should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc_node mm/slab.c:3297 [inline]
 kmem_cache_alloc_node+0x263/0x410 mm/slab.c:3640
 __alloc_skb+0x5c/0x510 net/core/skbuff.c:193
 alloc_skb include/linux/skbuff.h:980 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1159 [inline]
 netlink_sendmsg+0x901/0xb80 net/netlink/af_netlink.c:1853
======================================================
WARNING: possible circular locking dependency detected
4.14.212-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.0/7048 is trying to acquire lock:
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 (&p->lock
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
){+.+.}
, at: [<ffffffff8190e9ea>] seq_read+0xba/0x1120 fs/seq_file.c:165

but task is already holding lock:
 (
sb_writers#3
){.+.+}
, at: [<ffffffff8189017f>] file_start_write include/linux/fs.h:2712 [inline]
, at: [<ffffffff8189017f>] do_sendfile+0x84f/0xb30 fs/read_write.c:1440

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 (
sb_writers#3
){.+.+}
:
       percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline]
       percpu_down_read include/linux/percpu-rwsem.h:59 [inline]
       __sb_start_write+0x64/0x260 fs/super.c:1342
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
       sb_start_write include/linux/fs.h:1549 [inline]
       mnt_want_write+0x3a/0xb0 fs/namespace.c:386
       ovl_create_object+0x75/0x1d0 fs/overlayfs/dir.c:538
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
       lookup_open+0x77a/0x1750 fs/namei.c:3241
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
       do_last fs/namei.c:3334 [inline]
       path_openat+0xe08/0x2970 fs/namei.c:3569
RIP: 0033:0x45e149
       do_filp_open+0x179/0x3c0 fs/namei.c:3603
RSP: 002b:00007f85c16c6c68 EFLAGS: 00000246
       do_sys_open+0x296/0x410 fs/open.c:1081
 ORIG_RAX: 000000000000002e
       do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
       entry_SYSCALL_64_after_hwframe+0x46/0xbb
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003

-> #2
RBP: 00007f85c16c6ca0 R08: 0000000000000000 R09: 0000000000000000
 (
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
&ovl_i_mutex_dir_key[depth]
R13: 00007ffecd7f077f R14: 00007f85c16c79c0 R15: 000000000119c034
#3){++++}:
       down_read+0x36/0x80 kernel/locking/rwsem.c:24
       inode_lock_shared include/linux/fs.h:729 [inline]
       do_last fs/namei.c:3333 [inline]
       path_openat+0x149b/0x2970 fs/namei.c:3569
       do_filp_open+0x179/0x3c0 fs/namei.c:3603
       do_open_execat+0xd3/0x450 fs/exec.c:849
       do_execveat_common+0x711/0x1f30 fs/exec.c:1755
       do_execve fs/exec.c:1860 [inline]
       SYSC_execve fs/exec.c:1941 [inline]
       SyS_execve+0x3b/0x50 fs/exec.c:1936
       do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x46/0xbb

-> #1 (&sig->cred_guard_mutex){+.+.}:
       __mutex_lock_common kernel/locking/mutex.c:756 [inline]
       __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893
       lock_trace fs/proc/base.c:407 [inline]
       proc_pid_stack+0x13f/0x2f0 fs/proc/base.c:457
       proc_single_show+0xe7/0x150 fs/proc/base.c:761
       seq_read+0x4cf/0x1120 fs/seq_file.c:237
       __vfs_read+0xe4/0x620 fs/read_write.c:411
       vfs_read+0x139/0x340 fs/read_write.c:447
       SYSC_read fs/read_write.c:574 [inline]
       SyS_read+0xf2/0x210 fs/read_write.c:567
       do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x46/0xbb

