fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10f/0x159 lib/fault-inject.c:149 should_failslab+0xdb/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] kmem_cache_alloc_trace+0x2e9/0x790 mm/slab.c:3616 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] ovl_fill_super+0xdf/0x2660 fs/overlayfs/super.c:859 ===================================== WARNING: bad unlock balance detected! 4.14.157-syzkaller #0 Not tainted ------------------------------------- syz-executor.0/11194 is trying to release lock ( sb_writers ) at: [] sb_end_write include/linux/fs.h:1500 [inline] [] mnt_drop_write+0x3e/0x50 fs/namespace.c:532 but there are no more locks to release! other info that might help us debug this: mount_nodev+0x52/0xf0 fs/super.c:1180 1 lock held by syz-executor.0/11194: ovl_mount+0x2d/0x40 fs/overlayfs/super.c:1204 #0: mount_fs+0x97/0x2a1 fs/super.c:1237 ( vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046 &type->s_umount_key vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x417/0x27d0 fs/namespace.c:2879 #58 /1){+.+.} , at: [] alloc_super fs/super.c:251 [inline] , at: [] sget_userns+0x551/0xc30 fs/super.c:516 stack backtrace: SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xab/0x120 fs/namespace.c:3072 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45a679 RSP: 002b:00007fd43db7ec78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fd43db7ec90 RCX: 000000000045a679 RDX: 00000000200000c0 RSI: 0000000020000000 RDI: 000000000040000f RBP: 000000000075bf20 R08: 0000000020000100 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd43db7f6d4 R13: 00000000004c7a03 R14: 00000000004de858 R15: 0000000000000003 CPU: 0 PID: 11194 Comm: syz-executor.0 Not tainted 4.14.157-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 print_unlock_imbalance_bug kernel/locking/lockdep.c:3548 [inline] print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3525 __lock_release kernel/locking/lockdep.c:3765 [inline] lock_release+0x616/0x940 kernel/locking/lockdep.c:4013 percpu_up_read_preempt_enable include/linux/percpu-rwsem.h:102 [inline] percpu_up_read include/linux/percpu-rwsem.h:108 [inline] __sb_end_write+0xc1/0x100 fs/super.c:1329 sb_end_write include/linux/fs.h:1500 [inline] mnt_drop_write+0x3e/0x50 fs/namespace.c:532 ovl_workdir_create.cold+0x101/0x10d fs/overlayfs/super.c:546 ovl_fill_super+0x100c/0x2660 fs/overlayfs/super.c:988 mount_nodev+0x52/0xf0 fs/super.c:1180 ovl_mount+0x2d/0x40 fs/overlayfs/super.c:1204 mount_fs+0x97/0x2a1 fs/super.c:1237 vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x417/0x27d0 fs/namespace.c:2879 SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xab/0x120 fs/namespace.c:3072 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45a679 RSP: 002b:00007fb280502c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045a679 RDX: 00000000200000c0 RSI: 0000000020000000 RDI: 000000000040000f RBP: 000000000075bf20 R08: 0000000020000340 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb2805036d4 R13: 00000000004c7a03 R14: 00000000004de858 R15: 00000000ffffffff kobject: 'loop1' (ffff8880a40f5560): kobject_uevent_env kobject: 'loop1' (ffff8880a40f5560): fill_kobj_path: path = '/devices/virtual/block/loop1' overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection. kobject: 'loop4' (ffff8880a41d45a0): kobject_uevent_env overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection. kobject: 'loop4' (ffff8880a41d45a0): fill_kobj_path: path = '/devices/virtual/block/loop4' FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 kobject: 'kvm' (ffff88821945b210): kobject_uevent_env kobject: 'kvm' (ffff88821945b210): kobject_uevent_env kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection. CPU: 1 PID: 11209 Comm: syz-executor.4 Not tainted 4.14.157-syzkaller #0 kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10f/0x159 lib/fault-inject.c:149 should_failslab+0xdb/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc+0x2f0/0x7a0 mm/slab.c:3729 