BUG: sleeping function called from invalid context at net/core/sock.c:2761 in_atomic(): 1, irqs_disabled(): 0, pid: 1403, name: kworker/1:2 2 locks held by kworker/1:2/1403: #0: ((wq_completion)"%s"name){+.+.}, at: [] __write_once_size include/linux/compiler.h:212 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic_long_set include/asm-generic/atomic-long.h:57 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_data kernel/workqueue.c:618 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_pool_and_clear_pending kernel/workqueue.c:645 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] process_one_work+0xad4/0x1be0 kernel/workqueue.c:2083 #1: ((work_completion)(&squeue->work)){+.+.}, at: [] process_one_work+0xb2f/0x1be0 kernel/workqueue.c:2087 CPU: 1 PID: 1403 Comm: kworker/1:2 Not tainted 4.15.0-rc1+ #198 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: pdecrypt padata_serial_worker Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060 __might_sleep+0x95/0x190 kernel/sched/core.c:6013 lock_sock_nested+0x37/0x110 net/core/sock.c:2761 lock_sock include/net/sock.h:1465 [inline] af_alg_async_cb+0x86/0x1a0 crypto/af_alg.c:1039 aead_request_complete include/crypto/internal/aead.h:75 [inline] pcrypt_aead_serial+0x75/0xa0 crypto/pcrypt.c:123 padata_serial_worker+0x476/0x750 kernel/padata.c:348 process_one_work+0xbfd/0x1be0 kernel/workqueue.c:2112 worker_thread+0x223/0x1990 kernel/workqueue.c:2246 kthread+0x37a/0x440 kernel/kthread.c:238 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:441 QAT: failed to copy from user. QAT: failed to copy from user. binder: 28337 RLIMIT_NICE not set binder: 28335:28337 BC_FREE_BUFFER u0000000000000000 no match binder: 28335:28337 BC_DEAD_BINDER_DONE 0000000000000004 not found binder: 28335:28337 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 28335:28337 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 binder: 28335:28337 got reply transaction with no transaction stack binder: 28335:28337 transaction failed 29201/-71, size 72-40 line 2670 kvm: pic: level sensitive irq not supported binder: 28335:28337 DecRefs 0 refcount change on invalid ref 2 ret -22 binder: 28335:28337 BC_REQUEST_DEATH_NOTIFICATION death notification already set binder: 28337 RLIMIT_NICE not set binder: 28337 RLIMIT_NICE not set binder: 28335 invalid dec weak, ref 922 desc 0 s 1 w 0 binder: 28335:28344 BC_INCREFS_DONE uffffffffffffffff no match binder: 28335:28344 DecRefs 0 refcount change on invalid ref 4 ret -22 *** Guest State *** CR0: actual=0x0000000080000031, shadow=0x0000000060000010, gh_mask=fffffffffffffff7 CR4: actual=0x0000000000002051, shadow=0x0000000000000000, gh_mask=ffffffffffffe871 CR3 = 0x00000000fffbc000 RSP = 0x000000000000fffa RIP = 0x0000000000000f00 RFLAGS=0x00033000 DR7 = 0x0000000000000400 Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 CS: sel=0xd800, attr=0x000f3, limit=0x0000ffff, base=0x00000000000d8000 DS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 SS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 ES: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 FS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 GS: sel=0x0000, attr=0x000f3, limit=0x0000ffff, base=0x0000000000000000 GDTR: limit=0x0000ffff, base=0x0000000000000000 LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000 IDTR: limit=0x0000ffff, base=0x0000000000000000 TR: sel=0x0000, attr=0x0008b, limit=0x00002088, base=0x0000000000000000 EFER = 0x0000000000000000 PAT = 0x0007040600070406 DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 Interruptibility = 00000000 ActivityState = 00000000 *** Host State *** RIP = 0xffffffff811bced3 RSP = 0xffff8801c9aff4c8 CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 FSBase=00007fad1b0e2700 GSBase=ffff8801db400000 TRBase=ffff8801db423100 GDTBase=ffffffffff577000 IDTBase=ffffffffff57b000 CR0=0000000080050033 CR3=00000001d676e000 CR4=00000000001426f0 Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff8516bec0 EFER = 0x0000000000000d01 PAT = 0x0000000000000000 *** Control State *** PinBased=0000003f CPUBased=b6a1edfa SecondaryExec=00000043 EntryControls=0000d1ff ExitControls=0023efff ExceptionBitmap=ffffbfff PFECmask=00000000 PFECmatch=00000000 VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 VMExit: intr_info=00000000 errcode=00000000 ilen=00000003 reason=80000021 qualification=0000000000000000 IDTVectoring: info=00000000 errcode=00000000 TSC Offset = 0xfffffd6149735f39 TPR Threshold = 0x00 EPT pointer = 0x00000001d7eea01e binder: 28335:28354 tried to acquire reference to desc 0, got 1 instead binder: 28335:28354 BC_REQUEST_DEATH_NOTIFICATION death notification already set binder: 28335:28355 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000003 != 0000000000000000 binder: 28355 RLIMIT_NICE not set binder: 28335:28354 BC_FREE_BUFFER u0000000000000000 no match binder: 28335:28354 BC_REQUEST_DEATH_NOTIFICATION death notification already set binder: 28335:28354 BC_DEAD_BINDER_DONE 0000000000000004 not found binder: 28335:28354 ERROR: BC_REGISTER_LOOPER called without request binder: 28335:28354 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 binder: 28335:28354 got reply transaction with no transaction stack binder: 28335:28354 transaction failed 29201/-71, size 72-40 line 2670 binder: 28335:28354 unknown command 0 binder: 28335:28354 ioctl c0306201 20003fd0 returned -22 binder: 28355 RLIMIT_NICE not set BUG: sleeping function called from invalid context at net/core/sock.c:2761 in_atomic(): 1, irqs_disabled(): 0, pid: 1403, name: kworker/1:2 2 locks held by kworker/1:2/1403: #0: ((wq_completion)"%s"name){+.+.}, at: [] __write_once_size include/linux/compiler.h:212 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic_long_set include/asm-generic/atomic-long.h:57 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_data kernel/workqueue.c:618 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_pool_and_clear_pending kernel/workqueue.c:645 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] process_one_work+0xad4/0x1be0 kernel/workqueue.c:2083 #1: ((work_completion)(&squeue->work)){+.+.}, at: [] process_one_work+0xb2f/0x1be0 kernel/workqueue.c:2087 CPU: 1 PID: 1403 Comm: kworker/1:2 Tainted: G W 4.15.0-rc1+ #198 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: pdecrypt padata_serial_worker Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060 __might_sleep+0x95/0x190 kernel/sched/core.c:6013 lock_sock_nested+0x37/0x110 net/core/sock.c:2761 lock_sock include/net/sock.h:1465 [inline] af_alg_async_cb+0x86/0x1a0 crypto/af_alg.c:1039 aead_request_complete include/crypto/internal/aead.h:75 [inline] pcrypt_aead_serial+0x75/0xa0 crypto/pcrypt.c:123 padata_serial_worker+0x476/0x750 kernel/padata.c:348 process_one_work+0xbfd/0x1be0 kernel/workqueue.c:2112 worker_thread+0x223/0x1990 kernel/workqueue.c:2246 kthread+0x37a/0x440 kernel/kthread.c:238 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:441 binder: 28335:28376 BC_DEAD_BINDER_DONE 0000000000000003 not found binder: 28335 invalid dec weak, ref 922 desc 0 s 1 w 0 binder: 28335:28376 BC_INCREFS_DONE uffffffffffffffff no match binder: 28335:28376 DecRefs 0 refcount change on invalid ref 4 ret -22 binder: 28335:28376 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000003 != fffffffffffffffe binder: 28335:28376 got reply transaction with no transaction stack binder: 28335:28376 