FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
======================================================
WARNING: possible circular locking dependency detected
6.14.0-rc7-syzkaller-00205-g586de92313fc #0 Not tainted
------------------------------------------------------
syz.7.6609/29735 is trying to acquire lock:
ffffffff8e0ca600 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x9f/0xd0 kernel/printk/printk.c:1924

but task is already holding lock:
ffff88802b63ed58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:606 [inline]
ffff88802b63ed58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:591

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #4 (&rq->__lock){-.-.}-{2:2}:
       _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
       raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598
       raw_spin_rq_lock kernel/sched/sched.h:1521 [inline]
       task_rq_lock+0xcf/0x3b0 kernel/sched/core.c:700
       cgroup_move_task+0x82/0x250 kernel/sched/psi.c:1161
       css_set_move_task+0x288/0x5f0 kernel/cgroup/cgroup.c:898
       cgroup_post_fork+0x202/0x9d0 kernel/cgroup/cgroup.c:6695
       copy_process+0x4ffd/0x8c50 kernel/fork.c:2629
       kernel_clone+0xfd/0x960 kernel/fork.c:2815
       user_mode_thread+0xc9/0x110 kernel/fork.c:2893
       rest_init+0x23/0x2b0 init/main.c:708
       start_kernel+0x3e9/0x4d0 init/main.c:1099
       x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:515
       x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:496
       common_startup_64+0x13e/0x148

-> #3 (&p->pi_lock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
       class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
       try_to_wake_up+0xb6/0x1490 kernel/sched/core.c:4214
       __wake_up_common+0x131/0x1e0 kernel/sched/wait.c:89
       __wake_up_common_lock kernel/sched/wait.c:106 [inline]
       __wake_up+0x31/0x60 kernel/sched/wait.c:127
       tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
       serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1844
       serial8250_handle_irq+0x74c/0xc80 drivers/tty/serial/8250/8250_port.c:1952
       serial8250_default_handle_irq+0x9a/0x210 drivers/tty/serial/8250/8250_port.c:1972
       serial8250_interrupt+0x103/0x210 drivers/tty/serial/8250/8250_core.c:86
       __handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
       handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
       handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
       handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
       generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
       handle_irq arch/x86/kernel/irq.c:249 [inline]
       call_irq_handler arch/x86/kernel/irq.c:261 [inline]
       __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:287
       common_interrupt+0xba/0xe0 arch/x86/kernel/irq.c:280
       asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
       native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
       arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline]
       default_idle+0xf/0x20 arch/x86/kernel/process.c:743
       default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117
       cpuidle_idle_call kernel/sched/idle.c:185 [inline]
       do_idle+0x329/0x3f0 kernel/sched/idle.c:325
       cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:423
       start_secondary+0x222/0x2b0 arch/x86/kernel/smpboot.c:315
       common_startup_64+0x13e/0x148

-> #2 (&tty->write_wait){-...}-{3:3}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
       __wake_up_common_lock kernel/sched/wait.c:105 [inline]
       __wake_up+0x1c/0x60 kernel/sched/wait.c:127
       tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
       serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1844
       __start_tx+0x3e9/0x4a0 drivers/tty/serial/8250/8250_port.c:1549
       serial8250_start_tx+0x368/0x530 drivers/tty/serial/8250/8250_port.c:1659
       __uart_start+0x292/0x4c0 drivers/tty/serial/serial_core.c:160
       uart_write+0x218/0xb30 drivers/tty/serial/serial_core.c:635
       process_output_block drivers/tty/n_tty.c:574 [inline]
       n_tty_write+0x419/0x1140 drivers/tty/n_tty.c:2389
       iterate_tty_write drivers/tty/tty_io.c:1015 [inline]
       file_tty_write.constprop.0+0x506/0x9a0 drivers/tty/tty_io.c:1090
       tty_write drivers/tty/tty_io.c:1111 [inline]
       redirected_tty_write drivers/tty/tty_io.c:1134 [inline]
       redirected_tty_write+0xcc/0x140 drivers/tty/tty_io.c:1114
       new_sync_write fs/read_write.c:586 [inline]
       vfs_write+0x5ae/0x1150 fs/read_write.c:679
       ksys_write+0x12b/0x250 fs/read_write.c:731
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (&port_lock_key){-.-.}-{3:3}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
       uart_port_lock_irqsave include/linux/serial_core.h:715 [inline]
       serial8250_console_write+0x17c/0x1870 drivers/tty/serial/8250/8250_port.c:3424
       console_emit_next_record kernel/printk/printk.c:3122 [inline]
       console_flush_all+0x803/0xc60 kernel/printk/printk.c:3210
       __console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
       console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
       vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
       _printk+0xc8/0x100 kernel/printk/printk.c:2457
       register_console+0xbfd/0x1170 kernel/printk/printk.c:4099
       univ8250_console_init+0x5f/0x90 drivers/tty/serial/8250/8250_core.c:513
       console_init+0x154/0x690 kernel/printk/printk.c:4292
       start_kernel+0x29f/0x4d0 init/main.c:1034
       x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:515
       x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:496
       common_startup_64+0x13e/0x148

