===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 6.9.0-syzkaller-12277-g56fb6f92854f #0 Not tainted ----------------------------------------------------- syz-fuzzer/5086 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: ffffffff8e43bdc0 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: fs_reclaim_acquire+0x93/0x140 mm/page_alloc.c:3800 and this task is already holding: ffff88801a681318 (&pool->lock#5){..-.}-{2:2}, at: mempool_alloc_noprof+0x286/0x5a0 mm/mempool.c:406 which would create a new lock dependency: ( &pool->lock#5){..-.}-{2:2} -> (mmu_notifier_invalidate_range_start){+.+.}-{0:0} but this new dependency connects a SOFTIRQ-irq-safe lock: (&pool->lock#5){..-.}-{2:2} ... which became SOFTIRQ-irq-safe at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 mempool_free+0x115/0x390 mm/mempool.c:539 __read_end_io+0x504/0x580 fs/ext4/readpage.c:77 blk_update_request+0x5e7/0x10d0 block/blk-mq.c:929 scsi_end_request+0x80/0x880 drivers/scsi/scsi_lib.c:631 scsi_io_completion+0x1bd/0x430 drivers/scsi/scsi_lib.c:1068 blk_complete_reqs block/blk-mq.c:1132 [inline] blk_done_softirq+0x100/0x150 block/blk-mq.c:1137 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 rcu_lock_acquire include/linux/rcupdate.h:329 [inline] rcu_read_lock include/linux/rcupdate.h:781 [inline] list_lru_count_one+0x46/0x2e0 mm/list_lru.c:171 list_lru_shrink_count include/linux/list_lru.h:156 [inline] super_cache_count+0x14f/0x2a0 fs/super.c:263 do_shrink_slab+0x86/0x1160 mm/shrinker.c:382 shrink_slab+0x1094/0x14d0 mm/shrinker.c:662 shrink_node_memcgs mm/vmscan.c:5891 [inline] shrink_node+0x10ec/0x2a30 mm/vmscan.c:5924 shrink_zones mm/vmscan.c:6168 [inline] do_try_to_free_pages+0x695/0x1aa0 mm/vmscan.c:6230 try_to_free_pages+0x760/0x1100 mm/vmscan.c:6465 __perform_reclaim mm/page_alloc.c:3859 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:3881 [inline] __alloc_pages_slowpath+0xdc3/0x23d0 mm/page_alloc.c:4287 __alloc_pages_noprof+0x43e/0x6c0 mm/page_alloc.c:4673 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2264 allocate_slab+0x5a/0x2e0 mm/slub.c:2427 new_slab mm/slub.c:2480 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3666 __slab_alloc+0x58/0xa0 mm/slub.c:3756 __slab_alloc_node mm/slub.c:3809 [inline] slab_alloc_node mm/slub.c:3988 [inline] kmem_cache_alloc_noprof+0x1c1/0x2a0 mm/slub.c:4007 mempool_alloc_noprof+0x521/0x5a0 mm/mempool.c:402 bio_alloc_bioset+0x26f/0x1130 block/bio.c:554 bio_alloc include/linux/bio.h:437 [inline] ext4_mpage_readpages+0x1166/0x2140 fs/ext4/readpage.c:353 read_pages+0x17e/0x840 mm/readahead.c:160 page_cache_ra_unbounded+0x188/0x7f0 mm/readahead.c:242 do_sync_mmap_readahead+0x49c/0x970 filemap_fault+0x828/0x1760 mm/filemap.c:3313 __do_fault+0x135/0x460 mm/memory.c:4562 do_read_fault mm/memory.c:4926 [inline] do_fault mm/memory.c:5056 [inline] do_pte_missing mm/memory.c:3903 [inline] handle_pte_fault+0x3d8d/0x7130 mm/memory.c:5380 __handle_mm_fault mm/memory.c:5523 [inline] handle_mm_fault+0xfb0/0x19d0 mm/memory.c:5688 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x459/0x8c0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 to a SOFTIRQ-irq-unsafe lock: ( mmu_notifier_invalidate_range_start){+.+.