transaction failed 29201/-71, size 0-48 line 2670 binder: 28335:28344 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000003 != fffffffffffffffe binder: 28335:28344 got reply transaction with no transaction stack binder: 28335:28344 transaction failed 29201/-71, size 0-48 line 2670 binder: undelivered death notification, 0000000000000000 netlink: 18 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 18 bytes leftover after parsing attributes in process `syz-executor7'. binder: 28543:28546 ioctl 40046205 e6 returned -22 binder: 28543:28546 Acquire 1 refcount change on invalid ref 0 ret -22 binder: 28543:28546 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 28543:28552 ioctl 40046205 136 returned -22 binder: 28543:28546 unknown command 0 binder: 28543:28546 ioctl c0306201 2077b000 returned -22 binder_alloc: binder_alloc_mmap_handler: 28543 20005000-20009000 already mapped failed -16 binder: 28543:28552 ioctl 40046205 e6 returned -22 binder_alloc: binder_alloc_mmap_handler: 28543 20f65000-20f68000 already mapped failed -16 QAT: Invalid ioctl binder: 28543:28546 ioctl 40046205 136 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 28543:28552 ioctl 40046207 0 returned -16 device sit0 entered promiscuous mode device sit0 left promiscuous mode QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl device sit0 entered promiscuous mode device sit0 left promiscuous mode kauditd_printk_skb: 25 callbacks suppressed audit: type=1326 audit(1511901967.672:25317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=28642 comm="syz-executor7" exe="/root/syz-executor7" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x7fec0000 audit: type=1326 audit(1511901967.692:25318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=28642 comm="syz-executor7" exe="/root/syz-executor7" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x7fec0000 device gre0 entered promiscuous mode device gre0 entered promiscuous mode BUG: sleeping function called from invalid context at net/core/sock.c:2761 in_atomic(): 1, irqs_disabled(): 0, pid: 1403, name: kworker/1:2 2 locks held by kworker/1:2/1403: #0: ((wq_completion)"%s"name){+.+.}, at: [] __write_once_size include/linux/compiler.h:212 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic_long_set include/asm-generic/atomic-long.h:57 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_data kernel/workqueue.c:618 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_pool_and_clear_pending kernel/workqueue.c:645 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] process_one_work+0xad4/0x1be0 kernel/workqueue.c:2083 device gre0 entered promiscuous mode #1: ((work_completion)(&squeue->work)){+.+.}, at: [] process_one_work+0xb2f/0x1be0 kernel/workqueue.c:2087 CPU: 1 PID: 1403 Comm: kworker/1:2 Tainted: G W 4.15.0-rc1+ #198 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: pdecrypt padata_serial_worker Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060 __might_sleep+0x95/0x190 kernel/sched/core.c:6013 lock_sock_nested+0x37/0x110 net/core/sock.c:2761 lock_sock include/net/sock.h:1465 [inline] af_alg_async_cb+0x86/0x1a0 crypto/af_alg.c:1039 aead_request_complete include/crypto/internal/aead.h:75 [inline] pcrypt_aead_serial+0x75/0xa0 crypto/pcrypt.c:123 padata_serial_worker+0x476/0x750 kernel/padata.c:348 process_one_work+0xbfd/0x1be0 kernel/workqueue.c:2112 worker_thread+0x223/0x1990 kernel/workqueue.c:2246 kthread+0x37a/0x440 kernel/kthread.c:238 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:441 Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable netlink: 2 bytes leftover after parsing attributes in process `syz-executor1'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=28806 comm=syz-executor1 netlink: 2 bytes leftover after parsing attributes in process `syz-executor5'. BUG: sleeping function called from invalid context at net/core/sock.c:2761 in_atomic(): 1, irqs_disabled(): 0, pid: 1403, name: kworker/1:2 2 locks held by kworker/1:2/1403: #0: ((wq_completion)"%s"name){+.