RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f08b087f6d4 R13: 00000000004beb9d R14: 00000000004cf7f8 R15: 0000000000000006 ================================ WARNING: inconsistent lock state netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. 4.20.0-rc6+ #374 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz-executor4/10974 [HC0[0]:SC1[1]:HE1:SE0] takes: 00000000e96dd8b7 (fs_reclaim){+.?.}, at: fs_reclaim_acquire.part.97+0x0/0x30 mm/internal.h:79 netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844 kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env __fs_reclaim_acquire mm/page_alloc.c:3730 [inline] fs_reclaim_acquire.part.97+0x24/0x30 mm/page_alloc.c:3741 fs_reclaim_acquire+0x14/0x20 mm/page_alloc.c:3742 slab_pre_alloc_hook mm/slab.h:418 [inline] slab_alloc_node mm/slab.c:3299 [inline] kmem_cache_alloc_node_trace+0x3c/0x740 mm/slab.c:3661 kmalloc_node include/linux/slab.h:584 [inline] kzalloc_node include/linux/slab.h:752 [inline] alloc_worker+0xc5/0x300 kernel/workqueue.c:1704 init_rescuer.part.24+0x1f/0x190 kernel/workqueue.c:4028 init_rescuer kernel/workqueue.c:4025 [inline] workqueue_init+0x491/0x744 kernel/workqueue.c:5794 kernel_init_freeable+0x3bb/0x6bf init/main.c:1139 kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kernel_init+0x11/0x1ae init/main.c:1071 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 irq event stamp: 1456 hardirqs last enabled at (1456): [] console_unlock+0xcfb/0x1190 kernel/printk/printk.c:2443 hardirqs last disabled at (1455): [] console_unlock+0x2d9/0x1190 kernel/printk/printk.c:2353 kobject: 'loop0p255' (000000000e1165e9): kobject_add_internal: parent: 'loop0', set: 'devices' softirqs last enabled at (188): [] spin_unlock_bh include/linux/spinlock.h:374 [inline] softirqs last enabled at (188): [] bpf_map_alloc_id kernel/bpf/syscall.c:247 [inline] softirqs last enabled at (188): [] map_create+0xbe2/0x1110 kernel/bpf/syscall.c:554 softirqs last disabled at (1369): [] invoke_softirq kernel/softirq.c:373 [inline] softirqs last disabled at (1369): [] irq_exit+0x17f/0x1c0 kernel/softirq.c:413 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(fs_reclaim); lock(fs_reclaim); *** DEADLOCK *** 3 locks held by syz-executor4/10974: #0: 000000003dad8586 (&(ptlock_ptr(page))->rlock#2){+.+.}, at: spin_lock include/linux/spinlock.h:329 [inline] #0: 000000003dad8586 (&(ptlock_ptr(page))->rlock#2){+.+.}, at: zap_pte_range mm/memory.c:1052 [inline] #0: 000000003dad8586 (&(ptlock_ptr(page))->rlock#2){+.+.}, at: zap_pmd_range mm/memory.c:1193 [inline] #0: 000000003dad8586 (&(ptlock_ptr(page))->rlock#2){+.+.}, at: zap_pud_range mm/memory.c:1222 [inline] #0: 000000003dad8586 (&(ptlock_ptr(page))->rlock#2){+.+.}, at: zap_p4d_range mm/memory.c:1243 [inline] #0: 000000003dad8586 (&(ptlock_ptr(page))->rlock#2){+.+.}, at: unmap_page_range+0xc1b/0x2930 mm/memory.c:1264 #1: 00000000c786538c (rcu_read_lock){....}, at: lock_page_memcg+0x0/0x350 mm/memcontrol.c:2909 #2: 00000000dbd98a9b (rcu_callback){....}, at: __rcu_reclaim kernel/rcu/rcu.h:228 [inline] #2: 00000000dbd98a9b (rcu_callback){....}, at: rcu_do_batch kernel/rcu/tree.c:2437 [inline] #2: 00000000dbd98a9b (rcu_callback){....}, at: invoke_rcu_callbacks kernel/rcu/tree.c:2716 [inline] #2: 00000000dbd98a9b (rcu_callback){....