lowmemorykiller: Killing 'syz-executor.5' (29460) (tgid 29460), adj 1000,
   to free 54060kB on behalf of 'syz-executor.2' (2111) because
   cache 65352kB is below limit 65536kB for oom_score_adj 12
   Free memory is -13280kB above reserved
BUG: sleeping function called from invalid context at kernel/fork.c:905
in_atomic(): 0, irqs_disabled(): 0, pid: 29463, name: syz-executor.5
3 locks held by syz-executor.5/29463:
 #0:  (&mm->mmap_sem){++++++}, at: [<000000003435a376>] __mm_populate+0x20c/0x300 mm/gup.c:1143
 #1:  (shrinker_rwsem){++++..}, at: [<000000002b3e3227>] shrink_slab.part.0+0xb2/0xa20 mm/vmscan.c:472
 #2:  (rcu_read_lock){......}, at: [<00000000c504f4cd>] lowmem_scan+0x242/0xb50 drivers/staging/android/lowmemorykiller.c:272
Preemption disabled at:
[<0000000089e441e0>] spin_lock include/linux/spinlock.h:302 [inline]
[<0000000089e441e0>] task_lock include/linux/sched.h:3217 [inline]
[<0000000089e441e0>] get_task_mm+0x20/0xc0 kernel/fork.c:1012
CPU: 1 PID: 29463 Comm: syz-executor.5 Not tainted 4.9.189+ #1
 ffff8801c5cd7440 ffffffff81b65c01 0000000000000000 0000000000000001
 ffff8801cc4adf00 ffffffff810d1010 ffff8801cc4adf00 ffff8801c5cd7478
 ffffffff814018f3 ffff8801cc4adf00 ffffffff82a39fc0 0000000000000389
Call Trace:
 [<000000005ead2a50>] __dump_stack lib/dump_stack.c:15 [inline]
 [<000000005ead2a50>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<000000004f27829c>] ___might_sleep.cold+0x1c1/0x1fa kernel/sched/core.c:8004
 [<00000000c6fbbe74>] __might_sleep+0x95/0x1a0 kernel/sched/core.c:7961
 [<000000000e6797ec>] mmput+0x28/0x370 kernel/fork.c:905
 [<00000000de4558b3>] handle_lmk_event+0xea/0x8a0 drivers/staging/android/lowmemorykiller.c:111
 [<000000000d2ed87d>] lowmem_scan+0x695/0xb50 drivers/staging/android/lowmemorykiller.c:345
 [<00000000e0d9ff9c>] do_shrink_slab mm/vmscan.c:399 [inline]
 [<00000000e0d9ff9c>] shrink_slab.part.0+0x3cf/0xa20 mm/vmscan.c:502
 [<000000004956dbe0>] shrink_slab mm/vmscan.c:466 [inline]
 [<000000004956dbe0>] shrink_node+0x1ed/0x750 mm/vmscan.c:2604
 [<000000009d9cfcfd>] shrink_zones mm/vmscan.c:2751 [inline]
 [<000000009d9cfcfd>] do_try_to_free_pages mm/vmscan.c:2793 [inline]
 [<000000009d9cfcfd>] try_to_free_pages+0x397/0xbd0 mm/vmscan.c:3004
 [<00000000186c8cb3>] __perform_reclaim mm/page_alloc.c:3332 [inline]
 [<00000000186c8cb3>] __alloc_pages_direct_reclaim mm/page_alloc.c:3354 [inline]
 [<00000000186c8cb3>] __alloc_pages_slowpath mm/page_alloc.c:3704 [inline]
 [<00000000186c8cb3>] __alloc_pages_nodemask+0x930/0x1a80 mm/page_alloc.c:3861
 [<000000002a215d46>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<000000002a215d46>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<000000002a215d46>] alloc_pages_node include/linux/gfp.h:460 [inline]
 [<000000002a215d46>] alloc_zeroed_user_highpage_movable include/linux/highmem.h:183 [inline]
 [<000000002a215d46>] do_anonymous_page mm/memory.c:2761 [inline]
 [<000000002a215d46>] handle_pte_fault mm/memory.c:3545 [inline]
 [<000000002a215d46>] __handle_mm_fault mm/memory.c:3634 [inline]
 [<000000002a215d46>] handle_mm_fault+0x12e1/0x2420 mm/memory.c:3671
 [<00000000fb1db7bb>] faultin_page mm/gup.c:395 [inline]
 [<00000000fb1db7bb>] __get_user_pages+0x3c7/0x10b0 mm/gup.c:597
 [<000000006f025ca7>] populate_vma_page_range+0x19a/0x230 mm/gup.c:1115
 [<000000006981f60b>] __mm_populate+0x1b9/0x300 mm/gup.c:1163
 [<000000000ca61805>] mm_populate include/linux/mm.h:2080 [inline]
 [<000000000ca61805>] SYSC_mlockall mm/mlock.c:817 [inline]
 [<000000000ca61805>] SyS_mlockall+0x405/0x530 mm/mlock.c:791
 [<00000000fdb936ff>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
 [<000000007ba3e9af>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

=================================
[ INFO: inconsistent lock state ]
4.9.189+ #1 Tainted: G        W      
---------------------------------
inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-R} usage.
