BUG: sleeping function called from invalid context at kernel/workqueue.c:3414
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6517, name: syz.3.234
preempt_count: 101, expected: 0
RCU nest depth: 2, expected: 0
6 locks held by syz.3.234/6517:
#0: ffff88814cc8c730 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88814cc8c730 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: tipc_wait_for_rcvmsg+0x343/0x640 net/tipc/socket.c:1857
#1: ffff88801886d720 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:165 [inline]
#1: ffff88801886d720 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5380 [inline]
#1: ffff88801886d720 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 mm/memory.c:5440
#2: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#2: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#2: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 mm/pgtable-generic.c:287
#3: ffff888031035558 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff888031035558 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 mm/pgtable-generic.c:375
#4: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#4: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#4: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __mod_lruvec_page_state+0xa5/0x410 mm/memcontrol.c:889
#5: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 6517 Comm: syz.3.234 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
__might_resched+0x48d/0x5f0 kernel/sched/core.c:10212
start_flush_work kernel/workqueue.c:3414 [inline]
__flush_work+0x10f/0xac0 kernel/workqueue.c:3474
__cancel_work_timer+0x3f8/0x560 kernel/workqueue.c:3562
mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:694
call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x570/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__mod_memcg_lruvec_state+0x19f/0x280 mm/memcontrol.c:854
Code: 49 bf 00 00 00 00 00 fc ff df 42 80 3c 38 00 74 08 4c 89 f7 e8 22 2d f9 ff 4d 8b 36 83 fb 2c 0f 83 c2 00 00 00 65 4f 01 24 ee <48> 8b 7c 24 10 44 89 e6 e8 f4 fb ff ff 48 c7 44 24 20 0e 36 e0 45
RSP: 0018:ffffc900102ff0e0 EFLAGS: 00000202
RAX: 1ffff11004d8b0cc RBX: 0000000000000011 RCX: 16afb37c1c3cac00
RDX: 0000000000000001 RSI: ffffffff8ad6c9e0 RDI: ffffffff8b1d5160
RBP: ffffc900102ff190 R08: ffffea000147bc07 R09: 1ffffd400028f780
R10: dffffc0000000000 R11: fffff9400028f781 R12: 0000000000000001
R13: 0000000000000011 R14: 0000607f470799c0 R15: dffffc0000000000
__mod_lruvec_state mm/memcontrol.c:878 [inline]
__mod_lruvec_page_state+0x1f3/0x410 mm/memcontrol.c:899
__lruvec_stat_mod_folio include/linux/vmstat.h:615 [inline]
folio_add_new_anon_rmap+0x1cf/0x4b0 mm/rmap.c:1292
wp_page_copy mm/memory.c:3163 [inline]
do_wp_page+0x1d1e/0x34d0 mm/memory.c:3469
handle_pte_fault mm/memory.c:5063 [inline]
__handle_mm_fault mm/memory.c:5188 [inline]
handle_mm_fault+0x1306/0x4a50 mm/memory.c:5353
do_user_addr_fault+0x736/0x12d0 arch/x86/mm/fault.c:1371
handle_page_fault arch/x86/mm/fault.c:1463 [inline]
exc_page_fault+0x64/0x100 arch/x86/mm/fault.c:1516
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0010:rep_movs_alternative+0x4a/0x90 arch/x86/lib/copy_user_64.S:71
Code: 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 29 f8 48 01
RSP: 0018:ffffc900102ff718 EFLAGS: 00050206
RAX: ffffffff84326101 RBX: 1ffff9200205ffc7 RCX: 000000000000a3d0
RDX: 0000000000000000 RSI: ffff888058e85ee8 RDI: 0000200000611000
RBP: ffffc900102ff868 R08: ffff888058e902b7 R09: 1ffff1100b1d2056
R10: dffffc0000000000 R11: ffffed100b1d2057 R12: ffff888058e800e8
R13: 00000000000101d0 R14: 00000000000101d0 R15: ffffc900102ffe48
copy_user_generic arch/x86/include/asm/uaccess_64.h:112 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:133 [inline]
copyout lib/iov_iter.c:168 [inline]
_copy_to_iter+0x24f/0x1110 lib/iov_iter.c:317
