BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:34 in_atomic(): 1, irqs_disabled(): 0, pid: 15234, name: syz-executor4 2 locks held by syz-executor4/15234: #0: (&net->xfrm.xfrm_cfg_mutex){+.+.}, at: [<000000008e3eb99d>] pfkey_sendmsg+0x4ce/0xa00 net/key/af_key.c:3647 #1: (&(&net->xfrm.xfrm_policy_lock)->rlock){+...}, at: [<00000000001a166b>] spin_lock_bh include/linux/spinlock.h:315 [inline] #1: (&(&net->xfrm.xfrm_policy_lock)->rlock){+...}, at: [<00000000001a166b>] xfrm_policy_flush+0x5d3/0x770 net/xfrm/xfrm_policy.c:969 CPU: 0 PID: 15234 Comm: syz-executor4 Not tainted 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060 __might_sleep+0x95/0x190 kernel/sched/core.c:6013 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:34 [inline] percpu_down_read include/linux/percpu-rwsem.h:59 [inline] cpus_read_lock+0x1c/0x90 kernel/cpu.c:293 get_online_cpus include/linux/cpu.h:117 [inline] xfrm_policy_cache_flush+0x1d0/0x710 net/xfrm/xfrm_policy.c:1767 xfrm_policy_flush+0x650/0x770 net/xfrm/xfrm_policy.c:978 pfkey_spdflush+0x98/0x370 net/key/af_key.c:2750 pfkey_process+0x611/0x720 net/key/af_key.c:2809 pfkey_sendmsg+0x4dc/0xa00 net/key/af_key.c:3648 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f6243031c58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 000000002057f000 RDI: 0000000000000013 RBP: 000000000000058a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f6590 R13: 00000000ffffffff R14: 00007f62430326d4 R15: 0000000000000000 ===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 4.15.0-rc5+ #177 Tainted: G W ----------------------------------------------------- syz-executor4/15234 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire: (cpu_hotplug_lock.rw_sem){++++}, at: [<0000000057f513b6>] get_online_cpus include/linux/cpu.h:117 [inline] (cpu_hotplug_lock.rw_sem){++++}, at: [<0000000057f513b6>] xfrm_policy_cache_flush+0x1d0/0x710 net/xfrm/xfrm_policy.c:1767 and this task is already holding: (&(&net->xfrm.xfrm_policy_lock)->rlock){+...}, at: [<00000000001a166b>] spin_lock_bh include/linux/spinlock.h:315 [inline] (&(&net->xfrm.xfrm_policy_lock)->rlock){+...}, at: [<00000000001a166b>] xfrm_policy_flush+0x5d3/0x770 net/xfrm/xfrm_policy.c:969 which would create a new lock dependency: (&(&net->xfrm.xfrm_policy_lock)->rlock){+...} -> (cpu_hotplug_lock.rw_sem){++++} but this new dependency connects a SOFTIRQ-irq-safe lock: (slock-AF_INET6){+.-.} ... which became SOFTIRQ-irq-safe at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:310 [inline] sctp_generate_timeout_event+0x73/0x320 net/sctp/sm_sideeffect.c:292 sctp_generate_t1_init_event+0x1e/0x30 net/sctp/sm_sideeffect.c:336 call_timer_fn+0x228/0x820 kernel/time/timer.c:1320 expire_timers kernel/time/timer.c:1357 [inline] __run_timers+0x7ee/0xb70 kernel/time/timer.c:1660 run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1686 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285 invoke_softirq kernel/softirq.c:365 [inline] irq_exit+0x1cc/0x200 kernel/softirq.c:405 exiting_irq arch/x86/include/asm/apic.h:540 [inline] smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052 apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:904 memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:65 free_pages_prepare mm/page_alloc.c:1071 [inline] __free_pages_ok+0x783/0x31e0 mm/page_alloc.c:1259 free_compound_page+0x5e/0x70 mm/page_alloc.c:601 free_transhuge_page+0x2d2/0x430 mm/huge_memory.c:2740 __put_compound_page+0x87/0xb0 mm/swap.c:95 release_pages+0x64b/0x1230 mm/swap.c:788 free_pages_and_swap_cache+0x2ad/0x400 