}, at: rcu_process_callbacks+0x1103/0x1ac0 kernel/rcu/tree.c:2697 stack backtrace: CPU: 1 PID: 10974 Comm: syz-executor4 Not tainted 4.20.0-rc6+ #374 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_usage_bug.cold.59+0x320/0x41a kernel/locking/lockdep.c:2472 valid_state kernel/locking/lockdep.c:2485 [inline] mark_lock_irq kernel/locking/lockdep.c:2679 [inline] mark_lock+0x1276/0x1cd0 kernel/locking/lockdep.c:3059 mark_irqflags kernel/locking/lockdep.c:2937 [inline] __lock_acquire+0x155f/0x4c20 kernel/locking/lockdep.c:3298 lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844 __fs_reclaim_acquire mm/page_alloc.c:3730 [inline] fs_reclaim_acquire.part.97+0x24/0x30 mm/page_alloc.c:3741 fs_reclaim_acquire+0x14/0x20 mm/page_alloc.c:3742 slab_pre_alloc_hook mm/slab.h:418 [inline] slab_alloc mm/slab.c:3378 [inline] kmem_cache_alloc_trace+0x2d/0x750 mm/slab.c:3618 kmalloc include/linux/slab.h:546 [inline] kzalloc include/linux/slab.h:741 [inline] kobject_uevent_env+0x2f3/0x101e lib/kobject_uevent.c:514 kobject_uevent+0x1f/0x24 lib/kobject_uevent.c:636 kobject_cleanup lib/kobject.c:649 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:70 [inline] kobject_put.cold.9+0x170/0x2e4 lib/kobject.c:708 put_device+0x20/0x30 drivers/base/core.c:2024 delete_partition_rcu_cb+0x147/0x1b0 block/partition-generic.c:259 __rcu_reclaim kernel/rcu/rcu.h:240 [inline] rcu_do_batch kernel/rcu/tree.c:2437 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2716 [inline] rcu_process_callbacks+0x100a/0x1ac0 kernel/rcu/tree.c:2697 __do_softirq+0x308/0xb7e kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1061 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:__read_once_size include/linux/compiler.h:182 [inline] RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline] RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:22 [inline] RIP: 0010:rcu_dynticks_curr_cpu_in_eqs+0xc4/0x170 kernel/rcu/tree.c:292 Code: 4c 89 f7 e8 ee 6d 58 00 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 <84> d2 75 77 49 8d 7d c0 41 8b 84 24 b8 00 00 00 48 ba 00 00 00 00 RSP: 0018:ffff88817d40e840 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000003 RBX: 1ffff1102fa81d09 RCX: ffffffff816a6b32 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8881daf2daf8 RBP: ffff88817d40e8c8 R08: ffffed103b5e5b60 R09: ffffed103b5e5b5f R10: ffffed103b5e5b5f R11: ffff8881daf2dafb R12: ffff8881daf2da40 R13: ffff88817d40e8a8 R14: ffff8881daf2daf8 R15: 0000000000000000 rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:906 rcu_read_unlock include/linux/rcupdate.h:657 [inline] __unlock_page_memcg+0x78/0x100 mm/memcontrol.c:1909 unlock_page_memcg+0x2c/0x40 mm/memcontrol.c:1918 page_remove_file_rmap mm/rmap.c:1249 [inline] page_remove_rmap+0x896/0x1a30 mm/rmap.c:1300 zap_pte_range mm/memory.c:1091 [inline] zap_pmd_range mm/memory.c:1193 [inline] zap_pud_range mm/memory.c:1222 [inline] zap_p4d_range mm/memory.c:1243 [inline] unmap_page_range+0x11c7/0x2930 mm/memory.c:1264 unmap_single_vma+0x19b/0x310 mm/memory.c:1309 unmap_vmas+0x125/0x200 mm/memory.c:1339 exit_mmap+0x2be/0x590 mm/mmap.c:3145 __mmput kernel/fork.c:1045 [inline] mmput+0x247/0x610 kernel/fork.c:1066 exit_mm kernel/exit.c:545 [inline] do_exit+0xe74/0x26d0 kernel/exit.c:854 do_group_exit+0x177/0x440 kernel/exit.c:970 get_signal+0x8b0/0x1980 kernel/signal.c:2517 do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457669 Code: Bad RIP value. RSP: 002b:00007fe2f9abccf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000000 RBX: 