}-{0:0} ... which became SOFTIRQ-irq-unsafe at: ... lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 fs_reclaim_acquire+0xaf/0x140 mm/page_alloc.c:3800 might_alloc include/linux/sched/mm.h:334 [inline] slab_pre_alloc_hook mm/slub.c:3890 [inline] slab_alloc_node mm/slub.c:3980 [inline] kmalloc_trace_noprof+0x3d/0x2c0 mm/slub.c:4147 kmalloc_noprof include/linux/slab.h:660 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] __kthread_create_worker+0x5c/0x3e0 kernel/kthread.c:865 kthread_create_worker+0xda/0x120 kernel/kthread.c:908 wq_cpu_intensive_thresh_init+0x18/0x160 kernel/workqueue.c:7775 workqueue_init+0x26/0x8a0 kernel/workqueue.c:7824 kernel_init_freeable+0x3fe/0x5d0 init/main.c:1562 kernel_init+0x1d/0x2b0 init/main.c:1467 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(mmu_notifier_invalidate_range_start); local_irq_disable(); lock(&pool->lock#5); lock(mmu_notifier_invalidate_range_start); lock(&pool->lock#5); *** DEADLOCK *** 3 locks held by syz-fuzzer/5086: #0: ffff88807eac85a0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:846 [inline] #0: ffff88807eac85a0 (mapping.invalidate_lock){++++}-{3:3}, at: page_cache_ra_unbounded+0xf7/0x7f0 mm/readahead.c:225 #1: ffffffff8e333e60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #1: ffffffff8e333e60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #1: ffffffff8e333e60 (rcu_read_lock){....}-{1:2}, at: blk_mq_run_hw_queue+0x40c/0xae0 block/blk-mq.c:2250 #2: ffff88801a681318 (&pool->lock#5){..-.}-{2:2}, at: mempool_alloc_noprof+0x286/0x5a0 mm/mempool.c:406 the dependencies between SOFTIRQ-irq-safe lock and the holding lock: -> (&pool->lock#5){..-.}-{2:2} { IN-SOFTIRQ-W at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 mempool_free+0x115/0x390 mm/mempool.c:539 __read_end_io+0x504/0x580 fs/ext4/readpage.c:77 blk_update_request+0x5e7/0x10d0 block/blk-mq.c:929 scsi_end_request+0x80/0x880 drivers/scsi/scsi_lib.c:631 scsi_io_completion+0x1bd/0x430 drivers/scsi/scsi_lib.c:1068 blk_complete_reqs block/blk-mq.c:1132 [inline] blk_done_softirq+0x100/0x150 block/blk-mq.c:1137 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 rcu_lock_acquire include/linux/rcupdate.h:329 [inline] rcu_read_lock include/linux/rcupdate.h:781 [inline] list_lru_count_one+0x46/0x2e0 mm/list_lru.c:171 list_lru_shrink_count include/linux/list_lru.h:156 [inline] super_cache_count+0x14f/0x2a0 fs/super.c:263 do_shrink_slab+0x86/0x1160 mm/shrinker.c:382 shrink_slab+0x1094/0x14d0 mm/shrinker.c:662 shrink_node_memcgs mm/vmscan.c:5891 [inline] shrink_node+0x10ec/0x2a30 mm/vmscan.c:5924 shrink_zones mm/vmscan.c:6168 [inline] do_try_to_free_pages+0x695/0x1aa0 mm/vmscan.c:6230 try_to_free_pages+0x760/0x1100 mm/vmscan.c:6465 __perform_reclaim mm/page_alloc.c:3859 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:3881 [inline] __alloc_pages_slowpath+0xdc3/0x23d0 mm/page_alloc.c:4287 __alloc_pages_noprof+0x43e/0x6c0 mm/page_alloc.c:4673 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2264 allocate_slab+0x5a/0x2e0 mm/slub.c:2427 new_slab mm/slub.c:2480 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3666 __slab_alloc+0x58/0xa0 mm/slub.c:3756 __slab_alloc_node mm/slub.c:3809 [inline] slab_alloc_node mm/slub.c:3988 [inline] kmem_cache_alloc_noprof+0x1c1/0x2a0 mm/slub.c:4007 mempool_alloc_noprof+0x521/0x5a0 mm/mempool.c:402 bio_alloc_bioset+0x26f/0x1130 block/bio.c:554 bio_alloc include/linux/bio.h:437 [inline] ext4_mpage_readpages+0x1166/0x2140 fs/ext4/readpage.c:353 read_pages+0x17e/0x840 mm/readahead.c:160 page_cache_ra_unbounded+0x188/0x7f0 mm/readahead.c:242 do_sync_mmap_readahead+0x49c/0x970 filemap_fault+0x828/0x1760 mm/filemap.c:3313 __do_fault+0x135/0x460 mm/memory.c:4562 do_read_fault mm/memory.c:4926 [inline] do_fault mm/memory.c:5056 [inline] do_pte_missing mm/memory.c:3903 [inline] handle_pte_fault+0x3d8d/0x7130 mm/memory.c:5380 __handle_mm_fault mm/memory.c:5523 [inline] handle_mm_fault+0xfb0/0x19d0 mm/memory.c:5688 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x459/0x8c0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 INITIAL USE at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 mempool_alloc_noprof+0x286/0x5a0 mm/mempool.c:406 bio_alloc_bioset+0x26f/0x1130 block/bio.c:554 bio_alloc include/linux/bio.h:437 [inline] ext4_mpage_readpages+0x1166/0x2140 fs/ext4/readpage.c:353 read_pages+0x17e/0x840 mm/readahead.c:160 page_cache_ra_unbounded+0x188/0x7f0 mm/readahead.c:242 do_sync_mmap_readahead+0x49c/0x970 filemap_fault+0x828/0x1760 mm/filemap.c:3313 __do_fault+0x135/0x460 mm/memory.c:4562 do_read_fault mm/memory.c:4926 [inline] do_fault mm/memory.c:5056 [inline] do_pte_missing mm/memory.c:3903 [inline] handle_pte_fault+0x3d8d/0x7130 mm/memory.c:5380 __handle_mm_fault mm/memory.c:5523 [inline] handle_mm_fault+0xfb0/0x19d0 mm/memory.c:5688 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x459/0x8c0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 } ... key at: [] mempool_init_node.__key+0x0/0x20 the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: -> (mmu_notifier_invalidate_range_start){+.+.}-{0:0} { HARDIRQ-ON-W at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 fs_reclaim_acquire+0xaf/0x140 mm/page_alloc.c:3800 might_alloc include/linux/sched/mm.h:334 [inline] slab_pre_alloc_hook mm/slub.c:3890 [inline] slab_alloc_node mm/slub.c:3980 [inline] kmalloc_trace_noprof+0x3d/0x2c0 mm/slub.c:4147 kmalloc_noprof include/linux/slab.h:660 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] __kthread_create_worker+0x5c/0x3e0 kernel/kthread.c:865 kthread_create_worker+0xda/0x120 kernel/kthread.c:908 wq_cpu_intensive_thresh_init+0x18/0x160 kernel/workqueue.c:7775 workqueue_init+0x26/0x8a0 kernel/workqueue.c:7824 kernel_init_freeable+0x3fe/0x5d0 init/main.c:1562 kernel_init+0x1d/0x2b0 init/main.c:1467 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 SOFTIRQ-ON-W at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 fs_reclaim_acquire+0xaf/0x140 mm/page_alloc.c:3800 might_alloc include/linux/sched/mm.h:334 [inline] slab_pre_alloc_hook mm/slub.c:3890 [inline] slab_alloc_node mm/slub.c:3980 [inline] kmalloc_trace_noprof+0x3d/0x2c0 mm/slub.c:4147 kmalloc_noprof include/linux/slab.h:660 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] __kthread_create_worker+0x5c/0x3e0 kernel/kthread.c:865 kthread_create_worker+0xda/0x120 kernel/kthread.c:908 wq_cpu_intensive_thresh_init+0x18/0x160 kernel/workqueue.c:7775 workqueue_init+0x26/0x8a0 