=================================
[ INFO: inconsistent lock state ]
4.9.141+ #23 Not tainted
---------------------------------
inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage.
kworker/u4:0/6 [HC0[0]:SC0[0]:HE1:SE1] takes:
 (&sb->s_type->i_mutex_key#10){+.+.?.}, at: [<ffffffff81464edc>] inode_lock include/linux/fs.h:766 [inline]
 (&sb->s_type->i_mutex_key#10){+.+.?.}, at: [<ffffffff81464edc>] shmem_fallocate+0x13c/0xb10 mm/shmem.c:2676
  mark_held_locks+0xc7/0x130 kernel/locking/lockdep.c:2660
  __lockdep_trace_alloc kernel/locking/lockdep.c:2882 [inline]
  lockdep_trace_alloc+0x18e/0x2a0 kernel/locking/lockdep.c:2897
  __alloc_pages_nodemask+0x14a/0x1bd0 mm/page_alloc.c:3804
  __alloc_pages include/linux/gfp.h:433 [inline]
  __alloc_pages_node include/linux/gfp.h:446 [inline]
  alloc_pages_node include/linux/gfp.h:460 [inline]
  shmem_alloc_page mm/shmem.c:1420 [inline]
  shmem_alloc_and_acct_page mm/shmem.c:1450 [inline]
  shmem_getpage_gfp+0xc7c/0x18f0 mm/shmem.c:1724
  shmem_getpage mm/shmem.c:123 [inline]
  shmem_write_begin+0xf4/0x1a0 mm/shmem.c:2205
  generic_perform_write+0x28a/0x500 mm/filemap.c:2753
  __generic_file_write_iter+0x352/0x540 mm/filemap.c:2878
lowmemorykiller: Killing 'syz-executor.3' (31918) (tgid 31918), adj 1000,
   to free 52128kB on behalf of 'syz-executor.3' (32147) because
   cache 51532kB is below limit 65536kB for oom_score_adj 12
   Free memory is -13296kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (31971) (tgid 31971), adj 1000,
   to free 52128kB on behalf of 'syz-executor.3' (32147) because
   cache 51532kB is below limit 65536kB for oom_score_adj 12
   Free memory is 2704kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (32002) (tgid 32002), adj 1000,
   to free 52128kB on behalf of 'syz-executor.3' (32147) because
   cache 51532kB is below limit 65536kB for oom_score_adj 12
   Free memory is 12204kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (3707) (tgid 3707), adj 1000,
   to free 52088kB on behalf of 'syz-executor.3' (32147) because
   cache 51532kB is below limit 65536kB for oom_score_adj 12
   Free memory is 26504kB above reserved
  generic_file_write_iter+0x37a/0x620 mm/filemap.c:2906
  new_sync_write fs/read_write.c:496 [inline]
  __vfs_write+0x3d7/0x580 fs/read_write.c:509
  vfs_write+0x187/0x520 fs/read_write.c:557
  SYSC_write fs/read_write.c:604 [inline]
  SyS_write+0xd9/0x1c0 fs/read_write.c:596
  do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
  entry_SYSCALL_64_after_swapgs+0x5d/0xdb
irq event stamp: 1514663
hardirqs last  enabled at (1514663): [<ffffffff8280b008>] __mutex_trylock_slowpath kernel/locking/mutex.c:885 [inline]
hardirqs last  enabled at (1514663): [<ffffffff8280b008>] mutex_trylock+0x258/0x3e0 kernel/locking/mutex.c:908
hardirqs last disabled at (1514662): [<ffffffff8280ae5f>] __mutex_trylock_slowpath kernel/locking/mutex.c:873 [inline]
hardirqs last disabled at (1514662): [<ffffffff8280ae5f>] mutex_trylock+0xaf/0x3e0 kernel/locking/mutex.c:908
softirqs last  enabled at (1514164): [<ffffffff81471b80>] spin_unlock_bh include/linux/spinlock.h:352 [inline]
softirqs last  enabled at (1514164): [<ffffffff81471b80>] wb_wakeup_delayed+0x90/0xd0 mm/backing-dev.c:281
softirqs last disabled at (1514160): [<ffffffff81471b50>] spin_lock_bh include/linux/spinlock.h:307 [inline]
softirqs last disabled at (1514160): [<ffffffff81471b50>] wb_wakeup_delayed+0x60/0xd0 mm/backing-dev.c:278

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&sb->s_type->i_mutex_key#10);
  <Interrupt>
    lock(&sb->s_type->i_mutex_key#10);