000000000072bf08 RCX: 0000000000457669 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bf08 RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bf0c R13: 00007fff7a502a1f R14: 00007fe2f9abd9c0 R15: 000000000072bf0c BUG: sleeping function called from invalid context at mm/slab.h:421 in_atomic(): 1, irqs_disabled(): 0, pid: 10974, name: syz-executor4 INFO: lockdep is turned off. Preemption disabled at: [] spin_lock include/linux/spinlock.h:329 [inline] [] zap_pte_range mm/memory.c:1052 [inline] [] zap_pmd_range mm/memory.c:1193 [inline] [] zap_pud_range mm/memory.c:1222 [inline] [] zap_p4d_range mm/memory.c:1243 [inline] [] unmap_page_range+0xc1b/0x2930 mm/memory.c:1264 kobject: 'loop0p255' (000000000e1165e9): kobject_uevent_env CPU: 1 PID: 10974 Comm: syz-executor4 Not tainted 4.20.0-rc6+ #374 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 kobject: 'loop0p255' (000000000e1165e9): kobject_uevent_env: uevent_suppress caused the event to drop! ___might_sleep.cold.86+0x221/0x254 kernel/sched/core.c:6148 kobject: 'holders' (00000000c4cc40e1): kobject_add_internal: parent: 'loop0p255', set: '' __might_sleep+0x95/0x190 kernel/sched/core.c:6101 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3378 [inline] kmem_cache_alloc_trace+0x2cd/0x750 mm/slab.c:3618 kmalloc include/linux/slab.h:546 [inline] kzalloc include/linux/slab.h:741 [inline] kobject_uevent_env+0x2f3/0x101e lib/kobject_uevent.c:514 kobject_uevent+0x1f/0x24 lib/kobject_uevent.c:636 kobject_cleanup lib/kobject.c:649 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:70 [inline] kobject_put.cold.9+0x170/0x2e4 lib/kobject.c:708 kobject: 'loop0p255' (000000000e1165e9): kobject_uevent_env put_device+0x20/0x30 drivers/base/core.c:2024 delete_partition_rcu_cb+0x147/0x1b0 block/partition-generic.c:259 __rcu_reclaim kernel/rcu/rcu.h:240 [inline] rcu_do_batch kernel/rcu/tree.c:2437 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2716 [inline] rcu_process_callbacks+0x100a/0x1ac0 kernel/rcu/tree.c:2697 kobject: 'loop0p255' (000000000e1165e9): fill_kobj_path: path = '/devices/virtual/block/loop0/loop0p255' __do_softirq+0x308/0xb7e kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1061 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:__read_once_size include/linux/compiler.h:182 [inline] RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline] RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:22 [inline] RIP: 0010:rcu_dynticks_curr_cpu_in_eqs+0xc4/0x170 kernel/rcu/tree.c:292 Code: 4c 89 f7 e8 ee 6d 58 00 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 <84> d2 75 77 49 8d 7d c0 41 8b 84 24 b8 00 00 00 48 ba 00 00 00 00 RSP: 0018:ffff88817d40e840 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000003 RBX: 1ffff1102fa81d09 RCX: ffffffff816a6b32 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8881daf2daf8 RBP: ffff88817d40e8c8 R08: ffffed103b5e5b60 R09: ffffed103b5e5b5f R10: ffffed103b5e5b5f R11: ffff8881daf2dafb R12: ffff8881daf2da40 R13: ffff88817d40e8a8 R14: ffff8881daf2daf8 R15: 0000000000000000 rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:906 rcu_read_unlock include/linux/rcupdate.h:657 [inline] __unlock_page_memcg+0x78/0x100 mm/memcontrol.c:1909 unlock_page_memcg+0x2c/0x40 mm/memcontrol.c:1918 page_remove_file_rmap mm/rmap.c:1249 [inline] page_remove_rmap+0x896/0x1a30 mm/rmap.c:1300 zap_pte_range mm/memory.c:1091 [inline] zap_pmd_range