=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
5.2.0-rc6-next-20190628 #25 Not tainted
-----------------------------------------------------
syz-executor.5/31209 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
00000000e2220289 (&ctx->fault_pending_wqh){+.+.}, at: spin_lock include/linux/spinlock.h:338 [inline]
00000000e2220289 (&ctx->fault_pending_wqh){+.+.}, at: userfaultfd_ctx_read fs/userfaultfd.c:1045 [inline]
00000000e2220289 (&ctx->fault_pending_wqh){+.+.}, at: userfaultfd_read+0x54d/0x1940 fs/userfaultfd.c:1203

and this task is already holding:
00000000a4c2a515 (&ctx->fd_wqh){....}, at: spin_lock_irq include/linux/spinlock.h:363 [inline]
00000000a4c2a515 (&ctx->fd_wqh){....}, at: userfaultfd_ctx_read fs/userfaultfd.c:1041 [inline]
00000000a4c2a515 (&ctx->fd_wqh){....}, at: userfaultfd_read+0x27a/0x1940 fs/userfaultfd.c:1203
which would create a new lock dependency:
 (&ctx->fd_wqh){....} -> (&ctx->fault_pending_wqh){+.+.}

but this new dependency connects a SOFTIRQ-irq-safe lock:
 (&(&ctx->ctx_lock)->rlock){..-.}

... which became SOFTIRQ-irq-safe at:
  lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
  __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
  _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:167
  spin_lock_irq include/linux/spinlock.h:363 [inline]
  free_ioctx_users+0x2d/0x490 fs/aio.c:620
  percpu_ref_put_many include/linux/percpu-refcount.h:293 [inline]
  percpu_ref_put include/linux/percpu-refcount.h:309 [inline]
  percpu_ref_call_confirm_rcu lib/percpu-refcount.c:130 [inline]
  percpu_ref_switch_to_atomic_rcu+0x4c0/0x570 lib/percpu-refcount.c:165
  __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
  rcu_do_batch kernel/rcu/tree.c:2114 [inline]
  rcu_core+0x67f/0x1580 kernel/rcu/tree.c:2314
  rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2323
  __do_softirq+0x262/0x98c kernel/softirq.c:292
  invoke_softirq kernel/softirq.c:373 [inline]
  irq_exit+0x19b/0x1e0 kernel/softirq.c:413
  exiting_irq arch/x86/include/asm/apic.h:535 [inline]
  smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1068
  apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
  arch_local_irq_restore arch/x86/include/asm/paravirt.h:767 [inline]
  console_unlock+0xdab/0xf10 kernel/printk/printk.c:2467
  vprintk_emit+0x2a0/0x700 kernel/printk/printk.c:1986
  vprintk_default+0x28/0x30 kernel/printk/printk.c:2013
  vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386
  printk+0xba/0xed kernel/printk/printk.c:2046
  kauditd_printk_skb kernel/audit.c:532 [inline]
  kauditd_hold_skb.cold+0x3f/0x4e kernel/audit.c:565
  kauditd_send_queue+0x12b/0x170 kernel/audit.c:728
  kauditd_thread+0x7b5/0xb00 kernel/audit.c:854
  kthread+0x361/0x430 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:353

to a SOFTIRQ-irq-unsafe lock:
 (&ctx->fault_pending_wqh){+.+.}

... which became SOFTIRQ-irq-unsafe at:
...
  lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
  __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
  _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
  spin_lock include/linux/spinlock.h:338 [inline]
  handle_userfault+0x58e/0x1900 fs/userfaultfd.c:461
  shmem_getpage_gfp+0x1f4c/0x2680 mm/shmem.c:1786
  shmem_fault+0x22a/0x7b0 mm/shmem.c:2048
  __do_fault+0x111/0x540 mm/memory.c:3193
  do_read_fault mm/memory.c:3590 [inline]
  do_fault mm/memory.c:3720 [inline]
  handle_pte_fault mm/memory.c:3951 [inline]
  __handle_mm_fault+0x2cc0/0x3f20 mm/memory.c:4075
  handle_mm_fault+0x1b5/0x6b0 mm/memory.c:4112
  do_user_addr_fault arch/x86/mm/fault.c:1438 [inline]
  __do_page_fault+0x531/0xdc0 arch/x86/mm/fault.c:1504
  do_page_fault+0x71/0x5e1 arch/x86/mm/fault.c:1535
  page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1161
  copy_user_generic_unrolled+0x86/0xc0 arch/x86/lib/copy_user_64.S:89
  copy_from_user include/linux/uaccess.h:144 [inline]
  sctp_getsockopt_local_addrs+0xec/0xbb0 net/sctp/socket.c:6270
  sctp_getsockopt net/sctp/socket.c:7851 [inline]
  sctp_getsockopt+0x20be/0x5ae9 net/sctp/socket.c:7786
  sock_common_getsockopt+0x94/0xd0 net/core/sock.c:3089
  __sys_getsockopt+0x16d/0x310 net/socket.c:2135
  __do_sys_getsockopt net/socket.c:2150 [inline]
  __se_sys_getsockopt net/socket.c:2147 [inline]
  __x64_sys_getsockopt+0xbe/0x150 net/socket.c:2147
  do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:
  &(&ctx->ctx_lock)->rlock --> &ctx->fd_wqh --> &ctx->fault_pending_wqh