+.}, at: [] __write_once_size include/linux/compiler.h:212 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic_long_set include/asm-generic/atomic-long.h:57 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_data kernel/workqueue.c:618 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_pool_and_clear_pending kernel/workqueue.c:645 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] process_one_work+0xad4/0x1be0 kernel/workqueue.c:2083 #1: ((work_completion)(&squeue->work)){+.+.}, at: [] process_one_work+0xb2f/0x1be0 kernel/workqueue.c:2087 CPU: 1 PID: 1403 Comm: kworker/1:2 Tainted: G W 4.15.0-rc1+ #198 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: pdecrypt padata_serial_worker Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060 __might_sleep+0x95/0x190 kernel/sched/core.c:6013 lock_sock_nested+0x37/0x110 net/core/sock.c:2761 lock_sock include/net/sock.h:1465 [inline] af_alg_async_cb+0x86/0x1a0 crypto/af_alg.c:1039 aead_request_complete include/crypto/internal/aead.h:75 [inline] pcrypt_aead_serial+0x75/0xa0 crypto/pcrypt.c:123 padata_serial_worker+0x476/0x750 kernel/padata.c:348 process_one_work+0xbfd/0x1be0 kernel/workqueue.c:2112 worker_thread+0x223/0x1990 kernel/workqueue.c:2246 kthread+0x37a/0x440 kernel/kthread.c:238 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:441 netlink: 2 bytes leftover after parsing attributes in process `syz-executor5'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=28845 comm=syz-executor4 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 28890 Comm: syz-executor6 Tainted: G W 4.15.0-rc1+ #198 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3371 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3545 aio_get_req fs/aio.c:1033 [inline] io_submit_one fs/aio.c:1562 [inline] do_io_submit+0x353/0x14f0 fs/aio.c:1682 SYSC_io_submit fs/aio.c:1707 [inline] SyS_io_submit+0x27/0x30 fs/aio.c:1704 do_syscall_64+0x26c/0x920 arch/x86/entry/common.c:285 entry_SYSCALL64_slow_path+0x25/0x25 RIP: 0033:0x4529d9 RSP: 002b:00007fc1b430bc58 EFLAGS: 00000212 ORIG_RAX: 00000000000000d1 RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 00000000004529d9 RDX: 0000000020bd9fe0 RSI: 0000000000000001 RDI: 00007fc1b42eb000 RBP: 000000000000015e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006ef170 R13: 0000000000000015 R14: 00007fc1b430c6d4 R15: ffffffffffffffff QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 28904 Comm: syz-executor6 Tainted: G W 4.15.0-rc1+ #198 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3371 [inline] __do_kmalloc mm/slab.c:3709 [inline] __kmalloc+0x63/0x760 mm/slab.c:3720 kmalloc include/linux/slab.h:504 [inline] sock_kmalloc+0x112/0x190 net/core/sock.c:1979 af_alg_alloc_areq+0x74/0x2f0 crypto/af_alg.c:1088 _aead_recvmsg crypto/algif_aead.c:152 [inline] aead_recvmsg+0x1cd/0x1970 crypto/algif_aead.c:313 sock_recvmsg_nosec net/socket.c:805 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:812 sock_read_iter+0x361/0x560 net/socket.c:889 call_read_iter include/linux/fs.h:1766 [inline] aio_read+0x2b0/0x3a0 fs/aio.c:1501 io_submit_one fs/aio.c:1611 [inline] do_io_submit+0xf99/0x14f0 fs/aio.c:1682 SYSC_io_submit fs/aio.c:1707 [inline] SyS_io_submit+0x27/0x30 fs/aio.c:1704 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x4529d9 RSP: 002b:00007fc1b430bc58 EFLAGS: 00000212 ORIG_RAX: 00000000000000d1 RAX: ffffffffffffffda RBX: 