-> #0 (console_owner){-.-.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3163 [inline]
       check_prevs_add kernel/locking/lockdep.c:3282 [inline]
       validate_chain kernel/locking/lockdep.c:3906 [inline]
       __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
       lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
       console_lock_spinning_enable+0xb0/0xd0 kernel/printk/printk.c:1924
       console_emit_next_record kernel/printk/printk.c:3116 [inline]
       console_flush_all+0x7ac/0xc60 kernel/printk/printk.c:3210
       __console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
       console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
       vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
       _printk+0xc8/0x100 kernel/printk/printk.c:2457
       fail_dump lib/fault-inject.c:66 [inline]
       should_fail_ex+0x4df/0x650 lib/fault-inject.c:174
       strncpy_from_user+0x3b/0x2d0 lib/strncpy_from_user.c:118
       strncpy_from_user_nofault+0x7f/0x180 mm/maccess.c:193
       bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:215 [inline]
       ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:310 [inline]
       bpf_probe_read_compat_str+0xf1/0x170 kernel/trace/bpf_trace.c:306
       bpf_prog_c1796171ffc7efef+0x3e/0x40
       bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
       __bpf_prog_run include/linux/filter.h:692 [inline]
       bpf_prog_run include/linux/filter.h:708 [inline]
       __bpf_trace_run kernel/trace/bpf_trace.c:2371 [inline]
       bpf_trace_run4+0x360/0x5a0 kernel/trace/bpf_trace.c:2414
       __bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222
       __traceiter_sched_switch+0x6c/0xc0 include/trace/events/sched.h:222
       __do_trace_sched_switch include/trace/events/sched.h:222 [inline]
       trace_sched_switch include/trace/events/sched.h:222 [inline]
       __schedule+0x160c/0x5890 kernel/sched/core.c:6762
       preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6944
       preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
       __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
       _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
       debug_object_active_state+0x2ec/0x3a0 lib/debugobjects.c:1055
       debug_rcu_head_unqueue kernel/rcu/rcu.h:233 [inline]
       debug_rcu_bhead_unqueue mm/slab_common.c:1416 [inline]
       kvfree_rcu_bulk+0x4b/0x1f0 mm/slab_common.c:1493
       kvfree_rcu_drain_ready mm/slab_common.c:1684 [inline]
       kfree_rcu_monitor+0x1bd/0x2d0 mm/slab_common.c:1757
       kfree_rcu_shrink_scan+0xdd/0x180 mm/slab_common.c:2107
       do_shrink_slab+0x44f/0x11c0 mm/shrinker.c:437
       shrink_slab+0x32b/0x12a0 mm/shrinker.c:664
       drop_slab_node mm/vmscan.c:421 [inline]
       drop_slab+0x14c/0x2c0 mm/vmscan.c:439
       drop_caches_sysctl_handler+0x171/0x190 fs/drop_caches.c:68
       proc_sys_call_handler+0x3c6/0x5a0 fs/proc/proc_sysctl.c:601
       iter_file_splice_write+0x90f/0x10b0 fs/splice.c:743
       do_splice_from fs/splice.c:941 [inline]
       direct_splice_actor+0x18f/0x6c0 fs/splice.c:1164
       splice_direct_to_actor+0x346/0xa40 fs/splice.c:1108
       do_splice_direct_actor fs/splice.c:1207 [inline]
       do_splice_direct+0x178/0x250 fs/splice.c:1233
       do_sendfile+0xafb/0xe40 fs/read_write.c:1363
       __do_compat_sys_sendfile fs/read_write.c:1439 [inline]
       __se_compat_sys_sendfile fs/read_write.c:1428 [inline]
       __ia32_compat_sys_sendfile+0x163/0x230 fs/read_write.c:1428
       do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
       __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:387
       do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:412
       entry_SYSENTER_compat_after_hwframe+0x84/0x8e

other info that might help us debug this:

Chain exists of:
  console_owner --> &p->pi_lock --> &rq->__lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&rq->__lock);
                               lock(&p->pi_lock);
                               lock(&rq->__lock);
  lock(console_owner);