kernel/workqueue.c:7824 kernel_init_freeable+0x3fe/0x5d0 init/main.c:1562 kernel_init+0x1d/0x2b0 init/main.c:1467 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INITIAL USE at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 fs_reclaim_acquire+0xaf/0x140 mm/page_alloc.c:3800 might_alloc include/linux/sched/mm.h:334 [inline] slab_pre_alloc_hook mm/slub.c:3890 [inline] slab_alloc_node mm/slub.c:3980 [inline] kmalloc_trace_noprof+0x3d/0x2c0 mm/slub.c:4147 kmalloc_noprof include/linux/slab.h:660 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] __kthread_create_worker+0x5c/0x3e0 kernel/kthread.c:865 kthread_create_worker+0xda/0x120 kernel/kthread.c:908 wq_cpu_intensive_thresh_init+0x18/0x160 kernel/workqueue.c:7775 workqueue_init+0x26/0x8a0 kernel/workqueue.c:7824 kernel_init_freeable+0x3fe/0x5d0 init/main.c:1562 kernel_init+0x1d/0x2b0 init/main.c:1467 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 } ... key at: [] __mmu_notifier_invalidate_range_start_map+0x0/0x40 ... acquired at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 fs_reclaim_acquire+0xaf/0x140 mm/page_alloc.c:3800 might_alloc include/linux/sched/mm.h:334 [inline] prepare_alloc_pages+0x147/0x5d0 mm/page_alloc.c:4431 __alloc_pages_noprof+0x166/0x6c0 mm/page_alloc.c:4649 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 stack_depot_save_flags+0x666/0x830 lib/stackdepot.c:627 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_save_track+0x51/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_mempool_unpoison_object+0xa0/0x170 mm/kasan/common.c:535 remove_element+0x129/0x1a0 mm/mempool.c:150 mempool_alloc_noprof+0x54e/0x5a0 mm/mempool.c:408 __sg_alloc_table+0xcc/0x3c0 lib/scatterlist.c:321 sg_alloc_table_chained+0xe6/0x1c0 lib/sg_pool.c:133 scsi_alloc_sgtables+0x290/0xcb0 drivers/scsi/scsi_lib.c:1133 sd_setup_read_write_cmnd drivers/scsi/sd.c:1227 [inline] sd_init_command+0x531/0x2100 drivers/scsi/sd.c:1345 scsi_prepare_cmd drivers/scsi/scsi_lib.c:1698 [inline] scsi_queue_rq+0x18cd/0x2f70 drivers/scsi/scsi_lib.c:1832 blk_mq_dispatch_rq_list+0xb89/0x1b30 block/blk-mq.c:2037 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline] __blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309 blk_mq_sched_dispatch_requests+0xcb/0x140 block/blk-mq-sched.c:331 blk_mq_run_hw_queue+0x9a5/0xae0 block/blk-mq.c:2250 blk_mq_flush_plug_list+0x1115/0x1880 block/blk-mq.c:2799 __blk_flush_plug+0x420/0x500 block/blk-core.c:1194 blk_finish_plug+0x5e/0x80 block/blk-core.c:1221 read_pages+0x644/0x840 mm/readahead.c:183 page_cache_ra_unbounded+0x6ce/0x7f0 mm/readahead.c:273 do_sync_mmap_readahead+0x49c/0x970 filemap_fault+0x828/0x1760 mm/filemap.c:3313 __do_fault+0x135/0x460 mm/memory.c:4562 do_read_fault mm/memory.c:4926 [inline] do_fault mm/memory.c:5056 [inline] do_pte_missing mm/memory.c:3903 [inline] handle_pte_fault+0x3d8d/0x7130 mm/memory.c:5380 __handle_mm_fault mm/memory.c:5523 [inline] handle_mm_fault+0xfb0/0x19d0 mm/memory.c:5688 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x459/0x8c0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 stack backtrace: CPU: 1 PID: 5086 Comm: syz-fuzzer Not tainted 6.9.0-syzkaller-12277-g56fb6f92854f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_bad_irq_dependency