__skb_datagram_iter+0xdb/0x780 net/core/datagram.c:419
skb_copy_datagram_iter+0xb1/0x200 net/core/datagram.c:535
skb_copy_datagram_msg include/linux/skbuff.h:4052 [inline]
tipc_recvstream+0x730/0xe90 net/tipc/socket.c:2076
sock_recvmsg_nosec net/socket.c:1047 [inline]
sock_recvmsg net/socket.c:1069 [inline]
____sys_recvmsg+0x2bd/0x5d0 net/socket.c:2814
___sys_recvmsg+0x214/0x590 net/socket.c:2856
__sys_recvmsg net/socket.c:2886 [inline]
__do_sys_recvmsg net/socket.c:2896 [inline]
__se_sys_recvmsg net/socket.c:2893 [inline]
__x64_sys_recvmsg+0x21e/0x2f0 net/socket.c:2893
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f924c79e559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f924a9f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 00007f924ca25fa0 RCX: 00007f924c79e559
RDX: 0000000000001f00 RSI: 0000200000000500 RDI: 0000000000000005
RBP: 00007f924c8358b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f924ca26038 R14: 00007f924ca25fa0 R15: 00007ffebc481e68
=============================
WARNING: suspicious RCU usage
syzkaller #0 Tainted: G W
-----------------------------
kernel/rcu/srcutree.c:1377 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
6 locks held by syz.3.234/6517:
#0: ffff88814cc8c730 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88814cc8c730 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: tipc_wait_for_rcvmsg+0x343/0x640 net/tipc/socket.c:1857
#1: ffff88801886d720 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:165 [inline]
#1: ffff88801886d720 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5380 [inline]
#1: ffff88801886d720 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 mm/memory.c:5440
#2: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#2: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#2: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 mm/pgtable-generic.c:287
#3: ffff888031035558 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff888031035558 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 mm/pgtable-generic.c:375
#4: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#4: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#4: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __mod_lruvec_page_state+0xa5/0x410 mm/memcontrol.c:889
#5: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698
stack backtrace:
CPU: 1 PID: 6517 Comm: syz.3.234 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
lockdep_rcu_suspicious+0x1e1/0x300 kernel/locking/lockdep.c:6767
__synchronize_srcu+0x150/0x3d0 kernel/rcu/srcutree.c:1373
wakeup_source_remove drivers/base/power/wakeup.c:198 [inline]
wakeup_source_unregister+0x116/0x190 drivers/base/power/wakeup.c:242
mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:77
device_release+0xbc/0x1e0 drivers/base/core.c:-1
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x21b/0x450 lib/kobject.c:737
call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x570/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__mod_memcg_lruvec_state+0x19f/0x280 mm/memcontrol.c:854
Code: 49 bf 00 00 00 00 00 fc ff df 42 80 3c 38 00 74 08 4c 89 f7 e8 22 2d f9 ff 4d 8b 36 83 fb 2c 0f 83 c2 00 00 00 65 4f 01 24 ee <48> 8b 7c 24 10 44 89 e6 e8 f4 fb ff ff 48 c7 44 24 20 0e 36 e0 45
RSP: 0018:ffffc900102ff0e0 EFLAGS: 00000202
RAX: 1ffff11004d8b0cc RBX: 0000000000000011 RCX: 16afb37c1c3cac00
RDX: 0000000000000001 RSI: ffffffff8ad6c9e0 RDI: ffffffff8b1d5160
RBP: ffffc900102ff190 R08: ffffea000147bc07 R09: 1ffffd400028f780
R10: dffffc0000000000 R11: fffff9400028f781 R12: 0000000000000001
R13: 0000000000000011 R14: 0000607f470799c0 R15: dffffc0000000000
__mod_lruvec_state mm/memcontrol.c:878 [inline]
__mod_lruvec_page_state+0x1f3/0x410 mm/memcontrol.c:899
__lruvec_stat_mod_folio include/linux/vmstat.h:615 [inline]
folio_add_new_anon_rmap+0x1cf/0x4b0 mm/rmap.c:1292
wp_page_copy mm/memory.c:3163 [inline]
do_wp_page+0x1d1e/0x34d0 mm/memory.c:3469
handle_pte_fault mm/memory.c:5063 [inline]
__handle_mm_fault mm/memory.c:5188 [inline]
handle_mm_fault+0x1306/0x4a50 mm/memory.c:5353
do_user_addr_fault+0x736/0x12d0 arch/x86/mm/fault.c:1371
handle_page_fault arch/x86/mm/fault.c:1463 [inline]
exc_page_fault+0x64/0x100 arch/x86/mm/fault.c:1516
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0010:rep_movs_alternative+0x4a/0x90 arch/x86/lib/copy_user_64.S:71
Code: 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 29 f8 48 01
RSP: 0018:ffffc900102ff718 EFLAGS: 00050206
RAX: ffffffff84326101 RBX: 1ffff9200205ffc7 RCX: 000000000000a3d0
RDX: 0000000000000000 RSI: ffff888058e85ee8 RDI: 0000200000611000
RBP: ffffc900102ff868 R08: ffff888058e902b7 R09: 1ffff1100b1d2056
R10: dffffc0000000000 R11: ffffed100b1d2057 R12: ffff888058e800e8
R13: 00000000000101d0 R14: 00000000000101d0 R15: ffffc900102ffe48
copy_user_generic arch/x86/include/asm/uaccess_64.h:112 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:133 [inline]
copyout lib/iov_iter.c:168 [inline]
_copy_to_iter+0x24f/0x1110 lib/iov_iter.c:317
__skb_datagram_iter+0xdb/0x780 net/core/datagram.c:419
skb_copy_datagram_iter+0xb1/0x200 net/core/datagram.c:535
skb_copy_datagram_msg include/linux/skbuff.h:4052 [inline]
tipc_recvstream+0x730/0xe90 net/tipc/socket.c:2076
sock_recvmsg_nosec net/socket.c:1047 [inline]
sock_recvmsg net/socket.c:1069 [inline]
____sys_recvmsg+0x2bd/0x5d0 net/socket.c:2814
___sys_recvmsg+0x214/0x590 net/socket.c:2856
__sys_recvmsg net/socket.c:2886 [inline]
__do_sys_recvmsg net/socket.c:2896 [inline]
__se_sys_recvmsg net/socket.c:2893 [inline]
__x64_sys_recvmsg+0x21e/0x2f0 net/socket.c:2893
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f924c79e559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f924a9f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 00007f924ca25fa0 RCX: 00007f924c79e559
RDX: 0000000000001f00 RSI: 0000200000000500 RDI: 0000000000000005
RBP: 00007f924c8358b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f924ca26038 R14: 00007f924ca25fa0 R15: 00007ffebc481e68
BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1381
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6517, name: syz.3.234
preempt_count: 101, expected: 0
RCU nest depth: 2, expected: 0
6 locks held by syz.3.234/6517:
#0: ffff88814cc8c730 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88814cc8c730 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: tipc_wait_for_rcvmsg+0x343/0x640 net/tipc/socket.c:1857
#1: ffff88801886d720 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:165 [inline]
#1: ffff88801886d720 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5380 [inline]
#1: ffff88801886d720 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 mm/memory.c:5440
#2: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#2: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#2: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 mm/pgtable-generic.c:287
#3: ffff888031035558 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff888031035558 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 mm/pgtable-generic.c:375
#4: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#4: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#4: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __mod_lruvec_page_state+0xa5/0x410 mm/memcontrol.c:889
#5: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 6517 Comm: syz.3.234 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
__might_resched+0x48d/0x5f0 kernel/sched/core.c:10212
__synchronize_srcu+0x197/0x3d0 kernel/rcu/srcutree.c:1381
wakeup_source_remove drivers/base/power/wakeup.c:198 [inline]
wakeup_source_unregister+0x116/0x190 drivers/base/power/wakeup.c:242
mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:77
device_release+0xbc/0x1e0 drivers/base/core.c:-1
