====================================================== WARNING: possible circular locking dependency detected 4.13.0-mm1+ #3 Not tainted ------------------------------------------------------ syz-executor2/3999 is trying to acquire lock: (event_mutex){+.+.}, at: [] ftrace_profile_set_filter+0x7a/0x270 kernel/trace/trace_events_filter.c:2266 but task is already holding lock: (&ctx->mutex){+.+.}, at: [] perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #8 (&ctx->mutex){+.+.}: check_prevs_add kernel/locking/lockdep.c:2020 [inline] validate_chain kernel/locking/lockdep.c:2469 [inline] __lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210 perf_event_ctx_lock kernel/events/core.c:1223 [inline] perf_read+0xb9/0x970 kernel/events/core.c:4584 do_loop_readv_writev fs/read_write.c:670 [inline] do_iter_read+0x3db/0x5b0 fs/read_write.c:894 vfs_readv+0x121/0x1c0 fs/read_write.c:956 kernel_readv fs/splice.c:361 [inline] default_file_splice_read+0x508/0xae0 fs/splice.c:432 do_splice_to+0x110/0x170 fs/splice.c:896 do_splice fs/splice.c:1189 [inline] SYSC_splice fs/splice.c:1418 [inline] SyS_splice+0x11a8/0x1630 fs/splice.c:1398 entry_SYSCALL_64_fastpath+0x1f/0xbe -> #7 (&pipe->mutex/1){+.+.}: check_prevs_add kernel/locking/lockdep.c:2020 [inline] validate_chain kernel/locking/lockdep.c:2469 [inline] __lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 pipe_lock_nested fs/pipe.c:66 [inline] pipe_lock+0x56/0x70 fs/pipe.c:74 iter_file_splice_write+0x264/0xf50 fs/splice.c:715 do_splice_from fs/splice.c:867 [inline] do_splice fs/splice.c:1163 [inline] SYSC_splice fs/splice.c:1418 [inline] SyS_splice+0x7d5/0x1630 fs/splice.c:1398 entry_SYSCALL_64_fastpath+0x1f/0xbe -> #6 (sb_writers){.+.+}: percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:35 [inline] percpu_down_read include/linux/percpu-rwsem.h:58 [inline] __sb_start_write+0x18f/0x290 fs/super.c:1340 sb_start_write include/linux/fs.h:1514 [inline] mnt_want_write+0x3f/0xb0 fs/namespace.c:386 filename_create+0x12b/0x520 fs/namei.c:3629 kern_path_create+0x33/0x40 fs/namei.c:3675 handle_create+0xc0/0x760 drivers/base/devtmpfs.c:202 -> #5 ((complete)&req.done){+.+.}: check_prevs_add kernel/locking/lockdep.c:2020 [inline] validate_chain kernel/locking/lockdep.c:2469 [inline] __lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002 complete_acquire include/linux/completion.h:39 [inline] __wait_for_common kernel/sched/completion.c:108 [inline] wait_for_common kernel/sched/completion.c:122 [inline] wait_for_completion+0xc8/0x770 kernel/sched/completion.c:143 devtmpfs_create_node+0x32b/0x4a0 drivers/base/devtmpfs.c:114 device_add+0x120f/0x1640 drivers/base/core.c:1824 device_create_groups_vargs+0x1f3/0x250 drivers/base/core.c:2430 device_create_vargs drivers/base/core.c:2470 [inline] device_create+0xda/0x110 drivers/base/core.c:2506 msr_device_create+0x26/0x40 arch/x86/kernel/msr.c:188 cpuhp_invoke_callback+0x256/0x14d0 kernel/cpu.c:145 cpuhp_thread_fun+0x265/0x520 kernel/cpu.c:434 smpboot_thread_fn+0x489/0x850 kernel/smpboot.c:164 kthread+0x39c/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 -> #4 (cpuhp_state){+.+.}: check_prevs_add kernel/locking/lockdep.c:2020 [inline] validate_chain kernel/locking/lockdep.c:2469 [inline] __lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002 cpuhp_invoke_ap_callback kernel/cpu.c:467 [inline] cpuhp_issue_call+0x1a2/0x3e0 kernel/cpu.c:1308 __cpuhp_setup_state_cpuslocked+0x2d6/0x5f0 kernel/cpu.c:1455 __cpuhp_setup_state+0xb0/0x140 kernel/cpu.c:1484 cpuhp_setup_state include/linux/cpuhotplug.h:177 [inline] page_writeback_init+0x4d/0x71 mm/page-writeback.c:2082 pagecache_init+0x48/0x4f mm/filemap.c:871 start_kernel+0x6c1/0x754 init/main.c:690 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:377 x86_64_start_kernel+0x87/0x8a arch/x86/kernel/head64.c:358 verify_cpu+0x0/0xfb -> #3 (cpuhp_state_mutex){+.+.