kernel/locking/lockdep.c:2626 [inline] check_irq_usage kernel/locking/lockdep.c:2865 [inline] check_prev_add kernel/locking/lockdep.c:3138 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x4de0/0x5900 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 fs_reclaim_acquire+0xaf/0x140 mm/page_alloc.c:3800 might_alloc include/linux/sched/mm.h:334 [inline] prepare_alloc_pages+0x147/0x5d0 mm/page_alloc.c:4431 __alloc_pages_noprof+0x166/0x6c0 mm/page_alloc.c:4649 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 stack_depot_save_flags+0x666/0x830 lib/stackdepot.c:627 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_save_track+0x51/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_mempool_unpoison_object+0xa0/0x170 mm/kasan/common.c:535 remove_element+0x129/0x1a0 mm/mempool.c:150 mempool_alloc_noprof+0x54e/0x5a0 mm/mempool.c:408 __sg_alloc_table+0xcc/0x3c0 lib/scatterlist.c:321 sg_alloc_table_chained+0xe6/0x1c0 lib/sg_pool.c:133 scsi_alloc_sgtables+0x290/0xcb0 drivers/scsi/scsi_lib.c:1133 sd_setup_read_write_cmnd drivers/scsi/sd.c:1227 [inline] sd_init_command+0x531/0x2100 drivers/scsi/sd.c:1345 scsi_prepare_cmd drivers/scsi/scsi_lib.c:1698 [inline] scsi_queue_rq+0x18cd/0x2f70 drivers/scsi/scsi_lib.c:1832 blk_mq_dispatch_rq_list+0xb89/0x1b30 block/blk-mq.c:2037 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline] __blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309 blk_mq_sched_dispatch_requests+0xcb/0x140 block/blk-mq-sched.c:331 blk_mq_run_hw_queue+0x9a5/0xae0 block/blk-mq.c:2250 blk_mq_flush_plug_list+0x1115/0x1880 block/blk-mq.c:2799 __blk_flush_plug+0x420/0x500 block/blk-core.c:1194 blk_finish_plug+0x5e/0x80 block/blk-core.c:1221 read_pages+0x644/0x840 mm/readahead.c:183 page_cache_ra_unbounded+0x6ce/0x7f0 mm/readahead.c:273 do_sync_mmap_readahead+0x49c/0x970 filemap_fault+0x828/0x1760 mm/filemap.c:3313 __do_fault+0x135/0x460 mm/memory.c:4562 do_read_fault mm/memory.c:4926 [inline] do_fault mm/memory.c:5056 [inline] do_pte_missing mm/memory.c:3903 [inline] handle_pte_fault+0x3d8d/0x7130 mm/memory.c:5380 __handle_mm_fault mm/memory.c:5523 [inline] handle_mm_fault+0xfb0/0x19d0 mm/memory.c:5688 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x459/0x8c0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x4cbc60 Code: Unable to access opcode bytes at 0x4cbc36. RSP: 002b:000000c00092fb80 EFLAGS: 00010206 RAX: 0000000000a9da80 RBX: 000000c000076060 RCX: 0000000000000000 RDX: 0000000000e24918 RSI: 00000000004cbc60 RDI: 0000000000000004 RBP: 000000c00092fbd0 R08: 0000000000000001 R09: 0000000000000005 R10: 00000079d573976a R11: 0000000000000001 R12: 00000078217af63c R13: 0000000000000001 R14: 000000c0007c3a00 R15: 00000000000000ff BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5086, name: syz-fuzzer preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. irq event stamp: 510736 hardirqs last enabled at (510735): [] seqcount_lockdep_reader_access+0x13b/0x1e0 include/linux/seqlock.h:74 hardirqs last disabled at (510736): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (510736): [] _raw_spin_lock_irqsave+0xb0/0x120 kernel/locking/spinlock.c:162 softirqs last enabled