=============================
[ BUG: Invalid wait context ]
6.13.0-rc2-syzkaller-00292-ga446e965a188 #0 Not tainted
-----------------------------
syz.3.180/6580 is trying to lock:
ffff8880b863a930 (batched_entropy_u8.lock){..-.}-{3:3}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
ffff8880b863a930 (batched_entropy_u8.lock){..-.}-{3:3}, at: get_random_u8+0x1a0/0xaa0 drivers/char/random.c:551
other info that might help us debug this:
context-{2:2}
1 lock held by syz.3.180/6580:
#0: ffff88802ceff950 (&u->iolock){+.+.}-{4:4}, at: __unix_dgram_recvmsg+0x246/0x12f0 net/unix/af_unix.c:2433
stack backtrace:
CPU: 0 UID: 0 PID: 6580 Comm: syz.3.180 Not tainted 6.13.0-rc2-syzkaller-00292-ga446e965a188 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline]
check_wait_context kernel/locking/lockdep.c:4898 [inline]
__lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5176
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
get_random_u8+0x1bd/0xaa0 drivers/char/random.c:551
get_random_u32_below include/linux/random.h:78 [inline]
kfence_guarded_alloc+0x9c/0xcd0 mm/kfence/core.c:421
__kfence_alloc+0x344/0x370 mm/kfence/core.c:1136
kfence_alloc include/linux/kfence.h:129 [inline]
slab_alloc_node mm/slub.c:4152 [inline]
__kmalloc_cache_noprof+0x2dd/0x390 mm/slub.c:4324
kmalloc_noprof include/linux/slab.h:901 [inline]
add_stack_record_to_list mm/page_owner.c:172 [inline]
inc_stack_record_count mm/page_owner.c:214 [inline]
__set_page_owner+0x55f/0x800 mm/page_owner.c:329
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
prep_new_page mm/page_alloc.c:1564 [inline]
get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2269
stack_depot_save_flags+0x72d/0x940 lib/stackdepot.c:627
kasan_save_stack+0x4f/0x60 mm/kasan/common.c:48
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
task_work_add+0xd9/0x490 kernel/task_work.c:77
__run_posix_cpu_timers kernel/time/posix-cpu-timers.c:1223 [inline]
run_posix_cpu_timers+0x6ac/0x810 kernel/time/posix-cpu-timers.c:1422
tick_sched_handle kernel/time/tick-sched.c:276 [inline]
tick_nohz_handler+0x37c/0x500 kernel/time/tick-sched.c:297
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x551/0xd30 kernel/time/hrtimer.c:1803
hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1865
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
__sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x5a/0xb0 kernel/rcu/tree.c:737
Code: f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 9c 3b 7e 00 48 c7 c3 d8 7c 03 00 49 03 1e 48 89 d8 48 c1 e8 03 42 0f b6 04 38 <84> c0 75 22 8b 03 65 ff 0d f1 da 7e 7e 74 10 83 e0 04 c1 e8 02 5b
RSP: 0018:ffffc900032b76a8 EFLAGS: 00000a02
RAX: 0000000000000000 RBX: ffff8880b8637cd8 RCX: ffffffff89884995
RDX: ffff888034679e00 RSI: ffffffff8c5ec400 RDI: ffffffff8c5ec3c0
RBP: 0000000000000001 R08: ffffffff898849bb R09: 1ffffffff203079e
R10: dffffc0000000000 R11: fffffbfff203079f R12: ffff888064902c80
R13: 0000000000000000 R14: ffffffff8e2cea90 R15: dffffc0000000000
trace_skb_copy_datagram_iovec include/trace/events/skb.h:76 [inline]
skb_copy_datagram_iter+0x94/0x250 net/core/datagram.c:537
skb_copy_datagram_msg include/linux/skbuff.h:4115 [inline]
__unix_dgram_recvmsg+0x7e3/0x12f0 net/unix/af_unix.c:2480
sock_recvmsg_nosec+0x18e/0x1d0 net/socket.c:1033
____sys_recvmsg+0x3cd/0x480 net/socket.c:2801
___sys_recvmsg net/socket.c:2845 [inline]
do_recvmmsg+0x426/0xab0 net/socket.c:2940
__sys_recvmmsg net/socket.c:3014 [inline]
__do_sys_recvmmsg net/socket.c:3037 [inline]
__se_sys_recvmmsg net/socket.c:3030 [inline]
__x64_sys_recvmmsg+0x199/0x250 net/socket.c:3030
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f94cc985d19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f94cd73c038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f94ccb76080 RCX: 00007f94cc985d19
RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000005
RBP: 00007f94cca01a20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f94ccb76080 R15: 00007ffd4768bea8
----------------
Code disassembly (best guess):
0: f0 48 c1 e8 03 lock shr $0x3,%rax
5: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
a: 74 08 je 0x14
c: 4c 89 f7 mov %r14,%rdi
f: e8 9c 3b 7e 00 call 0x7e3bb0
14: 48 c7 c3 d8 7c 03 00 mov $0x37cd8,%rbx
1b: 49 03 1e add (%r14),%rbx
1e: 48 89 d8 mov %rbx,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax
* 2a: 84 c0 test %al,%al <-- trapping instruction
2c: 75 22 jne 0x50
2e: 8b 03 mov (%rbx),%eax
30: 65 ff 0d f1 da 7e 7e decl %gs:0x7e7edaf1(%rip) # 0x7e7edb28
37: 74 10 je 0x49
39: 83 e0 04 and $0x4,%eax
3c: c1 e8 02 shr $0x2,%eax
3f: 5b pop %rbx