mm/memory.c:1193 [inline] zap_pud_range mm/memory.c:1222 [inline] zap_p4d_range mm/memory.c:1243 [inline] unmap_page_range+0x11c7/0x2930 mm/memory.c:1264 unmap_single_vma+0x19b/0x310 mm/memory.c:1309 unmap_vmas+0x125/0x200 mm/memory.c:1339 exit_mmap+0x2be/0x590 mm/mmap.c:3145 __mmput kernel/fork.c:1045 [inline] mmput+0x247/0x610 kernel/fork.c:1066 exit_mm kernel/exit.c:545 [inline] do_exit+0xe74/0x26d0 kernel/exit.c:854 do_group_exit+0x177/0x440 kernel/exit.c:970 get_signal+0x8b0/0x1980 kernel/signal.c:2517 do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457669 Code: Bad RIP value. RSP: 002b:00007fe2f9abccf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000000 RBX: 000000000072bf08 RCX: 0000000000457669 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bf08 RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bf0c R13: 00007fff7a502a1f R14: 00007fe2f9abd9c0 R15: 000000000072bf0c BUG: sleeping function called from invalid context at mm/slab.c:3066 in_atomic(): 1, irqs_disabled(): 0, pid: 10974, name: syz-executor4 INFO: lockdep is turned off. Preemption disabled at: [] spin_lock include/linux/spinlock.h:329 [inline] [] zap_pte_range mm/memory.c:1052 [inline] [] zap_pmd_range mm/memory.c:1193 [inline] [] zap_pud_range mm/memory.c:1222 [inline] [] zap_p4d_range mm/memory.c:1243 [inline] [] unmap_page_range+0xc1b/0x2930 mm/memory.c:1264 CPU: 1 PID: 10974 Comm: syz-executor4 Tainted: G W 4.20.0-rc6+ #374 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env ___might_sleep.cold.86+0x221/0x254 kernel/sched/core.c:6148 kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' __might_sleep+0x95/0x190 kernel/sched/core.c:6101 cache_alloc_debugcheck_before mm/slab.c:3066 [inline] slab_alloc mm/slab.c:3382 [inline] kmem_cache_alloc_trace+0x307/0x750 mm/slab.c:3618 kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kmalloc include/linux/slab.h:546 [inline] kzalloc include/linux/slab.h:741 [inline] kobject_uevent_env+0x2f3/0x101e lib/kobject_uevent.c:514 kobject_uevent+0x1f/0x24 lib/kobject_uevent.c:636 kobject_cleanup lib/kobject.c:649 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:70 [inline] kobject_put.cold.9+0x170/0x2e4 lib/kobject.c:708 put_device+0x20/0x30 drivers/base/core.c:2024 kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' delete_partition_rcu_cb+0x147/0x1b0 block/partition-generic.c:259 __rcu_reclaim kernel/rcu/rcu.h:240 [inline] rcu_do_batch kernel/rcu/tree.c:2437 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2716 [inline] rcu_process_callbacks+0x100a/0x1ac0 kernel/rcu/tree.c:2697 kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0p254' (000000006edd0869): kobject_add_internal: parent: 'loop0', set: 'devices' __do_softirq+0x308/0xb7e kernel/softirq.c:292 kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop0p254' (000000006edd0869): kobject_uevent_env invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1061 kobject: 'loop0p254' (000000006edd0869): kobject_uevent_env: uevent_suppress caused the event to drop! kobject: 'holders' (000000002f48a797): kobject_add_internal: parent: 'loop0p254', set: '' apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:__read_once_size include/linux/compiler.h:182 [inline] RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline] RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:22 [inline] RIP: 0010:rcu_dynticks_curr_cpu_in_eqs+0xc4/0x170 kernel/rcu/tree.c:292 