mm/swap_state.c:322 tlb_flush_mmu_free+0xb4/0x160 mm/memory.c:260 tlb_flush_mmu mm/memory.c:269 [inline] arch_tlb_finish_mmu+0x9d/0x130 mm/memory.c:284 tlb_finish_mmu+0x10f/0x190 mm/memory.c:427 unmap_region+0x35c/0x4f0 mm/mmap.c:2514 do_munmap+0x726/0xdf0 mm/mmap.c:2726 mmap_region+0x59e/0x15a0 mm/mmap.c:1646 do_mmap+0x6c0/0xe00 mm/mmap.c:1483 do_mmap_pgoff include/linux/mm.h:2217 [inline] vm_mmap_pgoff+0x1de/0x280 mm/util.c:333 SYSC_mmap_pgoff mm/mmap.c:1533 [inline] SyS_mmap_pgoff+0x23b/0x5f0 mm/mmap.c:1491 SYSC_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:91 entry_SYSCALL_64_fastpath+0x23/0x9a to a SOFTIRQ-irq-unsafe lock: (cpu_hotplug_lock.rw_sem){++++} ... which became SOFTIRQ-irq-unsafe at: ... lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 down_write+0x87/0x120 kernel/locking/rwsem.c:70 percpu_down_write+0xa3/0x500 kernel/locking/percpu-rwsem.c:145 cpus_write_lock kernel/cpu.c:305 [inline] _cpu_up+0x60/0x510 kernel/cpu.c:990 do_cpu_up+0x73/0xa0 kernel/cpu.c:1066 cpu_up+0x18/0x20 kernel/cpu.c:1074 smp_init+0x13a/0x152 kernel/smp.c:578 kernel_init_freeable+0x2fe/0x521 init/main.c:1064 kernel_init+0x13/0x172 init/main.c:996 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:515 other info that might help us debug this: Chain exists of: slock-AF_INET6 --> &(&net->xfrm.xfrm_policy_lock)->rlock --> cpu_hotplug_lock.rw_sem Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(cpu_hotplug_lock.rw_sem); local_irq_disable(); lock(slock-AF_INET6); lock(&(&net->xfrm.xfrm_policy_lock)->rlock); lock(slock-AF_INET6); *** DEADLOCK *** 2 locks held by syz-executor4/15234: #0: (&net->xfrm.xfrm_cfg_mutex){+.+.}, at: [<000000008e3eb99d>] pfkey_sendmsg+0x4ce/0xa00 net/key/af_key.c:3647 #1: (&(&net->xfrm.xfrm_policy_lock)->rlock){+...}, at: [<00000000001a166b>] spin_lock_bh include/linux/spinlock.h:315 [inline] #1: (&(&net->xfrm.xfrm_policy_lock)->rlock){+...}, at: [<00000000001a166b>] xfrm_policy_flush+0x5d3/0x770 net/xfrm/xfrm_policy.c:969 the dependencies between SOFTIRQ-irq-safe lock and the holding lock: -> (slock-AF_INET6){+.-.} ops: 104586 { HARDIRQ-ON-W at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:315 [inline] lock_sock_nested+0x44/0x110 net/core/sock.c:2772 lock_sock include/net/sock.h:1462 [inline] sock_setsockopt+0x16b/0x1af0 net/core/sock.c:717 SYSC_setsockopt net/socket.c:1817 [inline] SyS_setsockopt+0x2ff/0x360 net/socket.c:1800 entry_SYSCALL_64_fastpath+0x23/0x9a IN-SOFTIRQ-W at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:310 [inline] sctp_generate_timeout_event+0x73/0x320 net/sctp/sm_sideeffect.c:292 sctp_generate_t1_init_event+0x1e/0x30 net/sctp/sm_sideeffect.c:336 call_timer_fn+0x228/0x820 kernel/time/timer.c:1320 expire_timers kernel/time/timer.c:1357 [inline] __run_timers+0x7ee/0xb70 kernel/time/timer.c:1660 run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1686 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285 invoke_softirq kernel/softirq.c:365 [inline] irq_exit+0x1cc/0x200 kernel/softirq.c:405 exiting_irq arch/x86/include/asm/apic.h:540 [inline] smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052 apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:904 memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:65 free_pages_prepare mm/page_alloc.c:1071 [inline] __free_pages_ok+0x783/0x31e0 mm/page_alloc.c:1259 free_compound_page+0x5e/0x70 mm/page_alloc.c:601 free_transhuge_page+0x2d2/0x430 mm/huge_memory.c:2740 __put_compound_page+0x87/0xb0 mm/swap.c:95 release_pages+0x64b/0x1230 mm/swap.c:788 free_pages_and_swap_cache+0x2ad/0x400 