=============================
[ BUG: Invalid wait context ]
6.13.0-syzkaller-04858-g21266b8df522 #0 Not tainted
-----------------------------
syz.1.306/6890 is trying to lock:
ffff88807ffd8298 (&zone->lock){..-.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:2909 [inline]
ffff88807ffd8298 (&zone->lock){..-.}-{3:3}, at: rmqueue mm/page_alloc.c:3082 [inline]
ffff88807ffd8298 (&zone->lock){..-.}-{3:3}, at: get_page_from_freelist+0xbbe/0x2f80 mm/page_alloc.c:3473
other info that might help us debug this:
context-{2:2}
4 locks held by syz.1.306/6890:
#0: ffffffff8fef25e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
#0: ffffffff8fef25e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:335 [inline]
#0: ffffffff8fef25e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x5d9/0x1d60 net/core/rtnetlink.c:4020
#1: ffffffff8e1be2c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#1: ffffffff8e1be2c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffffff8e1be2c0 (rcu_read_lock){....}-{1:3}, at: __fib6_clean_all+0x45/0x2d0 net/ipv6/ip6_fib.c:2263
#2: ffff888108d2bc30 (&tb->tb6_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#2: ffff888108d2bc30 (&tb->tb6_lock){+...}-{3:3}, at: __fib6_clean_all+0xe5/0x2d0 net/ipv6/ip6_fib.c:2267
#3: ffff88806a744c18 (&pcp->lock){+.+.}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline]
#3: ffff88806a744c18 (&pcp->lock){+.+.}-{3:3}, at: rmqueue_pcplist mm/page_alloc.c:3032 [inline]
#3: ffff88806a744c18 (&pcp->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3076 [inline]
#3: ffff88806a744c18 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x350/0x2f80 mm/page_alloc.c:3473
stack backtrace:
CPU: 1 UID: 0 PID: 6890 Comm: syz.1.306 Not tainted 6.13.0-syzkaller-04858-g21266b8df522 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4828 [inline]
check_wait_context kernel/locking/lockdep.c:4900 [inline]
__lock_acquire+0x878/0x3c40 kernel/locking/lockdep.c:5178
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
rmqueue_buddy mm/page_alloc.c:2909 [inline]
rmqueue mm/page_alloc.c:3082 [inline]
get_page_from_freelist+0xbbe/0x2f80 mm/page_alloc.c:3473
__alloc_pages_noprof+0x221/0x2470 mm/page_alloc.c:4753
alloc_pages_mpol_noprof+0x2c8/0x620 mm/mempolicy.c:2269
stack_depot_save_flags+0x8aa/0x9c0 lib/stackdepot.c:627
kasan_save_stack+0x42/0x60 mm/kasan/common.c:48
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:544
task_work_add+0xc0/0x3b0 kernel/task_work.c:77
__run_posix_cpu_timers kernel/time/posix-cpu-timers.c:1223 [inline]
run_posix_cpu_timers+0x69f/0x7d0 kernel/time/posix-cpu-timers.c:1422
update_process_times+0x1a1/0x2d0 kernel/time/timer.c:2522
tick_sched_handle kernel/time/tick-sched.c:276 [inline]
tick_nohz_handler+0x376/0x530 kernel/time/tick-sched.c:297
__run_hrtimer kernel/time/hrtimer.c:1738 [inline]
__hrtimer_run_queues+0x5fb/0xae0 kernel/time/hrtimer.c:1802
hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1864
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
__sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 36 26 40 f6 48 89 df e8 8e a5 40 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 d5 7b 31 f6 65 8b 05 96 32 cd 74 85 c0 74 16 5b
RSP: 0018:ffffc90002915f58 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffff88807ffd8280 RCX: 1ffffffff2dd5a10
RDX: 0000000000000000 RSI: ffffffff8b6cd6c0 RDI: ffffffff8bd2c020
RBP: 0000000000000202 R08: 0000000000000001 R09: fffffbfff2dd5598
R10: ffffffff96eaacc7 R11: dffffc0000000000 R12: 000000000000000f