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&ctx->fault_pending_wqh);
                               local_irq_disable();
                               lock(&(&ctx->ctx_lock)->rlock);
                               lock(&ctx->fd_wqh);
  <Interrupt>
    lock(&(&ctx->ctx_lock)->rlock);

 *** DEADLOCK ***

1 lock held by syz-executor.5/31209:
 #0: 00000000a4c2a515 (&ctx->fd_wqh){....}, at: spin_lock_irq include/linux/spinlock.h:363 [inline]
 #0: 00000000a4c2a515 (&ctx->fd_wqh){....}, at: userfaultfd_ctx_read fs/userfaultfd.c:1041 [inline]
 #0: 00000000a4c2a515 (&ctx->fd_wqh){....}, at: userfaultfd_read+0x27a/0x1940 fs/userfaultfd.c:1203

the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
 -> (&(&ctx->ctx_lock)->rlock){..-.} {
    IN-SOFTIRQ-W at:
                      lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
                      __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                      _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:167
                      spin_lock_irq include/linux/spinlock.h:363 [inline]
                      free_ioctx_users+0x2d/0x490 fs/aio.c:620
                      percpu_ref_put_many include/linux/percpu-refcount.h:293 [inline]
                      percpu_ref_put include/linux/percpu-refcount.h:309 [inline]
                      percpu_ref_call_confirm_rcu lib/percpu-refcount.c:130 [inline]
                      percpu_ref_switch_to_atomic_rcu+0x4c0/0x570 lib/percpu-refcount.c:165
                      __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
                      rcu_do_batch kernel/rcu/tree.c:2114 [inline]
                      rcu_core+0x67f/0x1580 kernel/rcu/tree.c:2314
                      rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2323
                      __do_softirq+0x262/0x98c kernel/softirq.c:292
                      invoke_softirq kernel/softirq.c:373 [inline]
                      irq_exit+0x19b/0x1e0 kernel/softirq.c:413
                      exiting_irq arch/x86/include/asm/apic.h:535 [inline]
                      smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1068
                      apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
                      arch_local_irq_restore arch/x86/include/asm/paravirt.h:767 [inline]
                      console_unlock+0xdab/0xf10 kernel/printk/printk.c:2467
                      vprintk_emit+0x2a0/0x700 kernel/printk/printk.c:1986
                      vprintk_default+0x28/0x30 kernel/printk/printk.c:2013
                      vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386
                      printk+0xba/0xed kernel/printk/printk.c:2046
                      kauditd_printk_skb kernel/audit.c:532 [inline]
                      kauditd_hold_skb.cold+0x3f/0x4e kernel/audit.c:565
                      kauditd_send_queue+0x12b/0x170 kernel/audit.c:728
                      kauditd_thread+0x7b5/0xb00 kernel/audit.c:854
                      kthread+0x361/0x430 kernel/kthread.c:255
                      ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:353
    INITIAL USE at:
                     lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
                     __raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
                     _raw_spin_lock_irq+0x60/0x80 kernel/locking/spinlock.c:167
                     spin_lock_irq include/linux/spinlock.h:363 [inline]
                     free_ioctx_users+0x2d/0x490 fs/aio.c:620
                     percpu_ref_put_many include/linux/percpu-refcount.h:293 [inline]
                     percpu_ref_put include/linux/percpu-refcount.h:309 [inline]
                     percpu_ref_call_confirm_rcu lib/percpu-refcount.c:130 [inline]
                     percpu_ref_switch_to_atomic_rcu+0x4c0/0x570 lib/percpu-refcount.c:165
                     __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
                     rcu_do_batch kernel/rcu/tree.c:2114 [inline]
                     rcu_core+0x67f/0x1580 kernel/rcu/tree.c:2314
                     rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2323
                     __do_softirq+0x262/0x98c kernel/softirq.c:292
                     invoke_softirq kernel/softirq.c:373 [inline]
                     irq_exit+0x19b/0x1e0 kernel/softirq.c:413
                     exiting_irq arch/x86/include/asm/apic.h:535 [inline]