Code: 4c 89 f7 e8 ee 6d 58 00 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 <84> d2 75 77 49 8d 7d c0 41 8b 84 24 b8 00 00 00 48 ba 00 00 00 00 kobject: 'loop0p254' (000000006edd0869): kobject_uevent_env RSP: 0018:ffff88817d40e840 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000003 RBX: 1ffff1102fa81d09 RCX: ffffffff816a6b32 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8881daf2daf8 RBP: ffff88817d40e8c8 R08: ffffed103b5e5b60 R09: ffffed103b5e5b5f R10: ffffed103b5e5b5f R11: ffff8881daf2dafb R12: ffff8881daf2da40 R13: ffff88817d40e8a8 R14: ffff8881daf2daf8 R15: 0000000000000000 kobject: 'loop0p254' (000000006edd0869): fill_kobj_path: path = '/devices/virtual/block/loop0/loop0p254' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:906 rcu_read_unlock include/linux/rcupdate.h:657 [inline] __unlock_page_memcg+0x78/0x100 mm/memcontrol.c:1909 unlock_page_memcg+0x2c/0x40 mm/memcontrol.c:1918 page_remove_file_rmap mm/rmap.c:1249 [inline] page_remove_rmap+0x896/0x1a30 mm/rmap.c:1300 zap_pte_range mm/memory.c:1091 [inline] zap_pmd_range mm/memory.c:1193 [inline] zap_pud_range mm/memory.c:1222 [inline] zap_p4d_range mm/memory.c:1243 [inline] unmap_page_range+0x11c7/0x2930 mm/memory.c:1264 unmap_single_vma+0x19b/0x310 mm/memory.c:1309 unmap_vmas+0x125/0x200 mm/memory.c:1339 exit_mmap+0x2be/0x590 mm/mmap.c:3145 __mmput kernel/fork.c:1045 [inline] mmput+0x247/0x610 kernel/fork.c:1066 exit_mm kernel/exit.c:545 [inline] do_exit+0xe74/0x26d0 kernel/exit.c:854 do_group_exit+0x177/0x440 kernel/exit.c:970 get_signal+0x8b0/0x1980 kernel/signal.c:2517 kobject: 'loop5' (0000000014f4595e): kobject_uevent_env do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816 kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162 kobject: 'loop0' (000000000b3166af): kobject_uevent_env prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457669 Code: Bad RIP value. RSP: 002b:00007fe2f9abccf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000000 RBX: 000000000072bf08 RCX: 0000000000457669 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bf08 RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bf0c R13: 00007fff7a502a1f R14: 00007fe2f9abd9c0 R15: 000000000072bf0c BUG: sleeping function called from invalid context at mm/slab.h:421 in_atomic(): 1, irqs_disabled(): 0, pid: 10974, name: syz-executor4 INFO: lockdep is turned off. Preemption disabled at: [] spin_lock include/linux/spinlock.h:329 [inline] [] zap_pte_range mm/memory.c:1052 [inline] [] zap_pmd_range mm/memory.c:1193 [inline] [] zap_pud_range mm/memory.c:1222 [inline] [] zap_p4d_range mm/memory.c:1243 [inline] [] unmap_page_range+0xc1b/0x2930 mm/memory.c:1264 CPU: 1 PID: 10974 Comm: syz-executor4 Tainted: G W 4.20.0-rc6+ #374 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 ___might_sleep.cold.86+0x221/0x254 kernel/sched/core.c:6148 __might_sleep+0x95/0x190 kernel/sched/core.c:6101 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3378 [inline] __do_kmalloc mm/slab.c:3720 [inline] __kmalloc+0x2d6/0x760 mm/slab.c:3731 kmalloc include/linux/slab.h:551 [inline] kzalloc include/linux/slab.h:741 [inline] kobject_get_path+0xc2/0x1b0 lib/kobject.c:171 kobject_uevent_env+0x314/0x101e lib/kobject_uevent.c:519 kobject_uevent+0x1f/0x24 lib/kobject_uevent.c:636 kobject_cleanup lib/kobject.c:649 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:70 [inline] kobject_put.cold.9+0x170/0x2e4 