syzbot


BUG: sleeping function called from invalid context in dump_header

Status: auto-closed as invalid on 2021/11/08 22:10
Reported-by: syzbot+ddfdc431d181564e80a0@syzkaller.appspotmail.com
First crash: 1019d, last: 1019d

Sample crash report:
Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
syz-fuzzer invoked oom-killer: gfp_mask=0x6200ca(GFP_HIGHUSER_MOVABLE), nodemask=(null), order=0, oom_score_adj=0
20519 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
BUG: sleeping function called from invalid context at net/core/sock.c:2863
syz-fuzzer cpuset=/ mems_allowed=0-1
in_atomic(): 1, irqs_disabled(): 0, pid: 10800, name: syz-executor.1
1 lock held by syz-executor.1/10800:
CPU: 0 PID: 8093 Comm: syz-fuzzer Not tainted 4.19.197-syzkaller #0
 #0: 00000000324fe180 (hci_sk_list.lock){++++}, at: hci_sock_dev_event+0x3db/0x660 net/bluetooth/hci_sock.c:756
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Preemption disabled at:
[<0000000000000000>]           (null)
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 dump_header+0x15d/0xc3f mm/oom_kill.c:443
 oom_kill_process.cold+0x10/0x692 mm/oom_kill.c:956
 out_of_memory mm/oom_kill.c:1114 [inline]
 out_of_memory+0x1072/0x1390 mm/oom_kill.c:1064
 __alloc_pages_may_oom mm/page_alloc.c:3553 [inline]
 __alloc_pages_slowpath mm/page_alloc.c:4255 [inline]
 __alloc_pages_nodemask+0x23a2/0x2890 mm/page_alloc.c:4419
 alloc_pages_current+0x193/0x2a0 mm/mempolicy.c:2197
 alloc_pages include/linux/gfp.h:532 [inline]
 __page_cache_alloc mm/filemap.c:969 [inline]
 page_cache_read mm/filemap.c:2408 [inline]
 filemap_fault+0x146e/0x2180 mm/filemap.c:2592
 ext4_filemap_fault+0x84/0xb0 fs/ext4/inode.c:6379
 __do_fault+0x10b/0x4b0 mm/memory.c:3403
 do_read_fault mm/memory.c:3815 [inline]
 do_fault mm/memory.c:3944 [inline]
 handle_pte_fault mm/memory.c:4175 [inline]
 __handle_mm_fault+0x273b/0x41c0 mm/memory.c:4299
 handle_mm_fault+0x436/0xb10 mm/memory.c:4336
 __do_page_fault+0x68e/0xd60 arch/x86/mm/fault.c:1412
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
RIP: 0033:0x4326f7
Code: 00 00 8b 4c 24 58 89 4c 24 0c 48 8d 4c 24 30 48 89 4c 24 10 48 c7 44 24 18 00 00 00 00 c7 44 24 20 00 00 00 00 e8 49 ba 03 00 <48> 8b 6c 24 40 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc
RSP: 002b:000000c00003de88 EFLAGS: 00010202
RAX: ffffffffffffff92 RBX: 000000c00002e000 RCX: 000000000046e163
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000018575b8
RBP: 000000c00003dec8 R08: 0000000000000000 R09: 0000000000000000
R10: 000000c00003deb8 R11: 0000000000000202 R12: 000000000043b6a0
R13: 0000000000000000 R14: 000000000094b8c4 R15: 0000000000000000
CPU: 1 PID: 10800 Comm: syz-executor.1 Not tainted 4.19.197-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6192
Free swap  = 0kB
 lock_sock_nested+0x33/0x110 net/core/sock.c:2863
Total swap = 0kB
 lock_sock include/net/sock.h:1510 [inline]
 hci_sock_dev_event+0x465/0x660 net/bluetooth/hci_sock.c:758
 hci_unregister_dev+0x25b/0x910 net/bluetooth/hci_core.c:3292
 vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:354
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbf3/0x2be0 kernel/exit.c:870
2097051 pages RAM
 do_group_exit+0x125/0x310 kernel/exit.c:967
 get_signal+0x3f2/0x1f70 kernel/signal.c:2589
0 pages HighMem/MovableOnly
 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799
 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4665d9
Code: Bad RIP value.
RSP: 002b:00007f8cc63f5218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000056bf88 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88
RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c
R13: 00007ffe4f4603ff R14: 00007f8cc63f5300 R15: 0000000000022000
Mem-Info:
369647 pages reserved
active_anon:284774 inactive_anon:28278 isolated_anon:0
 active_file:200 inactive_file:1516 isolated_file:0
 unevictable:0 dirty:50 writeback:0 unstable:0
 slab_reclaimable:20434 slab_unreclaimable:122039
 mapped:45344 shmem:19332 pagetables:7071 bounce:0
 free:34109 free_pcp:553 free_cma:0
0 pages cma reserved
Node 0 active_anon:1138752kB inactive_anon:113076kB active_file:3100kB inactive_file:5360kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:181976kB dirty:200kB writeback:0kB shmem:77292kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 854016kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