overlayfs: workdir and upperdir must reside under the same mount kobject: 'kvm' (ffff88821945b210): kobject_uevent_env kmalloc include/linux/slab.h:493 [inline] match_strdup+0x5f/0xa0 lib/parser.c:331 ovl_parse_opt fs/overlayfs/super.c:421 [inline] ovl_fill_super+0x633/0x2660 fs/overlayfs/super.c:865 kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' overlayfs: upper fs is r/o, try multi-lower layers mount mount_nodev+0x52/0xf0 fs/super.c:1180 ovl_mount+0x2d/0x40 fs/overlayfs/super.c:1204 kobject: 'kvm' (ffff88821945b210): kobject_uevent_env mount_fs+0x97/0x2a1 fs/super.c:1237 kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x417/0x27d0 fs/namespace.c:2879 SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xab/0x120 fs/namespace.c:3072 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45a679 RSP: 002b:00007fd43db7ec78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fd43db7ec90 RCX: 000000000045a679 RDX: 00000000200000c0 RSI: 0000000020000000 RDI: 000000000040000f RBP: 000000000075bf20 R08: 0000000020000100 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd43db7f6d4 R13: 00000000004c7a03 R14: 00000000004de858 R15: 0000000000000003 kobject: 'kvm' (ffff88821945b210): kobject_uevent_env overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection. caif:caif_disconnect_client(): nothing to disconnect kobject: 'kvm' (ffff88821945b210): kobject_uevent_env kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' caif:caif_disconnect_client(): nothing to disconnect kobject: 'loop4' (ffff8880a41d45a0): kobject_uevent_env kobject: 'loop4' (ffff8880a41d45a0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'kvm' (ffff88821945b210): kobject_uevent_env FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 kobject: 'kvm' (ffff88821945b210): kobject_uevent_env kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' CPU: 0 PID: 11236 Comm: syz-executor.4 Not tainted 4.14.157-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10f/0x159 lib/fault-inject.c:149 should_failslab+0xdb/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc_track_caller+0x2ec/0x790 mm/slab.c:3735 kstrdup+0x3a/0x70 mm/util.c:56 ovl_mount_dir+0x2a/0x1a0 fs/overlayfs/super.c:608 ovl_fill_super+0x420/0x2660 fs/overlayfs/super.c:884 kobject: 'kvm' (ffff88821945b210): kobject_uevent_env kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' mount_nodev+0x52/0xf0 fs/super.c:1180 ovl_mount+0x2d/0x40 fs/overlayfs/super.c:1204 mount_fs+0x97/0x2a1 fs/super.c:1237 overlayfs: missing 'lowerdir' vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x417/0x27d0 fs/namespace.c:2879 kobject: 'kvm' (ffff88821945b210): kobject_uevent_env kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xab/0x120 fs/namespace.c:3072 kobject: 'kvm' (ffff88821945b210): kobject_uevent_env do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45a679 kobject: 'kvm' (ffff88821945b210): kobject_uevent_env RSP: 002b:00007fd43db7ec78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fd43db7ec90 RCX: 000000000045a679 RDX: 00000000200000c0 RSI: 0000000020000000 RDI: 000000000040000f RBP: 000000000075bf20 R08: 0000000020000100 R09: 0000000000000000 kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd43db7f6d4 R13: 00000000004c7a03 R14: 00000000004de858 R15: 0000000000000003 kobject: 'loop3' (ffff8880a41a5660): kobject_uevent_env kobject: 'loop3' (ffff8880a41a5660): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'kvm' (ffff88821945b210): kobject_uevent_env overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection. overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection. kobject: 'loop4' (ffff8880a41d45a0): kobject_uevent_env kobject: 'kvm' (ffff88821945b210): fill_kobj_path: path = '/devices/virtual/misc/kvm' kobject: 'loop4' (ffff8880a41d45a0): fill_kobj_path: path = '/devices/virtual/block/loop4' ------------[ cut here ]------------ WARNING: CPU: 0 PID: 7049 at fs/namespace.c:1178 cleanup_mnt+0x104/0x150 fs/namespace.c:1178