=============================
[ BUG: Invalid wait context ]
6.13.0-rc1-syzkaller-00035-ge10500b69c3f #0 Not tainted
-----------------------------
syz.2.176/6618 is trying to lock:
ffff88813fffc298 (&zone->lock){-.-.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:2907 [inline]
ffff88813fffc298 (&zone->lock){-.-.}-{3:3}, at: rmqueue mm/page_alloc.c:3080 [inline]
ffff88813fffc298 (&zone->lock){-.-.}-{3:3}, at: get_page_from_freelist+0xb3d/0x37a0 mm/page_alloc.c:3471
other info that might help us debug this:
context-{3:3}
6 locks held by syz.2.176/6618:
#0: ffff88802987e420 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x2260/0x3100 fs/coredump.c:757
#1: ffff88807bda3d90 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline]
#1: ffff88807bda3d90 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: shmem_file_write_iter+0x80/0x120 mm/shmem.c:3283
#2: ffff8880b8644958 (&pcp->lock){+.+.}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline]
#2: ffff8880b8644958 (&pcp->lock){+.+.}-{3:3}, at: rmqueue_pcplist mm/page_alloc.c:3030 [inline]
#2: ffff8880b8644958 (&pcp->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3074 [inline]
#2: ffff8880b8644958 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x7d3/0x37a0 mm/page_alloc.c:3471
#3: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#3: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8e937aa0 (rcu_read_lock){....}-{1:3}, at: ieee80211_iterate_active_interfaces_atomic+0x2a/0x170 net/mac80211/util.c:810
#4: ffffffff8f521a78 (hwsim_radio_lock){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#4: ffffffff8f521a78 (hwsim_radio_lock){+.-.}-{3:3}, at: mac80211_hwsim_tx_frame_no_nl+0x982/0x18d0 drivers/net/wireless/virtual/mac80211_hwsim.c:1817
#5: ffff8880b863e8d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
stack backtrace:
CPU: 0 UID: 0 PID: 6618 Comm: syz.2.176 Not tainted 6.13.0-rc1-syzkaller-00035-ge10500b69c3f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline]
check_wait_context kernel/locking/lockdep.c:4898 [inline]
__lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5176
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
rmqueue_buddy mm/page_alloc.c:2907 [inline]
rmqueue mm/page_alloc.c:3080 [inline]
get_page_from_freelist+0xb3d/0x37a0 mm/page_alloc.c:3471
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
stack_depot_save_flags+0x666/0x830 lib/stackdepot.c:627
kasan_save_stack+0x4f/0x60 mm/kasan/common.c:48
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
task_work_add+0xd9/0x490 kernel/task_work.c:77
task_tick_numa kernel/sched/fair.c:3607 [inline]
task_tick_fair+0x58c/0x7b0 kernel/sched/fair.c:13054
sched_tick+0x21e/0x660 kernel/sched/core.c:5652
update_process_times+0x276/0x2f0 kernel/time/timer.c:2524
tick_sched_handle kernel/time/tick-sched.c:276 [inline]
tick_nohz_handler+0x37c/0x500 kernel/time/tick-sched.c:297
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x551/0xd30 kernel/time/hrtimer.c:1803
hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1865
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
__sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:___slab_alloc+0x4f7/0x14b0 mm/slub.c:3745
Code: e9 78 fb ff ff e8 39 cb d1 09 f7 c3 00 02 00 00 74 18 e9 8e fe ff ff 48 c7 43 10 00 00 00 00 4c 89 ff 48 89 de e8 f9 15 00 00 <49> 83 7c 24 18 00 0f 84 89 06 00 00 48 c7 44 24 60 00 00 00 00 9c
RSP: 0018:ffffc90000007620 EFLAGS: 00000206
RAX: 320f3a3263842c00 RBX: 0000000000000246 RCX: ffffffff817b246a
RDX: dffffc0000000000 RSI: ffffffff8c0a9680 RDI: ffffffff8c5f6660
RBP: ffff8880b8646bf0 R08: ffffffff942b88ff R09: 1ffffffff285711f
R10: dffffc0000000000 R11: fffffbfff2857120 R12: ffff8880b8646bd0
