BUG: sleeping function called from invalid context at mm/slab.h:421 in_atomic(): 1, irqs_disabled(): 1, pid: 4466, name: syz-fuzzer 3 locks held by syz-fuzzer/4466: #0: (ptrval) (&mm->mmap_sem){++++}, at: __do_page_fault+0x381/0xe40 arch/x86/mm/fault.c:1328 #1: (ptrval) (sb_pagefaults){.+.+}, at: sb_start_pagefault include/linux/fs.h:1579 [inline] #1: (ptrval) (sb_pagefaults){.+.+}, at: ext4_page_mkwrite+0x1c8/0x1420 fs/ext4/inode.c:6094 #2: (ptrval) (jbd2_handle){.+.+}, at: start_this_handle+0x581/0x1250 fs/jbd2/transaction.c:385 irq event stamp: 75678 hardirqs last enabled at (75677): [] lookup_bh_lru fs/buffer.c:1271 [inline] hardirqs last enabled at (75677): [] __find_get_block+0x2b8/0xe50 fs/buffer.c:1283 hardirqs last disabled at (75678): [] interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625 softirqs last enabled at (75642): [] __do_softirq+0x778/0xaf5 kernel/softirq.c:311 softirqs last disabled at (75609): [] invoke_softirq kernel/softirq.c:365 [inline] softirqs last disabled at (75609): [] irq_exit+0x1d1/0x200 kernel/softirq.c:405 CPU: 1 PID: 4466 Comm: syz-fuzzer Not tainted 4.17.0-rc2+ #27 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 ___might_sleep.cold.87+0x11f/0x13a kernel/sched/core.c:6188 __might_sleep+0x95/0x190 kernel/sched/core.c:6141 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3378 [inline] __do_kmalloc mm/slab.c:3716 [inline] __kmalloc+0x2b9/0x760 mm/slab.c:3727 kmalloc_array include/linux/slab.h:631 [inline] kcalloc include/linux/slab.h:642 [inline] numa_crng_init drivers/char/random.c:798 [inline] crng_reseed+0x427/0x920 drivers/char/random.c:923 credit_entropy_bits+0x98d/0xa30 drivers/char/random.c:708 add_interrupt_randomness+0x494/0x860 drivers/char/random.c:1254 handle_irq_event_percpu+0xf9/0x1c0 kernel/irq/handle.c:191 handle_irq_event+0xa7/0x135 kernel/irq/handle.c:206 handle_edge_irq+0x20f/0x870 kernel/irq/chip.c:791 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x18c/0x2e7 arch/x86/kernel/irq_64.c:77 do_IRQ+0x78/0x190 arch/x86/kernel/irq.c:245 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:642 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:783 [inline] RIP: 0010:lock_is_held_type+0x18b/0x210 kernel/locking/lockdep.c:3960 RSP: 0000:ffff8801b4706a20 EFLAGS: 00000286 ORIG_RAX: ffffffffffffffd9 RAX: dffffc0000000000 RBX: 0000000000000286 RCX: 0000000000000000 RDX: 1ffffffff11a315d RSI: ffffffff88d8e5e0 RDI: 0000000000000286 RBP: ffff8801b4706a40 R08: ffffed003b5e46c3 R09: ffffed003b5e46c2 R10: ffffed003b5e46c2 R11: ffff8801daf23613 R12: ffff8801b3b88240 R13: 0000000000000000 R14: 0000000000000000 R15: ffff8801ace5c1f8 lock_is_held include/linux/lockdep.h:344 [inline] rcu_read_lock_sched_held+0x108/0x120 kernel/rcu/update.c:117 trace_block_touch_buffer include/trace/events/block.h:45 [inline] touch_buffer fs/buffer.c:58 [inline] __find_get_block+0xb59/0xe50 fs/buffer.c:1291 __getblk_gfp+0xd6/0xaf0 fs/buffer.c:1309 sb_getblk include/linux/buffer_head.h:327 [inline] __ext4_get_inode_loc+0x4c5/0x14a0 fs/ext4/inode.c:4526 ext4_get_inode_loc fs/ext4/inode.c:4639 [inline] ext4_reserve_inode_write+0xf8/0x260 fs/ext4/inode.c:5760 ext4_mark_inode_dirty+0x177/0xb20 fs/ext4/inode.c:5912 ext4_dirty_inode+0x97/0xc0 fs/ext4/inode.c:5951 __mark_inode_dirty+0x811/0x1530 fs/fs-writeback.c:2129 generic_update_time+0x255/0x420 fs/inode.c:1656 update_time fs/inode.c:1672 [inline] file_update_time+0x384/0x640 fs/inode.c:1883 ext4_page_mkwrite+0x1f6/0x1420 fs/ext4/inode.c:6095 do_page_mkwrite+0x146/0x500 mm/memory.c:2371 wp_page_shared mm/memory.c:2667 [inline] do_wp_page+0xf5d/0x1990 mm/memory.c:2767 handle_pte_fault mm/memory.c:3979 [inline] __handle_mm_fault+0x2996/0x4310 mm/memory.c:4087 handle_mm_fault+0x53a/0xc70 mm/memory.c:4124 __do_page_fault+0x60b/0xe40 arch/x86/mm/fault.c:1399 do_page_fault+0xee/0x8a7 arch/x86/mm/fault.c:1474 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160 RIP: 0033:0x45d54e RSP: 002b:000000c42d0c2c30 EFLAGS: 00010206 RAX: 0000000000000080 RBX: 0000000000000578 RCX: 000000c42a38b000 RDX: 000000c42d0c3948 RSI: 000000c42a38aa88 RDI: 00007ff995785fe0 RBP: 000000c42d0c2cd8 R08: 0000000001e1b9c0 R09: 0000000000810d40 R10: 00007ff9957855d8 R11: 0000000000000008 R12: 0000000000000000 R13: 0000000000000020 R14: 0000000000000013 R15: 0000000000000000 random: crng init done netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 'syz-executor3': attribute type 29 has an invalid length. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 'syz-executor3': attribute type 29 has an invalid length. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 'syz-executor3': attribute type 29 has an invalid length. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 'syz-executor3': attribute type 29 has an invalid length. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. kernel msg: ebtables bug: please report to author: Wrong len argument netlink: 'syz-executor3': attribute type 29 has an invalid length. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 'syz-executor3': attribute type 29 has an invalid length. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 'syz-executor3': attribute type 29 has an invalid length. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. kernel msg: ebtables bug: please report to author: bad policy kernel msg: ebtables bug: please report to author: bad policy ebt_limit: overflow, try lower: 2147483649/2 ebt_limit: overflow, try lower: 2147483649/2