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x21b/0x450 lib/kobject.c:737
call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x570/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__mod_memcg_lruvec_state+0x19f/0x280 mm/memcontrol.c:854
Code: 49 bf 00 00 00 00 00 fc ff df 42 80 3c 38 00 74 08 4c 89 f7 e8 22 2d f9 ff 4d 8b 36 83 fb 2c 0f 83 c2 00 00 00 65 4f 01 24 ee <48> 8b 7c 24 10 44 89 e6 e8 f4 fb ff ff 48 c7 44 24 20 0e 36 e0 45
RSP: 0018:ffffc900102ff0e0 EFLAGS: 00000202
RAX: 1ffff11004d8b0cc RBX: 0000000000000011 RCX: 16afb37c1c3cac00
RDX: 0000000000000001 RSI: ffffffff8ad6c9e0 RDI: ffffffff8b1d5160
RBP: ffffc900102ff190 R08: ffffea000147bc07 R09: 1ffffd400028f780
R10: dffffc0000000000 R11: fffff9400028f781 R12: 0000000000000001
R13: 0000000000000011 R14: 0000607f470799c0 R15: dffffc0000000000
__mod_lruvec_state mm/memcontrol.c:878 [inline]
__mod_lruvec_page_state+0x1f3/0x410 mm/memcontrol.c:899
__lruvec_stat_mod_folio include/linux/vmstat.h:615 [inline]
folio_add_new_anon_rmap+0x1cf/0x4b0 mm/rmap.c:1292
wp_page_copy mm/memory.c:3163 [inline]
do_wp_page+0x1d1e/0x34d0 mm/memory.c:3469
handle_pte_fault mm/memory.c:5063 [inline]
__handle_mm_fault mm/memory.c:5188 [inline]
handle_mm_fault+0x1306/0x4a50 mm/memory.c:5353
do_user_addr_fault+0x736/0x12d0 arch/x86/mm/fault.c:1371
handle_page_fault arch/x86/mm/fault.c:1463 [inline]
exc_page_fault+0x64/0x100 arch/x86/mm/fault.c:1516
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0010:rep_movs_alternative+0x4a/0x90 arch/x86/lib/copy_user_64.S:71
Code: 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 29 f8 48 01
RSP: 0018:ffffc900102ff718 EFLAGS: 00050206
RAX: ffffffff84326101 RBX: 1ffff9200205ffc7 RCX: 000000000000a3d0
RDX: 0000000000000000 RSI: ffff888058e85ee8 RDI: 0000200000611000
RBP: ffffc900102ff868 R08: ffff888058e902b7 R09: 1ffff1100b1d2056
R10: dffffc0000000000 R11: ffffed100b1d2057 R12: ffff888058e800e8
R13: 00000000000101d0 R14: 00000000000101d0 R15: ffffc900102ffe48
copy_user_generic arch/x86/include/asm/uaccess_64.h:112 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:133 [inline]
copyout lib/iov_iter.c:168 [inline]
_copy_to_iter+0x24f/0x1110 lib/iov_iter.c:317
__skb_datagram_iter+0xdb/0x780 net/core/datagram.c:419
skb_copy_datagram_iter+0xb1/0x200 net/core/datagram.c:535
skb_copy_datagram_msg include/linux/skbuff.h:4052 [inline]
tipc_recvstream+0x730/0xe90 net/tipc/socket.c:2076
sock_recvmsg_nosec net/socket.c:1047 [inline]
sock_recvmsg net/socket.c:1069 [inline]
____sys_recvmsg+0x2bd/0x5d0 net/socket.c:2814
___sys_recvmsg+0x214/0x590 net/socket.c:2856
__sys_recvmsg net/socket.c:2886 [inline]
__do_sys_recvmsg net/socket.c:2896 [inline]
__se_sys_recvmsg net/socket.c:2893 [inline]
__x64_sys_recvmsg+0x21e/0x2f0 net/socket.c:2893
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f924c79e559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f924a9f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 00007f924ca25fa0 RCX: 00007f924c79e559
RDX: 0000000000001f00 RSI: 0000200000000500 RDI: 0000000000000005
RBP: 00007f924c8358b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f924ca26038 R14: 00007f924ca25fa0 R15: 00007ffebc481e68
ODEBUG: object ffffc900001f09c0 is NOT on stack ffffc900102f8000, but annotated.
======================================================
----------------
Code disassembly (best guess):
0: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
7: fc ff df
a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
f: 74 08 je 0x19
11: 4c 89 f7 mov %r14,%rdi
14: e8 22 2d f9 ff call 0xfff92d3b
19: 4d 8b 36 mov (%r14),%r14
1c: 83 fb 2c cmp $0x2c,%ebx
1f: 0f 83 c2 00 00 00 jae 0xe7
25: 65 4f 01 24 ee add %r12,%gs:(%r14,%r13,8)
* 2a: 48 8b 7c 24 10 mov 0x10(%rsp),%rdi <-- trapping instruction
2f: 44 89 e6 mov %r12d,%esi
32: e8 f4 fb ff ff call 0xfffffc2b
37: 48 c7 44 24 20 0e 36 movq $0x45e0360e,0x20(%rsp)
3e: e0 45