Node 1 active_anon:344kB inactive_anon:36kB active_file:0kB inactive_file:4kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:36kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB unstable:0kB all_unreclaimable? yes
Node 0 DMA free:11748kB min:204kB low:252kB high:300kB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:4kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 2693 2695 2695 2695
Node 0 DMA32 free:331648kB min:35996kB low:44992kB high:53988kB active_anon:1138952kB inactive_anon:113076kB active_file:3296kB inactive_file:6760kB unevictable:0kB writepending:196kB present:3129332kB managed:2763460kB mlocked:0kB kernel_stack:15360kB pagetables:28004kB bounce:0kB free_pcp:1708kB local_pcp:448kB free_cma:0kB
lowmem_reserve[]: 0 0 1 1 1
Node 0 Normal free:8kB min:24kB low:28kB high:32kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:2000kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0 0
Node 1 Normal free:26764kB min:53876kB low:67344kB high:80812kB active_anon:344kB inactive_anon:36kB active_file:0kB inactive_file:4kB unevictable:0kB writepending:0kB present:4194304kB managed:4128248kB mlocked:0kB kernel_stack:128kB pagetables:132kB bounce:0kB free_pcp:432kB local_pcp:264kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0 0
Node 0 DMA: 3*4kB (UM) 12*8kB (UM) 12*16kB (UM) 9*32kB (UM) 15*64kB (UM) 10*128kB (UM) 2*256kB (UM) 2*512kB (UM) 1*1024kB (M) 0*2048kB 2*4096kB (ME) = 13580kB
Node 0 DMA32: 3264*4kB (UME) 5023*8kB (UME) 2493*16kB (UME) 1057*32kB (UME) 381*64kB (UME) 219*128kB (UM) 132*256kB (UM) 70*512kB (UM) 31*1024kB (U) 33*2048kB (UM) 13*4096kB (UM) = 401576kB
Node 0 Normal: 0*4kB 1*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB
Node 1 Normal: 55*4kB (UME) 43*8kB (UME) 24*16kB (UME) 20*32kB (UME) 9*64kB (UM) 3*128kB (UM) 3*256kB (UM) 4*512kB (UME) 2*1024kB (U) 2*2048kB (U) 10*4096kB (UM) = 52468kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
21877 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap  = 0kB
Total swap = 0kB
2097051 pages RAM
0 pages HighMem/MovableOnly
369647 pages reserved
0 pages cma reserved
Out of memory (oom_kill_allocating_task): Kill process 8093 (syz-fuzzer) score 0 or sacrifice child
Killed process 8124 (syz-executor.3) total-vm:84924kB, anon-rss:68kB, file-rss:0kB, shmem-rss:0kB
BUG: sleeping function called from invalid context at net/core/sock.c:2863
in_atomic(): 1, irqs_disabled(): 0, pid: 17986, name: syz-executor.3
1 lock held by syz-executor.3/17986:
batman_adv: batadv0: Interface deactivated: batadv_slave_0
 #0: 00000000324fe180 (hci_sk_list.lock){++++}, at: hci_sock_dev_event+0x3db/0x660 net/bluetooth/hci_sock.c:756
Preemption disabled at:
[<0000000000000000>]           (null)
CPU: 0 PID: 17986 Comm: syz-executor.3 Tainted: G        W         4.19.197-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6192
 lock_sock_nested+0x33/0x110 net/core/sock.c:2863
 lock_sock include/net/sock.h:1510 [inline]
 hci_sock_dev_event+0x465/0x660 net/bluetooth/hci_sock.c:758
batman_adv: batadv0: Removing interface: batadv_slave_0
 hci_unregister_dev+0x25b/0x910 net/bluetooth/hci_core.c:3292
 vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:354
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbf3/0x2be0 kernel/exit.c:870
 do_group_exit+0x125/0x310 kernel/exit.c:967
 get_signal+0x3f2/0x1f70 kernel/signal.c:2589
 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799
 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4665d9
Code: Bad RIP value.
RSP: 002b:00007f6c9411c188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: fffffffffffffffb RBX: 000000000056bf80 RCX: 00000000004665d9
RDX: 00000000200000c0 RSI: 00000000c0481273 RDI: 0000000000000003
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffd671f19ef R14: 00007f6c9411c300 R15: 0000000000022000
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
bridge0: port 3(veth3) entered disabled state
device bridge_slave_1 left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_0 left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
device veth1_macvtap left promiscuous mode
device veth0_macvtap left promiscuous mode
device veth1_vlan left promiscuous mode
device veth0_vlan left promiscuous mode

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/11 22:09 linux-4.19.y fcfbdfe9626e 8f5a7b8c .config console log report info ci2-linux-4-19 BUG: sleeping function called from invalid context in dump_header
* Struck through repros no longer work on HEAD.