}: check_prevs_add kernel/locking/lockdep.c:2020 [inline] validate_chain kernel/locking/lockdep.c:2469 [inline] __lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 __cpuhp_setup_state_cpuslocked+0x5b/0x5f0 kernel/cpu.c:1430 __cpuhp_setup_state+0xb0/0x140 kernel/cpu.c:1484 cpuhp_setup_state_nocalls include/linux/cpuhotplug.h:205 [inline] kvm_guest_init+0x1f3/0x20f arch/x86/kernel/kvm.c:488 setup_arch+0x1899/0x1ab3 arch/x86/kernel/setup.c:1294 start_kernel+0xa5/0x754 init/main.c:530 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:377 x86_64_start_kernel+0x87/0x8a arch/x86/kernel/head64.c:358 verify_cpu+0x0/0xfb -> #2 (cpu_hotplug_lock.rw_sem){++++}: check_prevs_add kernel/locking/lockdep.c:2020 [inline] validate_chain kernel/locking/lockdep.c:2469 [inline] __lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:35 [inline] percpu_down_read include/linux/percpu-rwsem.h:58 [inline] cpus_read_lock+0x42/0x90 kernel/cpu.c:218 static_key_slow_inc+0x9d/0x3c0 kernel/jump_label.c:123 tracepoint_add_func kernel/tracepoint.c:223 [inline] tracepoint_probe_register_prio+0x80d/0x9a0 kernel/tracepoint.c:283 tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304 trace_event_reg+0x167/0x320 kernel/trace/trace_events.c:305 perf_trace_event_reg kernel/trace/trace_event_perf.c:122 [inline] perf_trace_event_init kernel/trace/trace_event_perf.c:197 [inline] perf_trace_init+0x4f9/0xab0 kernel/trace/trace_event_perf.c:221 perf_tp_event_init+0x7d/0xf0 kernel/events/core.c:8037 perf_try_init_event+0xc9/0x1f0 kernel/events/core.c:9261 perf_init_event kernel/events/core.c:9299 [inline] perf_event_alloc+0x1c5b/0x2a00 kernel/events/core.c:9558 SYSC_perf_event_open+0x84e/0x2e00 kernel/events/core.c:10013 SyS_perf_event_open+0x39/0x50 kernel/events/core.c:9899 entry_SYSCALL_64_fastpath+0x1f/0xbe -> #1 (tracepoints_mutex){+.+.}: check_prevs_add kernel/locking/lockdep.c:2020 [inline] validate_chain kernel/locking/lockdep.c:2469 [inline] __lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 tracepoint_probe_register_prio+0xa0/0x9a0 kernel/tracepoint.c:279 tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304 trace_event_reg+0x167/0x320 kernel/trace/trace_events.c:305 perf_trace_event_reg kernel/trace/trace_event_perf.c:122 [inline] perf_trace_event_init kernel/trace/trace_event_perf.c:197 [inline] perf_trace_init+0x4f9/0xab0 kernel/trace/trace_event_perf.c:221 perf_tp_event_init+0x7d/0xf0 kernel/events/core.c:8037 perf_try_init_event+0xc9/0x1f0 kernel/events/core.c:9261 perf_init_event kernel/events/core.c:9299 [inline] perf_event_alloc+0x1c5b/0x2a00 kernel/events/core.c:9558 SYSC_perf_event_open+0x84e/0x2e00 kernel/events/core.c:10013 SyS_perf_event_open+0x39/0x50 kernel/events/core.c:9899 entry_SYSCALL_64_fastpath+0x1f/0xbe -> #0 (event_mutex){+.+.}: check_prev_add+0x865/0x1520 kernel/locking/lockdep.c:1894 check_prevs_add kernel/locking/lockdep.c:2020 [inline] validate_chain kernel/locking/lockdep.c:2469 [inline] __lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 ftrace_profile_set_filter+0x7a/0x270 kernel/trace/trace_events_filter.c:2266 perf_event_set_filter kernel/events/core.c:8622 [inline] _perf_ioctl kernel/events/core.c:4785 [inline] perf_ioctl+0x1026/0x1360 kernel/events/core.c:4822 vfs_ioctl fs/ioctl.c:45 [inline] do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685 SYSC_ioctl fs/ioctl.c:700 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691 entry_SYSCALL_64_fastpath+0x1f/0xbe other info that might help us debug this: Chain exists of: event_mutex --> &pipe->mutex/1 --> &ctx->mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ctx->mutex); lock(&pipe->mutex/1); lock(&ctx->mutex); lock(event_mutex); *** DEADLOCK *** 1 lock held by syz-executor2/3999: #0: (&ctx->mutex){+.+.}, at: [] perf_event_ctx_lock_nested+0x1dc/0x3c0 kernel/events/core.c:1210 stack backtrace: CPU: 1 PID: 3999 Comm: syz-executor2 Not tainted 4.13.0-mm1+ #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 print_circular_bug+0x503/0x710 kernel/locking/lockdep.c:1259 check_prev_add+0x865/0x1520 kernel/locking/lockdep.c:1894 check_prevs_add kernel/locking/lockdep.c:2020 [inline] validate_chain kernel/locking/lockdep.c:2469 [inline] __lock_acquire+0x328f/0x4620 kernel/locking/lockdep.c:3498 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4002 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1870 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 ftrace_profile_set_filter+0x7a/0x270 kernel/trace/trace_events_filter.c:2266 perf_event_set_filter kernel/events/core.c:8622 [inline] _perf_ioctl kernel/events/core.c:4785 [inline] perf_ioctl+0x1026/0x1360 kernel/events/core.c:4822 vfs_ioctl fs/ioctl.c:45 [inline] do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685 SYSC_ioctl fs/ioctl.c:700 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x451e59 RSP: 002b:00007f92997edc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59 RDX: 0000000020368fc0 RSI: 0000000040082406 RDI: 0000000000000006 RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000 R13: 0000000000a6f7ef R14: 00007f92997ee9c0 R15: 0000000000000000 *** Guest State *** CR0: actual=0x0000000080000031, shadow=0x0000000060000010, gh_mask=fffffffffffffff7 CR4: actual=0x0000000000002051, shadow=0x0000000000000000, gh_mask=ffffffffffffe871 CR3 = 0x00000000fffbc000 RSP = 0x000000000000fffa RIP = 0x0000000000000000 RFLAGS=0x00023000 DR7 = 0x0000000000000400 Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 CS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 DS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 SS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 ES: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 FS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 GS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 GDTR: limit=0x0000ffff, base=0x0000000000000000 LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000 IDTR: limit=0x0000ffff, base=0x0000000000000000 TR: sel=0x0000, attr=0x0008b, limit=0x00002088, base=0x0000000000000000 EFER = 0x0000000000000000 PAT = 0x0007040600070406 DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 Interruptibility = 00000000 ActivityState = 00000000 *** Host State *** RIP = 0xffffffff811b8c6f RSP = 0xffff8801c807f4c8 CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 FSBase=00007fae80c86700 GSBase=ffff8801db300000 TRBase=ffff8801db323100 GDTBase=ffffffffff576000 IDTBase=ffffffffff57b000 CR0=0000000080050033 CR3=00000001c4a04000 CR4=00000000001426e0 Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff84d41eb0 EFER = 0x0000000000000d01 PAT = 0x0000000000000000 *** Control State *** PinBased=0000003f CPUBased=b6a1edfa SecondaryExec=00000043 EntryControls=0000d1ff ExitControls=0023efff ExceptionBitmap=ffffbfff PFECmask=00000000 PFECmatch=00000000 VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 reason=80000021 qualification=0000000000000000 IDTVectoring: info=00000000 errcode=00000000 TSC Offset = 0xffffffe675408abf TPR Threshold = 0x00 EPT pointer = 0x00000001cacd801e QAT: Invalid ioctl audit: type=1326 audit(1504712915.573:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=4000 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x451e59 code=0xffff0000 RSP = 0x000000000000fffa RIP = 0x0000000000000000 RFLAGS=0x00023000 DR7 = 0x0000000000000400 Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 CS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 DS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 SS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 ES: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 FS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 GS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 GDTR: limit=0x0000ffff, base=0x0000000000000000 LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000 IDTR: limit=0x0000ffff, base=0x0000000000000000 TR: sel=0x0000, attr=0x0008b, limit=0x00002088, base=0x0000000000000000 EFER = 0x0000000000000000 PAT = 0x0007040600070406 DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 Interruptibility = 00000000 ActivityState = 00000000 *** Host State *** RIP = 0xffffffff811b8c6f RSP = 0xffff8801c46074c8 CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 FSBase=00007fae80d0f700 GSBase=ffff8801db200000 TRBase=ffff8801db223100 GDTBase=ffffffffff577000 IDTBase=ffffffffff57b000 CR0=0000000080050033 CR3=00000001c4a04000 CR4=00000000001426f0 Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff84d41eb0 EFER = 0x0000000000000d01 PAT = 0x0000000000000000 *** Control State *** PinBased=0000003f CPUBased=b6a1edfa SecondaryExec=00000043 EntryControls=0000d1ff ExitControls=0023efff ExceptionBitmap=ffffbfff PFECmask=00000000 PFECmatch=00000000 VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 reason=80000021 qualification=0000000000000000 IDTVectoring: info=00000000 