mm/swap_state.c:322 tlb_flush_mmu_free+0xb4/0x160 mm/memory.c:260 tlb_flush_mmu mm/memory.c:269 [inline] arch_tlb_finish_mmu+0x9d/0x130 mm/memory.c:284 tlb_finish_mmu+0x10f/0x190 mm/memory.c:427 unmap_region+0x35c/0x4f0 mm/mmap.c:2514 do_munmap+0x726/0xdf0 mm/mmap.c:2726 mmap_region+0x59e/0x15a0 mm/mmap.c:1646 do_mmap+0x6c0/0xe00 mm/mmap.c:1483 do_mmap_pgoff include/linux/mm.h:2217 [inline] vm_mmap_pgoff+0x1de/0x280 mm/util.c:333 SYSC_mmap_pgoff mm/mmap.c:1533 [inline] SyS_mmap_pgoff+0x23b/0x5f0 mm/mmap.c:1491 SYSC_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:91 entry_SYSCALL_64_fastpath+0x23/0x9a INITIAL USE at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:315 [inline] lock_sock_nested+0x44/0x110 net/core/sock.c:2772 lock_sock include/net/sock.h:1462 [inline] sock_setsockopt+0x16b/0x1af0 net/core/sock.c:717 SYSC_setsockopt net/socket.c:1817 [inline] SyS_setsockopt+0x2ff/0x360 net/socket.c:1800 entry_SYSCALL_64_fastpath+0x23/0x9a } ... key at: [<0000000029625a10>] af_family_slock_keys+0x50/0x180 ... acquired at: __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:315 [inline] xfrm_policy_delete+0x3e/0x90 net/xfrm/xfrm_policy.c:1247 xfrm_sk_free_policy include/net/xfrm.h:1256 [inline] inet_csk_destroy_sock+0x320/0x3f0 net/ipv4/inet_connection_sock.c:836 dccp_close+0x853/0xc20 net/dccp/proto.c:1084 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:427 inet6_release+0x50/0x70 net/ipv6/af_inet6.c:432 sock_release+0x8d/0x1e0 net/socket.c:593 sock_close+0x16/0x20 net/socket.c:1121 __fput+0x327/0x7e0 fs/file_table.c:210 ____fput+0x15/0x20 fs/file_table.c:244 task_work_run+0x199/0x270 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x296/0x310 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath+0x490/0x550 arch/x86/entry/common.c:264 entry_SYSCALL_64_fastpath+0x98/0x9a -> (&(&net->xfrm.xfrm_policy_lock)->rlock){+...} ops: 728 { HARDIRQ-ON-W at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:315 [inline] xfrm_policy_flush+0x32/0x770 net/xfrm/xfrm_policy.c:928 xfrm_flush_policy+0x153/0x440 net/xfrm/xfrm_user.c:2061 xfrm_user_rcv_msg+0x422/0x860 net/xfrm/xfrm_user.c:2591 netlink_rcv_skb+0x224/0x470 net/netlink/af_netlink.c:2441 xfrm_netlink_rcv+0x6f/0x90 net/xfrm/xfrm_user.c:2599 netlink_unicast_kernel net/netlink/af_netlink.c:1308 [inline] netlink_unicast+0x4c4/0x6b0 net/netlink/af_netlink.c:1334 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1897 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a INITIAL USE at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:315 [inline] xfrm_policy_flush+0x32/0x770 net/xfrm/xfrm_policy.c:928 xfrm_flush_policy+0x153/0x440 net/xfrm/xfrm_user.c:2061 xfrm_user_rcv_msg+0x422/0x860 net/xfrm/xfrm_user.c:2591 netlink_rcv_skb+0x224/0x470 net/netlink/af_netlink.c:2441 xfrm_netlink_rcv+0x6f/0x90 net/xfrm/xfrm_user.c:2599 netlink_unicast_kernel net/netlink/af_netlink.c:1308 [inline] netlink_unicast+0x4c4/0x6b0 net/netlink/af_netlink.c:1334 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1897 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a } ... key at: [<00000000ea3c831a>] __key.66927+0x0/0x40 ... acquired at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline] percpu_down_read include/linux/percpu-rwsem.h:59 [inline] cpus_read_lock+0x42/0x90 kernel/cpu.c:293 get_online_cpus include/linux/cpu.h:117 [inline] xfrm_policy_cache_flush+0x1d0/0x710 net/xfrm/xfrm_policy.c:1767 xfrm_policy_flush+0x650/0x770 net/xfrm/xfrm_policy.c:978 pfkey_spdflush+0x98/0x370 net/key/af_key.c:2750 pfkey_process+0x611/0x720 