BUG: TASK stack guard page was hit at ffffc90003e6ff38 (stack is ffffc90003e70000..ffffc90003e78000) Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 2 UID: 0 PID: 15168 Comm: syz.3.1925 Not tainted 6.11.0-syzkaller-11728-gad46e8f95e93 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:mark_lock+0x25/0xc60 kernel/locking/lockdep.c:4683 Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 89 d6 48 ba 00 00 00 00 00 fc ff df 41 55 41 54 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 44 24 30 48 c7 44 24 38 d0 42 57 RSP: 0018:ffffc90003e6ff40 EFLAGS: 00010082 RAX: 0000000000000004 RBX: ffff888020d4af6a RCX: 0000000000000080 RDX: dffffc0000000000 RSI: ffff888020d4af48 RDI: ffff888020d4a440 RBP: ffffc90003e70080 R08: 0000000000000000 R09: fffffbfff2d31388 R10: ffffffff96989c47 R11: 0000000000000000 R12: 0000000000000002 R13: ffff888020d4af48 R14: 0000000000000002 R15: ffff888020d4a440 FS: 0000000000000000(0000) GS:ffff88802b600000(0063) knlGS:00000000f5726b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: ffffc90003e6ff38 CR3: 0000000066efe000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> mark_usage kernel/locking/lockdep.c:4631 [inline] __lock_acquire+0x8a3/0x3ce0 kernel/locking/lockdep.c:5153 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5822 __raw_spin_trylock include/linux/spinlock_api_smp.h:90 [inline] _raw_spin_trylock+0x63/0x80 kernel/locking/spinlock.c:138 spin_trylock include/linux/spinlock.h:361 [inline] rmqueue_pcplist mm/page_alloc.c:3012 [inline] rmqueue mm/page_alloc.c:3056 [inline] get_page_from_freelist+0x371/0x3070 mm/page_alloc.c:3454 __alloc_pages_noprof+0x223/0x25c0 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2413 [inline] allocate_slab mm/slub.c:2579 [inline] new_slab+0x2ba/0x3f0 mm/slub.c:2632 ___slab_alloc+0xd1d/0x16f0 mm/slub.c:3819 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3909 __slab_alloc_node mm/slub.c:3962 [inline] slab_alloc_node mm/slub.c:4123 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_noprof+0x379/0x410 mm/slub.c:4277 kmalloc_noprof include/linux/slab.h:882 [inline] p9_fcall_init+0x97/0x260 net/9p/client.c:233 p9_tag_alloc+0x21c/0x870 net/9p/client.c:300 p9_client_prepare_req+0x19f/0x4d0 net/9p/client.c:644 p9_client_zc_rpc.constprop.0+0x105/0x880 net/9p/client.c:793 p9_client_read_once+0x443/0x820 net/9p/client.c:1560 p9_client_read+0x13f/0x1b0 net/9p/client.c:1524 v9fs_issue_read+0x115/0x310 fs/9p/vfs_addr.c:74 netfs_retry_read_subrequests fs/netfs/read_retry.c:60 [inline] netfs_retry_reads+0x153a/0x1d00 fs/netfs/read_retry.c:232 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405 netfs_dispatch_unbuffered_reads fs/netfs/direct_read.c:103 [inline] netfs_unbuffered_read fs/netfs/direct_read.c:127 [inline] netfs_unbuffered_read_iter_locked+0x12f6/0x19b0 fs/netfs/direct_read.c:221 netfs_unbuffered_read_iter+0xc5/0x100 fs/netfs/direct_read.c:256 v9fs_file_read_iter+0xbf/0x100 fs/9p/vfs_file.c:361 copy_splice_read+0x620/0xb90 fs/splice.c:365 v9fs_file_splice_read+0xc8/0xe0 fs/9p/vfs_file.c:385 do_splice_read fs/splice.c:985 [inline] do_splice_read+0x282/0x370 fs/splice.c:959 splice_direct_to_actor+0x2a4/0xa40 fs/splice.c:1089 do_splice_direct_actor fs/splice.c:1207 [inline] do_splice_direct+0x178/0x250 fs/splice.c:1233 do_sendfile+0xb0c/0xe40 fs/read_write.c:1388 __do_compat_sys_sendfile fs/read_write.c:1470 [inline] __se_compat_sys_sendfile fs/read_write.c:1459 [inline] __ia32_compat_sys_sendfile+0x163/0x230 fs/read_write.c:1459 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7fa6579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f572656c EFLAGS: 00000296 ORIG_RAX: 00000000000000bb RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000003 RDX: 00000000200000c0 RSI: 0000000000000fff RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:mark_lock+0x25/0xc60 kernel/locking/lockdep.c:4683 Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 89 d6 48 ba 00 00 00 00 00 fc ff df 41 55 41 54 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 44 24 30 48 c7 44 24 38 d0 42 57 RSP: 0018:ffffc90003e6ff40 EFLAGS: 00010082 RAX: 0000000000000004 RBX: ffff888020d4af6a RCX: 0000000000000080 RDX: dffffc0000000000 RSI: ffff888020d4af48 RDI: ffff888020d4a440 RBP: ffffc90003e70080 R08: 0000000000000000 R09: fffffbfff2d31388 R10: ffffffff96989c47 R11: 0000000000000000 R12: 0000000000000002 R13: ffff888020d4af48 R14: 0000000000000002 R15: ffff888020d4a440 FS: 0000000000000000(0000) GS:ffff88802b600000(0063) knlGS:00000000f5726b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: ffffc90003e6ff38 CR3: 0000000066efe000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 55 push %rbp 6: 48 89 e5 mov %rsp,%rbp 9: 41 57 push %r15 b: 41 56 push %r14 d: 41 89 d6 mov %edx,%r14d 10: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 17: fc ff df 1a: 41 55 push %r13 1c: 41 54 push %r12 1e: 53 push %rbx 1f: 48 83 e4 f0 and $0xfffffffffffffff0,%rsp 23: 48 81 ec 10 01 00 00 sub $0x110,%rsp * 2a: 48 c7 44 24 30 b3 8a movq $0x41b58ab3,0x30(%rsp) <-- trapping instruction 31: b5 41 33: 48 8d 44 24 30 lea 0x30(%rsp),%rax 38: 48 rex.W 39: c7 .byte 0xc7 3a: 44 24 38 rex.R and $0x38,%al 3d: d0 42 57 rolb 0x57(%rdx)