lib/kobject.c:708 put_device+0x20/0x30 drivers/base/core.c:2024 delete_partition_rcu_cb+0x147/0x1b0 block/partition-generic.c:259 __rcu_reclaim kernel/rcu/rcu.h:240 [inline] rcu_do_batch kernel/rcu/tree.c:2437 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2716 [inline] rcu_process_callbacks+0x100a/0x1ac0 kernel/rcu/tree.c:2697 __do_softirq+0x308/0xb7e kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1061 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:__read_once_size include/linux/compiler.h:182 [inline] RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline] RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:22 [inline] RIP: 0010:rcu_dynticks_curr_cpu_in_eqs+0xc4/0x170 kernel/rcu/tree.c:292 Code: 4c 89 f7 e8 ee 6d 58 00 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 <84> d2 75 77 49 8d 7d c0 41 8b 84 24 b8 00 00 00 48 ba 00 00 00 00 RSP: 0018:ffff88817d40e840 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000003 RBX: 1ffff1102fa81d09 RCX: ffffffff816a6b32 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8881daf2daf8 RBP: ffff88817d40e8c8 R08: ffffed103b5e5b60 R09: ffffed103b5e5b5f R10: ffffed103b5e5b5f R11: ffff8881daf2dafb R12: ffff8881daf2da40 R13: ffff88817d40e8a8 R14: ffff8881daf2daf8 R15: 0000000000000000 rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:906 rcu_read_unlock include/linux/rcupdate.h:657 [inline] __unlock_page_memcg+0x78/0x100 mm/memcontrol.c:1909 unlock_page_memcg+0x2c/0x40 mm/memcontrol.c:1918 page_remove_file_rmap mm/rmap.c:1249 [inline] page_remove_rmap+0x896/0x1a30 mm/rmap.c:1300 zap_pte_range mm/memory.c:1091 [inline] zap_pmd_range mm/memory.c:1193 [inline] zap_pud_range mm/memory.c:1222 [inline] zap_p4d_range mm/memory.c:1243 [inline] unmap_page_range+0x11c7/0x2930 mm/memory.c:1264 unmap_single_vma+0x19b/0x310 mm/memory.c:1309 unmap_vmas+0x125/0x200 mm/memory.c:1339 exit_mmap+0x2be/0x590 mm/mmap.c:3145 __mmput kernel/fork.c:1045 [inline] mmput+0x247/0x610 kernel/fork.c:1066 exit_mm kernel/exit.c:545 [inline] do_exit+0xe74/0x26d0 kernel/exit.c:854 do_group_exit+0x177/0x440 kernel/exit.c:970 get_signal+0x8b0/0x1980 kernel/signal.c:2517 do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457669 Code: Bad RIP value. RSP: 002b:00007fe2f9abccf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000000 RBX: 000000000072bf08 RCX: 0000000000457669 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bf08 RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bf0c R13: 00007fff7a502a1f R14: 00007fe2f9abd9c0 R15: 000000000072bf0c kobject: 'loop0p243' (00000000481cd911): fill_kobj_path: path = '/loop0p243' kobject: 'loop0p243' (00000000481cd911): calling ktype release kobject: 'loop0p243': free name kobject: 'loop0p252' (000000000d8d8073): kobject_add_internal: parent: 'loop0', set: 'devices' kobject: 'loop0p252' (000000000d8d8073): kobject_uevent_env kobject: 'loop0p252' (000000000d8d8073): kobject_uevent_env: uevent_suppress caused the event to drop! kobject: 'holders' (00000000db43b4b2): kobject_add_internal: parent: 'loop0p252', set: '' kobject: 'loop0p252' (000000000d8d8073): kobject_uevent_env kobject: 'loop0p252' (000000000d8d8073): fill_kobj_path: path = '/devices/virtual/block/loop0/loop0p252' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'holders' (0000000065a91f01): kobject_cleanup, parent 000000009f040cc6 kobject: 'holders' (0000000065a91f01): auto