 *** DEADLOCK ***

5 locks held by syz.7.6609/29735:
 #0: ffff8880701e8420 (sb_writers#3){.+.+}-{0:0}, at: splice_direct_to_actor+0x346/0xa40 fs/splice.c:1108
 #1: ffff88802b63ed58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:606 [inline]
 #1: ffff88802b63ed58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:591
 #2: ffffffff8e1bd140 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #2: ffffffff8e1bd140 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8e1bd140 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2370 [inline]
 #2: ffffffff8e1bd140 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run4+0x1d6/0x5a0 kernel/trace/bpf_trace.c:2414
 #3: ffffffff8e1aaa40 (console_lock){+.+.}-{0:0}, at: _printk+0xc8/0x100 kernel/printk/printk.c:2457
 #4: ffffffff8e1aaab0 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:342 [inline]
 #4: ffffffff8e1aaab0 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:304 [inline]
 #4: ffffffff8e1aaab0 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:288 [inline]
 #4: ffffffff8e1aaab0 (console_srcu){....}-{0:0}, at: console_flush_all+0x159/0xc60 kernel/printk/printk.c:3187

stack backtrace:
CPU: 3 UID: 0 PID: 29735 Comm: syz.7.6609 Not tainted 6.14.0-rc7-syzkaller-00205-g586de92313fc #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_circular_bug+0x490/0x760 kernel/locking/lockdep.c:2076
 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2208
 check_prev_add kernel/locking/lockdep.c:3163 [inline]
 check_prevs_add kernel/locking/lockdep.c:3282 [inline]
 validate_chain kernel/locking/lockdep.c:3906 [inline]
 __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
 console_lock_spinning_enable+0xb0/0xd0 kernel/printk/printk.c:1924
 console_emit_next_record kernel/printk/printk.c:3116 [inline]
 console_flush_all+0x7ac/0xc60 kernel/printk/printk.c:3210
 __console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
 console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
 vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
 _printk+0xc8/0x100 kernel/printk/printk.c:2457
 fail_dump lib/fault-inject.c:66 [inline]
 should_fail_ex+0x4df/0x650 lib/fault-inject.c:174
 strncpy_from_user+0x3b/0x2d0 lib/strncpy_from_user.c:118
 strncpy_from_user_nofault+0x7f/0x180 mm/maccess.c:193
 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:215 [inline]
 ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:310 [inline]
 bpf_probe_read_compat_str+0xf1/0x170 kernel/trace/bpf_trace.c:306
 bpf_prog_c1796171ffc7efef+0x3e/0x40
 bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
 __bpf_prog_run include/linux/filter.h:692 [inline]
 bpf_prog_run include/linux/filter.h:708 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2371 [inline]
 bpf_trace_run4+0x360/0x5a0 kernel/trace/bpf_trace.c:2414
 __bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222
 __traceiter_sched_switch+0x6c/0xc0 include/trace/events/sched.h:222
 __do_trace_sched_switch include/trace/events/sched.h:222 [inline]
 trace_sched_switch include/trace/events/sched.h:222 [inline]
 __schedule+0x160c/0x5890 kernel/sched/core.c:6762
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6944
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
 debug_object_active_state+0x2ec/0x3a0 lib/debugobjects.c:1055
 debug_rcu_head_unqueue kernel/rcu/rcu.h:233 [inline]
 debug_rcu_bhead_unqueue mm/slab_common.c:1416 [inline]
 kvfree_rcu_bulk+0x4b/0x1f0 mm/slab_common.c:1493
 kvfree_rcu_drain_ready mm/slab_common.c:1684 [inline]
 kfree_rcu_monitor+0x1bd/0x2d0 mm/slab_common.c:1757
 kfree_rcu_shrink_scan+0xdd/0x180 mm/slab_common.c:2107
 do_shrink_slab+0x44f/0x11c0 mm/shrinker.c:437
 shrink_slab+0x32b/0x12a0 mm/shrinker.c:664
 drop_slab_node mm/vmscan.c:421 [inline]
 drop_slab+0x14c/0x2c0 mm/vmscan.c:439
 drop_caches_sysctl_handler+0x171/0x190 fs/drop_caches.c:68
 proc_sys_call_handler+0x3c6/0x5a0 fs/proc/proc_sysctl.c:601
 iter_file_splice_write+0x90f/0x10b0 fs/splice.c:743
 do_splice_from fs/splice.c:941 [inline]
 direct_splice_actor+0x18f/0x6c0 fs/splice.c:1164
 splice_direct_to_actor+0x346/0xa40 fs/splice.c:1108
 do_splice_direct_actor fs/splice.c:1207 [inline]
 do_splice_direct+0x178/0x250 fs/splice.c:1233
 do_sendfile+0xafb/0xe40 fs/read_write.c:1363
 __do_compat_sys_sendfile fs/read_write.c:1439 [inline]
 __se_compat_sys_sendfile fs/read_write.c:1428 [inline]
 __ia32_compat_sys_sendfile+0x163/0x230 fs/read_write.c:1428
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:387