 *** DEADLOCK ***

4 locks held by kworker/u4:0/6:
 #0:  ("events_unbound"){.+.+.+}, at: [<ffffffff81130f0c>] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
 #1:  ((&sub_info->work)){+.+.+.}, at: [<ffffffff81130f44>] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
 #2:  (shrinker_rwsem){++++..}, at: [<ffffffff814499b2>] shrink_slab.part.8+0xb2/0xa00 mm/vmscan.c:471
 #3:  (ashmem_mutex){+.+.+.}, at: [<ffffffff821ed9f5>] ashmem_shrink_scan+0x55/0x4c0 drivers/staging/android/ashmem.c:455

stack backtrace:
CPU: 0 PID: 6 Comm: kworker/u4:0 Not tainted 4.9.141+ #23
Workqueue: events_unbound call_usermodehelper_exec_work
 ffff8801da686cf0 ffffffff81b42e79 ffff8801da678000 ffffffff83cacb10
 ffff8801da678950 ffff8801da678970 ffffffff84244d40 ffff8801da686d68
 ffffffff81400780 0000000000000000 ffffffff00000001 0000000000000001
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81400780>] print_usage_bug.cold.40+0x44e/0x57e kernel/locking/lockdep.c:2387
 [<ffffffff81205d42>] valid_state kernel/locking/lockdep.c:2400 [inline]
 [<ffffffff81205d42>] mark_lock_irq kernel/locking/lockdep.c:2602 [inline]
 [<ffffffff81205d42>] mark_lock+0x2f2/0x1290 kernel/locking/lockdep.c:3065
 [<ffffffff812079e2>] mark_irqflags kernel/locking/lockdep.c:2958 [inline]
 [<ffffffff812079e2>] __lock_acquire+0x632/0x4a10 kernel/locking/lockdep.c:3302
 [<ffffffff8120c8d0>] lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
 [<ffffffff828116f1>] down_write+0x41/0xa0 kernel/locking/rwsem.c:52
 [<ffffffff81464edc>] inode_lock include/linux/fs.h:766 [inline]
 [<ffffffff81464edc>] shmem_fallocate+0x13c/0xb10 mm/shmem.c:2676
 [<ffffffff821edb59>] ashmem_shrink_scan+0x1b9/0x4c0 drivers/staging/android/ashmem.c:462
 [<ffffffff81449cc6>] do_shrink_slab mm/vmscan.c:398 [inline]
 [<ffffffff81449cc6>] shrink_slab.part.8+0x3c6/0xa00 mm/vmscan.c:501
 [<ffffffff814557fd>] shrink_slab mm/vmscan.c:465 [inline]
 [<ffffffff814557fd>] shrink_node+0x1ed/0x740 mm/vmscan.c:2602
 [<ffffffff814560c7>] shrink_zones mm/vmscan.c:2749 [inline]
 [<ffffffff814560c7>] do_try_to_free_pages mm/vmscan.c:2791 [inline]
 [<ffffffff814560c7>] try_to_free_pages+0x377/0xb80 mm/vmscan.c:3002
 [<ffffffff81428a01>] __perform_reclaim mm/page_alloc.c:3324 [inline]
 [<ffffffff81428a01>] __alloc_pages_direct_reclaim mm/page_alloc.c:3345 [inline]
 [<ffffffff81428a01>] __alloc_pages_slowpath mm/page_alloc.c:3697 [inline]
 [<ffffffff81428a01>] __alloc_pages_nodemask+0x981/0x1bd0 mm/page_alloc.c:3862
 [<ffffffff810d3100>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<ffffffff810d3100>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<ffffffff810d3100>] alloc_pages_node include/linux/gfp.h:460 [inline]
 [<ffffffff810d3100>] alloc_thread_stack_node kernel/fork.c:212 [inline]
 [<ffffffff810d3100>] dup_task_struct kernel/fork.c:492 [inline]
 [<ffffffff810d3100>] copy_process.part.8+0x280/0x6a10 kernel/fork.c:1534
 [<ffffffff810d9d12>] copy_process kernel/fork.c:1505 [inline]
 [<ffffffff810d9d12>] _do_fork+0x1b2/0xd30 kernel/fork.c:1972
 [<ffffffff810da8c4>] kernel_thread+0x34/0x40 kernel/fork.c:2036
 [<ffffffff81123370>] call_usermodehelper_exec_sync kernel/kmod.c:275 [inline]
 [<ffffffff81123370>] call_usermodehelper_exec_work+0xb0/0x250 kernel/kmod.c:327
 [<ffffffff81131001>] process_one_work+0x831/0x15f0 kernel/workqueue.c:2092
 [<ffffffff81131e96>] worker_thread+0xd6/0x1140 kernel/workqueue.c:2226
 [<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
lowmemorykiller: Killing 'syz-executor.3' (3721) (tgid 3721), adj 1000,
   to free 52088kB on behalf of 'syz-executor.3' (32147) because
   cache 51576kB is below limit 65536kB for oom_score_adj 12
   Free memory is 45068kB above reserved
lowmemorykiller: Killing 'syz-executor.1' (32126) (tgid 32126), adj 1000,
   to free 52160kB on behalf of 'syz-executor.3' (32147) because
   cache 51576kB is below limit 65536kB for oom_score_adj 12
   Free memory is 59924kB above reserved
lowmemorykiller: Killing 'syz-executor.4' (32129) (tgid 32129), adj 1000,
   to free 52104kB on behalf of 'syz-executor.3' (32147) because
   cache 51376kB is below limit 65536kB for oom_score_adj 12
   Free memory is 63964kB above reserved
audit: type=1400 audit(1574091780.012:102): avc:  denied  { getattr } for  pid=32173 comm="syz-executor.5" path="socket:[140611]" dev="sockfs" ino=140611 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1