cleanup kobject_del kobject: 'holders' (0000000065a91f01): calling ktype release kobject: (0000000065a91f01): dynamic_kobj_release kobject: 'holders': free name kobject: 'loop0p245' (000000009f040cc6): kobject_uevent_env kobject: 'loop0p245' (000000009f040cc6): fill_kobj_path: path = '/devices/virtual/block/loop0/loop0p245' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop0p251' (00000000c5713dac): kobject_add_internal: parent: 'loop0', set: 'devices' kobject: 'loop0p251' (00000000c5713dac): kobject_uevent_env kobject: 'loop0p251' (00000000c5713dac): kobject_uevent_env: uevent_suppress caused the event to drop! kobject: 'holders' (000000008509c718): kobject_add_internal: parent: 'loop0p251', set: '' kobject: 'loop0p251' (00000000c5713dac): kobject_uevent_env kobject: 'loop0p251' (00000000c5713dac): fill_kobj_path: path = '/devices/virtual/block/loop0/loop0p251' kobject: 'loop0p245' (000000009f040cc6): kobject_cleanup, parent (null) kobject: 'loop0p245' (000000009f040cc6): calling ktype release kobject: 'loop0p245': free name kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop0p249' (0000000093537c03): kobject_add_internal: parent: 'loop0', set: 'devices' kobject: 'loop0p249' (0000000093537c03): kobject_uevent_env kobject: 'loop0p249' (0000000093537c03): kobject_uevent_env: uevent_suppress caused the event to drop! kobject: 'holders' (00000000e6cee2a6): kobject_add_internal: parent: 'loop0p249', set: '' kobject: 'loop0p249' (0000000093537c03): kobject_uevent_env kobject: 'loop0p249' (0000000093537c03): fill_kobj_path: path = '/devices/virtual/block/loop0/loop0p249' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop0p250' (0000000049b34595): kobject_add_internal: parent: 'loop0', set: 'devices' kobject: 'loop0p250' (0000000049b34595): kobject_uevent_env kobject: 'loop0p250' (0000000049b34595): kobject_uevent_env: uevent_suppress caused the event to drop! kobject: 'holders' (000000000eabe979): kobject_add_internal: parent: 'loop0p250', set: '' kobject: 'loop0p250' (0000000049b34595): kobject_uevent_env kobject: 'loop0p250' (0000000049b34595): fill_kobj_path: path = '/devices/virtual/block/loop0/loop0p250' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop0p253' (0000000054a8c0dd): kobject_add_internal: parent: 'loop0', set: 'devices' kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop0p253' (0000000054a8c0dd): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop0p253' (0000000054a8c0dd): kobject_uevent_env: uevent_suppress caused the event to drop! kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'holders' (00000000efdc3d39): kobject_add_internal: parent: 'loop0p253', set: '' kobject: 'loop0p253' (0000000054a8c0dd): kobject_uevent_env kobject: 'loop0p253' (0000000054a8c0dd): fill_kobj_path: path = '/devices/virtual/block/loop0/loop0p253' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop2' (00000000f2b749ca): kobject_uevent_env kobject: 'loop2' (00000000f2b749ca): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop1' (00000000fcdbab66): kobject_uevent_env kobject: 'loop1' (00000000fcdbab66): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop5' (0000000014f4595e): kobject_uevent_env kobject: 'loop5' (0000000014f4595e): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop0' (000000000b3166af): kobject_uevent_env kobject: 'loop0' (000000000b3166af): fill_kobj_path: path = '/devices/virtual/block/loop0'