                     smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1068
                     apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
                     arch_local_irq_restore arch/x86/include/asm/paravirt.h:767 [inline]
                     console_unlock+0xdab/0xf10 kernel/printk/printk.c:2467
                     vprintk_emit+0x2a0/0x700 kernel/printk/printk.c:1986
                     vprintk_default+0x28/0x30 kernel/printk/printk.c:2013
                     vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386
                     printk+0xba/0xed kernel/printk/printk.c:2046
                     kauditd_printk_skb kernel/audit.c:532 [inline]
                     kauditd_hold_skb.cold+0x3f/0x4e kernel/audit.c:565
                     kauditd_send_queue+0x12b/0x170 kernel/audit.c:728
                     kauditd_thread+0x7b5/0xb00 kernel/audit.c:854
                     kthread+0x361/0x430 kernel/kthread.c:255
                     ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:353
  }
  ... key      at: [<ffffffff8a8a9360>] __key.53845+0x0/0x40
  ... acquired at:
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
   spin_lock include/linux/spinlock.h:338 [inline]
   aio_poll fs/aio.c:1750 [inline]
   __io_submit_one fs/aio.c:1824 [inline]
   io_submit_one+0xefa/0x2ef0 fs/aio.c:1861
   __do_sys_io_submit fs/aio.c:1920 [inline]
   __se_sys_io_submit fs/aio.c:1890 [inline]
   __x64_sys_io_submit+0x1bd/0x570 fs/aio.c:1890
   do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
   entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> (&ctx->fd_wqh){....} {
   INITIAL USE at:
                   lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
                   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
                   _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:159
                   __wake_up_common_lock+0xc8/0x150 kernel/sched/wait.c:122
                   __wake_up+0xe/0x10 kernel/sched/wait.c:142
                   handle_userfault+0x932/0x1900 fs/userfaultfd.c:487
                   shmem_getpage_gfp+0x1f4c/0x2680 mm/shmem.c:1786
                   shmem_fault+0x22a/0x7b0 mm/shmem.c:2048
                   __do_fault+0x111/0x540 mm/memory.c:3193
                   do_read_fault mm/memory.c:3590 [inline]
                   do_fault mm/memory.c:3720 [inline]
                   handle_pte_fault mm/memory.c:3951 [inline]
                   __handle_mm_fault+0x2cc0/0x3f20 mm/memory.c:4075
                   handle_mm_fault+0x1b5/0x6b0 mm/memory.c:4112
                   do_user_addr_fault arch/x86/mm/fault.c:1438 [inline]
                   __do_page_fault+0x531/0xdc0 arch/x86/mm/fault.c:1504
                   do_page_fault+0x71/0x5e1 arch/x86/mm/fault.c:1535
                   page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1161
                   copy_user_generic_unrolled+0x86/0xc0 arch/x86/lib/copy_user_64.S:89
                   copy_from_user include/linux/uaccess.h:144 [inline]
                   sctp_getsockopt_local_addrs+0xec/0xbb0 net/sctp/socket.c:6270
                   sctp_getsockopt net/sctp/socket.c:7851 [inline]
                   sctp_getsockopt+0x20be/0x5ae9 net/sctp/socket.c:7786
                   sock_common_getsockopt+0x94/0xd0 net/core/sock.c:3089
                   __sys_getsockopt+0x16d/0x310 net/socket.c:2135
                   __do_sys_getsockopt net/socket.c:2150 [inline]
                   __se_sys_getsockopt net/socket.c:2147 [inline]
                   __x64_sys_getsockopt+0xbe/0x150 net/socket.c:2147
                   do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
                   entry_SYSCALL_64_after_hwframe+0x49/0xbe
 }
 ... key      at: [<ffffffff8a8a90e0>] __key.46560+0x0/0x40
 ... acquired at:
   lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
   spin_lock include/linux/spinlock.h:338 [inline]
   userfaultfd_ctx_read fs/userfaultfd.c:1045 [inline]
   userfaultfd_read+0x54d/0x1940 fs/userfaultfd.c:1203
   __vfs_read+0x8a/0x110 fs/read_write.c:425
   vfs_read+0x1f0/0x440 fs/read_write.c:461
   ksys_read+0x14f/0x290 fs/read_write.c:587
   __do_sys_read fs/read_write.c:597 [inline]
   __se_sys_read fs/read_write.c:595 [inline]
   __x64_sys_read+0x73/0xb0 fs/read_write.c:595
   do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
   entry_SYSCALL_64_after_hwframe+0x49/0xbe


