syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 CPU: 0 PID: 12128 Comm: syz-executor.1 Not tainted 6.0.0-rc1-next-20220818-syzkaller #0 BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1521 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 12128, name: syz-executor.1 preempt_count: 0, expected: 0 RCU nest depth: 0, expected: 0 3 locks held by syz-executor.1/12128: #0: ffff888026593228 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #0: ffff888026593228 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x276/0x1210 arch/x86/mm/fault.c:1340 #1: ffffffff8c0fdc00 (memcg_oom_lock#2){+.+.}-{0:0}, at: mem_cgroup_oom mm/memcontrol.c:1876 [inline] #1: ffffffff8c0fdc00 (memcg_oom_lock#2){+.+.}-{0:0}, at: try_charge_memcg+0xe85/0x1300 mm/memcontrol.c:2675 #2: ffffffff8c0780a8 (oom_lock){+.+.}-{3:3}, at: mem_cgroup_out_of_memory+0x8d/0x270 mm/memcontrol.c:1642 irq event stamp: 226166 hardirqs last enabled at (226165): [] __up_console_sem+0xae/0xc0 kernel/printk/printk.c:264 hardirqs last disabled at (226166): [] dump_stack_lvl+0x2e/0x134 lib/dump_stack.c:139 softirqs last enabled at (226154): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last enabled at (226154): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 softirqs last disabled at (226123): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last disabled at (226123): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 CPU: 0 PID: 12128 Comm: syz-executor.1 Not tainted 6.0.0-rc1-next-20220818-syzkaller #0 ============================================ WARNING: possible recursive locking detected 6.0.0-rc1-next-20220818-syzkaller #0 Not tainted -------------------------------------------- syz-executor.1/12128 is trying to acquire lock: ffff888026593228 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:126 [inline] ffff888026593228 (&mm->mmap_lock#2){++++}-{3:3}, at: __access_remote_vm+0xac/0x6f0 mm/memory.c:5461 but task is already holding lock: ffff888026593228 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] ffff888026593228 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x276/0x1210 arch/x86/mm/fault.c:1340 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&mm->mmap_lock#2); lock(&mm->mmap_lock#2); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by syz-executor.1/12128: #0: ffff888026593228 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #0: ffff888026593228 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x276/0x1210 arch/x86/mm/fault.c:1340 #1: ffffffff8c0fdc00 (memcg_oom_lock#2){+.+.}-{0:0}, at: mem_cgroup_oom mm/memcontrol.c:1876 [inline] #1: ffffffff8c0fdc00 (memcg_oom_lock#2){+.+.}-{0:0}, at: try_charge_memcg+0xe85/0x1300 mm/memcontrol.c:2675 #2: ffffffff8c0780a8 (oom_lock){+.+.}-{3:3}, at: mem_cgroup_out_of_memory+0x8d/0x270 mm/memcontrol.c:1642 stack backtrace: CPU: 0 PID: 12128 Comm: syz-executor.1 Not tainted 6.0.0-rc1-next-20220818-syzkaller #0 syz-executor.1[12128] cmdline: /root/syz-executor.1 exec Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Call Trace: __dump_stack lib/dump_stack.c:122 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:140 print_deadlock_bug kernel/locking/lockdep.c:2988 [inline] check_deadlock kernel/locking/lockdep.c:3031 [inline] validate_chain kernel/locking/lockdep.c:3816 [inline] __lock_acquire.cold+0x116/0x3a7 kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5666 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631 down_read_killable+0x9b/0x490 kernel/locking/rwsem.c:1522 mmap_read_lock_killable