__alloc_pages include/linux/gfp.h:473 [inline] __alloc_pages_node include/linux/gfp.h:486 [inline] kmem_getpages mm/slab.c:1409 [inline] cache_grow_begin+0xa5/0x8c0 mm/slab.c:2677 fallback_alloc+0x204/0x2e0 mm/slab.c:3219 ____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287 __do_cache_alloc mm/slab.c:3356 [inline] slab_alloc mm/slab.c:3384 [inline] kmem_cache_alloc+0x1f8/0x730 mm/slab.c:3552 kmem_cache_zalloc include/linux/slab.h:731 [inline] ext4_init_io_end+0x96/0x220 fs/ext4/page-io.c:253 INFO: task syz-executor2:17950 blocked for more than 140 seconds. ext4_writepages+0x15af/0x4150 fs/ext4/inode.c:2849 Not tainted 4.20.0-rc1-next-20181109+ #110 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor2 D19208 17950 12893 0x00000004 Call Trace: context_switch kernel/sched/core.c:2831 [inline] __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472 do_writepages+0x9a/0x1a0 mm/page-writeback.c:2328 __writeback_single_inode+0x205/0x1650 fs/fs-writeback.c:1316 writeback_sb_inodes+0x71f/0x1210 fs/fs-writeback.c:1580 schedule+0xef/0x370 kernel/sched/core.c:3516 __writeback_inodes_wb+0x1b9/0x340 fs/fs-writeback.c:1649 wb_writeback+0xa5d/0xfa0 fs/fs-writeback.c:1758 __lock_sock+0x1fb/0x350 net/core/sock.c:2254 lock_sock_nested+0xfe/0x120 net/core/sock.c:2776 lock_sock include/net/sock.h:1492 [inline] sctp_wait_for_connect+0x3ae/0x640 net/sctp/socket.c:8642 wb_check_background_flush fs/fs-writeback.c:1826 [inline] wb_do_writeback fs/fs-writeback.c:1914 [inline] wb_workfn+0xd5b/0x1780 fs/fs-writeback.c:1942 sctp_sendmsg_to_asoc+0x1627/0x1a20 net/sctp/socket.c:1967 process_one_work+0xc8b/0x1c40 kernel/workqueue.c:2153 sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2113 inet_sendmsg+0x19c/0x690 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:632 __sys_sendto+0x3d7/0x670 net/socket.c:1789 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 __do_sys_sendto net/socket.c:1801 [inline] __se_sys_sendto net/socket.c:1797 [inline] __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1797 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 Mem-Info: active_anon:154560 inactive_anon:199 isolated_anon:0 active_file:23 inactive_file:24 isolated_file:0 unevictable:0 dirty:27 writeback:1 unstable:0 slab_reclaimable:12492 slab_unreclaimable:1339104 mapped:49158 shmem:250 pagetables:1097 bounce:0 free:24336 free_pcp:99 free_cma:0 Node 0 active_anon:618240kB inactive_anon:796kB active_file:144kB inactive_file:280kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:196632kB dirty:108kB writeback:4kB shmem:1000kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 569344kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2818 6321 6321 Node 0 DMA32 free:44016kB min:30052kB low:37564kB high:45076kB active_anon:28kB inactive_anon:4kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888772kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 3503 3503 Node 0 Normal free:37200kB min:37364kB low:46704kB high:56044kB active_anon:618212kB inactive_anon:792kB active_file:92kB inactive_file:72kB unevictable:0kB writepending:112kB present:4718592kB managed:3587820kB mlocked:0kB kernel_stack:7200kB pagetables:4388kB bounce:0kB free_pcp:248kB local_pcp:0kB free_cma:0kB entry_SYSCALL_64_after_hwframe+0x49/0xbe lowmem_reserve[]: 0 0 0 0 RIP: 0033:0x457569 Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB Code: Bad RIP value. Node 0 DMA32: 8*4kB (UM) 4*8kB (UM) 3*16kB (M) 4*32kB (M) 4*64kB (UM) 4*128kB (UM) 4*256kB (UM) 4*512kB (UM) 3*1024kB (UM) 2*2048kB (M) 8*4096kB (M) = 44016kB RSP: 002b:00007ff66bb40c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c Node 0 Normal: 1323*4kB (UMEH) 1216*8kB (UMEH) 647*16kB (UMEH) 241*32kB (MEH) 34*64kB (UMH) 0*128kB 1*256kB (U) 1*512kB (U) 1*1024kB (U) 0*2048kB 0*4096kB = 37052kB RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457569 Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000008 Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 296 total pagecache pages 0 pages in swap cache RBP: 000000000072bf00 R08: 000000002005ffe4 R09: 000000000000001c Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff66bb416d4 0 pages HighMem/MovableOnly 342854 pages reserved 0 pages cma reserved Unreclaimable