errcode=00000000 TSC Offset = 0xffffffe68daa64fc TPR Threshold = 0x00 EPT pointer = 0x00000001c419e01e device lo left promiscuous mode TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending cookies. Check SNMP counters. device lo entered promiscuous mode TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending cookies. Check SNMP counters. device lo left promiscuous mode TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending cookies. Check SNMP counters. TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending cookies. Check SNMP counters. TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending cookies. Check SNMP counters. sctp: [Deprecated]: syz-executor7 (pid 4203) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606 sclass=netlink_route_socket pig=4207 comm=syz-executor3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606 sclass=netlink_route_socket pig=4200 comm=syz-executor3 TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending cookies. Check SNMP counters. sctp: [Deprecated]: syz-executor7 (pid 4203) Use of int in maxseg socket option. Use struct sctp_assoc_value instead SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606 sclass=netlink_route_socket pig=4235 comm=syz-executor3 netlink: 6 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 6 bytes leftover after parsing attributes in process `syz-executor2'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14606 sclass=netlink_route_socket pig=4248 comm=syz-executor3 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=29 sclass=netlink_tcpdiag_socket pig=4258 comm=syz-executor7 audit: type=1326 audit(1504712918.242:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=4267 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x451e59 code=0xffff0000 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=29 sclass=netlink_tcpdiag_socket pig=4275 comm=syz-executor7 audit: type=1326 audit(1504712918.318:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=4267 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x451e59 code=0xffff0000 TCP: request_sock_TCP: Possible SYN flooding on port 20012. Sending cookies. Check SNMP counters. audit: type=1326 audit(1504712919.273:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=4489 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x451e59 code=0xffff0000 audit: type=1326 audit(1504712919.346:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=4489 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x451e59 code=0xffff0000 netlink: 5 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor3'. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 1 PID: 4619 Comm: syz-executor6 Not tainted 4.13.0-mm1+ #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:31 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3383 [inline] __do_kmalloc mm/slab.c:3723 [inline] __kmalloc_track_caller+0x5f/0x760 mm/slab.c:3740 memdup_user+0x2c/0x90 mm/util.c:164 map_delete_elem kernel/bpf/syscall.c:623 [inline] SYSC_bpf kernel/bpf/syscall.c:1471 [inline] SyS_bpf+0x2186/0x4c50 kernel/bpf/syscall.c:1443 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x451e59 RSP: 002b:00007f10aa7a1c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59 RDX: 0000000000000010 RSI: 000000002096d000 RDI: 0000000000000003 RBP: 00007f10aa7a1a10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b69f7 R13: 00007f10aa7a1b48 R14: 00000000004b6a07 R15: 0000000000000000 TCP: request_sock_TCPv6: Possible SYN flooding on port 20009. Sending cookies. Check SNMP counters. netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. 9pnet_virtio: no channels available for device ./bus netlink: 1 bytes leftover after parsing attributes in process `syz-executor3'. 