the dependencies between the lock to be acquired
 and SOFTIRQ-irq-unsafe lock:
-> (&ctx->fault_pending_wqh){+.+.} {
   HARDIRQ-ON-W at:
                    lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
                    spin_lock include/linux/spinlock.h:338 [inline]
                    handle_userfault+0x58e/0x1900 fs/userfaultfd.c:461
                    shmem_getpage_gfp+0x1f4c/0x2680 mm/shmem.c:1786
                    shmem_fault+0x22a/0x7b0 mm/shmem.c:2048
                    __do_fault+0x111/0x540 mm/memory.c:3193
                    do_read_fault mm/memory.c:3590 [inline]
                    do_fault mm/memory.c:3720 [inline]
                    handle_pte_fault mm/memory.c:3951 [inline]
                    __handle_mm_fault+0x2cc0/0x3f20 mm/memory.c:4075
                    handle_mm_fault+0x1b5/0x6b0 mm/memory.c:4112
                    do_user_addr_fault arch/x86/mm/fault.c:1438 [inline]
                    __do_page_fault+0x531/0xdc0 arch/x86/mm/fault.c:1504
                    do_page_fault+0x71/0x5e1 arch/x86/mm/fault.c:1535
                    page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1161
                    copy_user_generic_unrolled+0x86/0xc0 arch/x86/lib/copy_user_64.S:89
                    copy_from_user include/linux/uaccess.h:144 [inline]
                    sctp_getsockopt_local_addrs+0xec/0xbb0 net/sctp/socket.c:6270
                    sctp_getsockopt net/sctp/socket.c:7851 [inline]
                    sctp_getsockopt+0x20be/0x5ae9 net/sctp/socket.c:7786
                    sock_common_getsockopt+0x94/0xd0 net/core/sock.c:3089
                    __sys_getsockopt+0x16d/0x310 net/socket.c:2135
                    __do_sys_getsockopt net/socket.c:2150 [inline]
                    __se_sys_getsockopt net/socket.c:2147 [inline]
                    __x64_sys_getsockopt+0xbe/0x150 net/socket.c:2147
                    do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
   SOFTIRQ-ON-W at:
                    lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
                    __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                    _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
                    spin_lock include/linux/spinlock.h:338 [inline]
                    handle_userfault+0x58e/0x1900 fs/userfaultfd.c:461
                    shmem_getpage_gfp+0x1f4c/0x2680 mm/shmem.c:1786
                    shmem_fault+0x22a/0x7b0 mm/shmem.c:2048
                    __do_fault+0x111/0x540 mm/memory.c:3193
                    do_read_fault mm/memory.c:3590 [inline]
                    do_fault mm/memory.c:3720 [inline]
                    handle_pte_fault mm/memory.c:3951 [inline]
                    __handle_mm_fault+0x2cc0/0x3f20 mm/memory.c:4075
                    handle_mm_fault+0x1b5/0x6b0 mm/memory.c:4112
                    do_user_addr_fault arch/x86/mm/fault.c:1438 [inline]
                    __do_page_fault+0x531/0xdc0 arch/x86/mm/fault.c:1504
                    do_page_fault+0x71/0x5e1 arch/x86/mm/fault.c:1535
                    page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1161
                    copy_user_generic_unrolled+0x86/0xc0 arch/x86/lib/copy_user_64.S:89
                    copy_from_user include/linux/uaccess.h:144 [inline]
                    sctp_getsockopt_local_addrs+0xec/0xbb0 net/sctp/socket.c:6270
                    sctp_getsockopt net/sctp/socket.c:7851 [inline]
                    sctp_getsockopt+0x20be/0x5ae9 net/sctp/socket.c:7786
                    sock_common_getsockopt+0x94/0xd0 net/core/sock.c:3089
                    __sys_getsockopt+0x16d/0x310 net/socket.c:2135
                    __do_sys_getsockopt net/socket.c:2150 [inline]
                    __se_sys_getsockopt net/socket.c:2147 [inline]
                    __x64_sys_getsockopt+0xbe/0x150 net/socket.c:2147
                    do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
   INITIAL USE at:
                   lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
                   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
                   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
                   spin_lock include/linux/spinlock.h:338 [inline]
                   handle_userfault+0x58e/0x1900 fs/userfaultfd.c:461
                   shmem_getpage_gfp+0x1f4c/0x2680 mm/shmem.c:1786
                   shmem_fault+0x22a/0x7b0 mm/shmem.c:2048
                   __do_fault+0x111/0x540 mm/memory.c:3193
                   do_read_fault mm/memory.c:3590 [inline]
                   do_fault mm/memory.c:3720 [inline]
                   handle_pte_fault mm/memory.c:3951 [inline]
                   __handle_mm_fault+0x2cc0/0x3f20 mm/memory.c:4075
                   handle_mm_fault+0x1b5/0x6b0 mm/memory.c:4112
                   do_user_addr_fault arch/x86/mm/fault.c:1438 [inline]
                   __do_page_fault+0x531/0xdc0 arch/x86/mm/fault.c:1504
                   do_page_fault+0x71/0x5e1 arch/x86/mm/fault.c:1535
                   page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1161
                   copy_user_generic_unrolled+0x86/0xc0 arch/x86/lib/copy_user_64.S:89
                   copy_from_user include/linux/uaccess.h:144 [inline]
                   sctp_getsockopt_local_addrs+0xec/0xbb0 net/sctp/socket.c:6270
                   sctp_getsockopt net/sctp/socket.c:7851 [inline]
                   sctp_getsockopt+0x20be/0x5ae9 net/sctp/socket.c:7786
                   sock_common_getsockopt+0x94/0xd0 net/core/sock.c:3089
                   __sys_getsockopt+0x16d/0x310 net/socket.c:2135
                   __do_sys_getsockopt net/socket.c:2150 [inline]
                   __se_sys_getsockopt net/socket.c:2147 [inline]
                   __x64_sys_getsockopt+0xbe/0x150 net/socket.c:2147
                   do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
                   entry_SYSCALL_64_after_hwframe+0x49/0xbe
 }
 ... key      at: [<ffffffff8a8a91a0>] __key.46557+0x0/0x40
 ... acquired at:
   lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
   __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
   _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
   spin_lock include/linux/spinlock.h:338 [inline]
   userfaultfd_ctx_read fs/userfaultfd.c:1045 [inline]
   userfaultfd_read+0x54d/0x1940 fs/userfaultfd.c:1203
   __vfs_read+0x8a/0x110 fs/read_write.c:425
   vfs_read+0x1f0/0x440 fs/read_write.c:461
   ksys_read+0x14f/0x290 fs/read_write.c:587
   __do_sys_read fs/read_write.c:597 [inline]
   __se_sys_read fs/read_write.c:595 [inline]
   __x64_sys_read+0x73/0xb0 fs/read_write.c:595
   do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
   entry_SYSCALL_64_after_hwframe+0x49/0xbe