net/key/af_key.c:2809 pfkey_sendmsg+0x4dc/0xa00 net/key/af_key.c:3648 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: -> (cpu_hotplug_lock.rw_sem){++++} ops: 1728 { HARDIRQ-ON-W at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 down_write+0x87/0x120 kernel/locking/rwsem.c:70 percpu_down_write+0xa3/0x500 kernel/locking/percpu-rwsem.c:145 cpus_write_lock kernel/cpu.c:305 [inline] _cpu_up+0x60/0x510 kernel/cpu.c:990 do_cpu_up+0x73/0xa0 kernel/cpu.c:1066 cpu_up+0x18/0x20 kernel/cpu.c:1074 smp_init+0x13a/0x152 kernel/smp.c:578 kernel_init_freeable+0x2fe/0x521 init/main.c:1064 kernel_init+0x13/0x172 init/main.c:996 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:515 HARDIRQ-ON-R at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline] percpu_down_read include/linux/percpu-rwsem.h:59 [inline] cpus_read_lock+0x42/0x90 kernel/cpu.c:293 get_online_cpus include/linux/cpu.h:117 [inline] kmem_cache_create+0x26/0x2a0 mm/slab_common.c:440 debug_objects_mem_init+0xda/0x910 lib/debugobjects.c:1139 start_kernel+0x6dd/0x819 init/main.c:671 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:378 x86_64_start_kernel+0x77/0x7a arch/x86/kernel/head64.c:359 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:237 SOFTIRQ-ON-W at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 down_write+0x87/0x120 kernel/locking/rwsem.c:70 percpu_down_write+0xa3/0x500 kernel/locking/percpu-rwsem.c:145 cpus_write_lock kernel/cpu.c:305 [inline] _cpu_up+0x60/0x510 kernel/cpu.c:990 do_cpu_up+0x73/0xa0 kernel/cpu.c:1066 cpu_up+0x18/0x20 kernel/cpu.c:1074 smp_init+0x13a/0x152 kernel/smp.c:578 kernel_init_freeable+0x2fe/0x521 init/main.c:1064 kernel_init+0x13/0x172 init/main.c:996 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:515 SOFTIRQ-ON-R at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline] percpu_down_read include/linux/percpu-rwsem.h:59 [inline] cpus_read_lock+0x42/0x90 kernel/cpu.c:293 get_online_cpus include/linux/cpu.h:117 [inline] kmem_cache_create+0x26/0x2a0 mm/slab_common.c:440 debug_objects_mem_init+0xda/0x910 lib/debugobjects.c:1139 start_kernel+0x6dd/0x819 init/main.c:671 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:378 x86_64_start_kernel+0x77/0x7a arch/x86/kernel/head64.c:359 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:237 INITIAL USE at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline] percpu_down_read include/linux/percpu-rwsem.h:59 [inline] cpus_read_lock kernel/cpu.c:293 [inline] __cpuhp_setup_state+0x60/0x140 kernel/cpu.c:1670 cpuhp_setup_state_nocalls include/linux/cpuhotplug.h:229 [inline] kvm_guest_init+0x1f3/0x20f arch/x86/kernel/kvm.c:528 setup_arch+0x17e8/0x1a02 arch/x86/kernel/setup.c:1266 start_kernel+0xcd/0x819 init/main.c:532 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:378 x86_64_start_kernel+0x77/0x7a arch/x86/kernel/head64.c:359 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:237 } ... key at: [<000000007018a7d1>] cpu_hotplug_lock+0xd8/0x140 ... acquired at: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline] percpu_down_read include/linux/percpu-rwsem.h:59 [inline] cpus_read_lock+0x42/0x90 kernel/cpu.c:293 get_online_cpus include/linux/cpu.h:117 [inline] xfrm_policy_cache_flush+0x1d0/0x710 net/xfrm/xfrm_policy.c:1767 xfrm_policy_flush+0x650/0x770 net/xfrm/xfrm_policy.c:978 pfkey_spdflush+0x98/0x370 net/key/af_key.c:2750 pfkey_process+0x611/0x720 net/key/af_key.c:2809 pfkey_sendmsg+0x4dc/0xa00 net/key/af_key.c:3648 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a stack backtrace: CPU: 0 PID: 15234 Comm: syz-executor4 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_bad_irq_dependency kernel/locking/lockdep.c:1565 [inline] check_usage+0xad0/0xb60 kernel/locking/lockdep.c:1597 check_irq_usage kernel/locking/lockdep.c:1653 [inline] check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline] check_prev_add kernel/locking/lockdep.c:1863 [inline] check_prevs_add kernel/locking/lockdep.c:1971 [inline] validate_chain kernel/locking/lockdep.c:2412 [inline] __lock_acquire+0x2bd1/0x3e00 kernel/locking/lockdep.c:3426 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline] percpu_down_read include/linux/percpu-rwsem.h:59 [inline] cpus_read_lock+0x42/0x90 kernel/cpu.c:293 get_online_cpus include/linux/cpu.h:117 [inline] xfrm_policy_cache_flush+0x1d0/0x710 net/xfrm/xfrm_policy.c:1767 xfrm_policy_flush+0x650/0x770 net/xfrm/xfrm_policy.c:978 pfkey_spdflush+0x98/0x370 net/key/af_key.c:2750 pfkey_process+0x611/0x720 net/key/af_key.c:2809 pfkey_sendmsg+0x4dc/0xa00 net/key/af_key.c:3648 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f6243031c58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 000000002057f000 RDI: 0000000000000013 RBP: 000000000000058a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f6590 R13: 00000000ffffffff R14: 00007f62430326d4 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 1 PID: 15950 Comm: syz-executor1 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3368 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3542 anon_vma_chain_alloc mm/rmap.c:128 [inline] __anon_vma_prepare+0xbc/0x6b0 mm/rmap.c:182 anon_vma_prepare include/linux/rmap.h:153 [inline] do_huge_pmd_anonymous_page+0x1127/0x1b00 mm/huge_memory.c:678 create_huge_pmd mm/memory.c:3828 [inline] __handle_mm_fault+0x1a0c/0x3ce0 mm/memory.c:4032 handle_mm_fault+0x334/0x8d0 mm/memory.c:4098 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1429 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1504 page_fault+0x2c/0x60 arch/x86/entry/entry_64.S:1225 RIP: 0010:__put_user_4+0x1c/0x30 arch/x86/lib/putuser.S:68 RSP: 0018:ffff8801bed7fe50 EFLAGS: 00010293 RAX: 0000000000000014 RBX: 00007fffffffeffd RCX: 000000002000dff8 RDX: 0000000000000044 RSI: ffffc9000271f000 RDI: 0000000000000282 RBP: ffff8801bed7ff48 R08: 0000000000000000 R09: 1ffff10037daffa7 R10: ffff8801bed7fd00 R11: ffff8801cff91a08 R12: 1ffff10037daffd0 R13: 0000000000000014 R14: 0000000000000001 R15: 0000000000000015 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007fcf350f6c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000035 RAX: ffffffffffffffda RBX: 00007fcf350f6aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 008000000000001e RBP: 00007fcf350f6a90 R08: 0000000000000000 R09: 0000000000000000 R10: 000000002000dff8 R11: 0000000000000212 R12: 00000000004b767a R13: 00007fcf350f6bc8 R14: 00000000004b767a R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 16028 Comm: syz-executor5 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node+0x56/0x760 mm/slab.c:3632 __alloc_skb+0xf1/0x780 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:983 [inline] netlink_dump+0x545/0xcf0 net/netlink/af_netlink.c:2203 netlink_recvmsg+0x9bf/0x1300 net/netlink/af_netlink.c:1980 sock_recvmsg_nosec net/socket.c:801 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:808 SYSC_recvfrom+0x2e5/0x5a0 net/socket.c:1771 SyS_recvfrom+0x40/0x50 net/socket.c:1743 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f272f113c58 EFLAGS: 00000212 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 