syz-executor.5/29463 [HC0[0]:SC0[0]:HE1:SE1] takes:
 (&mm->mmap_sem){+++++?}, at: [<00000000589c3049>] get_cmdline+0xa3/0x2d0 mm/util.c:641
  mark_held_locks+0xb1/0x100 kernel/locking/lockdep.c:2660
  __lockdep_trace_alloc kernel/locking/lockdep.c:2882 [inline]
  lockdep_trace_alloc+0x18c/0x2b0 kernel/locking/lockdep.c:2897
  __alloc_pages_nodemask+0x143/0x1a80 mm/page_alloc.c:3803
  __alloc_pages include/linux/gfp.h:433 [inline]
  __alloc_pages_node include/linux/gfp.h:446 [inline]
  alloc_pages_node include/linux/gfp.h:460 [inline]
  pmd_alloc_one arch/x86/include/asm/pgalloc.h:88 [inline]
  __pmd_alloc+0x4a/0x330 mm/memory.c:3742
  pmd_alloc include/linux/mm.h:1625 [inline]
  alloc_new_pmd mm/mremap.c:64 [inline]
  move_page_tables+0xadb/0xd60 mm/mremap.c:212
  shift_arg_pages+0x1ae/0x470 fs/exec.c:642
  setup_arg_pages+0x60d/0x7c0 fs/exec.c:754
  load_elf_binary+0xa84/0x4a90 fs/binfmt_elf.c:860
  search_binary_handler fs/exec.c:1621 [inline]
  search_binary_handler+0x14f/0x700 fs/exec.c:1599
  exec_binprm fs/exec.c:1663 [inline]
  do_execveat_common.isra.0+0xf81/0x1db0 fs/exec.c:1785
  do_execve+0x3a/0x50 fs/exec.c:1829
  run_init_process+0x33/0x37 init/main.c:904
  try_to_run_init_process+0x18/0x48 init/main.c:913
  kernel_init+0xf2/0x163 init/main.c:984
  ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375
irq event stamp: 24757
hardirqs last  enabled at (24757): [<000000005a474435>] restore_regs_and_iret+0x0/0x1d
hardirqs last disabled at (24756): [<000000001b870fb8>] preempt_schedule_irq+0x6a/0xa0 kernel/sched/core.c:3705
softirqs last  enabled at (23598): [<000000002782d45d>] __do_softirq+0x474/0x964 kernel/softirq.c:314
softirqs last disabled at (23225): [<0000000078186a21>] invoke_softirq kernel/softirq.c:368 [inline]
softirqs last disabled at (23225): [<0000000078186a21>] irq_exit+0x119/0x160 kernel/softirq.c:409

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&mm->mmap_sem);
  <Interrupt>
    lock(&mm->mmap_sem);

 *** DEADLOCK ***

4 locks held by syz-executor.5/29463:
 #0:  (&mm->mmap_sem){+++++?}, at: [<000000003435a376>] __mm_populate+0x20c/0x300 mm/gup.c:1143
 #1:  (shrinker_rwsem){++++..}, at: [<000000002b3e3227>] shrink_slab.part.0+0xb2/0xa20 mm/vmscan.c:472
 #2:  (rcu_read_lock){......}, at: [<00000000c504f4cd>] lowmem_scan+0x242/0xb50 drivers/staging/android/lowmemorykiller.c:272
 #3:  (lmk_event_lock){+.+.-.}, at: [<000000000d8bc09a>] spin_lock include/linux/spinlock.h:302 [inline]
 #3:  (lmk_event_lock){+.+.-.}, at: [<000000000d8bc09a>] handle_lmk_event+0xfb/0x8a0 drivers/staging/android/lowmemorykiller.c:114

stack backtrace:
CPU: 1 PID: 29463 Comm: syz-executor.5 Tainted: G        W       4.9.189+ #1
 ffff8801c5cd7180 ffffffff81b65c01 00000000000000f0 ffff8801cc4adf00
 ffffffff83caf7a0 ffff8801cc4ae870 ffffffff84250fc0 ffff8801c5cd71f8
 ffffffff81408330 0000000000000000 ffffffff00000001 0000000000000001
Call Trace:
