list_del corruption, ffff88803d6efa18->next is LIST_POISON1 (dead000000000100) syz-executor.2 invoked oom-killer: gfp_mask=0x6000c0(GFP_KERNEL), nodemask=(null), order=0, oom_score_adj=1000 ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:45! syz-executor.2 cpuset=syz2 mems_allowed=0-1 invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 31630 Comm: syz-executor.2 Not tainted 4.19.100-syzkaller #0 CPU: 1 PID: 31588 Comm: syz-executor.0 Not tainted 4.19.100-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: RIP: 0010:__list_del_entry_valid.cold+0x23/0x4f lib/list_debug.c:45 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 Code: e8 85 79 eb fd 0f 0b 4c 89 f6 48 c7 c7 20 fe ea 87 e8 74 79 eb fd 0f 0b 4c 89 ea 4c 89 f6 48 c7 c7 60 fd ea 87 e8 60 79 eb fd <0f> 0b 4c 89 e2 4c 89 f6 48 c7 c7 c0 fd ea 87 e8 4c 79 eb fd 0f 0b dump_header+0x15e/0xa55 mm/oom_kill.c:441 RSP: 0018:ffff88803d6ef8d8 EFLAGS: 00010086 RAX: 000000000000004e RBX: ffff88803d6efa00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81557a66 RDI: ffffed1007addf0d RBP: ffff88803d6ef8f0 R08: 000000000000004e R09: ffffed1015d25079 oom_kill_process.cold+0x10/0x6ef mm/oom_kill.c:954 R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: dead000000000200 R13: dead000000000100 R14: ffff88803d6efa18 R15: ffff88803d6efa20 FS: 00007f937b4f6700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 out_of_memory mm/oom_kill.c:1130 [inline] out_of_memory+0x362/0x1330 mm/oom_kill.c:1062 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000013bacd0 CR3: 0000000088e88000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_del_entry include/linux/list.h:117 [inline] list_del include/linux/list.h:125 [inline] __remove_wait_queue include/linux/wait.h:184 [inline] remove_wait_queue+0x2f/0x190 kernel/sched/wait.c:44 mem_cgroup_out_of_memory+0x1d2/0x240 mm/memcontrol.c:1416 __tipc_sendstream+0x3db/0xaa0 net/tipc/socket.c:1446 mem_cgroup_oom mm/memcontrol.c:1742 [inline] try_charge+0xec5/0x1490 mm/memcontrol.c:2313 tipc_sendstream+0x53/0x80 net/tipc/socket.c:1411 mem_cgroup_try_charge+0x259/0x6b0 mm/memcontrol.c:5991 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:632 mem_cgroup_try_charge_delay+0x1f/0xa0 mm/memcontrol.c:6006 sock_write_iter+0x2cb/0x400 net/socket.c:901 wp_page_copy+0x430/0x16a0 mm/memory.c:2520 do_wp_page+0x57d/0x10b0 mm/memory.c:2799 call_write_iter include/linux/fs.h:1820 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x587/0x810 fs/read_write.c:487 handle_pte_fault mm/memory.c:4057 [inline] __handle_mm_fault+0x2305/0x3f80 mm/memory.c:4165 vfs_write+0x20c/0x560 fs/read_write.c:549 ksys_write+0x14f/0x2d0 fs/read_write.c:599 handle_mm_fault+0x1b5/0x690 mm/memory.c:4202 __do_page_fault+0x62a/0xe90 arch/x86/mm/fault.c:1390 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:608 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe do_page_fault+0x71/0x57d arch/x86/mm/fault.c:1465 RIP: 0033:0x45b349 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1204 RSP: 002b:00007f937b4f5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RIP: 0033:0x410398 RAX: ffffffffffffffda RBX: 00007f937b4f66d4 RCX: 000000000045b349 Code: 8b 34 c6 4a 8d 04 2e 48 3d ff ff ff 7e 0f 86 77 ff ff ff bf 75 0c 4c 00 31 c0 e8 13 1b ff ff 31 ff e8 5c 17 ff ff 0f 1f 40 00 <89> 3c b5 00 00 73 00 eb b6 31 ed 0f 1f 44 00 00 80 3d ae 22 66 00 RDX: 00000000fffffd6d RSI: 00000000200015c0 RDI: 0000000000000003 RSP: 002b:00007fff694dbc20 EFLAGS: 00010246 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 RAX: 00000000ed3764ca RBX: 00000000c68a3309 RCX: 0000001b32820000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff RDX: 0000000000000000 RSI: 00000000000004ca RDI: ffffffffed3764ca R13: 0000000000000c9f R14: 00000000004cd777 R15: 000000000075bfd4 Modules linked in: RBP: 0000000000000004 R08: 00000000ed3764ca R09: 00000000ed3764ce ---[ end trace 36a4e8a0a202c165 ]--- R10: 00007fff694dbdc0 R11: 0000000000000246 R12: 000000000075bfa8 RIP: 0010:__list_del_entry_valid.cold+0x23/0x4f lib/list_debug.c:45 R13: 0000000080000000 R14: 00007f91746fb008 R15: 0000000000000004 Code: e8 85 79 eb fd 0f 0b 4c 89 f6 48 c7 c7 20 fe ea 87 e8 74 79 eb fd 0f 0b 4c 89 ea 4c 89 f6 48 c7 c7 60 fd ea 87 e8 60 79 eb fd <0f> 0b 4c 89 e2 4c 89 f6 48 c7 c7 c0 fd ea 87 e8 4c 79 eb fd 0f 0b Task in /syz2 killed as a result of limit of /syz2 RSP: 0018:ffff88803d6ef8d8 EFLAGS: 00010086 RAX: 000000000000004e RBX: ffff88803d6efa00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81557a66 RDI: ffffed1007addf0d RBP: ffff88803d6ef8f0 R08: 000000000000004e R09: ffffed1015d25079 R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: dead000000000200 R13: dead000000000100 R14: ffff88803d6efa18 R15: ffff88803d6efa20 memory: usage 307200kB, limit 307200kB, failcnt 572 FS: 00007f937b4f6700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000013bacd0 CR3: 0000000088e88000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400