 0000000000000010 RSI: 0000000000000902 RDI: 00000000004072c8
RBP: 0000000000000000 R08: 0000000000407370 R09: 0000000000000001
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000902
R13: 0000000000000102 R14: 00007ffd8e516d30 R15: 0000000002020358

Showing all locks held in the system:
1 lock held by khungtaskd/23:
 #0:  (tasklist_lock){.+.+}, at: [<ffffffffb34023b7>] debug_show_all_locks+0x74/0x20f kernel/locking/lockdep.c:4541
2 locks held by udevd/190:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb32b3fed>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffffb3961635>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6177
1 lock held by rsyslogd/1637:
 #0:  (&f->f_pos_lock){+.+.}, at: [<ffffffffb37bdcf2>] __fdget_pos+0xa2/0xc0 fs/file.c:768
2 locks held by getty/1765:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffffb3f3cf30>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffffb3f384af>] n_tty_read+0x1ff/0x15e0 drivers/tty/n_tty.c:2142
2 locks held by syz-fuzzer/1784:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb32b3fed>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffffb3961635>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6177
3 locks held by syz-executor1/1850:
 #0:  (&dup_mmap_sem){.+.+}, at: [<ffffffffb32d03d9>] dup_mmap kernel/fork.c:609 [inline]
 #0:  (&dup_mmap_sem){.+.+}, at: [<ffffffffb32d03d9>] dup_mm kernel/fork.c:1202 [inline]
 #0:  (&dup_mmap_sem){.+.+}, at: [<ffffffffb32d03d9>] copy_mm kernel/fork.c:1256 [inline]
 #0:  (&dup_mmap_sem){.+.+}, at: [<ffffffffb32d03d9>] copy_process.part.6+0x3989/0x6530 kernel/fork.c:1762
 #1:  (&mm->mmap_sem){++++}, at: [<ffffffffb32d03f5>] dup_mmap kernel/fork.c:610 [inline]
 #1:  (&mm->mmap_sem){++++}, at: [<ffffffffb32d03f5>] dup_mm kernel/fork.c:1202 [inline]
 #1:  (&mm->mmap_sem){++++}, at: [<ffffffffb32d03f5>] copy_mm kernel/fork.c:1256 [inline]
 #1:  (&mm->mmap_sem){++++}, at: [<ffffffffb32d03f5>] copy_process.part.6+0x39a5/0x6530 kernel/fork.c:1762
 #2:  (&mm->mmap_sem/1){+.+.}, at: [<ffffffffb32d043d>] dup_mmap kernel/fork.c:619 [inline]
 #2:  (&mm->mmap_sem/1){+.+.}, at: [<ffffffffb32d043d>] dup_mm kernel/fork.c:1202 [inline]
 #2:  (&mm->mmap_sem/1){+.+.}, at: [<ffffffffb32d043d>] copy_mm kernel/fork.c:1256 [inline]
 #2:  (&mm->mmap_sem/1){+.+.}, at: [<ffffffffb32d043d>] copy_process.part.6+0x39ed/0x6530 kernel/fork.c:1762
2 locks held by kworker/u4:5/2260:
 #0:  ("events_unbound"){+.+.}, at: [<ffffffffb3327d04>] process_one_work+0x784/0x1670 kernel/workqueue.c:2085
 #1:  ((&sub_info->work)){+.+.}, at: [<ffffffffb3327d3c>] process_one_work+0x7bc/0x1670 kernel/workqueue.c:2089
2 locks held by kworker/u4:1/6837:
 #0:  ("events_unbound"){+.+.}, at: [<ffffffffb3327d04>] process_one_work+0x784/0x1670 kernel/workqueue.c:2085
 #1:  ((&sub_info->work)){+.+.}, at: [<ffffffffb3327d3c>] process_one_work+0x7bc/0x1670 kernel/workqueue.c:2089
2 locks held by kworker/u4:3/8720:
 #0:  ("events_unbound"){+.+.}, at: [<ffffffffb3327d04>] process_one_work+0x784/0x1670 kernel/workqueue.c:2085
 #1:  ((&sub_info->work)){+.+.}, at: [<ffffffffb3327d3c>] process_one_work+0x7bc/0x1670 kernel/workqueue.c:2089
1 lock held by init/9111:
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by init/9112:
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by init/9114:
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by init/9115:
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by init/9118:
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by init/9121:
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffffb3f2c928>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by syz-executor2/11580:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb36912cf>] vm_mmap_pgoff+0x14f/0x1d0 mm/util.c:331
1 lock held by syz-executor2/11615:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb36c22f6>] __mm_populate+0x206/0x300 mm/gup.c:1247
1 lock held by syz-executor4/11609:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb36e9b5f>] do_mprotect_pkey mm/mprotect.c:469 [inline]
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb36e9b5f>] SYSC_mprotect mm/mprotect.c:566 [inline]
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb36e9b5f>] SyS_mprotect+0x16f/0x610 mm/mprotect.c:563
1 lock held by syz-executor0/11616:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb36912cf>] vm_mmap_pgoff+0x14f/0x1d0 mm/util.c:331
1 lock held by syz-executor5/11617:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb36912cf>] vm_mmap_pgoff+0x14f/0x1d0 mm/util.c:331
1 lock held by modprobe/11624:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffffb32b3fed>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 4.14.81+ #6
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x11b lib/dump_stack.c:53
 nmi_cpu_backtrace.cold.0+0x47/0x85 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x121/0x146 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
 watchdog+0x574/0xa70 kernel/hung_task.c:252
 kthread+0x348/0x420 kernel/kthread.c:232
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1854 Comm: syz-executor2 Not tainted 4.14.81+ #6
task: ffff8801d0425e00 task.stack: ffff8801a18d8000
RIP: 0010:mem_cgroup_get_lru_size include/linux/memcontrol.h:443 [inline]
RIP: 0010:lruvec_lru_size+0xdb/0x2f0 mm/vmscan.c:251
RSP: 0000:ffff8801a18df3a8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffff8801da95d210 RCX: 1ffff1003b52ba5e
RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff8801da95d2f0
RBP: 000000000000000a R08: 0000000000000001 R09: 0000000000000000
R10: ffff8801d0426680 R11: 0000000000000001 R12: ffff8801da95d200
R13: 0000000000000002 R14: 0000000000000002 R15: ffffffffb56e9480
FS:  000000000289e940(0000) GS:ffff8801dba00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f320000 CR3: 00000001a18e8002 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 get_scan_count mm/vmscan.c:2353 [inline]
 shrink_node_memcg+0x333/0x12e0 mm/vmscan.c:2408
 shrink_node+0x301/0xbf0 mm/vmscan.c:2630
 shrink_zones mm/vmscan.c:2812 [inline]
 do_try_to_free_pages+0x349/0xde0 mm/vmscan.c:2874
 try_to_free_pages+0x204/0x6b0 mm/vmscan.c:3080
 __perform_reclaim mm/page_alloc.c:3593 [inline]
 __alloc_pages_direct_reclaim mm/page_alloc.c:3614 [inline]
 __alloc_pages_slowpath mm/page_alloc.c:4022 [inline]
 __alloc_pages_nodemask+0xafb/0x2300 mm/page_alloc.c:4222
 __alloc_pages include/linux/gfp.h:461 [inline]
 __alloc_pages_node include/linux/gfp.h:474 [inline]
 alloc_pages_node include/linux/gfp.h:488 [inline]
 __page_cache_alloc include/linux/pagemap.h:226 [inline]
 page_cache_read mm/filemap.c:2286 [inline]
 filemap_fault+0xcdd/0x14a0 mm/filemap.c:2470
 ext4_filemap_fault+0x7d/0xb0 fs/ext4/inode.c:6178
 __do_fault+0x80/0x210 mm/memory.c:3194
 do_read_fault mm/memory.c:3604 [inline]
 do_fault mm/memory.c:3704 [inline]
 handle_pte_fault mm/memory.c:3934 [inline]
 __handle_mm_fault+0xe04/0x23a0 mm/memory.c:4058
 handle_mm_fault+0x2f2/0x6eb mm/memory.c:4095
 __do_page_fault+0x45d/0xb60 arch/x86/mm/fault.c:1425
 page_fault+0x42/0x50 arch/x86/entry/entry_64.S:1104
RIP: 1a2b34:0x65e
RSP: 1a359c:000000000000183f EFLAGS: 0000001d
Code: 00 0f 85 0e 02 00 00 4b 8d bc ec e0 00 00 00 48 03 ab b8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 <0f> 85 da 01 00 00 48 03 ab e0 00 00 00 e8 93 d4 e9 ff 41 8d 5e 

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/21 06:10 android-4.14 4e76528bd48d 5d9a3924 .config console log report ci-android-414-kasan-gce-root
2018/11/20 06:02 android-4.14 4e76528bd48d 9bc2a903 .config console log report ci-android-414-kasan-gce-root
2018/11/17 21:32 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/16 22:26 android-4.14 4e76528bd48d b08ee62a .config console log report ci-android-414-kasan-gce-root
2018/11/13 03:43 android-4.14 97c308ca4091 74dbb806 .config console log report ci-android-414-kasan-gce-root
2018/11/11 03:49 android-4.14 494c2659e60e f3c4e618 .config console log report ci-android-414-kasan-gce-root
2018/10/31 15:33 android-4.14 4ed22187defd 89781090 .config console log report ci-android-414-kasan-gce-root
2018/10/31 04:49 android-4.14 4ed22187defd 4ccf7bb4 .config console log report ci-android-414-kasan-gce-root
2018/10/30 17:50 android-4.14 4ed22187defd 8dbb755a .config console log report ci-android-414-kasan-gce-root
2018/10/24 20:56 android-4.14 35a066ea5bf9 a8292de9 .config console log report ci-android-414-kasan-gce-root
2018/10/23 00:11 android-4.14 a3ac63b18873 ecb386fe .config console log report ci-android-414-kasan-gce-root
2018/10/03 18:25 android-4.14 ff9973a5da5e 8b311eaf .config console log report ci-android-414-kasan-gce-root
2018/09/12 17:37 android-4.14 fc59235394b2 71907daf .config console log report ci-android-414-kasan-gce-root
2018/09/08 15:31 android-4.14 b859aa7d7a0c 6b5120a4 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.