-> #0 (&p->lock){+.+.}:
       lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
       __mutex_lock_common kernel/locking/mutex.c:756 [inline]
       __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893
       seq_read+0xba/0x1120 fs/seq_file.c:165
       do_loop_readv_writev fs/read_write.c:695 [inline]
       do_loop_readv_writev fs/read_write.c:682 [inline]
       do_iter_read+0x3eb/0x5b0 fs/read_write.c:919
       vfs_readv+0xc8/0x120 fs/read_write.c:981
       kernel_readv fs/splice.c:361 [inline]
       default_file_splice_read+0x418/0x910 fs/splice.c:416
       do_splice_to+0xfb/0x140 fs/splice.c:880
       splice_direct_to_actor+0x207/0x730 fs/splice.c:952
       do_splice_direct+0x164/0x210 fs/splice.c:1061
       do_sendfile+0x47f/0xb30 fs/read_write.c:1441
       SYSC_sendfile64 fs/read_write.c:1502 [inline]
       SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
       do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x46/0xbb

other info that might help us debug this:

Chain exists of:
  &p->lock --> &ovl_i_mutex_dir_key[depth]#3 --> sb_writers#3

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(sb_writers#3);
                               lock(&ovl_i_mutex_dir_key[depth]#3);
                               lock(sb_writers#3);
  lock(&p->lock);

 *** DEADLOCK ***

1 lock held by syz-executor.0/7048:
 #0:  (sb_writers#3){.+.+}, at: [<ffffffff8189017f>] file_start_write include/linux/fs.h:2712 [inline]
 #0:  (sb_writers#3){.+.+}, at: [<ffffffff8189017f>] do_sendfile+0x84f/0xb30 fs/read_write.c:1440