include/linux/mmap_lock.h:126 [inline] __access_remote_vm+0xac/0x6f0 mm/memory.c:5461 get_mm_cmdline.part.0+0x217/0x620 fs/proc/base.c:299 get_mm_cmdline fs/proc/base.c:367 [inline] get_task_cmdline_kernel+0x1d9/0x220 fs/proc/base.c:367 dump_stack_print_cmdline.part.0+0x82/0x150 lib/dump_stack.c:61 dump_stack_print_cmdline lib/dump_stack.c:89 [inline] dump_stack_print_info+0x185/0x190 lib/dump_stack.c:97 __dump_stack lib/dump_stack.c:121 [inline] dump_stack_lvl+0xc1/0x134 lib/dump_stack.c:140 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9896 down_read_killable+0x75/0x490 kernel/locking/rwsem.c:1521 mmap_read_lock_killable include/linux/mmap_lock.h:126 [inline] __access_remote_vm+0xac/0x6f0 mm/memory.c:5461 get_mm_cmdline.part.0+0x217/0x620 fs/proc/base.c:299 get_mm_cmdline fs/proc/base.c:367 [inline] get_task_cmdline_kernel+0x1d9/0x220 fs/proc/base.c:367 dump_stack_print_cmdline.part.0+0x82/0x150 lib/dump_stack.c:61 dump_stack_print_cmdline lib/dump_stack.c:89 [inline] dump_stack_print_info+0x185/0x190 lib/dump_stack.c:97 __dump_stack lib/dump_stack.c:121 [inline] dump_stack_lvl+0xc1/0x134 lib/dump_stack.c:140 dump_header+0x10b/0x7f9 mm/oom_kill.c:460 oom_kill_process.cold+0x10/0x15 mm/oom_kill.c:1036 out_of_memory+0x358/0x14a0 mm/oom_kill.c:1174 mem_cgroup_out_of_memory+0x206/0x270 mm/memcontrol.c:1652 mem_cgroup_oom mm/memcontrol.c:1882 [inline] try_charge_memcg+0xf13/0x1300 mm/memcontrol.c:2675 try_charge mm/memcontrol.c:2769 [inline] charge_memcg+0x31/0x320 mm/memcontrol.c:6816 __mem_cgroup_charge+0x27/0x90 mm/memcontrol.c:6837 mem_cgroup_charge include/linux/memcontrol.h:696 [inline] wp_page_copy+0x27c/0x1b60 mm/memory.c:3122 do_wp_page+0x1d1/0x1910 mm/memory.c:3393 handle_pte_fault mm/memory.c:4926 [inline] __handle_mm_fault+0x184b/0x3a90 mm/memory.c:5050 handle_mm_fault+0x1c8/0x780 mm/memory.c:5171 do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1399 handle_page_fault arch/x86/mm/fault.c:1490 [inline] exc_page_fault+0x94/0x170 arch/x86/mm/fault.c:1546 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:__put_user_nocheck_4+0x3/0x11 Code: 00 00 48 39 d9 73 54 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 0f 1f 44 00 00 48 bb fd ef ff ff ff 7f 00 00 48 39 d9 73 34 0f 01 cb <89> 01 31 c9 0f 01 ca c3 66 0f 1f 44 00 00 48 bb f9 ef ff ff ff 7f RSP: 0018:ffffc9000426fa00 EFLAGS: 00050246 RAX: 0000000000000000 RBX: ffffc9000426fdf4 RCX: 0000000020322030 RDX: 0000000000000000 RSI: ffffffff874ce9f5 RDI: 0000000000000005 RBP: ffffc9000426fdb0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: 0000000020322030 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 ____sys_recvmsg+0x3b4/0x600 net/socket.c:2714 ___sys_recvmsg+0xf2/0x180 net/socket.c:2743 do_recvmmsg+0x25e/0x6e0 net/socket.c:2837 __sys_recvmmsg net/socket.c:2916 [inline] __do_sys_recvmmsg net/socket.c:2939 [inline] __se_sys_recvmmsg net/socket.c:2932 [inline] __x64_sys_recvmmsg+0x20b/0x260 net/socket.c:2932 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fe528889279 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe52990a168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007fe52899c050 RCX: 00007fe528889279 RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007fe5288e3189 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffb21f7e3f R14: 00007fe52990a300 R15: 0000000000022000 syz-executor.1[12128] cmdline: /root/syz-executor.1 exec Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Call Trace: __dump_stack lib/dump_stack.c:122 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:140 