00007f272f113aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020d71000 RDI: 0000000000000013 RBP: 00007f272f113a90 R08: 0000000020324000 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f272f113bc8 R14: 00000000004b767a R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 16048 Comm: syz-executor5 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node_track_caller+0x33/0x70 mm/slab.c:3686 __kmalloc_reserve.isra.39+0x41/0xd0 net/core/skbuff.c:137 __alloc_skb+0x13b/0x780 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:983 [inline] netlink_dump+0x545/0xcf0 net/netlink/af_netlink.c:2203 netlink_recvmsg+0x9bf/0x1300 net/netlink/af_netlink.c:1980 sock_recvmsg_nosec net/socket.c:801 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:808 SYSC_recvfrom+0x2e5/0x5a0 net/socket.c:1771 SyS_recvfrom+0x40/0x50 net/socket.c:1743 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f272f113c58 EFLAGS: 00000212 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 00007f272f113aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020d71000 RDI: 0000000000000013 RBP: 00007f272f113a90 R08: 0000000020324000 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f272f113bc8 R14: 00000000004b767a R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 16150 Comm: syz-executor0 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node+0x56/0x760 mm/slab.c:3632 __alloc_skb+0xf1/0x780 net/core/skbuff.c:193 alloc_skb_fclone include/linux/skbuff.h:1025 [inline] tipc_buf_acquire+0x2d/0xf0 net/tipc/msg.c:66 tipc_msg_build+0xfa/0x1220 net/tipc/msg.c:277 __tipc_sendstream+0x60e/0xc20 net/tipc/socket.c:1424 tipc_sendstream+0x50/0x70 net/tipc/socket.c:1383 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f46731a4c58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f46731a4aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020017000 RDI: 0000000000000013 RBP: 00007f46731a4a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f46731a4bc8 R14: 00000000004b767a R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 16166 Comm: syz-executor0 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node_track_caller+0x33/0x70 mm/slab.c:3686 __kmalloc_reserve.isra.39+0x41/0xd0 net/core/skbuff.c:137 __alloc_skb+0x13b/0x780 net/core/skbuff.c:205 alloc_skb_fclone include/linux/skbuff.h:1025 [inline] tipc_buf_acquire+0x2d/0xf0 net/tipc/msg.c:66 tipc_msg_build+0xfa/0x1220 net/tipc/msg.c:277 __tipc_sendstream+0x60e/0xc20 net/tipc/socket.c:1424 tipc_sendstream+0x50/0x70 net/tipc/socket.c:1383 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f46731a4c58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f46731a4aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020017000 RDI: 0000000000000013 RBP: 00007f46731a4a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f46731a4bc8 R14: 00000000004b767a R15: 0000000000000000 audit: type=1400 audit(1515237878.360:91): avc: denied { getopt } for pid=16251 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 16346 Comm: syz-executor3 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3368 [inline] kmem_cache_alloc_trace+0x4b/0x750 mm/slab.c:3608 kmalloc include/linux/slab.h:499 [inline] tipc_alloc_entry net/tipc/server.c:414 [inline] tipc_conn_sendmsg+0x107/0x500 net/tipc/server.c:463 tipc_subscrp_send_event+0x410/0x6e0 net/tipc/subscr.c:84 tipc_subscrp_report_overlap+0x3ea/0x4c0 net/tipc/subscr.c:132 tipc_nameseq_remove_publ+0x786/0x10a0 net/tipc/name_table.c:399 tipc_nametbl_remove_publ+0xeb/0x3e0 net/tipc/name_table.c:499 tipc_nametbl_withdraw+0x262/0x6e0 net/tipc/name_table.c:788 