lowmemorykiller: Killing 'syz-executor.1' (3351) (tgid 3351), adj 1000, to free 52464kB on behalf of 'syz-executor.0' (27055) because cache 65456kB is below limit 65536kB for oom_score_adj 12 Free memory is -15128kB above reserved ================================= [ INFO: inconsistent lock state ] 4.9.194+ #0 Not tainted --------------------------------- inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-R} usage. syz-executor.0/27055 [HC0[0]:SC0[0]:HE1:SE1] takes: (&mm->mmap_sem){+++++?}, at: [<000000004339e4d3>] get_cmdline+0xa3/0x2d0 mm/util.c:641 mark_held_locks+0xb1/0x100 kernel/locking/lockdep.c:2660 __lockdep_trace_alloc kernel/locking/lockdep.c:2882 [inline] lockdep_trace_alloc+0x18c/0x2b0 kernel/locking/lockdep.c:2897 __alloc_pages_nodemask+0x143/0x1a80 mm/page_alloc.c:3803 __alloc_pages include/linux/gfp.h:433 [inline] __alloc_pages_node include/linux/gfp.h:446 [inline] alloc_pages_node include/linux/gfp.h:460 [inline] pmd_alloc_one arch/x86/include/asm/pgalloc.h:88 [inline] __pmd_alloc+0x4a/0x330 mm/memory.c:3742 pmd_alloc include/linux/mm.h:1625 [inline] alloc_new_pmd mm/mremap.c:64 [inline] move_page_tables+0xadb/0xd60 mm/mremap.c:212 shift_arg_pages+0x1ae/0x470 fs/exec.c:642 setup_arg_pages+0x60d/0x7c0 fs/exec.c:754 load_elf_binary+0xa84/0x4a90 fs/binfmt_elf.c:860 search_binary_handler fs/exec.c:1621 [inline] search_binary_handler+0x14f/0x700 fs/exec.c:1599 exec_binprm fs/exec.c:1663 [inline] do_execveat_common.isra.0+0xf81/0x1db0 fs/exec.c:1785 do_execve+0x3a/0x50 fs/exec.c:1829 run_init_process+0x33/0x37 init/main.c:904 try_to_run_init_process+0x18/0x48 init/main.c:913 kernel_init+0xf2/0x163 init/main.c:984 ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375 irq event stamp: 91437 hardirqs last enabled at (91437): [<00000000c6ae7252>] vprintk_emit+0x25c/0x6f0 kernel/printk/printk.c:1897 hardirqs last disabled at (91436): [<000000008b74c1bf>] vprintk_emit+0x6d/0x6f0 kernel/printk/printk.c:1801 softirqs last enabled at (91428): [<00000000dfc321c4>] __do_softirq+0x474/0x964 kernel/softirq.c:314 softirqs last disabled at (91401): [<000000008c6ee1d8>] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (91401): [<000000008c6ee1d8>] irq_exit+0x119/0x160 kernel/softirq.c:409 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&mm->mmap_sem); lock(&mm->mmap_sem); *** DEADLOCK *** 3 locks held by syz-executor.0/27055: #0: (&pipe->mutex/1){+.+.+.}, at: [<00000000283d8887>] pipe_lock_nested fs/pipe.c:66 [inline] #0: (&pipe->mutex/1){+.+.+.}, at: [<00000000283d8887>] pipe_lock fs/pipe.c:74 [inline] #0: (&pipe->mutex/1){+.+.+.}, at: [<00000000283d8887>] pipe_wait+0x1b8/0x1e0 fs/pipe.c:122 #1: (&mm->mmap_sem){+++++?}, at: [<0000000066508ff3>] __do_page_fault+0x25e/0xa60 arch/x86/mm/fault.c:1330 #2: (shrinker_rwsem){++++..}, at: [<0000000090841372>] shrink_slab.part.0+0xb2/0xa20 mm/vmscan.c:472 stack backtrace: CPU: 1 PID: 27055 Comm: syz-executor.0 Not tainted 4.9.194+ #0 ffff880195b4eb60 ffffffff81b67001 00000000000000f0 ffff8800630497c0 ffffffff83cb0990 ffff88006304a108 ffffffff84252000 ffff880195b4ebd8 ffffffff81408710 0000000000000000 ffffffff00000001 0000000000000001 Call Trace: [<000000002f4865c6>] __dump_stack lib/dump_stack.c:15 [inline] [<000000002f4865c6>] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [<00000000341cb673>] print_usage_bug kernel/locking/lockdep.c:2387 [inline] [<00000000341cb673>] print_usage_bug.cold+0x452/0x5a2 kernel/locking/lockdep.c:2354 [<0000000083126d34>] valid_state kernel/locking/lockdep.c:2400 [inline] [<0000000083126d34>] mark_lock_irq kernel/locking/lockdep.c:2602 [inline] [<0000000083126d34>] mark_lock+0x6c7/0x12e0 kernel/locking/lockdep.c:3065 [<00000000eda757ed>] mark_irqflags