vmalloc: allocation failure: 0 bytes BUG: using __this_cpu_add() in preemptible [00000000] code: syz-executor3/19111 syz-executor4: page allocation failure: order:0, mode:0x24000c2 CPU: 0 PID: 19112 Comm: syz-executor4 Not tainted 4.4.172+ #13 0000000000000000 eaa5943405976a72 ffff8800ba96f9f0 ffffffff81aacde1 1ffff1001752df41 ffff8801bcd8c740 00000000024000c2 0000000000000000 ffffffff82895080 ffff8800ba96fb00 ffffffff8148be88 ffffffff00000001 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] warn_alloc_failed.cold+0x78/0x99 mm/page_alloc.c:2757 [] __vmalloc_node_range mm/vmalloc.c:1693 [inline] [] __vmalloc_node_range+0x365/0x650 mm/vmalloc.c:1654 [] __vmalloc_node mm/vmalloc.c:1716 [inline] [] __vmalloc_node_flags mm/vmalloc.c:1730 [inline] [] vmalloc+0x5c/0x70 mm/vmalloc.c:1745 [] sel_write_load+0x119/0xf90 security/selinux/selinuxfs.c:527 [] __vfs_write+0x116/0x3d0 fs/read_write.c:489 [] vfs_write+0x182/0x4e0 fs/read_write.c:538 [] SYSC_write fs/read_write.c:585 [inline] [] SyS_write+0xdc/0x1c0 fs/read_write.c:577 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Mem-Info: active_anon:157211 inactive_anon:13474 isolated_anon:0 active_file:5015 inactive_file:11869 isolated_file:0 unevictable:0 dirty:214 writeback:0 unstable:0 slab_reclaimable:5840 slab_unreclaimable:64368 mapped:60412 shmem:17589 pagetables:9547 bounce:0 free:1308717 free_pcp:596 free_cma:0 DMA32 free:2391092kB min:4696kB low:5868kB high:7044kB active_anon:286268kB inactive_anon:23976kB active_file:9292kB inactive_file:22412kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021780kB mlocked:0kB dirty:460kB writeback:0kB mapped:110768kB shmem:31112kB slab_reclaimable:11032kB slab_unreclaimable:120512kB kernel_stack:7520kB pagetables:17760kB unstable:0kB bounce:0kB free_pcp:1088kB local_pcp:500kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no lowmem_reserve[]: 0 3504 3504 Normal free:2843776kB min:5580kB low:6972kB high:8368kB active_anon:342576kB inactive_anon:29920kB active_file:10768kB inactive_file:25064kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:396kB writeback:0kB mapped:130880kB shmem:39244kB slab_reclaimable:12328kB slab_unreclaimable:136960kB kernel_stack:9856kB pagetables:20428kB unstable:0kB bounce:0kB free_pcp:1296kB local_pcp:636kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no lowmem_reserve[]: 0 0 0 DMA32: 161*4kB (ME) 84*8kB (UME) 291*16kB (UME) 203*32kB (UME) 164*64kB (UME) 47*128kB (UME) 83*256kB (UME) 70*512kB (UME) 33*1024kB (UME) 27*2048kB (UME) 541*4096kB (UM) = 2391092kB Normal: 166*4kB (UME) 168*8kB (UME) 320*16kB (UME) 320*32kB (UME) 207*64kB (UME) 61*128kB (UME) 118*256kB (UM) 72*512kB (UM) 38*1024kB (UME) 32*2048kB (UM) 643*4096kB (UM) = 2843672kB 34456 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 313343 pages reserved vmalloc: allocation failure: 0 bytes syz-executor4: page allocation failure: order:0, mode:0x24000c2 CPU: 0 PID: 19112 Comm: syz-executor4 Not tainted 4.4.172+ #13 0000000000000000 eaa5943405976a72 ffff8800ba96f9f0 ffffffff81aacde1 1ffff1001752df41 ffff8801bcd8c740 00000000024000c2 0000000000000000 ffffffff82895080 ffff8800ba96fb00 ffffffff8148be88 ffffffff00000001 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] warn_alloc_failed.cold+0x78/0x99 mm/page_alloc.c:2757 [] __vmalloc_node_range mm/vmalloc.c:1693 [inline] [] __vmalloc_node_range+0x365/0x650 mm/vmalloc.c:1654 [] __vmalloc_node mm/vmalloc.c:1716 [inline] [] __vmalloc_node_flags mm/vmalloc.c:1730 [inline] [] vmalloc+0x5c/0x70 mm/vmalloc.c:1745 [] sel_write_load+0x119/0xf90 security/selinux/selinuxfs.c:527 [] __vfs_write+0x116/0x3d0 fs/read_write.c:489 [] vfs_write+0x182/0x4e0 fs/read_write.c:538 [] SYSC_write fs/read_write.c:585 [inline] [] SyS_write+0xdc/0x1c0 fs/read_write.c:577 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Mem-Info: active_anon:157186 inactive_anon:13474 isolated_anon:0 active_file:5015 inactive_file:11869 isolated_file:0 unevictable:0 dirty:214 writeback:0 