slab info: R13: 00000000004c3c1d R14: 00000000004d5e98 R15: 00000000ffffffff Name Used Total Showing all locks held in the system: pid_4 0KB 3KB pid_3 1KB 7KB pid_2 107KB 156KB TIPC 12KB 21KB rds_connection 0KB 3KB 9 locks held by kworker/u4:1/21: SCTPv6 14KB 18KB sctp_chunk 1157711KB 1157711KB 1 lock held by khungtaskd/1010: sctp_bind_bucket 6KB 11KB DCCPv6 17KB 21KB DCCP 16KB 20KB dccp_bind_bucket 1KB 4KB #0: 00000000e53e8d08 (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4379 kcm_mux_cache 1KB 7KB bridge_fdb_cache 10KB 15KB 2 locks held by udevd/3700: nf-frags 0KB 7KB fib6_nodes 73KB 92KB 2 locks held by rs:main Q:Reg/5853: #0: 00000000e7e9159f (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline] #0: 00000000e7e9159f (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489 ip6_dst_cache 245KB 326KB #1: 000000002b13e3d6 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291 RAWv6 68KB 71KB 2 locks held by rsyslogd/5856: UDPv6 3KB 3KB #0: 00000000e7e9159f (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline] #0: 00000000e7e9159f (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489 TCPv6 23KB 29KB #1: 000000009b2ec841 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291 nf_conntrack 54KB 86KB 2 locks held by getty/5945: #0: 000000000e43697f (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 ashmem_area_cache 1KB 7KB #1: 000000004775a30c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 sd_ext_cdb 0KB 3KB 2 locks held by getty/5946: scsi_sense_cache 1056KB 1060KB #0: 00000000db23fa06 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 virtio_scsi_cmd 16KB 16KB #1: 00000000c94732a2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 sgpool-128 8KB 8KB 2 locks held by getty/5947: sgpool-64 4KB 6KB sgpool-32 2KB 7KB #0: 00000000b91bcce7 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 sgpool-16 1KB 3KB sgpool-8 0KB 3KB #1: 000000005ad25108 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 mqueue_inode_cache 10KB 14KB bio_post_read_ctx 14KB 15KB 2 locks held by getty/5948: xfs_buf 0KB 3KB bio-2 14KB 15KB #0: 00000000cbb77631 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 jfs_mp 7KB 7KB #1: 00000000e2a8a93a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/5949: nfs_commit_data 3KB 7KB #0: 00000000a9f5b910 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 nfs_write_data 32KB 32KB #1: 00000000e56f31ba (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 ext4_system_zone 0KB 3KB 2 locks held by getty/5950: #0: 00000000ae7eb403 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 kioctx 44KB 89KB #1: 00000000dd1b0e3c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 aio_kiocb 9KB 24KB 2 locks held by getty/5951: #0: 0000000026ed438f (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 userfaultfd_ctx_cache 0KB 3KB #1: 00000000b55698d0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 fanotify_event_info 0KB 3KB 3 locks held by syz-fuzzer/5969: bio-1 1KB 3KB #0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline] #0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489 fasync_cache 0KB 4KB #1: 00000000e2433c97 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291 pid_namespace 5KB 15KB #2: 000000000617d65f (fs_reclaim){+.+.}, at: fs_reclaim_acquire.part.97+0x0/0x30 mm/page_alloc.c:4806 posix_timers_cache 3KB 7KB 3 locks held by syz-fuzzer/5970: #0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline] #0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489 rpc_buffers 17KB 19KB rpc_tasks 2KB 3KB #1: 00000000e2433c97 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291 UNIX 9KB 14KB tcp_bind_bucket 3KB 8KB #2: 000000008a08da11 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1126 [inline] #2: 000000008a08da11 (&rq->lock){-.-.}, at: __schedule+0x236/0x21d0 kernel/sched/core.c:3410 inet_peer_cache 2KB 4KB xfrm_state 10KB 12KB 2 locks held by syz-fuzzer/5971: #0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1351 [inline] #0: 00000000751c4ff8 (&mm->mmap_sem){++++}, at: __do_page_fault+0x3c8/0xe40 arch/x86/mm/fault.c:1489 #1: 00000000e2433c97 (&ei->i_mmap_sem){++++}, at: ext4_filemap_fault+0x7a/0xad fs/ext4/inode.c:6291 ip_fib_trie 10KB 15KB 3 locks held by syz-executor2/17960: ip_fib_alias 49KB 63KB ============================================= ip_dst_cache 703KB 740KB NMI backtrace for cpu 0 CPU: 0 PID: 1010 Comm: khungtaskd Not tainted 4.20.0-rc1-next-20181109+ #110 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 RAW 40KB 50KB nmi_cpu_backtrace.cold.2+0x5c/0xa1 lib/nmi_backtrace.c:101 UDP 16KB 19KB nmi_trigger_cpumask_backtrace+0x1e8/0x22a lib/nmi_backtrace.c:62 TCP 8KB 11KB arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:144 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0xb4c/0x1060 kernel/hung_task.c:289 hugetlbfs_inode_cache 2KB 7KB fscache_cookie_jar 1KB 7KB eventpoll_pwq 28KB 43KB eventpoll_epi 53KB 82KB inotify_inode_mark 52KB 74KB request_queue 139KB 145KB kthread+0x35a/0x440 kernel/kthread.c:246 blkdev_ioc 16KB 23KB ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 0 to CPUs 1: INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.513 msecs NMI backtrace for cpu 1 CPU: 1 PID: 17960 Comm: syz-executor2 Not tainted 4.20.0-rc1-next-20181109+ #110 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_del_entry_valid+0x88/0x100 lib/list_debug.c:51 Code: 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f 84 39 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 80 3c 02 00 <75> 5f 49 8b 14 24 48 39 da 0f 85 4e 01 00 00 49 8d 7d 08 48 b8 00 RSP: 0000:ffff88017fbb5890 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: ffffea0006b7f948 RCX: ffffc9001222f000 RDX: 1ffffd4000d5b171 RSI: ffffffff81a79029 RDI: ffffea0006b7f950 RBP: ffff88017fbb58a8 R08: ffff8801b316e0c0 R09: ffffed002ff76aa8 R10: ffffed002ff76aa8 R11: 0000000000000003 R12: ffffea0006ad8b88 R13: ffff8801d9a37220 R14: ffff88017fbb5df0 R15: 0000000000000002 FS: 00007ff66baff700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc08d0e3dd3 CR3: 00000001c1601000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_del_entry include/linux/list.h:117 [inline] list_move include/linux/list.h:170 [inline] isolate_lru_pages.isra.57+0xdfb/0x19e0 mm/vmscan.c:1708 shrink_inactive_list+0x428/0x1c50 mm/vmscan.c:1942 shrink_list mm/vmscan.c:2276 [inline] shrink_node_memcg+0x784/0x18d0 mm/vmscan.c:2541 shrink_node+0x3bc/0x16b0 mm/vmscan.c:2756 shrink_zones mm/vmscan.c:2988 [inline] do_try_to_free_pages+0x3e7/0x1290 mm/vmscan.c:3050 try_to_free_pages+0x4cb/0xb90 mm/vmscan.c:3265 __perform_reclaim mm/page_alloc.c:3769 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:3791 [inline] __alloc_pages_slowpath+0xa14/0x2e30 mm/page_alloc.c:4192 __alloc_pages_nodemask+0xa7b/0xdd0 mm/page_alloc.c:4391 __alloc_pages include/linux/gfp.h:473 [inline] __alloc_pages_node include/linux/gfp.h:486 [inline] kmem_getpages mm/slab.c:1409 [inline] cache_grow_begin+0xa5/0x8c0 mm/slab.c:2677 fallback_alloc+0x204/0x2e0 mm/slab.c:3219 ____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287 slab_alloc_node mm/slab.c:3327 [inline] kmem_cache_alloc_node_trace+0xe7/0x740 mm/slab.c:3661 __do_kmalloc_node mm/slab.c:3683 [inline] __kmalloc_node_track_caller+0x3c/0x70 mm/slab.c:3698 __kmalloc_reserve.isra.38+0x41/0xe0 net/core/skbuff.c:137 __alloc_skb+0x150/0x770 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:997 [inline] _sctp_make_chunk+0x58/0x280 net/sctp/sm_make_chunk.c:1402 sctp_make_data net/sctp/sm_make_chunk.c:1434 [inline] sctp_make_datafrag_empty+0x1d2/0x2e0 net/sctp/sm_make_chunk.c:748 sctp_datamsg_from_user+0x7ca/0x1310 net/sctp/chunk.c:275 sctp_sendmsg_to_asoc+0x5ca/0x1a20 net/sctp/socket.c:1941 sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2113 inet_sendmsg+0x19c/0x690 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:632 sock_write_iter+0x35e/0x5c0 net/socket.c:901 call_write_iter include/linux/fs.h:1867 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x6b8/0x9f0 fs/read_write.c:487 vfs_write+0x1fc/0x560 fs/read_write.c:549 ksys_write+0x101/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457569 Code: Bad RIP value. RSP: 002b:00007ff66bafec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 RDX: 000000000001fef0 RSI: 00000000200002c0 RDI: 0000000000000008 RBP: 000000000072c040 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff66baff6d4 R13: 00000000004c58a6 R14: 00000000004d95b8 R15: 00000000ffffffff