kernel/locking/lockdep.c:2958 [inline] [<00000000eda757ed>] __lock_acquire+0x5be/0x4390 kernel/locking/lockdep.c:3302 [<00000000eba5a036>] lock_acquire+0x133/0x3d0 kernel/locking/lockdep.c:3756 [<0000000040630c67>] down_read+0x44/0xb0 kernel/locking/rwsem.c:22 [<000000004339e4d3>] get_cmdline+0xa3/0x2d0 mm/util.c:641 [<0000000037444201>] handle_lmk_event+0x169/0x920 drivers/staging/android/lowmemorykiller.c:116 [<00000000036c769e>] lowmem_scan+0x6f3/0xb70 drivers/staging/android/lowmemorykiller.c:354 [<000000007b2b22cc>] do_shrink_slab mm/vmscan.c:399 [inline] [<000000007b2b22cc>] shrink_slab.part.0+0x3cf/0xa20 mm/vmscan.c:502 [<000000001b987c9d>] shrink_slab mm/vmscan.c:466 [inline] [<000000001b987c9d>] shrink_node+0x1ed/0x750 mm/vmscan.c:2604 [<000000002d98842a>] shrink_zones mm/vmscan.c:2751 [inline] [<000000002d98842a>] do_try_to_free_pages mm/vmscan.c:2793 [inline] [<000000002d98842a>] try_to_free_pages+0x397/0xbd0 mm/vmscan.c:3004 [<000000009d0aaf49>] __perform_reclaim mm/page_alloc.c:3332 [inline] [<000000009d0aaf49>] __alloc_pages_direct_reclaim mm/page_alloc.c:3354 [inline] [<000000009d0aaf49>] __alloc_pages_slowpath mm/page_alloc.c:3704 [inline] [<000000009d0aaf49>] __alloc_pages_nodemask+0x930/0x1a80 mm/page_alloc.c:3861 [<000000003aff204c>] __alloc_pages include/linux/gfp.h:433 [inline] [<000000003aff204c>] __alloc_pages_node include/linux/gfp.h:446 [inline] [<000000003aff204c>] alloc_pages_node include/linux/gfp.h:460 [inline] [<000000003aff204c>] alloc_zeroed_user_highpage_movable include/linux/highmem.h:183 [inline] [<000000003aff204c>] wp_page_copy+0xb9e/0x1470 mm/memory.c:2165 [<000000000fe95c3f>] do_wp_page+0x546/0x20a0 mm/memory.c:2390 [<000000001d611143>] handle_pte_fault mm/memory.c:3562 [inline] [<000000001d611143>] __handle_mm_fault mm/memory.c:3634 [inline] [<000000001d611143>] handle_mm_fault+0xeff/0x2420 mm/memory.c:3671 [<00000000ee12bf89>] __do_page_fault+0x3f0/0xa60 arch/x86/mm/fault.c:1401 [<000000005a507b08>] do_page_fault+0x28/0x30 arch/x86/mm/fault.c:1464 [<00000000c1541512>] page_fault+0x25/0x30 arch/x86/entry/entry_64.S:956 [<00000000ad591770>] pipe_to_user+0xb0/0x160 fs/splice.c:1256 [<0000000084d22de4>] splice_from_pipe_feed fs/splice.c:521 [inline] [<0000000084d22de4>] __splice_from_pipe+0x351/0x790 fs/splice.c:645 [<00000000d153d238>] vmsplice_to_user+0x1bd/0x1e0 fs/splice.c:1291 [<000000007559eb2c>] SYSC_vmsplice fs/splice.c:1370 [inline] [<000000007559eb2c>] SyS_vmsplice+0x114/0x140 fs/splice.c:1353 [<000000003a224855>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288 [<000000001ee62b32>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb lowmemorykiller: Killing 'syz-executor.1' (18116) (tgid 18116), adj 1000, to free 52460kB on behalf of 'kswapd0' (33) because cache 65240kB is below limit 65536kB for oom_score_adj 12 Free memory is 16420kB above reserved lowmemorykiller: Killing 'syz-executor.5' (12784) (tgid 12784), adj 1000, to free 52464kB on behalf of 'udevd' (31240) because cache 64996kB is below limit 65536kB for oom_score_adj 12 Free memory is 33328kB above reserved lowmemorykiller: Killing 'syz-executor.0' (9448) (tgid 9448), adj 1000, to free 52456kB on behalf of 'udevd' (31240) because cache 64996kB is below limit 65536kB for oom_score_adj 12 Free memory is 58428kB above reserved lowmemorykiller: Killing 'syz-executor.3' (11368) (tgid 11368), adj 1000, to free 52456kB on behalf of 'syz-executor.4' (27144) because cache 64600kB is below limit 65536kB for oom_score_adj 12 Free memory is -11808kB above reserved lowmemorykiller: Killing 'syz-executor.3' (2293) (tgid 2293), adj 1000, to free 52452kB on behalf of 'syz-executor.0' (27135) because cache 64300kB is below limit 65536kB for oom_score_adj 12 Free memory is -11808kB above reserved lowmemorykiller: Killing 'syz-executor.3' (2293) (tgid 2293), adj 1000, to free 52452kB on behalf of 'kswapd0' (33) because cache 64500kB is below limit 65536kB for oom_score_adj 12 Free memory is -11808kB above reserved lowmemorykiller: Killing 'syz-executor.0' (20936) (tgid 20936), adj 1000, to free 52452kB on behalf of 'syz-executor.0' (27135) because cache 64200kB is below limit 65536kB for oom_score_adj 12 Free memory is -11808kB above reserved lowmemorykiller: Killing 'syz-executor.3' (2293) (tgid 2293), adj 1000, to free 52452kB on behalf of 'syz-executor.3' (27136) because cache 64200kB is below limit 65536kB for oom_score_adj 12 Free memory is -11808kB above reserved lowmemorykiller: Killing 'syz-executor.2' (2821) (tgid 2821), adj 1000, to free 52448kB on behalf of 'syz-executor.3' (27136) because cache 63900kB is below limit 65536kB for oom_score_adj 12 Free memory is 5612kB above reserved lowmemorykiller: Killing 'syz-executor.2' (2821) (tgid 2821), adj 1000, to free 52448kB on behalf of 'kswapd0' (33) because cache 64100kB is below limit 65536kB for oom_score_adj 12 Free memory is -11808kB above reserved lowmemorykiller: Killing 'syz-executor.5' (14211) (tgid 14211), adj 1000, to free 52448kB on behalf of 'kswapd0' (33) because cache 63700kB is below limit 65536kB for oom_score_adj 12 Free memory is 5812kB above reserved lowmemorykiller: Killing 'syz-executor.5' (14161) (tgid 14161), adj 1000, to free 52448kB on behalf of 'syz-executor.3' (27136) because cache 63800kB is below limit 65536kB for oom_score_adj 12 Free memory is 5712kB above reserved lowmemorykiller: Killing 'syz-executor.2' (2821) (tgid 2821), adj 1000, to free 52448kB on behalf of 'syz-executor.0' (27135) because cache 64000kB is below limit 65536kB for oom_score_adj 12 Free memory is -1788kB above reserved lowmemorykiller: Killing 'syz-executor.2' (14968) (tgid 14968), adj 1000, to free 52448kB on behalf of 'kswapd0' (33) because cache 63500kB is below limit 65536kB for oom_score_adj 12 Free memory is 50672kB above reserved lowmemorykiller: Killing 'syz-executor.5' (3296) (tgid 3296), adj 1000, to free 52444kB on behalf of 'kswapd0' (33) because cache 63500kB is below limit 65536kB for oom_score_adj 12 Free memory is 55596kB above reserved lowmemorykiller: Killing 'syz-executor.4' (11321) (tgid 11321), adj 1000, to free 52444kB on behalf of 'syz-executor.4' (27144) because cache 63352kB is below limit 65536kB for oom_score_adj 12 Free memory is -136kB above reserved lowmemorykiller: Killing 'syz-executor.4' (12748) (tgid 12748), adj 1000, to free 52444kB on behalf of 'syz-executor.4' (27144) because cache 63372kB is below limit 65536kB for oom_score_adj 12 Free memory is 16672kB above reserved lowmemorykiller: Killing 'syz-executor.2' (13643) (tgid 13643), adj 1000, to free 52444kB on behalf of 'kswapd0' (33) because cache 63352kB is below limit 65536kB for oom_score_adj 12 Free memory is -6508kB above reserved lowmemorykiller: Killing 'syz-executor.2' (14279) (tgid 14279), adj 1000, to free 52444kB on behalf of 'syz-executor.3' (27244) because cache 63352kB is below limit 65536kB for oom_score_adj 12 Free memory is -6632kB above reserved lowmemorykiller: Killing 'syz-executor.5' (17463) (tgid 17463), adj 1000, to free 52444kB on behalf of 'syz-executor.4' (27246) because cache 62952kB is below limit 65536kB for oom_score_adj 12 Free memory is -2264kB above reserved lowmemorykiller: Killing 'syz-executor.5' (17463) (tgid 17463), adj 1000, to free 52444kB on behalf of 'syz-executor.3' (27244) because cache 62952kB is below limit 65536kB for oom_score_adj 12 Free memory is -988kB