9pnet_virtio: no channels available for device ./bus netlink: 1 bytes leftover after parsing attributes in process `syz-executor3'. sock: process `syz-executor3' is using obsolete getsockopt SO_BSDCOMPAT syz-executor2 (4872) used greatest stack depth: 14904 bytes left rfkill: input handler disabled rfkill: input handler enabled TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending cookies. Check SNMP counters. TCP: request_sock_TCPv6: Possible SYN flooding on port 20017. Sending cookies. Check SNMP counters. do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app FAULT_INJECTION: forcing a failure. name fail_page_alloc, interval 1, probability 0, space 0, times 1 CPU: 0 PID: 5176 Comm: syz-executor1 Not tainted 4.13.0-mm1+ #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_fail_alloc_page mm/page_alloc.c:2915 [inline] prepare_alloc_pages mm/page_alloc.c:4151 [inline] __alloc_pages_nodemask+0x338/0xd80 mm/page_alloc.c:4187 alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2035 alloc_pages include/linux/gfp.h:505 [inline] skb_page_frag_refill+0x358/0x5f0 net/core/sock.c:2196 tun_build_skb.isra.42+0x13f/0x1450 drivers/net/tun.c:1283 tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441 tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565 call_write_iter include/linux/fs.h:1744 [inline] new_sync_write fs/read_write.c:457 [inline] __vfs_write+0x68a/0x970 fs/read_write.c:470 vfs_write+0x18f/0x510 fs/read_write.c:518 SYSC_write fs/read_write.c:565 [inline] SyS_write+0xef/0x220 fs/read_write.c:557 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x40c2c1 RSP: 002b:00007f845a55fc10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1 RDX: 0000000000000036 RSI: 0000000020002000 RDI: 0000000000000015 RBP: 00007f845a55fa10 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7 R13: 00007f845a55fb48 R14: 00000000004b6a07 R15: 0000000000000000 xprt_adjust_timeout: rq_timeout = 0! xprt_adjust_timeout: rq_timeout = 0! sctp: [Deprecated]: syz-executor7 (pid 5276) Use of int in maxseg socket option. Use struct sctp_assoc_value instead FAULT_INJECTION: forcing a failure. name fail_page_alloc, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 5307 Comm: syz-executor4 Not tainted 4.13.0-mm1+ #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_fail_alloc_page mm/page_alloc.c:2915 [inline] prepare_alloc_pages mm/page_alloc.c:4151 [inline] __alloc_pages_nodemask+0x338/0xd80 mm/page_alloc.c:4187 alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2035 alloc_pages include/linux/gfp.h:505 [inline] skb_page_frag_refill+0x358/0x5f0 net/core/sock.c:2196 tun_build_skb.isra.42+0x13f/0x1450 drivers/net/tun.c:1283 tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441 tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565 call_write_iter include/linux/fs.h:1744 [inline] new_sync_write fs/read_write.c:457 [inline] __vfs_write+0x68a/0x970 fs/read_write.c:470 vfs_write+0x18f/0x510 fs/read_write.c:518 SYSC_write fs/read_write.c:565 [inline] SyS_write+0xef/0x220 fs/read_write.c:557 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x40c2c1 RSP: 002b:00007fae80d0ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1 RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015 RBP: 00007fae80d0ea10 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7 R13: 00007fae80d0eb48 R14: 00000000004b6a07 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 5319 Comm: syz-executor4 Not tainted 4.13.0-mm1+ #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:31 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3559 __build_skb+0x9d/0x450 net/core/skbuff.c:284 build_skb+0x6f/0x260 net/core/skbuff.c:316 tun_build_skb.isra.42+0x692/0x1450 drivers/net/tun.c:1336 tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441 tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565 call_write_iter include/linux/fs.h:1744 [inline] new_sync_write fs/read_write.c:457 [inline] __vfs_write+0x68a/0x970 fs/read_write.c:470 vfs_write+0x18f/0x510 fs/read_write.c:518 SYSC_write fs/read_write.c:565 [inline] SyS_write+0xef/0x220 fs/read_write.c:557 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x40c2c1 RSP: 002b:00007fae80d0ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1 RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015 RBP: 00007fae80d0ea10 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7 R13: 00007fae80d0eb48 R14: 00000000004b6a07 R15: 0000000000000000 sctp: [Deprecated]: syz-executor7 (pid 5325) Use of int in maxseg socket option. Use struct sctp_assoc_value instead FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 5337 Comm: syz-executor4 Not tainted 4.13.0-mm1+ #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:31 