339412 pages reserved 0 pages cma reserved oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0-1,global_oom,task_memcg=/syz2,task=syz-executor.2,pid=28689,uid=0 Out of memory: Kill process 28689 (syz-executor.2) score 1007 or sacrifice child Killed process 28689 (syz-executor.2) total-vm:72840kB, anon-rss:18380kB, file-rss:34688kB, shmem-rss:0kB INFO: task syz-executor.4:316 blocked for more than 140 seconds. Not tainted 5.0.0-rc7+ #84 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28224 316 4202 0x00000004 Call Trace: context_switch kernel/sched/core.c:2844 [inline] __schedule+0x817/0x1cc0 kernel/sched/core.c:3485 schedule+0x92/0x180 kernel/sched/core.c:3529 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:287 [inline] rwsem_down_read_failed+0x213/0x420 kernel/locking/rwsem-xadd.c:304 call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94 __down_read arch/x86/include/asm/rwsem.h:83 [inline] down_read+0x49/0x90 kernel/locking/rwsem.c:26 do_user_addr_fault arch/x86/mm/fault.c:1426 [inline] __do_page_fault+0x9c2/0xd60 arch/x86/mm/fault.c:1541 do_page_fault+0x71/0x581 arch/x86/mm/fault.c:1572 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143 RIP: 0033:0x4016a7 Code: Bad RIP value. RSP: 002b:00007ffe3bef06b0 EFLAGS: 00010287 RAX: 0000001b3252653c RBX: 0000000000000005 RCX: 0000001b33520000 RDX: 0000001b32526540 RSI: 0000000000000000 RDI: 000000000000000d RBP: 00000000000003e7 R08: 00000000001128be R09: 00000000001128be R10: 00007ffe3bef07c0 R11: 0000000000000246 R12: 000000000073c900 R13: 0000000000112966 R14: 000000000073bf00 R15: 000000000073bfac INFO: task syz-executor.4:334 blocked for more than 140 seconds. Not tainted 5.0.0-rc7+ #84 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28608 334 4202 0x00000004 Call Trace: context_switch kernel/sched/core.c:2844 [inline] __schedule+0x817/0x1cc0 kernel/sched/core.c:3485 schedule+0x92/0x180 kernel/sched/core.c:3529 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:584 [inline] rwsem_down_write_failed+0x774/0xc30 kernel/locking/rwsem-xadd.c:613 call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117 __down_write arch/x86/include/asm/rwsem.h:142 [inline] down_write+0x53/0x90 kernel/locking/rwsem.c:72 map_vdso_once+0x30/0xa0 arch/x86/entry/vdso/vma.c:258 prctl_map_vdso arch/x86/kernel/process_64.c:704 [inline] do_arch_prctl_64+0x216/0x4d0 arch/x86/kernel/process_64.c:794 __do_sys_arch_prctl arch/x86/kernel/process_64.c:812 [inline] __se_sys_arch_prctl arch/x86/kernel/process_64.c:808 [inline] __x64_sys_arch_prctl+0x60/0x90 arch/x86/kernel/process_64.c:808 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29 Code: Bad RIP value. RSP: 002b:00007f82f06dbc78 EFLAGS: 00000246 ORIG_RAX: 000000000000009e RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000457e29 RDX: 0000000000000000 RSI: 0000000000000081 RDI: 0000000000002002 RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82f06dc6d4 R13: 00000000004bddbd R14: 00000000004ce250 R15: 00000000ffffffff Showing all locks held in the system: 1 lock held by khungtaskd/1039: #0: 00000000ee03f3f6 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4389 1 lock held by udevd/3868: 1 lock held by rsyslogd/7430: #0: 00000000b3a9416b (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:795 2 locks held by getty/7521: #0: 000000000210dee2 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 00000000ba5852f9 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7522: #0: 000000000005537d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 00000000c54c526d (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7523: #0: 00000000b9e19a25 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 0000000081f10dfd (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7524: #0: 000000002d3c0753 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 0000000052731927 