 [<000000005ead2a50>] __dump_stack lib/dump_stack.c:15 [inline]
 [<000000005ead2a50>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<00000000a18af479>] print_usage_bug kernel/locking/lockdep.c:2387 [inline]
 [<00000000a18af479>] print_usage_bug.cold+0x452/0x5a2 kernel/locking/lockdep.c:2354
 [<00000000a59a874b>] valid_state kernel/locking/lockdep.c:2400 [inline]
 [<00000000a59a874b>] mark_lock_irq kernel/locking/lockdep.c:2602 [inline]
 [<00000000a59a874b>] mark_lock+0x6c7/0x12e0 kernel/locking/lockdep.c:3065
 [<000000004f669148>] mark_irqflags kernel/locking/lockdep.c:2958 [inline]
 [<000000004f669148>] __lock_acquire+0x5be/0x4390 kernel/locking/lockdep.c:3302
 [<00000000da7162a6>] lock_acquire+0x133/0x3d0 kernel/locking/lockdep.c:3756
 [<00000000a6228aa0>] down_read+0x44/0xb0 kernel/locking/rwsem.c:22
 [<00000000589c3049>] get_cmdline+0xa3/0x2d0 mm/util.c:641
 [<000000004a55cfa0>] handle_lmk_event+0x13c/0x8a0 drivers/staging/android/lowmemorykiller.c:128
 [<000000000d2ed87d>] lowmem_scan+0x695/0xb50 drivers/staging/android/lowmemorykiller.c:345
 [<00000000e0d9ff9c>] do_shrink_slab mm/vmscan.c:399 [inline]
 [<00000000e0d9ff9c>] shrink_slab.part.0+0x3cf/0xa20 mm/vmscan.c:502
 [<000000004956dbe0>] shrink_slab mm/vmscan.c:466 [inline]
 [<000000004956dbe0>] shrink_node+0x1ed/0x750 mm/vmscan.c:2604
 [<000000009d9cfcfd>] shrink_zones mm/vmscan.c:2751 [inline]
 [<000000009d9cfcfd>] do_try_to_free_pages mm/vmscan.c:2793 [inline]
 [<000000009d9cfcfd>] try_to_free_pages+0x397/0xbd0 mm/vmscan.c:3004
 [<00000000186c8cb3>] __perform_reclaim mm/page_alloc.c:3332 [inline]
 [<00000000186c8cb3>] __alloc_pages_direct_reclaim mm/page_alloc.c:3354 [inline]
 [<00000000186c8cb3>] __alloc_pages_slowpath mm/page_alloc.c:3704 [inline]
 [<00000000186c8cb3>] __alloc_pages_nodemask+0x930/0x1a80 mm/page_alloc.c:3861
 [<000000002a215d46>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<000000002a215d46>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<000000002a215d46>] alloc_pages_node include/linux/gfp.h:460 [inline]
 [<000000002a215d46>] alloc_zeroed_user_highpage_movable include/linux/highmem.h:183 [inline]
 [<000000002a215d46>] do_anonymous_page mm/memory.c:2761 [inline]
 [<000000002a215d46>] handle_pte_fault mm/memory.c:3545 [inline]
 [<000000002a215d46>] __handle_mm_fault mm/memory.c:3634 [inline]
 [<000000002a215d46>] handle_mm_fault+0x12e1/0x2420 mm/memory.c:3671
 [<00000000fb1db7bb>] faultin_page mm/gup.c:395 [inline]
 [<00000000fb1db7bb>] __get_user_pages+0x3c7/0x10b0 mm/gup.c:597
 [<000000006f025ca7>] populate_vma_page_range+0x19a/0x230 mm/gup.c:1115
 [<000000006981f60b>] __mm_populate+0x1b9/0x300 mm/gup.c:1163
 [<000000000ca61805>] mm_populate include/linux/mm.h:2080 [inline]
 [<000000000ca61805>] SYSC_mlockall mm/mlock.c:817 [inline]
 [<000000000ca61805>] SyS_mlockall+0x405/0x530 mm/mlock.c:791
 [<00000000fdb936ff>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
 [<000000007ba3e9af>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
lowmemorykiller: Killing 'syz-executor.3' (29457) (tgid 29457), adj 1000,
   to free 72636kB on behalf of 'kswapd0' (33) because
   cache 54340kB is below limit 65536kB for oom_score_adj 12
   Free memory is -6980kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (29464) (tgid 29457), adj 1000,
   to free 72636kB on behalf of 'kswapd0' (33) because
   cache 52140kB is below limit 65536kB for oom_score_adj 12
   Free memory is -8268kB above reserved
lowmemorykiller: Killing 'syz-executor.1' (18099) (tgid 18099), adj 1000,
   to free 53172kB on behalf of 'kswapd0' (33) because
   cache 49440kB is below limit 65536kB for oom_score_adj 12
   Free memory is -9216kB above reserved
lowmemorykiller: Killing 'syz-executor.5' (29475) (tgid 29475), adj 1000,
   to free 54060kB on behalf of 'kswapd0' (33) because
   cache 43040kB is below limit 65536kB for oom_score_adj 12
   Free memory is -2368kB above reserved
lowmemorykiller: Killing 'syz-executor.5' (29477) (tgid 29475), adj 1000,
   to free 55036kB on behalf of 'kswapd0' (33) because
   cache 42788kB is below limit 65536kB for oom_score_adj 12
   Free memory is -3020kB above reserved
lowmemorykiller: Killing 'syz-executor.1' (18136) (tgid 18136), adj 1000,
   to free 53172kB on behalf of 'kswapd0' (33) because
   cache 42788kB is below limit 65536kB for oom_score_adj 12
   Free memory is -3020kB above reserved
lowmemorykiller: Killing 'syz-executor.1' (18190) (tgid 18190), adj 1000,
   to free 53172kB on behalf of 'kswapd0' (33) because
   cache 53584kB is below limit 65536kB for oom_score_adj 12
   Free memory is 924kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (21169) (tgid 21169), adj 1000,
   to free 53172kB on behalf of 'kswapd0' (33) because
   cache 62184kB is below limit 65536kB for oom_score_adj 12
   Free memory is 4924kB above reserved
lowmemorykiller: Killing 'syz-executor.2' (21189) (tgid 21189), adj 1000,
   to free 53172kB on behalf of 'kswapd0' (33) because
   cache 62184kB is below limit 65536kB for oom_score_adj 12
   Free memory is 5324kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (21214) (tgid 21214), adj 1000,
   to free 53172kB on behalf of 'kswapd0' (33) because
   cache 62184kB is below limit 65536kB for oom_score_adj 12
   Free memory is 19548kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (21300) (tgid 21300), adj 1000,
   to free 53172kB on behalf of 'kswapd0' (33) because
   cache 62184kB is below limit 65536kB for oom_score_adj 12
   Free memory is 60828kB above reserved
BUG: scheduling while atomic: kswapd0/33/0x00000002
INFO: lockdep is turned off.
Modules linked in:
Preemption disabled at:
[<000000000d8bc09a>] spin_lock include/linux/spinlock.h:302 [inline]
[<000000000d8bc09a>] handle_lmk_event+0xfb/0x8a0 drivers/staging/android/lowmemorykiller.c:114