R13: ffff88802bbe9e00 R14: 00000000ffffffff R15: ffff888141699a00
__slab_alloc+0x58/0xa0 mm/slub.c:3905
__slab_alloc_node mm/slub.c:3980 [inline]
slab_alloc_node mm/slub.c:4141 [inline]
kmem_cache_alloc_node_noprof+0x269/0x380 mm/slub.c:4205
kmalloc_reserve+0xa8/0x2a0 net/core/skbuff.c:587
__alloc_skb+0x1f3/0x440 net/core/skbuff.c:678
skb_copy+0x19d/0x9c0 net/core/skbuff.c:2159
mac80211_hwsim_tx_frame_no_nl+0x106b/0x18d0 drivers/net/wireless/virtual/mac80211_hwsim.c:1866
mac80211_hwsim_tx_frame+0x1cc/0x220 drivers/net/wireless/virtual/mac80211_hwsim.c:2215
mac80211_hwsim_beacon_tx+0x3bf/0x850 drivers/net/wireless/virtual/mac80211_hwsim.c:2315
__iterate_interfaces+0x297/0x570 net/mac80211/util.c:775
ieee80211_iterate_active_interfaces_atomic+0xd8/0x170 net/mac80211/util.c:811
mac80211_hwsim_beacon+0xd4/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim.c:2345
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x59b/0xd30 kernel/time/hrtimer.c:1803
hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:655
irq_exit_rcu+0x9/0x30 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 7e 48 37 f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 43 64 9a f5 65 8b 05 24 b6 30 74 85 c0 74 43 48 c7 04 24 0e 36
RSP: 0018:ffffc900041de560 EFLAGS: 00000206
RAX: 320f3a3263842c00 RBX: 1ffff9200083bcb0 RCX: ffffffff817b246a
RDX: dffffc0000000000 RSI: ffffffff8c0a9680 RDI: 0000000000000001
RBP: ffffc900041de5f8 R08: ffffffff942b8887 R09: 1ffffffff2857110
R10: dffffc0000000000 R11: fffffbfff2857111 R12: dffffc0000000000
R13: 1ffff9200083bcac R14: ffffc900041de580 R15: 0000000000000246
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
rmqueue_bulk mm/page_alloc.c:2326 [inline]
__rmqueue_pcplist+0x21fd/0x2a90 mm/page_alloc.c:3001
rmqueue_pcplist mm/page_alloc.c:3043 [inline]
rmqueue mm/page_alloc.c:3074 [inline]
get_page_from_freelist+0x886/0x37a0 mm/page_alloc.c:3471
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
folio_alloc_mpol_noprof+0x36/0x50 mm/mempolicy.c:2283
shmem_alloc_folio mm/shmem.c:1794 [inline]
shmem_alloc_and_add_folio+0x49b/0x13d0 mm/shmem.c:1833
shmem_get_folio_gfp+0x5a9/0x20a0 mm/shmem.c:2355
shmem_get_folio mm/shmem.c:2461 [inline]
shmem_write_begin+0x17e/0x460 mm/shmem.c:3117
generic_perform_write+0x344/0x6d0 mm/filemap.c:4055
shmem_file_write_iter+0xf9/0x120 mm/shmem.c:3293
__kernel_write_iter+0x42a/0x940 fs/read_write.c:612
dump_emit_page fs/coredump.c:884 [inline]
dump_user_range+0x4f1/0x970 fs/coredump.c:945
elf_core_dump+0x3e9f/0x4790 fs/binfmt_elf.c:2129
do_coredump+0x229b/0x3100 fs/coredump.c:758
get_signal+0x140b/0x1750 kernel/signal.c:3002
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
irqentry_exit_to_user_mode+0x7e/0x250 kernel/entry/common.c:231
exc_page_fault+0x590/0x8b0 arch/x86/mm/fault.c:1542
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 002b:0000000020000288 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fb0e2346080 RCX: 00007fb0e217fed9
RDX: 00000000200002c0 RSI: 0000000020000280 RDI: 0000000080000000
RBP: 00007fb0e21f3cc8 R08: 0000000020000580 R09: 0000000020000580
R10: 0000000020000300 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fb0e2346080 R15: 00007fffbc1acf58
----------------
Code disassembly (best guess):
0: e9 78 fb ff ff jmp 0xfffffb7d
5: e8 39 cb d1 09 call 0x9d1cb43
a: f7 c3 00 02 00 00 test $0x200,%ebx
10: 74 18 je 0x2a
12: e9 8e fe ff ff jmp 0xfffffea5
17: 48 c7 43 10 00 00 00 movq $0x0,0x10(%rbx)
1e: 00
1f: 4c 89 ff mov %r15,%rdi
22: 48 89 de mov %rbx,%rsi
25: e8 f9 15 00 00 call 0x1623
* 2a: 49 83 7c 24 18 00 cmpq $0x0,0x18(%r12) <-- trapping instruction
30: 0f 84 89 06 00 00 je 0x6bf
36: 48 c7 44 24 60 00 00 movq $0x0,0x60(%rsp)
3d: 00 00
3f: 9c pushf