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9896 down_read_killable+0x75/0x490 kernel/locking/rwsem.c:1521 mmap_read_lock_killable include/linux/mmap_lock.h:126 [inline] __access_remote_vm+0xac/0x6f0 mm/memory.c:5461 get_mm_cmdline.part.0+0x217/0x620 fs/proc/base.c:299 get_mm_cmdline fs/proc/base.c:367 [inline] get_task_cmdline_kernel+0x1d9/0x220 fs/proc/base.c:367 dump_stack_print_cmdline.part.0+0x82/0x150 lib/dump_stack.c:61 dump_stack_print_cmdline lib/dump_stack.c:89 [inline] dump_stack_print_info+0x185/0x190 lib/dump_stack.c:97 __dump_stack lib/dump_stack.c:121 [inline] dump_stack_lvl+0xc1/0x134 lib/dump_stack.c:140 dump_header+0x10b/0x7f9 mm/oom_kill.c:460 oom_kill_process.cold+0x10/0x15 mm/oom_kill.c:1036 out_of_memory+0x358/0x14a0 mm/oom_kill.c:1174 mem_cgroup_out_of_memory+0x206/0x270 mm/memcontrol.c:1652 mem_cgroup_oom mm/memcontrol.c:1882 [inline] try_charge_memcg+0xf13/0x1300 mm/memcontrol.c:2675 try_charge mm/memcontrol.c:2769 [inline] charge_memcg+0x31/0x320 mm/memcontrol.c:6816 __mem_cgroup_charge+0x27/0x90 mm/memcontrol.c:6837 mem_cgroup_charge include/linux/memcontrol.h:696 [inline] wp_page_copy+0x27c/0x1b60 mm/memory.c:3122 do_wp_page+0x1d1/0x1910 mm/memory.c:3393 handle_pte_fault mm/memory.c:4926 [inline] __handle_mm_fault+0x184b/0x3a90 mm/memory.c:5050 handle_mm_fault+0x1c8/0x780 mm/memory.c:5171 do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1399 handle_page_fault arch/x86/mm/fault.c:1490 [inline] exc_page_fault+0x94/0x170 arch/x86/mm/fault.c:1546 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:__put_user_nocheck_4+0x3/0x11 Code: 00 00 48 39 d9 73 54 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 0f 1f 44 00 00 48 bb fd ef ff ff ff 7f 00 00 48 39 d9 73 34 0f 01 cb <89> 01 31 c9 0f 01 ca c3 66 0f 1f 44 00 00 48 bb f9 ef ff ff ff 7f RSP: 0018:ffffc9000426fa00 EFLAGS: 00050246 RAX: 0000000000000000 RBX: ffffc9000426fdf4 RCX: 0000000020322030 RDX: 0000000000000000 RSI: ffffffff874ce9f5 RDI: 0000000000000005 RBP: ffffc9000426fdb0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: 0000000020322030 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 ____sys_recvmsg+0x3b4/0x600 net/socket.c:2714 ___sys_recvmsg+0xf2/0x180 net/socket.c:2743 do_recvmmsg+0x25e/0x6e0 net/socket.c:2837 __sys_recvmmsg net/socket.c:2916 [inline] __do_sys_recvmmsg net/socket.c:2939 [inline] __se_sys_recvmmsg net/socket.c:2932 [inline] __x64_sys_recvmmsg+0x20b/0x260 net/socket.c:2932 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fe528889279 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe52990a168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007fe52899c050 RCX: 00007fe528889279 RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007fe5288e3189 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffb21f7e3f R14: 00007fe52990a300 R15: 0000000000022000 BUG: sleeping function called from invalid context at mm/gup.c:1215 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 12128, name: syz-executor.1 preempt_count: 0, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 226166 hardirqs last enabled at (226165): [] __up_console_sem+0xae/0xc0 kernel/printk/printk.c:264 hardirqs last disabled at (226166): [] dump_stack_lvl+0x2e/0x134 lib/dump_stack.c:139 softirqs last enabled at (226154): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last enabled at (226154): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 softirqs last disabled at (226123): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last disabled at (226123): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 CPU: 0 PID: 12128 Comm: syz-executor.1 Tainted: G W 6.0.0-rc1-next-20220818-syzkaller #0 syz-executor.1[12128] cmdline: /root/syz-executor.1 exec Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Call Trace: __dump_stack lib/dump_stack.c:122 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:140 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9896 __get_user_pages+0x451/0xfd0 mm/gup.c:1215 __get_user_pages_locked mm/gup.c:1423 [inline] __get_user_pages_remote+0x18f/0x830 mm/gup.c:2133 get_user_pages_remote+0x84/0xc0 mm/gup.c:2206 __access_remote_vm+0x275/0x6f0 mm/memory.c:5470 get_mm_cmdline.part.0+0x217/0x620 fs/proc/base.c:299 get_mm_cmdline fs/proc/base.c:367 [inline] get_task_cmdline_kernel+0x1d9/0x220 fs/proc/base.c:367 dump_stack_print_cmdline.part.0+0x82/0x150 lib/dump_stack.c:61 dump_stack_print_cmdline lib/dump_stack.c:89 [inline] dump_stack_print_info+0x185/0x190 lib/dump_stack.c:97 __dump_stack lib/dump_stack.c:121 [inline] dump_stack_lvl+0xc1/0x134 lib/dump_stack.c:140 dump_header+0x10b/0x7f9 mm/oom_kill.c:460 oom_kill_process.cold+0x10/0x15 mm/oom_kill.c:1036 out_of_memory+0x358/0x14a0 mm/oom_kill.c:1174 mem_cgroup_out_of_memory+0x206/0x270 mm/memcontrol.c:1652 mem_cgroup_oom mm/memcontrol.c:1882 [inline] try_charge_memcg+0xf13/0x1300 mm/memcontrol.c:2675 try_charge mm/memcontrol.c:2769 [inline] charge_memcg+0x31/0x320 mm/memcontrol.c:6816 __mem_cgroup_charge+0x27/0x90 mm/memcontrol.c:6837 mem_cgroup_charge include/linux/memcontrol.h:696 [inline] wp_page_copy+0x27c/0x1b60 mm/memory.c:3122 do_wp_page+0x1d1/0x1910 mm/memory.c:3393 handle_pte_fault mm/memory.c:4926 [inline] __handle_mm_fault+0x184b/0x3a90 mm/memory.c:5050 handle_mm_fault+0x1c8/0x780 mm/memory.c:5171 do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1399 handle_page_fault arch/x86/mm/fault.c:1490 [inline] exc_page_fault+0x94/0x170 arch/x86/mm/fault.c:1546 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:__put_user_nocheck_4+0x3/0x11 Code: 00 00 48 39 d9 73 54 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 0f 1f 44 00 00 48 bb fd ef ff ff ff 7f 00 00 48 39 d9 73 34 0f 01 cb <89> 01 31 c9 0f 01 ca c3 66 0f 1f 44 00 00 48 bb f9 ef ff ff ff 7f RSP: 0018:ffffc9000426fa00 EFLAGS: 00050246 RAX: 0000000000000000 RBX: ffffc9000426fdf4 RCX: 0000000020322030 RDX: 0000000000000000 RSI: ffffffff874ce9f5 RDI: 0000000000000005 RBP: ffffc9000426fdb0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: 0000000020322030 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 ____sys_recvmsg+0x3b4/0x600 net/socket.c:2714 ___sys_recvmsg+0xf2/0x180 net/socket.c:2743 do_recvmmsg+0x25e/0x6e0 net/socket.c:2837 __sys_recvmmsg net/socket.c:2916 [inline] __do_sys_recvmmsg net/socket.c:2939 [inline] __se_sys_recvmmsg net/socket.c:2932 [inline] __x64_sys_recvmmsg+0x20b/0x260 net/socket.c:2932 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fe528889279 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe52990a168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007fe52899c050 RCX: 00007fe528889279 RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007fe5288e3189 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffb21f7e3f R14: 00007fe52990a300 R15: 0000000000022000 syz-executor.1[12128] cmdline: /root/syz-executor.1 exec Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Call Trace: __dump_stack lib/dump_stack.c:122 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:140 dump_header+0x10b/0x7f9 mm/oom_kill.c:460 