================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. swapper/1/0 [HC0[0]:SC1[1]:HE0:SE0] takes: ffffffff8efca020 (fs_reclaim){+.?.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline] ffffffff8efca020 (fs_reclaim){+.?.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4636 [inline] ffffffff8efca020 (fs_reclaim){+.?.}-{0:0}, at: slab_alloc_node mm/slub.c:4974 [inline] ffffffff8efca020 (fs_reclaim){+.?.}-{0:0}, at: __do_kmalloc_node mm/slub.c:5413 [inline] ffffffff8efca020 (fs_reclaim){+.?.}-{0:0}, at: __kmalloc_node_track_caller_noprof+0xcc/0x870 mm/slub.c:5545 {SOFTIRQ-ON-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline] fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389 might_alloc include/linux/sched/mm.h:316 [inline] xa_alloc include/linux/xarray.h:876 [inline] mem_cgroup_alloc mm/memcontrol.c:4160 [inline] mem_cgroup_css_alloc+0x7e/0x1d10 mm/memcontrol.c:4225 cgroup_init_subsys+0x223/0x700 kernel/cgroup/cgroup.c:6434 cgroup_init+0x569/0xe50 kernel/cgroup/cgroup.c:6561 start_kernel+0x475/0x490 init/main.c:1181 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x158 irq event stamp: 249033 hardirqs last enabled at (249032): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (249032): [] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:221 hardirqs last disabled at (249033): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:153 [inline] hardirqs last disabled at (249033): [] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:181 softirqs last enabled at (249016): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last enabled at (249016): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last enabled at (249016): [] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758 softirqs last disabled at (249029): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last disabled at (249029): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last disabled at (249029): [] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(fs_reclaim); lock(fs_reclaim); *** DEADLOCK *** locks held by swapper/1/0: 0, last CPU#1 stack backtrace: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_usage_bug.part.0+0x258/0x340 kernel/locking/lockdep.c:4086 print_usage_bug kernel/locking/lockdep.c:4054 [inline] valid_state kernel/locking/lockdep.c:4100 [inline] mark_lock_irq kernel/locking/lockdep.c:4311 [inline] mark_lock+0x956/0x1020 kernel/locking/lockdep.c:4797 mark_usage kernel/locking/lockdep.c:4686 [inline] __lock_acquire+0x7f1/0x1f40 kernel/locking/lockdep.c:5242 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline] fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389 might_alloc include/linux/sched/mm.h:316 [inline] slab_pre_alloc_hook mm/slub.c:4636 [inline] slab_alloc_node mm/slub.c:4974 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_node_track_caller_noprof+0xcc/0x870 mm/slub.c:5545 alloc_dr drivers/base/devres.c:141 [inline] devm_kmalloc+0xa5/0x2b0 drivers/base/devres.c:951 devm_kzalloc include/linux/device/devres.h:50 [inline] mt_allocate_report_data+0x59/0xcc0 drivers/hid/hid-multitouch.c:714 mt_find_report_data drivers/hid/hid-multitouch.c:764 [inline] mt_event+0x1bf/0x270 drivers/hid/hid-multitouch.c:1589 hid_process_event+0x37d/0x5a0 drivers/hid/hid-core.c:1572 hid_process_report drivers/hid/hid-core.c:1730 [inline] hid_report_raw_event+0xb14/0x14c0 drivers/hid/hid-core.c:2109 __hid_input_report.constprop.0+0x349/0x470 drivers/hid/hid-core.c:2180 hid_ctrl+0x4a4/0x560 drivers/hid/usbhid/hid-core.c:486 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2074 [inline] __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 57 95 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 93 46 1b 00 fb f4 0c 50 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffc9000047fe00 EFLAGS: 00000206 RAX: 000000000003ccc3 RBX: ffff88801cb04b00 RCX: ffffffff8bd07215 RDX: 0000000000000001 RSI: ffffffff8e391eab RDI: ffffffff8c623f80 RBP: ffffed1003960960 R08: 0000000000000001 R09: ffffed10056667bd R10: ffff88802b333deb R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 1ffff9200008ffc4 R15: dffffc0000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:768 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x158 BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:322 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 249033 hardirqs last enabled at (249032): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (249032): [] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:221 hardirqs last disabled at (249033): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:153 [inline] hardirqs last disabled at (249033): [] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:181 softirqs last enabled at (249016): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last enabled at (249016): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last enabled at (249016): [] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758 softirqs last disabled at (249029): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last disabled at (249029): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last disabled at (249029): [] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9264 might_alloc include/linux/sched/mm.h:322 [inline] slab_pre_alloc_hook mm/slub.c:4636 [inline] slab_alloc_node mm/slub.c:4974 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_node_track_caller_noprof+0x512/0x870 mm/slub.c:5545 alloc_dr drivers/base/devres.c:141 [inline] devm_kmalloc+0xa5/0x2b0 drivers/base/devres.c:951 devm_kzalloc include/linux/device/devres.h:50 [inline] mt_allocate_report_data+0x59/0xcc0 drivers/hid/hid-multitouch.c:714 mt_find_report_data drivers/hid/hid-multitouch.c:764 [inline] mt_event+0x1bf/0x270 drivers/hid/hid-multitouch.c:1589 hid_process_event+0x37d/0x5a0 drivers/hid/hid-core.c:1572 hid_process_report drivers/hid/hid-core.c:1730 [inline] hid_report_raw_event+0xb14/0x14c0 drivers/hid/hid-core.c:2109 __hid_input_report.constprop.0+0x349/0x470 drivers/hid/hid-core.c:2180 hid_ctrl+0x4a4/0x560 drivers/hid/usbhid/hid-core.c:486 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2074 [inline] __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 57 95 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 93 46 1b 00 fb f4 0c 50 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffc9000047fe00 EFLAGS: 00000206 RAX: 000000000003ccc3 RBX: ffff88801cb04b00 RCX: ffffffff8bd07215 RDX: 0000000000000001 RSI: ffffffff8e391eab RDI: ffffffff8c623f80 RBP: ffffed1003960960 R08: 0000000000000001 R09: ffffed10056667bd R10: ffff88802b333deb R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 1ffff9200008ffc4 R15: dffffc0000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:768 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x158 ---------------- Code disassembly (best guess): 0: 57 push %rdi 1: 95 xchg %eax,%ebp 2: 02 c3 add %bl,%al 4: cc int3 5: cc int3 6: cc int3 7: cc int3 8: 0f 1f 00 nopl (%rax) b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: f3 0f 1e fa endbr64 1f: eb 07 jmp 0x28 21: 0f 00 2d 93 46 1b 00 verw 0x1b4693(%rip) # 0x1b46bb 28: fb sti 29: f4 hlt * 2a: e9 0c 50 03 00 jmp 0x3503b <-- trapping instruction 2f: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 36: 00 00 00 39: 66 90 xchg %ax,%ax 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop