================================ WARNING: inconsistent lock state 4.14.229-syzkaller #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. syz-executor.2/19602 [HC1[1]:SC0[0]:HE0:SE1] takes: (hugetlb_lock){?.+.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] (hugetlb_lock){?.+.}, at: [] free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309 {HARDIRQ-ON-W} state was registered at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x283/0x400 mm/hugetlb.c:3034 proc_sys_call_handler.isra.0+0x1ba/0x340 fs/proc/proc_sysctl.c:598 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb irq event stamp: 418 hardirqs last enabled at (417): [] restore_regs_and_return_to_kernel+0x0/0x2a hardirqs last disabled at (418): [] common_interrupt+0x8e/0x93 arch/x86/entry/entry_64.S:576 softirqs last enabled at (232): [] __do_softirq+0x68b/0x9ff kernel/softirq.c:314 softirqs last disabled at (125): [] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (125): [] irq_exit+0x193/0x240 kernel/softirq.c:409 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(hugetlb_lock); lock(hugetlb_lock); *** DEADLOCK *** 1 lock held by syz-executor.2/19602: #0: (&(&virtscsi_vq->vq_lock)->rlock){-.-.}, at: [] virtscsi_vq_done drivers/scsi/virtio_scsi.c:219 [inline] #0: (&(&virtscsi_vq->vq_lock)->rlock){-.-.}, at: [] virtscsi_req_done+0x113/0x1d0 drivers/scsi/virtio_scsi.c:238 stack backtrace: CPU: 0 PID: 19602 Comm: syz-executor.2 Not tainted 4.14.229-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_usage_bug.cold+0x42e/0x570 kernel/locking/lockdep.c:2589 valid_state kernel/locking/lockdep.c:2602 [inline] mark_lock_irq kernel/locking/lockdep.c:2796 [inline] mark_lock+0xb4d/0x1050 kernel/locking/lockdep.c:3194 mark_irqflags kernel/locking/lockdep.c:3069 [inline] __lock_acquire+0xfb2/0x3f20 kernel/locking/lockdep.c:3448 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page+0x5ab/0x7f0 mm/hugetlb.c:1309 __put_page+0xb9/0x2f0 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] bio_check_pages_dirty+0x287/0x490 block/bio.c:1794 dio_bio_complete+0x454/0x5d0 fs/direct-io.c:553 dio_bio_end_aio+0x43/0x450 fs/direct-io.c:358 bio_endio+0x27a/0x680 block/bio.c:1918 req_bio_endio block/blk-core.c:204 [inline] blk_update_request+0x2d0/0xa30 block/blk-core.c:2765 scsi_end_request+0x7d/0xa10 drivers/scsi/scsi_lib.c:659 scsi_io_completion+0xa3f/0x1530 drivers/scsi/scsi_lib.c:885 scsi_softirq_done+0x2c8/0x360 drivers/scsi/scsi_lib.c:1671 __blk_mq_complete_request+0x30b/0x6c0 block/blk-mq.c:571 blk_mq_complete_request+0x52/0x60 block/blk-mq.c:591 virtscsi_vq_done drivers/scsi/virtio_scsi.c:223 [inline] virtscsi_req_done+0x13b/0x1d0 drivers/scsi/virtio_scsi.c:238 vring_interrupt+0x117/0x200 drivers/virtio/virtio_ring.c:954 __handle_irq_event_percpu+0xee/0x7f0 kernel/irq/handle.c:147 handle_irq_event_percpu kernel/irq/handle.c:187 [inline] handle_irq_event+0xf0/0x250 kernel/irq/handle.c:204 handle_edge_irq+0x224/0xc40 kernel/irq/chip.c:770 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x93/0x1d0 arch/x86/kernel/irq.c:230 common_interrupt+0x93/0x93 arch/x86/entry/entry_64.S:576 RIP: 0010:page_zonenum include/linux/mm.h:797 [inline] RIP: 0010:is_zone_device_page include/linux/mm.h:803 [inline] RIP: 0010:is_device_public_page include/linux/memremap.h:171 [inline] RIP: 0010:release_pages+0xf7/0xbf0 mm/swap.c:769 RSP: 0018:ffff88803fa376c0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff6e RAX: 1ffffd400051a9e8 RBX: 00000000000001fe RCX: 0000000000000000 RDX: 0000000000000000 RSI: 00000000000001fe RDI: ffff8880a589b010 RBP: ffffea00028d4f40 R08: ffffed1007549a00 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffffea00028d4f1c R14: ffff8880a589b5b8 R15: dffffc0000000000 tlb_flush_mmu_free+0xc1/0x1a0 mm/memory.c:272 zap_pte_range mm/memory.c:1421 [inline] zap_pmd_range mm/memory.c:1456 [inline] zap_pud_range mm/memory.c:1485 [inline] zap_p4d_range mm/memory.c:1506 [inline] unmap_page_range+0x1533/0x1ce0 mm/memory.c:1527 unmap_single_vma+0x147/0x2b0 mm/memory.c:1572 unmap_vmas+0x9d/0x160 mm/memory.c:1602 exit_mmap+0x270/0x4d0 mm/mmap.c:3058 __mmput kernel/fork.c:930 [inline] mmput kernel/fork.c:951 [inline] mmput+0xfa/0x420 kernel/fork.c:946 exit_mm kernel/exit.c:548 [inline] do_exit+0x984/0x2850 kernel/exit.c:855 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2423 