above reserved lowmemorykiller: Killing 'syz-executor.4' (1502) (tgid 1502), adj 1000, to free 52440kB on behalf of 'syz-executor.4' (27246) because cache 62952kB is below limit 65536kB for oom_score_adj 12 Free memory is 3496kB above reserved lowmemorykiller: Killing 'syz-executor.4' (1502) (tgid 1502), adj 1000, to free 52440kB on behalf of 'syz-executor.3' (27244) because cache 62952kB is below limit 65536kB for oom_score_adj 12 Free memory is 13356kB above reserved lowmemorykiller: Killing 'syz-executor.1' (3423) (tgid 3423), adj 1000, to free 52440kB on behalf of 'syz-executor.4' (27246) because cache 62852kB is below limit 65536kB for oom_score_adj 12 Free memory is 24708kB above reserved lowmemorykiller: Killing 'syz-executor.1' (3423) (tgid 3423), adj 1000, to free 52440kB on behalf of 'syz-executor.3' (27244) because cache 62852kB is below limit 65536kB for oom_score_adj 12 Free memory is 26160kB above reserved lowmemorykiller: Killing 'syz-executor.5' (11228) (tgid 11228), adj 1000, to free 52440kB on behalf of 'syz-executor.4' (27246) because cache 62852kB is below limit 65536kB for oom_score_adj 12 Free memory is 40544kB above reserved lowmemorykiller: Killing 'syz-executor.5' (11228) (tgid 11228), adj 1000, to free 52440kB on behalf of 'syz-executor.3' (27244) because cache 62752kB is below limit 65536kB for oom_score_adj 12 Free memory is 44472kB above reserved lowmemorykiller: Killing 'syz-executor.4' (12859) (tgid 12859), adj 1000, to free 52440kB on behalf of 'syz-executor.4' (27246) because cache 62752kB is below limit 65536kB for oom_score_adj 12 Free memory is 46924kB above reserved lowmemorykiller: Killing 'syz-executor.5' (27325) (tgid 27325), adj 1000, to free 52448kB on behalf of 'kswapd0' (33) because cache 62812kB is below limit 65536kB for oom_score_adj 12 Free memory is -8276kB above reserved lowmemorykiller: Killing 'syz-executor.5' (13532) (tgid 13532), adj 1000, to free 52440kB on behalf of 'syz-executor.3' (27361) because cache 62812kB is below limit 65536kB for oom_score_adj 12 Free memory is -8276kB above reserved lowmemorykiller: Killing 'syz-executor.0' (23749) (tgid 23749), adj 1000, to free 52440kB on behalf of 'syz-executor.0' (27364) because cache 62708kB is below limit 65536kB for oom_score_adj 12 Free memory is -7264kB above reserved lowmemorykiller: Killing 'syz-executor.5' (13532) (tgid 13532), adj 1000, to free 52440kB on behalf of 'syz-executor.4' (27363) because cache 62708kB is below limit 65536kB for oom_score_adj 12 Free memory is -7964kB above reserved lowmemorykiller: Killing 'syz-executor.4' (13553) (tgid 13553), adj 1000, to free 52436kB on behalf of 'syz-executor.0' (27364) because cache 62408kB is below limit 65536kB for oom_score_adj 12 Free memory is 36900kB above reserved lowmemorykiller: Killing 'syz-executor.3' (22238) (tgid 22238), adj 1000, to free 52436kB on behalf of 'syz-executor.0' (27364) because cache 62308kB is below limit 65536kB for oom_score_adj 12 Free memory is 49440kB above reserved lowmemorykiller: Killing 'syz-executor.4' (13553) (tgid 13553), adj 1000, to free 52436kB on behalf of 'syz-executor.4' (27363) because cache 62408kB is below limit 65536kB for oom_score_adj 12 Free memory is 33824kB above reserved lowmemorykiller: Killing 'syz-executor.5' (23813) (tgid 23813), adj 1000, to free 52436kB on behalf of 'syz-executor.0' (27364) because cache 62308kB is below limit 65536kB for oom_score_adj 12 Free memory is 58632kB above reserved lowmemorykiller: Killing 'syz-executor.0' (24562) (tgid 24562), adj 1000, to free 52436kB on behalf of 'kswapd0' (33) because cache 61764kB is below limit 65536kB for oom_score_adj 12 Free memory is 56692kB above reserved