at (509100): [] __do_softirq kernel/softirq.c:588 [inline] softirqs last enabled at (509100): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last enabled at (509100): [] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 softirqs last disabled at (509075): [] __do_softirq kernel/softirq.c:588 [inline] softirqs last disabled at (509075): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last disabled at (509075): [] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 PID: 5086 Comm: syz-fuzzer Not tainted 6.9.0-syzkaller-12277-g56fb6f92854f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 __might_resched+0x5d4/0x780 kernel/sched/core.c:10196 might_alloc include/linux/sched/mm.h:337 [inline] prepare_alloc_pages+0x1c9/0x5d0 mm/page_alloc.c:4431 __alloc_pages_noprof+0x166/0x6c0 mm/page_alloc.c:4649 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 stack_depot_save_flags+0x666/0x830 lib/stackdepot.c:627 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_save_track+0x51/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_mempool_unpoison_object+0xa0/0x170 mm/kasan/common.c:535 remove_element+0x129/0x1a0 mm/mempool.c:150 mempool_alloc_noprof+0x54e/0x5a0 mm/mempool.c:408 __sg_alloc_table+0xcc/0x3c0 lib/scatterlist.c:321 sg_alloc_table_chained+0xe6/0x1c0 lib/sg_pool.c:133 scsi_alloc_sgtables+0x290/0xcb0 drivers/scsi/scsi_lib.c:1133 sd_setup_read_write_cmnd drivers/scsi/sd.c:1227 [inline] sd_init_command+0x531/0x2100 drivers/scsi/sd.c:1345 scsi_prepare_cmd drivers/scsi/scsi_lib.c:1698 [inline] scsi_queue_rq+0x18cd/0x2f70 drivers/scsi/scsi_lib.c:1832 blk_mq_dispatch_rq_list+0xb89/0x1b30 block/blk-mq.c:2037 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline] __blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309 blk_mq_sched_dispatch_requests+0xcb/0x140 block/blk-mq-sched.c:331 blk_mq_run_hw_queue+0x9a5/0xae0 block/blk-mq.c:2250 blk_mq_flush_plug_list+0x1115/0x1880 block/blk-mq.c:2799 __blk_flush_plug+0x420/0x500 block/blk-core.c:1194 blk_finish_plug+0x5e/0x80 block/blk-core.c:1221 read_pages+0x644/0x840 mm/readahead.c:183 page_cache_ra_unbounded+0x6ce/0x7f0 mm/readahead.c:273 do_sync_mmap_readahead+0x49c/0x970 filemap_fault+0x828/0x1760 mm/filemap.c:3313 __do_fault+0x135/0x460 mm/memory.c:4562 do_read_fault mm/memory.c:4926 [inline] do_fault mm/memory.c:5056 [inline] do_pte_missing mm/memory.c:3903 [inline] handle_pte_fault+0x3d8d/0x7130 mm/memory.c:5380 __handle_mm_fault mm/memory.c:5523 [inline] handle_mm_fault+0xfb0/0x19d0 mm/memory.c:5688 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x459/0x8c0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x4cbc60 Code: Unable to access opcode bytes at 0x4cbc36. RSP: 002b:000000c00092fb80 EFLAGS: 00010206 RAX: 0000000000a9da80 RBX: 000000c000076060 RCX: 0000000000000000 RDX: 0000000000e24918 RSI: 00000000004cbc60 RDI: 0000000000000004 RBP: 000000c00092fbd0 R08: 0000000000000001 R09: 0000000000000005 R10: 00000079d573976a R11: 0000000000000001 R12: 00000078217af63c R13: 0000000000000001 R14: 000000c0007c3a00 R15: 00000000000000ff BUG: scheduling while atomic: syz-fuzzer/5086/0x00000002 INFO: lockdep is turned off. Modules linked in: Preemption disabled at: [<0000000000000000>] 0x0