00007fc1b430baa0 RCX: 00000000004529d9 RDX: 0000000020bd9fe0 RSI: 0000000000000001 RDI: 00007fc1b42eb000 RBP: 00007fc1b430ba90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b759b R13: 00007fc1b430bbc8 R14: 00000000004b759b R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 28910 Comm: syz-executor6 Tainted: G W 4.15.0-rc1+ #198 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3371 [inline] __do_kmalloc mm/slab.c:3709 [inline] __kmalloc+0x63/0x760 mm/slab.c:3720 kmalloc include/linux/slab.h:504 [inline] sock_kmalloc+0x112/0x190 net/core/sock.c:1979 _aead_recvmsg crypto/algif_aead.c:238 [inline] aead_recvmsg+0xd26/0x1970 crypto/algif_aead.c:313 sock_recvmsg_nosec net/socket.c:805 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:812 sock_read_iter+0x361/0x560 net/socket.c:889 call_read_iter include/linux/fs.h:1766 [inline] aio_read+0x2b0/0x3a0 fs/aio.c:1501 io_submit_one fs/aio.c:1611 [inline] do_io_submit+0xf99/0x14f0 fs/aio.c:1682 SYSC_io_submit fs/aio.c:1707 [inline] SyS_io_submit+0x27/0x30 fs/aio.c:1704 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x4529d9 RSP: 002b:00007fc1b430bc58 EFLAGS: 00000212 ORIG_RAX: 00000000000000d1 RAX: ffffffffffffffda RBX: 00007fc1b430baa0 RCX: 00000000004529d9 RDX: 0000000020bd9fe0 RSI: 0000000000000001 RDI: 00007fc1b42eb000 RBP: 00007fc1b430ba90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b759b R13: 00007fc1b430bbc8 R14: 00000000004b759b R15: 0000000000000000 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 28910 Comm: syz-executor6 Tainted: G W 4.15.0-rc1+ #198 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d502c480 task.stack: ffff8801ce6d0000 RIP: 0010:compound_head include/linux/page-flags.h:147 [inline] RIP: 0010:put_page include/linux/mm.h:849 [inline] RIP: 0010:af_alg_free_areq_sgls+0x5d1/0xab0 crypto/af_alg.c:678 RSP: 0018:ffff8801ce6d7678 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff8239a67a RDX: 0000000000010000 RSI: ffffc9000300e000 RDI: 0000000000000000 RBP: ffff8801ce6d7870 R08: 1ffff10039cdae4f R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8801c88ae340 R15: ffffed0039cdaf01 FS: 00007fc1b430c700(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020fe4ffc CR3: 00000001a6cde000 CR4: 00000000001406f0 DR0: 0000000020000008 DR1: 0000000020000008 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: _aead_recvmsg crypto/algif_aead.c:299 [inline] aead_recvmsg+0x27a/0x1970 crypto/algif_aead.c:313 sock_recvmsg_nosec net/socket.c:805 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:812 sock_read_iter+0x361/0x560 net/socket.c:889 call_read_iter include/linux/fs.h:1766 [inline] aio_read+0x2b0/0x3a0 fs/aio.c:1501 io_submit_one fs/aio.c:1611 [inline] do_io_submit+0xf99/0x14f0 fs/aio.c:1682 SYSC_io_submit fs/aio.c:1707 [inline] SyS_io_submit+0x27/0x30 fs/aio.c:1704 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x4529d9 RSP: 002b:00007fc1b430bc58 EFLAGS: 00000212 ORIG_RAX: 00000000000000d1 RAX: ffffffffffffffda RBX: 00007fc1b430baa0 RCX: 00000000004529d9 RDX: 0000000020bd9fe0 RSI: 0000000000000001 RDI: 00007fc1b42eb000 RBP: 00007fc1b430ba90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b759b R13: 00007fc1b430bbc8 R14: 00000000004b759b R15: 0000000000000000 Code: 00 00 48 8d 45 98 48 bb 00 00 00 00 00 fc ff df 48 89 85 48 fe ff ff 48 c1 e8 03 4c 8d 3c 18 e8 b6 41 36 ff 4c 89 e0 48 c1 e8 03 <80> 3c 18 00 0f 85 4b 03 00 00 49 8b 04 24 48 83 e0 fc 48 89 85 RIP: compound_head include/linux/page-flags.h:147 [inline] RSP: ffff8801ce6d7678 RIP: put_page include/linux/mm.h:849 [inline] RSP: ffff8801ce6d7678 RIP: af_alg_free_areq_sgls+0x5d1/0xab0 crypto/af_alg.c:678 RSP: ffff8801ce6d7678 ---[ end trace c2c4d54fbfe5364e ]---