stack backtrace:
CPU: 0 PID: 31209 Comm: syz-executor.5 Not tainted 5.2.0-rc6-next-20190628 #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_bad_irq_dependency kernel/locking/lockdep.c:2025 [inline]
 check_irq_usage.cold+0x5b4/0x72e kernel/locking/lockdep.c:2223
 check_prev_add kernel/locking/lockdep.c:2409 [inline]
 check_prevs_add kernel/locking/lockdep.c:2507 [inline]
 validate_chain kernel/locking/lockdep.c:2897 [inline]
 __lock_acquire+0x25bd/0x4c20 kernel/locking/lockdep.c:3880
 lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4413
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:338 [inline]
 userfaultfd_ctx_read fs/userfaultfd.c:1045 [inline]
 userfaultfd_read+0x54d/0x1940 fs/userfaultfd.c:1203
 __vfs_read+0x8a/0x110 fs/read_write.c:425
 vfs_read+0x1f0/0x440 fs/read_write.c:461
 ksys_read+0x14f/0x290 fs/read_write.c:587
 __do_sys_read fs/read_write.c:597 [inline]
 __se_sys_read fs/read_write.c:595 [inline]
 __x64_sys_read+0x73/0xb0 fs/read_write.c:595
 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459519
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f7f30944c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459519
RDX: 0000000000000064 RSI: 0000000020000400 RDI: 0000000000000003
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7f309456d4
R13: 00000000004c55fd R14: 00000000004db678 R15: 00000000ffffffff