tipc_sk_withdraw+0x446/0x6b0 net/tipc/socket.c:2621 tipc_bind+0x255/0x2d0 net/tipc/socket.c:615 SYSC_bind+0x1c3/0x410 net/socket.c:1446 SyS_bind+0x24/0x30 net/socket.c:1432 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f0888314c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 00007f0888314aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020d01ff0 RDI: 0000000000000013 RBP: 00007f0888314a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f0888314bc8 R14: 00000000004b767a R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 16375 Comm: syz-executor3 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3368 [inline] __do_kmalloc mm/slab.c:3706 [inline] __kmalloc_track_caller+0x5f/0x760 mm/slab.c:3723 kmemdup+0x24/0x50 mm/util.c:118 kmemdup include/linux/string.h:417 [inline] tipc_alloc_entry net/tipc/server.c:418 [inline] tipc_conn_sendmsg+0x133/0x500 net/tipc/server.c:463 tipc_subscrp_send_event+0x410/0x6e0 net/tipc/subscr.c:84 tipc_subscrp_report_overlap+0x3ea/0x4c0 net/tipc/subscr.c:132 tipc_nameseq_remove_publ+0x786/0x10a0 net/tipc/name_table.c:399 tipc_nametbl_remove_publ+0xeb/0x3e0 net/tipc/name_table.c:499 tipc_nametbl_withdraw+0x262/0x6e0 net/tipc/name_table.c:788 tipc_sk_withdraw+0x446/0x6b0 net/tipc/socket.c:2621 tipc_bind+0x255/0x2d0 net/tipc/socket.c:615 SYSC_bind+0x1c3/0x410 net/socket.c:1446 SyS_bind+0x24/0x30 net/socket.c:1432 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f0888314c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 00007f0888314aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020d01ff0 RDI: 0000000000000013 RBP: 00007f0888314a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f0888314bc8 R14: 00000000004b767a R15: 0000000000000000 CPU: 1 PID: 16385 Comm: syz-executor6 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3368 [inline] kmem_cache_alloc_trace+0x4b/0x750 mm/slab.c:3608 kmalloc include/linux/slab.h:499 [inline] kzalloc include/linux/slab.h:688 [inline] tipc_group_create+0x116/0x9c0 net/tipc/group.c:167 tipc_sk_join net/tipc/socket.c:2745 [inline] tipc_setsockopt+0x249/0xc10 net/tipc/socket.c:2859 SYSC_setsockopt net/socket.c:1821 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1800 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f05634c2c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007f05634c2aa0 RCX: 0000000000452ac9 RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000013 RBP: 00007f05634c2a90 R08: 0000000000000010 R09: 0000000000000000 R10: 0000000020540ff0 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f05634c2bc8 R14: 00000000004b767a R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 16401 Comm: syz-executor3 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node+0x56/0x760 mm/slab.c:3632 __alloc_skb+0xf1/0x780 net/core/skbuff.c:193 alloc_skb_fclone include/linux/skbuff.h:1025 [inline] tipc_buf_acquire+0x2d/0xf0 net/tipc/msg.c:66 named_prepare_buf+0x1e8/0x410 net/tipc/name_distr.c:72 tipc_named_withdraw+0x1f6/0x620 net/tipc/name_distr.c:123 tipc_nametbl_withdraw+0x2db/0x6e0 net/tipc/name_table.c:792 tipc_sk_withdraw+0x446/0x6b0 net/tipc/socket.c:2621 tipc_bind+0x255/0x2d0 net/tipc/socket.c:615 SYSC_bind+0x1c3/0x410 net/socket.c:1446 SyS_bind+0x24/0x30 net/socket.c:1432 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f0888314c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 00007f0888314aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020d01ff0 RDI: 0000000000000013 RBP: 00007f0888314a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f0888314bc8 R14: 00000000004b767a