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x466459 RSP: 002b:00007f2367560218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000056bf68 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf68 RBP: 000000000056bf60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf6c R13: 00007ffe0a8bb37f R14: 00007f2367560300 R15: 0000000000022000 capability: warning: `syz-executor.3' uses 32-bit capabilities (legacy support in use) ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table Cannot find add_set index 0 as target ip6_tables: ip6tables: counters copy to user failed while replacing table Cannot find add_set index 0 as target Cannot find add_set index 0 as target ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table xt_HMARK: hash modulus can't be zero xt_HMARK: hash modulus can't be zero xt_HMARK: hash modulus can't be zero ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table ip6t_rpfilter: unknown options encountered ip6t_rpfilter: unknown options encountered BTRFS: device fsid 3ef4e72b-bd40-425e-a16a-bfe806a542dc devid 1 transid 7 /dev/loop1 BTRFS: device fsid abb5d618-46c7-4e89-943b-7a9d2665c168 devid 1 transid 7 /dev/loop2 BTRFS error (device loop1): unsupported checksum algorithm 2 BTRFS error (device loop2): superblock checksum mismatch BTRFS error (device loop1): superblock checksum mismatch BTRFS error (device loop2): open_ctree failed BTRFS error (device loop1): open_ctree failed BTRFS error (device loop2): superblock checksum mismatch BTRFS error (device loop2): open_ctree failed BTRFS error (device loop1): unsupported checksum algorithm 2 BTRFS error (device loop1): superblock checksum mismatch syz-executor.2 (20432): drop_caches: 0 BTRFS: device fsid abb5d618-46c7-4e89-943b-7a9d2665c168 devid 1 transid 7 /dev/loop4 BTRFS error (device loop1): open_ctree failed ip6t_rpfilter: unknown options encountered BTRFS info (device loop4): disk space caching is enabled BTRFS info (device loop4): has skinny extents BTRFS error (device loop1): unsupported checksum algorithm 2 BTRFS error (device loop1): superblock checksum mismatch BTRFS error (device loop1): open_ctree failed BTRFS error (device loop4): bad tree block start 0 5300224 BTRFS error (device loop4): open_ctree failed BTRFS info (device loop4): disk space caching is enabled BTRFS info (device loop4): has skinny extents BTRFS error (device loop4): bad tree block start 0 5300224 BTRFS error (device loop4): open_ctree failed BTRFS info (device loop4): disk space caching is enabled BTRFS error (device loop1): unsupported checksum algorithm 2 BTRFS info (device loop4): has skinny extents BTRFS error (device loop1): superblock checksum mismatch BTRFS error (device loop1): open_ctree failed BTRFS error (device loop4): bad tree block start 0 5300224 BTRFS error (device loop4): open_ctree failed caif:caif_disconnect_client(): nothing to disconnect caif:caif_disconnect_client(): nothing to disconnect BTRFS info (device loop4): disk space caching is enabled BTRFS info (device loop4): has skinny extents usb usb2: usbfs: process 20655 (syz-executor.3) did not claim interface 0 before use BTRFS error (device loop4): bad tree block start 0 5300224 BTRFS error (device loop4): open_ctree failed usb usb2: usbfs: process 20702 (syz-executor.3) did not claim interface 0 before use BTRFS info (device loop4): disk space caching is enabled BTRFS info (device loop4): has skinny extents usb usb2: usbfs: process 20731 (syz-executor.3) did not claim interface 0 before use BTRFS error (device loop4): bad tree block start 0 5300224 BTRFS error (device loop4): open_ctree failed usb usb2: usbfs: process 20779 (syz-executor.3) did not claim interface 0 before use usb usb2: usbfs: process 20832 (syz-executor.5) did not claim interface 0 before use usb usb2: usbfs: process 20841 (syz-executor.5) did not claim interface 0 before use BFS-fs: bfs_fill_super(): No BFS filesystem on loop2 (magic=00000000) IPVS: ftp: loaded support on port[0] = 21 batman_adv: batadv0: Interface deactivated: batadv_slave_1 usb usb2: usbfs: process 21049 (syz-executor.1) did not claim interface 0 before use IPVS: ftp: loaded support on port[0] = 21 BFS-fs: bfs_fill_super(): No BFS filesystem on loop3 (magic=000000c1) EXT4-fs (loop3): VFS: Can't find ext4 filesystem EXT4-fs (loop3): VFS: Can't find ext4 filesystem