stack backtrace:
CPU: 1 PID: 7048 Comm: syz-executor.0 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258
 check_prev_add kernel/locking/lockdep.c:1905 [inline]
 check_prevs_add kernel/locking/lockdep.c:2022 [inline]
 validate_chain kernel/locking/lockdep.c:2464 [inline]
 __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491
 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
 __mutex_lock_common kernel/locking/mutex.c:756 [inline]
 __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893
 seq_read+0xba/0x1120 fs/seq_file.c:165
 do_loop_readv_writev fs/read_write.c:695 [inline]
 do_loop_readv_writev fs/read_write.c:682 [inline]
 do_iter_read+0x3eb/0x5b0 fs/read_write.c:919
 vfs_readv+0xc8/0x120 fs/read_write.c:981
 kernel_readv fs/splice.c:361 [inline]
 default_file_splice_read+0x418/0x910 fs/splice.c:416
 do_splice_to+0xfb/0x140 fs/splice.c:880
 splice_direct_to_actor+0x207/0x730 fs/splice.c:952
 do_splice_direct+0x164/0x210 fs/splice.c:1061
 do_sendfile+0x47f/0xb30 fs/read_write.c:1441
 SYSC_sendfile64 fs/read_write.c:1502 [inline]
 SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007fd256703c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
RBP: 000000000119bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000209 R11: 0000000000000246 R12: 000000000119bf8c
R13: 00007ffc8d772c0f R14: 00007fd2567049c0 R15: 000000000119bf8c
nla_parse: 13 callbacks suppressed
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 7066 Comm: syz-executor.5 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc_node mm/slab.c:3297 [inline]
 kmem_cache_alloc_node_trace+0x25a/0x400 mm/slab.c:3659
 __do_kmalloc_node mm/slab.c:3681 [inline]
 __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696
 __kmalloc_reserve net/core/skbuff.c:137 [inline]
 __alloc_skb+0x96/0x510 net/core/skbuff.c:205
 alloc_skb include/linux/skbuff.h:980 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1159 [inline]
 netlink_sendmsg+0x901/0xb80 net/netlink/af_netlink.c:1853
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007f85c16c6c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f85c16c6ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffecd7f077f R14: 00007f85c16c79c0 R15: 000000000119c034
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 7103 Comm: syz-executor.5 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc mm/slab.c:3376 [inline]
 kmem_cache_alloc+0x40/0x3c0 mm/slab.c:3550
 skb_clone+0x126/0x9a0 net/core/skbuff.c:1282
 __netlink_deliver_tap_skb net/netlink/af_netlink.c:266 [inline]
 __netlink_deliver_tap net/netlink/af_netlink.c:291 [inline]
 netlink_deliver_tap+0x655/0x7d0 net/netlink/af_netlink.c:302
 netlink_deliver_tap_kernel net/netlink/af_netlink.c:311 [inline]
 netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
 netlink_unicast+0x485/0x610 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007f85c16e7c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f85c16e7ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffecd7f077f R14: 00007f85c16e89c0 R15: 000000000119bf8c
cannot load conntrack support for proto=2
cannot load conntrack support for proto=2
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 7214 Comm: syz-executor.5 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc mm/slab.c:3376 [inline]
 kmem_cache_alloc+0x40/0x3c0 mm/slab.c:3550
 skb_clone+0x126/0x9a0 net/core/skbuff.c:1282
 dev_queue_xmit_nit+0x2ee/0x950 net/core/dev.c:1939
 xmit_one net/core/dev.c:3001 [inline]
 dev_hard_start_xmit+0xaa/0x890 net/core/dev.c:3021
 __dev_queue_xmit+0x1d7f/0x2480 net/core/dev.c:3521
 __netlink_deliver_tap_skb net/netlink/af_netlink.c:273 [inline]
 __netlink_deliver_tap net/netlink/af_netlink.c:291 [inline]
 netlink_deliver_tap+0x60c/0x7d0 net/netlink/af_netlink.c:302
 netlink_deliver_tap_kernel net/netlink/af_netlink.c:311 [inline]
 netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
 netlink_unicast+0x485/0x610 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007f85c16c6c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f85c16c6ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 00007ffecd7f077f R14: 00007f85c16c79c0 R15: 000000000119c034
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
EXT4-fs (loop3): can't mount with journal_checksum, fs mounted w/o journal
CPU: 0 PID: 7264 Comm: syz-executor.5 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc mm/slab.c:3376 [inline]
 kmem_cache_alloc_trace+0x29a/0x3d0 mm/slab.c:3616
 kmalloc include/linux/slab.h:488 [inline]
 kzalloc include/linux/slab.h:661 [inline]
 dev_ingress_queue_create+0xa1/0x1c0 net/core/dev.c:8031
 tc_modify_qdisc+0x7b6/0x1250 net/sched/sch_api.c:1337
 rtnetlink_rcv_msg+0x3be/0xb10 net/core/rtnetlink.c:4316
 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2433
 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
 netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007f85c16c6c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f85c16c6ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: 00007ffecd7f077f R14: 00007f85c16c79c0 R15: 000000000119c034
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 7295 Comm: syz-executor.5 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc_node mm/slab.c:3297 [inline]
 kmem_cache_alloc_node_trace+0x25a/0x400 mm/slab.c:3659
 __do_kmalloc_node mm/slab.c:3681 [inline]
 __kmalloc_node+0x38/0x70 mm/slab.c:3689
 kmalloc_node include/linux/slab.h:530 [inline]
 kzalloc_node include/linux/slab.h:672 [inline]