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:412
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf73de579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f506655c EFLAGS: 00000296 ORIG_RAX: 00000000000000bb
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000003
RDX: 0000000080002080 RSI: 000000000000023b RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
CPU: 3 UID: 0 PID: 29735 Comm: syz.7.6609 Not tainted 6.14.0-rc7-syzkaller-00205-g586de92313fc #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 fail_dump lib/fault-inject.c:73 [inline]
 should_fail_ex+0x50a/0x650 lib/fault-inject.c:174
 strncpy_from_user+0x3b/0x2d0 lib/strncpy_from_user.c:118
 strncpy_from_user_nofault+0x7f/0x180 mm/maccess.c:193
 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:215 [inline]
 ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:310 [inline]
 bpf_probe_read_compat_str+0xf1/0x170 kernel/trace/bpf_trace.c:306
 bpf_prog_c1796171ffc7efef+0x3e/0x40
 bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
 __bpf_prog_run include/linux/filter.h:692 [inline]
 bpf_prog_run include/linux/filter.h:708 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2371 [inline]
 bpf_trace_run4+0x360/0x5a0 kernel/trace/bpf_trace.c:2414
 __bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222
 __traceiter_sched_switch+0x6c/0xc0 include/trace/events/sched.h:222
 __do_trace_sched_switch include/trace/events/sched.h:222 [inline]
 trace_sched_switch include/trace/events/sched.h:222 [inline]
 __schedule+0x160c/0x5890 kernel/sched/core.c:6762
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6944
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
 debug_object_active_state+0x2ec/0x3a0 lib/debugobjects.c:1055
 debug_rcu_head_unqueue kernel/rcu/rcu.h:233 [inline]
 debug_rcu_bhead_unqueue mm/slab_common.c:1416 [inline]
 kvfree_rcu_bulk+0x4b/0x1f0 mm/slab_common.c:1493
 kvfree_rcu_drain_ready mm/slab_common.c:1684 [inline]
 kfree_rcu_monitor+0x1bd/0x2d0 mm/slab_common.c:1757
 kfree_rcu_shrink_scan+0xdd/0x180 mm/slab_common.c:2107
 do_shrink_slab+0x44f/0x11c0 mm/shrinker.c:437
 shrink_slab+0x32b/0x12a0 mm/shrinker.c:664
 drop_slab_node mm/vmscan.c:421 [inline]
 drop_slab+0x14c/0x2c0 mm/vmscan.c:439
 drop_caches_sysctl_handler+0x171/0x190 fs/drop_caches.c:68
 proc_sys_call_handler+0x3c6/0x5a0 fs/proc/proc_sysctl.c:601
 iter_file_splice_write+0x90f/0x10b0 fs/splice.c:743
 do_splice_from fs/splice.c:941 [inline]
 direct_splice_actor+0x18f/0x6c0 fs/splice.c:1164
 splice_direct_to_actor+0x346/0xa40 fs/splice.c:1108
 do_splice_direct_actor fs/splice.c:1207 [inline]
 do_splice_direct+0x178/0x250 fs/splice.c:1233
 do_sendfile+0xafb/0xe40 fs/read_write.c:1363
 __do_compat_sys_sendfile fs/read_write.c:1439 [inline]
 __se_compat_sys_sendfile fs/read_write.c:1428 [inline]
 __ia32_compat_sys_sendfile+0x163/0x230 fs/read_write.c:1428
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:387
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:412
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf73de579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f506655c EFLAGS: 00000296 ORIG_RAX: 00000000000000bb
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000003
RDX: 0000000080002080 RSI: 000000000000023b RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
syz.7.6609 (29735): drop_caches: 2
syz.7.6609 (29735): drop_caches: 2
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	10 06                	adc    %al,(%rsi)
   2:	03 74 b4 01          	add    0x1(%rsp,%rsi,4),%esi
   6:	10 07                	adc    %al,(%rdi)
   8:	03 74 b0 01          	add    0x1(%rax,%rsi,4),%esi
   c:	10 08                	adc    %cl,(%rax)
   e:	03 74 d8 01          	add    0x1(%rax,%rbx,8),%esi
  1e:	00 51 52             	add    %dl,0x52(%rcx)
  21:	55                   	push   %rbp
  22:	89 e5                	mov    %esp,%ebp
  24:	0f 34                	sysenter
  26:	cd 80                	int    $0x80
* 28:	5d                   	pop    %rbp <-- trapping instruction
  29:	5a                   	pop    %rdx
  2a:	59                   	pop    %rcx
  2b:	c3                   	ret
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	90                   	nop
  2f:	90                   	nop
  30:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi
  37:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi