============================= WARNING: suspicious RCU usage 4.14.154 #0 Not tainted ----------------------------- include/linux/radix-tree.h:238 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz-executor.1/18243: #0: (&sb->s_type->i_mutex_key#12){+.+.}, at: [] inode_lock include/linux/fs.h:718 [inline] #0: (&sb->s_type->i_mutex_key#12){+.+.}, at: [] shmem_add_seals+0x15e/0x1060 mm/shmem.c:2810 #1: (&(&mapping->tree_lock)->rlock){-.-.}, at: [] spin_lock_irq include/linux/spinlock.h:342 [inline] #1: (&(&mapping->tree_lock)->rlock){-.-.}, at: [] shmem_tag_pins mm/shmem.c:2665 [inline] #1: (&(&mapping->tree_lock)->rlock){-.-.}, at: [] shmem_wait_for_pins mm/shmem.c:2706 [inline] #1: (&(&mapping->tree_lock)->rlock){-.-.}, at: [] shmem_add_seals+0x334/0x1060 mm/shmem.c:2822 stack backtrace: CPU: 1 PID: 18243 Comm: syz-executor.1 Not tainted 4.14.154 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:4665 radix_tree_deref_slot include/linux/radix-tree.h:238 [inline] radix_tree_deref_slot include/linux/radix-tree.h:236 [inline] shmem_tag_pins mm/shmem.c:2667 [inline] shmem_wait_for_pins mm/shmem.c:2706 [inline] shmem_add_seals+0x9e0/0x1060 mm/shmem.c:2822 shmem_fcntl+0xf7/0x130 mm/shmem.c:2857 do_fcntl+0x190/0xe10 fs/fcntl.c:421 SYSC_fcntl fs/fcntl.c:463 [inline] SyS_fcntl+0xd5/0x110 fs/fcntl.c:448 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45a639 RSP: 002b:00007f7c2f38cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a639 RDX: 0000000000000008 RSI: 0000000000000409 RDI: 0000000000000005 RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7c2f38d6d4 R13: 00000000004c1068 R14: 00000000004d3c60 R15: 00000000ffffffff SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18321 comm=syz-executor.4 nla_parse: 2 callbacks suppressed netlink: 2220 bytes leftover after parsing attributes in process `syz-executor.0'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0 syz-executor.2 invoked oom-killer: gfp_mask=0x14280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=1000 syz-executor.2 cpuset=syz2 mems_allowed=0-1 CPU: 0 PID: 18320 Comm: syz-executor.2 Not tainted 4.14.154 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 dump_header+0x177/0x6cd mm/oom_kill.c:422 oom_kill_process.cold+0x10/0xadd mm/oom_kill.c:861 out_of_memory mm/oom_kill.c:1084 [inline] out_of_memory+0x2ee/0x1180 mm/oom_kill.c:1023 __alloc_pages_may_oom mm/page_alloc.c:3344 [inline] __alloc_pages_slowpath+0x2251/0x2930 mm/page_alloc.c:4033 __alloc_pages_nodemask+0x62c/0x7a0 mm/page_alloc.c:4198 alloc_pages_vma+0xc9/0x4c0 mm/mempolicy.c:2077 alloc_zeroed_user_highpage_movable include/linux/highmem.h:184 [inline] wp_page_copy+0xb13/0x1410 mm/memory.c:2497 do_wp_page+0x24b/0x12b0 mm/memory.c:2784 handle_pte_fault mm/memory.c:4005 [inline] __handle_mm_fault+0x1d4a/0x3470 mm/memory.c:4113 handle_mm_fault+0x293/0x7c0 mm/memory.c:4150 __do_page_fault+0x4c1/0xb80 arch/x86/mm/fault.c:1420 do_page_fault+0x71/0x511 arch/x86/mm/fault.c:1495 page_fault+0x25/0x50 arch/x86/entry/entry_64.S:1122 RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 arch/x86/lib/copy_user_64.S:181 RSP: 0018:ffff8881f667fb30 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000500 RDX: 0000000000001000 RSI: ffff888200c70b00 RDI: 00000000201fd000 RBP: ffff8881f667fb60 R08: ffffed104018e200 R09: 0000000000000000 R10: ffffed104018e1ff R11: ffff888200c70fff R12: 00000000201fc500 R13: ffff888200c70000 R14: 00007ffffffff000 R15: 00000000201fd500 copy_page_to_iter_iovec lib/iov_iter.c:206 [inline] copy_page_to_iter+0x31b/0xc40 lib/iov_iter.c:723 pipe_to_user+0xb0/0x160 fs/splice.c:1237 splice_from_pipe_feed fs/splice.c:502 [inline] __splice_from_pipe+0x348/0x780 fs/splice.c:626 vmsplice_to_user+0x197/0x1c0 fs/splice.c:1272 SYSC_vmsplice fs/splice.c:1353 [inline] SyS_vmsplice+0x131/0x160 fs/splice.c:1334 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45a639 RSP: 002b:00007f7457e1cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a639 RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000004 RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7457e1d6d4 R13: 00000000004ca5cf R14: 00000000004e2600 R15: 00000000ffffffff SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18324 comm=syz-executor.4 Mem-Info: active_anon:1338845 inactive_anon:1203 isolated_anon:0 active_file:271 inactive_file:341 isolated_file:45 unevictable:0 dirty:68 writeback:50 unstable:0 slab_reclaimable:14069 slab_unreclaimable:118767 mapped:52588 shmem:333 pagetables:22747 bounce:0 free:25087 free_pcp:235 free_cma:0 Node 0 active_anon:1919496kB inactive_anon:2568kB active_file:736kB inactive_file:1028kB unevictable:0kB isolated(anon):0kB isolated(file):180kB mapped:209924kB dirty:116kB writeback:140kB shmem:1280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 464896kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 1 active_anon:3429784kB inactive_anon:2244kB active_file:348kB inactive_file:232kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:428kB dirty:156kB writeback:60kB shmem:52kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 98304kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 0 DMA free:10476kB min:216kB low:268kB high:320kB active_anon:4484kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:32kB pagetables:12kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2580 2580 2580 Node 0 DMA32 free:36388kB min:36468kB low:45584kB high:54700kB active_anon:1914892kB inactive_anon:2568kB active_file:780kB inactive_file:4184kB unevictable:0kB writepending:112kB present:3129332kB managed:2644872kB mlocked:0kB kernel_stack:11840kB pagetables:38504kB bounce:0kB free_pcp:880kB local_pcp:320kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 Node 0 Normal free:0kB min:0kB low:0kB high:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0 lowmem_reserve[]: 0 0 0 0 Node 1 Normal free:56112kB min:53420kB low:66772kB high:80124kB active_anon:3424932kB inactive_anon:2244kB active_file:1848kB inactive_file:3212kB unevictable:0kB writepending:216kB present:3932160kB managed:3870204kB mlocked:0kB kernel_stack:19552kB pagetables:52308kB bounce:0kB free_pcp:272kB local_pcp:88kB free_cma:0kB SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0 lowmem_reserve[]: 0 0 0 0 Node 0 DMA: 5*4kB (UMEH) 35*8kB (UMEH) 24*16kB (UMEH) 4*32kB (MH) 3*64kB (UME) 2*128kB (ME) 2*256kB (UE) 3*512kB (UME) 3*1024kB (UME) 2*2048kB (UE) 0*4096kB = 10476kB Node 0 DMA32: 942*4kB (UME) 1045*8kB (UME) 742*16kB (UMEH) 303*32kB (UMH) 39*64kB (UME) 2*128kB (ME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 36448kB Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB Node 1 Normal: 490*4kB (UME) 827*8kB (UMEH) 391*16kB (UMEH) 739*32kB (UMEH) 229*64kB (UMEH) 28*128kB (UMH) 17*256kB (UMH) 1*512kB (M) 1*1024kB (H) 0*2048kB 0*4096kB = 62608kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 1900 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 333233 pages reserved 0 pages cma reserved Out of memory: Kill process 18302 (syz-executor.4) score 1007 or sacrifice child udevd invoked oom-killer: gfp_mask=0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null), order=1, oom_score_adj=-1000 udevd cpuset=/ mems_allowed=0-1 CPU: 0 PID: 15399 Comm: udevd Not tainted 4.14.154 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 dump_header+0x177/0x6cd mm/oom_kill.c:422 oom_kill_process.cold+0x10/0xadd mm/oom_kill.c:861 out_of_memory mm/oom_kill.c:1084 [inline] out_of_memory+0x2ee/0x1180 mm/oom_kill.c:1023 __alloc_pages_may_oom mm/page_alloc.c:3344 [inline] __alloc_pages_slowpath+0x2251/0x2930 mm/page_alloc.c:4033 __alloc_pages_nodemask+0x62c/0x7a0 mm/page_alloc.c:4198 __alloc_pages include/linux/gfp.h:484 [inline] __alloc_pages_node include/linux/gfp.h:497 [inline] kmem_getpages mm/slab.c:1419 [inline] cache_grow_begin+0x80/0x400 mm/slab.c:2676 fallback_alloc+0x1fd/0x2c0 mm/slab.c:3217 ____cache_alloc_node+0x1be/0x1d0 mm/slab.c:3285 __do_cache_alloc mm/slab.c:3354 [inline] slab_alloc mm/slab.c:3382 [inline] kmem_cache_alloc+0x1f3/0x780 mm/slab.c:3550 getname_flags fs/namei.c:138 [inline] getname_flags+0xcb/0x580 fs/namei.c:128 user_path_at_empty+0x2f/0x50 fs/namei.c:2630 SYSC_readlinkat fs/stat.c:394 [inline] SyS_readlinkat fs/stat.c:382 [inline] SYSC_readlink fs/stat.c:421 [inline] SyS_readlink+0xb7/0x290 fs/stat.c:418 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x7f7d00e83577 RSP: 002b:00007fff0e44e5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000059 RAX: ffffffffffffffda RBX: 00000000024c4030 RCX: 00007f7d00e83577 RDX: 0000000000000400 RSI: 00007fff0e44e5c0 RDI: 00007fff0e44eaa0 RBP: 00007fff0e44f2e0 R08: 00007fff0e44f2e0 R09: 00007f7d00ed7dc0 R10: 7665642f7379732f R11: 0000000000000246 R12: 00007fff0e44eaa0 R13: 0000000000000400 R14: 00000000024c4030 R15: 00000000024fca00 Mem-Info: active_anon:1339472 inactive_anon:1200 isolated_anon:0 active_file:22 inactive_file:17 isolated_file:0 unevictable:0 dirty:0 writeback:0 unstable:0 slab_reclaimable:14128 slab_unreclaimable:118672 mapped:52254 shmem:333 pagetables:22706 bounce:0 free:25470 free_pcp:63 free_cma:0 Node 0 active_anon:1923388kB inactive_anon:2568kB active_file:136kB inactive_file:232kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:208972kB dirty:0kB writeback:0kB shmem:1280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 464896kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 1 active_anon:3434504kB inactive_anon:2232kB active_file:12kB inactive_file:120kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:52kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 98304kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 0 DMA free:10492kB min:216kB low:268kB high:320kB active_anon:4484kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:32kB pagetables:12kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2580 2580 2580 Node 0 DMA32 free:36876kB min:36468kB low:45584kB high:54700kB active_anon:1918904kB inactive_anon:2568kB active_file:148kB inactive_file:120kB unevictable:0kB writepending:0kB present:3129332kB managed:2644872kB mlocked:0kB kernel_stack:11840kB pagetables:38512kB bounce:0kB free_pcp:312kB local_pcp:76kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 Node 0 Normal free:0kB min:0kB low:0kB high:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 Node 1 Normal free:53920kB min:53420kB low:66772kB high:80124kB active_anon:3434504kB inactive_anon:2232kB active_file:0kB inactive_file:44kB unevictable:0kB writepending:0kB present:3932160kB managed:3870204kB mlocked:0kB kernel_stack:19488kB pagetables:52300kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 Node 0 DMA: 5*4kB (UMEH) 37*8kB (UMEH) 24*16kB (UMEH) 4*32kB (MH) 3*64kB (UME) 2*128kB (ME) 2*256kB (UE) 3*512kB (UME) 3*1024kB (UME) 2*2048kB (UE) 0*4096kB = 10492kB Node 0 DMA32: 1113*4kB (UME) 1062*8kB (UME) 740*16kB (UME) 301*32kB (UME) 38*64kB (UM) 2*128kB (ME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 37108kB Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB Node 1 Normal: 104*4kB (UME) 654*8kB (UMEH) 279*16kB (UMEH) 708*32kB (UMEH) 215*64kB (UMEH) 15*128kB (UMH) 16*256kB (UMH) 1*512kB (M) 1*1024kB (H) 0*2048kB 0*4096kB = 54080kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 605 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 333233 pages reserved 0 pages cma reserved Out of memory: Kill process 23920 (syz-executor.2) score 1007 or sacrifice child Killed process 23920 (syz-executor.2) total-vm:73512kB, anon-rss:16612kB, file-rss:34816kB, shmem-rss:0kB selinux_nlmsg_perm: 9 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18411 comm=syz-executor.4 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18410 comm=syz-executor.3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18424 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18425 comm=syz-executor.5