 qdisc_alloc+0xa1/0x550 net/sched/sch_generic.c:609
 qdisc_create+0xa8/0xda0 net/sched/sch_api.c:1026
 tc_modify_qdisc+0x953/0x1250 net/sched/sch_api.c:1420
 rtnetlink_rcv_msg+0x3be/0xb10 net/core/rtnetlink.c:4316
 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2433
 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
 netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007f85c16c6c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f85c16c6ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
R13: 00007ffecd7f077f R14: 00007f85c16c79c0 R15: 000000000119c034
xt_policy: too many policy elements
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
xt_policy: too many policy elements
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 7315 Comm: syz-executor.5 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc_node mm/slab.c:3297 [inline]
 kmem_cache_alloc_node+0x263/0x410 mm/slab.c:3640
 __alloc_skb+0x5c/0x510 net/core/skbuff.c:193
 alloc_skb include/linux/skbuff.h:980 [inline]
 nlmsg_new include/net/netlink.h:511 [inline]
 netlink_ack+0x216/0x9a0 net/netlink/af_netlink.c:2360
 netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2439
 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
 netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007f85c16e7c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f85c16e7ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
R13: 00007ffecd7f077f R14: 00007f85c16e89c0 R15: 000000000119bf8c
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 7352 Comm: syz-executor.5 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc_node mm/slab.c:3297 [inline]
 kmem_cache_alloc_node_trace+0x25a/0x400 mm/slab.c:3659
 __do_kmalloc_node mm/slab.c:3681 [inline]
 __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696
 __kmalloc_reserve net/core/skbuff.c:137 [inline]
 __alloc_skb+0x96/0x510 net/core/skbuff.c:205
 alloc_skb include/linux/skbuff.h:980 [inline]
 nlmsg_new include/net/netlink.h:511 [inline]
 netlink_ack+0x216/0x9a0 net/netlink/af_netlink.c:2360
 netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2439
 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
 netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007f85c16e7c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f85c16e7ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007
R13: 00007ffecd7f077f R14: 00007f85c16e89c0 R15: 000000000119bf8c
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 7372 Comm: syz-executor.5 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc mm/slab.c:3376 [inline]
 kmem_cache_alloc+0x40/0x3c0 mm/slab.c:3550
 skb_clone+0x126/0x9a0 net/core/skbuff.c:1282
 __netlink_deliver_tap_skb net/netlink/af_netlink.c:266 [inline]
 __netlink_deliver_tap net/netlink/af_netlink.c:291 [inline]
 netlink_deliver_tap+0x655/0x7d0 net/netlink/af_netlink.c:302
 __netlink_sendskb net/netlink/af_netlink.c:1231 [inline]
 netlink_sendskb+0x45/0xd0 net/netlink/af_netlink.c:1240
 netlink_unicast+0x50a/0x610 net/netlink/af_netlink.c:1328
 netlink_ack+0x514/0x9a0 net/netlink/af_netlink.c:2403
 netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2439
 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
 netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007f85c16c6c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f85c16c6ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008
R13: 00007ffecd7f077f R14: 00007f85c16c79c0 R15: 000000000119c034
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 7428 Comm: syz-executor.5 Not tainted 4.14.212-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
 should_failslab+0xd6/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc mm/slab.c:3376 [inline]
 kmem_cache_alloc+0x40/0x3c0 mm/slab.c:3550
 skb_clone+0x126/0x9a0 net/core/skbuff.c:1282
 dev_queue_xmit_nit+0x2ee/0x950 net/core/dev.c:1939
 xmit_one net/core/dev.c:3001 [inline]
 dev_hard_start_xmit+0xaa/0x890 net/core/dev.c:3021
 __dev_queue_xmit+0x1d7f/0x2480 net/core/dev.c:3521
 __netlink_deliver_tap_skb net/netlink/af_netlink.c:273 [inline]
 __netlink_deliver_tap net/netlink/af_netlink.c:291 [inline]
 netlink_deliver_tap+0x60c/0x7d0 net/netlink/af_netlink.c:302
 __netlink_sendskb net/netlink/af_netlink.c:1231 [inline]
 netlink_sendskb+0x45/0xd0 net/netlink/af_netlink.c:1240
 netlink_unicast+0x50a/0x610 net/netlink/af_netlink.c:1328
 netlink_ack+0x514/0x9a0 net/netlink/af_netlink.c:2403
 netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2439
 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
 netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:656
 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062
 __sys_sendmsg+0xa3/0x120 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x27/0x40 net/socket.c:2103
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e149
RSP: 002b:00007f85c16e7c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e149
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00007f85c16e7ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009
R13: 00007ffecd7f077f R14: 00007f85c16e89c0 R15: 000000000119bf8c
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
nla_parse: 1 callbacks suppressed
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 36 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 100 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 36 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 100 bytes leftover after parsing attributes in process `syz-executor.5'.