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3559 reqsk_alloc include/net/request_sock.h:88 [inline] inet_reqsk_alloc+0xad/0x570 net/ipv4/tcp_input.c:6192 tcp_conn_request+0x657/0x3410 net/ipv4/tcp_input.c:6291 tcp_v6_conn_request+0x212/0x270 net/ipv6/tcp_ipv6.c:1015 tcp_rcv_state_process+0x8ff/0x4d10 net/ipv4/tcp_input.c:5878 tcp_v6_do_rcv+0x739/0x11b0 net/ipv6/tcp_ipv6.c:1325 tcp_v6_rcv+0x1f92/0x27f0 net/ipv6/tcp_ipv6.c:1502 ip6_input_finish+0x36f/0x16d0 net/ipv6/ip6_input.c:284 NF_HOOK include/linux/netfilter.h:249 [inline] ip6_input+0xe9/0x560 net/ipv6/ip6_input.c:327 dst_input include/net/dst.h:478 [inline] ip6_rcv_finish+0x1a9/0x7a0 net/ipv6/ip6_input.c:71 NF_HOOK include/linux/netfilter.h:249 [inline] ipv6_rcv+0xff0/0x2190 net/ipv6/ip6_input.c:208 __netif_receive_skb_core+0x19af/0x33d0 net/core/dev.c:4418 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4456 netif_receive_skb_internal+0x10b/0x5e0 net/core/dev.c:4527 netif_receive_skb+0xae/0x390 net/core/dev.c:4551 tun_rx_batched.isra.43+0x5ed/0x860 drivers/net/tun.c:1218 tun_get_user+0x11dd/0x2150 drivers/net/tun.c:1539 tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565 call_write_iter include/linux/fs.h:1744 [inline] new_sync_write fs/read_write.c:457 [inline] __vfs_write+0x68a/0x970 fs/read_write.c:470 vfs_write+0x18f/0x510 fs/read_write.c:518 SYSC_write fs/read_write.c:565 [inline] SyS_write+0xef/0x220 fs/read_write.c:557 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x40c2c1 RSP: 002b:00007fae80d0ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1 RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015 RBP: 00007fae80d0ea10 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7 R13: 00007fae80d0eb48 R14: 00000000004b6a07 R15: 0000000000000000 TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending cookies. Check SNMP counters. TCP: tcp_parse_options: Illegal window scaling value 64 > 14 received netlink: 5 bytes leftover after parsing attributes in process `syz-executor3'. TCP: tcp_parse_options: Illegal window scaling value 64 > 14 received netlink: 5 bytes leftover after parsing attributes in process `syz-executor3'. FAULT_INJECTION: forcing a failure. name fail_page_alloc, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 5608 Comm: syz-executor5 Not tainted 4.13.0-mm1+ #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_fail_alloc_page mm/page_alloc.c:2915 [inline] prepare_alloc_pages mm/page_alloc.c:4151 [inline] __alloc_pages_nodemask+0x338/0xd80 mm/page_alloc.c:4187 alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2035 alloc_pages include/linux/gfp.h:505 [inline] skb_page_frag_refill+0x358/0x5f0 net/core/sock.c:2196 tun_build_skb.isra.42+0x13f/0x1450 drivers/net/tun.c:1283 tun_get_user+0x1daf/0x2150 drivers/net/tun.c:1441 tun_chr_write_iter+0xde/0x190 drivers/net/tun.c:1565 call_write_iter include/linux/fs.h:1744 [inline] new_sync_write fs/read_write.c:457 [inline] __vfs_write+0x68a/0x970 fs/read_write.c:470 vfs_write+0x18f/0x510 fs/read_write.c:518 SYSC_write fs/read_write.c:565 [inline] SyS_write+0xef/0x220 fs/read_write.c:557 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x40c2c1 RSP: 002b:00007fc6afc91c10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000040c2c1 RDX: 000000000000004a RSI: 0000000020d85f9e RDI: 0000000000000015 RBP: 00007fc6afc91a10 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000f4240 R11: 0000000000000293 R12: 00000000004b69f7 R13: 00007fc6afc91b48 R14: 00000000004b6a07 R15: 0000000000000000 TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending cookies. Check SNMP counters. TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending cookies. Check SNMP counters. TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending cookies. Check SNMP counters. TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending cookies. Check SNMP counters. TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending cookies. Check SNMP counters. TCP: request_sock_TCPv6: Possible SYN flooding on port 20029. Sending cookies. Check SNMP counters. TCP: request_sock_TCPv6: Possible SYN flooding on port 20017. Sending cookies. Check SNMP counters. TCP: request_sock_TCPv6: Possible SYN flooding on port 20021. Sending cookies. Check SNMP counters.