R15: 0000000000000000 Withdrawal distribution failure FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 16447 Comm: syz-executor3 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node_track_caller+0x33/0x70 mm/slab.c:3686 __kmalloc_reserve.isra.39+0x41/0xd0 net/core/skbuff.c:137 __alloc_skb+0x13b/0x780 net/core/skbuff.c:205 alloc_skb_fclone include/linux/skbuff.h:1025 [inline] tipc_buf_acquire+0x2d/0xf0 net/tipc/msg.c:66 named_prepare_buf+0x1e8/0x410 net/tipc/name_distr.c:72 tipc_named_withdraw+0x1f6/0x620 net/tipc/name_distr.c:123 tipc_nametbl_withdraw+0x2db/0x6e0 net/tipc/name_table.c:792 tipc_sk_withdraw+0x446/0x6b0 net/tipc/socket.c:2621 tipc_bind+0x255/0x2d0 net/tipc/socket.c:615 SYSC_bind+0x1c3/0x410 net/socket.c:1446 SyS_bind+0x24/0x30 net/socket.c:1432 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f0888314c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 00007f0888314aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020d01ff0 RDI: 0000000000000013 RBP: 00007f0888314a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f0888314bc8 R14: 00000000004b767a R15: 0000000000000000 Withdrawal distribution failure FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 16521 Comm: syz-executor2 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node+0x56/0x760 mm/slab.c:3632 __alloc_skb+0xf1/0x780 net/core/skbuff.c:193 alloc_skb_fclone include/linux/skbuff.h:1025 [inline] tipc_buf_acquire+0x2d/0xf0 net/tipc/msg.c:66 tipc_msg_build+0xfa/0x1220 net/tipc/msg.c:277 __tipc_sendstream+0x60e/0xc20 net/tipc/socket.c:1424 tipc_sendstream+0x50/0x70 net/tipc/socket.c:1383 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f2d2cebcc58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f2d2cebcaa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020017000 RDI: 0000000000000013 RBP: 00007f2d2cebca90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f2d2cebcbc8 R14: 00000000004b767a R15: 0000000000000000 nla_parse: 11 callbacks suppressed netlink: 5 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor2'. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 16654 Comm: syz-executor4 Tainted: G W 4.15.0-rc5+ #177 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3368 [inline] __do_kmalloc mm/slab.c:3706 [inline] __kmalloc+0x63/0x760 mm/slab.c:3717 kmalloc include/linux/slab.h:504 [inline] kzalloc include/linux/slab.h:688 [inline] rds_message_alloc+0xb1/0x330 net/rds/message.c:202 rds_sendmsg+0xb5e/0x20e0 net/rds/send.c:1100 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2018 __sys_sendmsg+0xe5/0x210 net/socket.c:2052 SYSC_sendmsg net/socket.c:2063 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2059 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007f6243010c58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f6243010aa0 RCX: 0000000000452ac9 RDX: 0000000000000000 RSI: 0000000020159fc8 RDI: 0000000000000013 RBP: 00007f6243010a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b767a R13: 00007f6243010bc8 R14: 00000000004b767a R15: 0000000000000000 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=18574 sclass=netlink_route_socket pig=16669 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=18574 sclass=netlink_route_socket pig=16678 comm=syz-executor5 RDS: rds_bind could not find a transport for 172.20.4.187, load rds_tcp or rds_rdma? SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6482 sclass=netlink_route_socket pig=16954 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6482 sclass=netlink_route_socket pig=16965 comm=syz-executor5