R13: dffffc0000000000 R14: ffff88806a744cc8 R15: ffff88806a744c00
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
rmqueue_bulk mm/page_alloc.c:2328 [inline]
__rmqueue_pcplist+0x5b1/0x1600 mm/page_alloc.c:3003
rmqueue_pcplist mm/page_alloc.c:3045 [inline]
rmqueue mm/page_alloc.c:3076 [inline]
get_page_from_freelist+0x3d2/0x2f80 mm/page_alloc.c:3473
__alloc_pages_noprof+0x221/0x2470 mm/page_alloc.c:4753
alloc_pages_mpol_noprof+0x2c8/0x620 mm/mempolicy.c:2269
stack_depot_save_flags+0x8aa/0x9c0 lib/stackdepot.c:627
kasan_save_stack+0x42/0x60 mm/kasan/common.c:48
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4119 [inline]
slab_alloc_node mm/slub.c:4168 [inline]
kmem_cache_alloc_node_noprof+0x223/0x3c0 mm/slub.c:4220
__alloc_skb+0x2b1/0x380 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1331 [inline]
nlmsg_new include/net/netlink.h:1018 [inline]
inet6_rt_notify+0xc7/0x260 net/ipv6/route.c:6213
fib6_del_route net/ipv6/ip6_fib.c:2005 [inline]
fib6_del+0xf56/0x1760 net/ipv6/ip6_fib.c:2040
fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2202
fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2124
fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2172
fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2252
__fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2268
rt6_sync_down_dev net/ipv6/route.c:4908 [inline]
rt6_disable_ip+0x2ef/0x940 net/ipv6/route.c:4913
addrconf_ifdown.isra.0+0x126/0x1af0 net/ipv6/addrconf.c:3849
addrconf_notify+0x220/0x19c0 net/ipv6/addrconf.c:3772
notifier_call_chain+0xb7/0x410 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2141
call_netdevice_notifiers_extack net/core/dev.c:2179 [inline]
call_netdevice_notifiers net/core/dev.c:2193 [inline]
__dev_notify_flags+0x1f9/0x2e0 net/core/dev.c:9213
dev_change_flags+0x10c/0x160 net/core/dev.c:9249
do_setlink.constprop.0+0x699/0x3f80 net/core/rtnetlink.c:3118
rtnl_changelink net/core/rtnetlink.c:3732 [inline]
__rtnl_newlink net/core/rtnetlink.c:3884 [inline]
rtnl_newlink+0x1306/0x1d60 net/core/rtnetlink.c:4021
rtnetlink_rcv_msg+0x95b/0xea0 net/core/rtnetlink.c:6911
netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2543
netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1348
netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1892
sock_sendmsg_nosec net/socket.c:713 [inline]
__sock_sendmsg net/socket.c:728 [inline]
____sys_sendmsg+0xaaf/0xc90 net/socket.c:2568
___sys_sendmsg+0x135/0x1e0 net/socket.c:2622
__sys_sendmsg+0x16e/0x220 net/socket.c:2654
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f447b18cd29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f447c06c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f447b3a5fa0 RCX: 00007f447b18cd29
RDX: 0000000000000000 RSI: 00000000200006c0 RDI: 0000000000000009
RBP: 00007f447b20e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f447b3a5fa0 R15: 00007fff0366a8f8
----------------
Code disassembly (best guess):
0: f5 cmc
1: 53 push %rbx
2: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
7: 48 89 fb mov %rdi,%rbx
a: 48 83 c7 18 add $0x18,%rdi
e: e8 36 26 40 f6 call 0xf6402649
13: 48 89 df mov %rbx,%rdi
16: e8 8e a5 40 f6 call 0xf640a5a9
1b: f7 c5 00 02 00 00 test $0x200,%ebp
21: 75 23 jne 0x46
23: 9c pushf
24: 58 pop %rax
25: f6 c4 02 test $0x2,%ah
28: 75 37 jne 0x61
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 d5 7b 31 f6 call 0xf6317c09
34: 65 8b 05 96 32 cd 74 mov %gs:0x74cd3296(%rip),%eax # 0x74cd32d1
3b: 85 c0 test %eax,%eax
3d: 74 16 je 0x55
3f: 5b pop %rbx