unstable:0 slab_reclaimable:5840 slab_unreclaimable:64368 mapped:60412 shmem:17589 pagetables:9547 bounce:0 free:1308717 free_pcp:621 free_cma:0 DMA32 free:2391092kB min:4696kB low:5868kB high:7044kB active_anon:286168kB inactive_anon:23976kB active_file:9292kB inactive_file:22412kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021780kB mlocked:0kB dirty:460kB writeback:0kB mapped:110768kB shmem:31112kB slab_reclaimable:11032kB slab_unreclaimable:120512kB kernel_stack:7520kB pagetables:17760kB unstable:0kB bounce:0kB free_pcp:1188kB local_pcp:600kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no lowmem_reserve[]: 0 3504 3504 Normal free:2843776kB min:5580kB low:6972kB high:8368kB active_anon:342576kB inactive_anon:29920kB active_file:10768kB inactive_file:25064kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:396kB writeback:0kB mapped:130880kB shmem:39244kB slab_reclaimable:12328kB slab_unreclaimable:136960kB kernel_stack:9856kB pagetables:20428kB unstable:0kB bounce:0kB free_pcp:1296kB local_pcp:636kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no lowmem_reserve[]: 0 0 0 DMA32: 161*4kB (ME) 84*8kB (UME) 291*16kB (UME) 203*32kB (UME) 164*64kB (UME) 47*128kB (UME) 83*256kB (UME) 70*512kB (UME) 33*1024kB (UME) 27*2048kB (UME) 541*4096kB (UM) = 2391092kB Normal: 171*4kB (UME) 173*8kB (UME) 322*16kB (UME) 319*32kB (UME) 207*64kB (UME) 61*128kB (UME) 118*256kB (UM) 72*512kB (UM) 38*1024kB (UME) 32*2048kB (UM) 643*4096kB (UM) = 2843732kB 34456 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 313343 pages reserved caller is __this_cpu_preempt_check+0x1d/0x30 lib/smp_processor_id.c:62 CPU: 1 PID: 19111 Comm: syz-executor3 Not tainted 4.4.172+ #13 0000000000000000 6faf182c2a3a2660 ffff8800a7bd7930 ffffffff81aacde1 ffff8801c0665f00 0000000000000001 ffffffff82a860a0 ffffffff8292c040 0000000000000001 ffff8800a7bd7970 ffffffff81b0a993 ffff8801d9f3d204 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] check_preemption_disabled+0x1d3/0x200 lib/smp_processor_id.c:46 [] __this_cpu_preempt_check+0x1d/0x30 lib/smp_processor_id.c:62 [] tcp_try_coalesce net/ipv4/tcp_input.c:4293 [inline] [] tcp_try_coalesce+0x245/0x510 net/ipv4/tcp_input.c:4275 [] tcp_queue_rcv+0x127/0x6f0 net/ipv4/tcp_input.c:4539 [] tcp_send_rcvq+0x3de/0x4a0 net/ipv4/tcp_input.c:4585 [] tcp_sendmsg+0x2332/0x2ab0 net/ipv4/tcp.c:1134 [] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755 [] sock_sendmsg_nosec net/socket.c:638 [inline] [] sock_sendmsg+0xbe/0x110 net/socket.c:648 [] SYSC_sendto net/socket.c:1678 [inline] [] SyS_sendto+0x201/0x340 net/socket.c:1646 [] entry_SYSCALL_64_fastpath+0x1e/0x9a tc_dump_action: action bad kind netlink: 8 bytes leftover after parsing attributes in process `syz-executor2'. tc_dump_action: action bad kind netlink: 8 bytes leftover after parsing attributes in process `syz-executor2'. audit: type=1400 audit(1548798472.042:71): avc: denied { getattr } for pid=19175 comm="syz-executor5" path="socket:[61855]" dev="sockfs" ino=61855 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: BINDER_SET_CONTEXT_MGR already set binder: 19187:19189 ioctl 40046207 0 returned -16 binder: 19187:19189 unknown command 454795503 binder: 19187:19189 ioctl c0306201 2000dfd0 returned -22 SELinux: policydb table sizes (11730950,564510518) do not match mine (5,6) SELinux: policydb table sizes (11730950,564510518) do not match mine (5,6) binder: 19567:19569 transaction failed 29189/-22, size 0-52776558133248 line 3014 binder: undelivered TRANSACTION_ERROR: 29189 SELinux: ebitmap: map size 0 does not match my size 64 (high bit was -570425344) SELinux: ebitmap: map size 0 does not match my size 64 (high bit was -570425344) device lo left promiscuous mode binder: BINDER_SET_CONTEXT_MGR already set binder: 19653:19655 ioctl 40046207 0 returned -16 binder_alloc: 15669: binder_alloc_buf, no vma binder: 19653:19655 transaction failed 29189/-3, size 24-8 line 3137 binder: undelivered TRANSACTION_ERROR: 29189