oom_kill_process.cold+0x10/0x15 mm/oom_kill.c:1036 out_of_memory+0x358/0x14a0 mm/oom_kill.c:1174 mem_cgroup_out_of_memory+0x206/0x270 mm/memcontrol.c:1652 mem_cgroup_oom mm/memcontrol.c:1882 [inline] try_charge_memcg+0xf13/0x1300 mm/memcontrol.c:2675 try_charge mm/memcontrol.c:2769 [inline] charge_memcg+0x31/0x320 mm/memcontrol.c:6816 __mem_cgroup_charge+0x27/0x90 mm/memcontrol.c:6837 mem_cgroup_charge include/linux/memcontrol.h:696 [inline] wp_page_copy+0x27c/0x1b60 mm/memory.c:3122 do_wp_page+0x1d1/0x1910 mm/memory.c:3393 handle_pte_fault mm/memory.c:4926 [inline] __handle_mm_fault+0x184b/0x3a90 mm/memory.c:5050 handle_mm_fault+0x1c8/0x780 mm/memory.c:5171 do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1399 handle_page_fault arch/x86/mm/fault.c:1490 [inline] exc_page_fault+0x94/0x170 arch/x86/mm/fault.c:1546 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:__put_user_nocheck_4+0x3/0x11 Code: 00 00 48 39 d9 73 54 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 0f 1f 44 00 00 48 bb fd ef ff ff ff 7f 00 00 48 39 d9 73 34 0f 01 cb <89> 01 31 c9 0f 01 ca c3 66 0f 1f 44 00 00 48 bb f9 ef ff ff ff 7f RSP: 0018:ffffc9000426fa00 EFLAGS: 00050246 RAX: 0000000000000000 RBX: ffffc9000426fdf4 RCX: 0000000020322030 RDX: 0000000000000000 RSI: ffffffff874ce9f5 RDI: 0000000000000005 RBP: ffffc9000426fdb0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: 0000000020322030 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 ____sys_recvmsg+0x3b4/0x600 net/socket.c:2714 ___sys_recvmsg+0xf2/0x180 net/socket.c:2743 do_recvmmsg+0x25e/0x6e0 net/socket.c:2837 __sys_recvmmsg net/socket.c:2916 [inline] __do_sys_recvmmsg net/socket.c:2939 [inline] __se_sys_recvmmsg net/socket.c:2932 [inline] __x64_sys_recvmmsg+0x20b/0x260 net/socket.c:2932 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fe528889279 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe52990a168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007fe52899c050 RCX: 00007fe528889279 RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007fe5288e3189 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffb21f7e3f R14: 00007fe52990a300 R15: 0000000000022000 memory: usage 16384kB, limit 16384kB, failcnt 6606 swap: usage 0kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /syz1: anon 3686400 file 10481664 kernel 2609152 kernel_stack 229376 pagetables 258048 percpu 28416 sock 0 vmalloc 0 shmem 10469376 zswap 0 zswapped 0 file_mapped 434176 file_dirty 0 file_writeback 0 swapcached 0 anon_thp 0 file_thp 0 shmem_thp 0 inactive_anon 13701120 active_anon 454656 inactive_file 8192 active_file 4096 unevictable 0 slab_reclaimable 80496 slab_unreclaimable 1949336 slab 2029832 oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=12122,uid=0 Memory cgroup out of memory: Killed process 12122 (syz-executor.1) total-vm:56820kB, anon-rss:3564kB, file-rss:8192kB, shmem-rss:0kB, UID:0 pgtables:88kB oom_score_adj:0 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 48 39 d9 cmp %rbx,%rcx 5: 73 54 jae 0x5b 7: 0f 01 cb stac a: 66 89 01 mov %ax,(%rcx) d: 31 c9 xor %ecx,%ecx f: 0f 01 ca clac 12: c3 retq 13: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 18: 48 bb fd ef ff ff ff movabs $0x7fffffffeffd,%rbx 1f: 7f 00 00 22: 48 39 d9 cmp %rbx,%rcx 25: 73 34 jae 0x5b 27: 0f 01 cb stac * 2a: 89 01 mov %eax,(%rcx) <-- trapping instruction 2c: 31 c9 xor %ecx,%ecx 2e: 0f 01 ca clac 31: c3 retq 32: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 38: 48 rex.W 39: bb f9 ef ff ff mov $0xffffeff9,%ebx 3e: ff (bad) 3f: 7f .byte 0x7f