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7525: #0: 0000000025dc87ec (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 0000000056b4610d (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7526: #0: 000000001068b96e (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 000000005913e872 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7527: #0: 00000000068a94ef (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 000000005ac465be (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 1 lock held by syz-executor.4/316: #0: 000000008cfff838 (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1426 [inline] #0: 000000008cfff838 (&mm->mmap_sem){++++}, at: __do_page_fault+0x9c2/0xd60 arch/x86/mm/fault.c:1541 3 locks held by syz-executor.4/318: 1 lock held by syz-executor.4/334: #0: 000000008cfff838 (&mm->mmap_sem){++++}, at: map_vdso_once+0x30/0xa0 arch/x86/entry/vdso/vma.c:258 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1039 Comm: khungtaskd Not tainted 5.0.0-rc7+ #84 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x9df/0xee0 kernel/hung_task.c:287 kthread+0x357/0x430 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.841 msecs CPU: 0 PID: 318 Comm: syz-executor.4 Not tainted 5.0.0-rc7+ #84 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:preempt_count_add+0x8c/0x1b0 kernel/sched/core.c:3206 Code: 03 65 44 01 25 c5 20 b4 7e 0f b6 04 02 38 c3 7c 08 84 c0 0f 85 fe 00 00 00 8b 15 7f 9d 07 09 85 d2 75 15 65 8b 05 a4 20 b4 7e <0f> b6 c0 3d f4 00 00 00 0f 8f 80 00 00 00 65 8b 05 8f 20 b4 7e 25 RSP: 0018:ffff8880ae807db8 EFLAGS: 00000046 RAX: 0000000080010003 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffff8880ae807dc8 R08: 1ffff11015d05bcf R09: ffffed1015d05bd0 R10: ffffed1015d05bcf R11: ffff8880ae82de7b R12: 0000000000000001 R13: 0000000000000000 R14: ffff888054df4f58 R15: dffffc0000000000 FS: 00007f82f06fd700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c42025a000 CR3: 000000008adef000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_lockdep_current_cpu_online kernel/rcu/tree.c:979 [inline] rcu_lockdep_current_cpu_online+0x34/0x130 kernel/rcu/tree.c:971 rcu_read_lock_sched_held+0x97/0x130 kernel/rcu/update.c:114 trace_hrtimer_expire_exit include/trace/events/timer.h:274 [inline] __run_hrtimer kernel/time/hrtimer.c:1390 [inline] __hrtimer_run_queues+0xc07/0xde0 kernel/time/hrtimer.c:1451 hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline] smp_apic_timer_interrupt+0x120/0x570 arch/x86/kernel/apic/apic.c:1060 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:debug_lockdep_rcu_enabled+0x1f/0xa0 kernel/rcu/update.c:248 Code: 00 66 2e 0f 1f 84 00 00 00 00 00 48 c7 c0 a4 79 5c 89 55 48 ba 00 00 00 00 00 fc ff df 48 89 c1 83 e0 07 48 89 e5 48 c1 e9 03 <83> c0 03 0f b6 14 11 38 d0 7c 04 84 d2 75 49 8b 15 60 4c ff 07 85 RSP: 0018:ffff88805ba3e768 EFLAGS: 00000a03 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000004 RBX: ffff8880588a6d90 RCX: 1ffffffff12b8f34 RDX: dffffc0000000000 RSI: ffff88809598cde0 RDI: 0000000000000286 RBP: ffff88805ba3e768 R08: 0000000000000004 R09: ffff88809598ce00 R10: ffff88809598cde0 R11: 0000000000000001 R12: 1ffff1100b747cf0 R13: ffff88805ba3e7e0 R14: ffff888097ad2040 R15: ffff8880a7be8980 rcu_read_lock_sched include/linux/rcupdate.h:716 [inline] percpu_ref_tryget_live+0x96/0x290 include/linux/percpu-refcount.h:252 css_tryget_online include/linux/cgroup.h:356 [inline] get_mem_cgroup_from_mm mm/memcontrol.c:848 [inline] get_mem_cgroup_from_mm+0x235/0x2b0 mm/memcontrol.c:827 mem_cgroup_try_charge+0x238/0x5e0 mm/memcontrol.c:5911 __add_to_page_cache_locked+0x425/0xe70 mm/filemap.c:812 add_to_page_cache_lru+0x1f1/0x780 mm/filemap.c:886 mpage_readpages+0x341/0x620 fs/mpage.c:399 blkdev_readpages+0x2d/0x40 fs/block_dev.c:615 read_pages+0x10f/0x550 mm/readahead.c:123 __do_page_cache_readahead+0x4c3/0x5c0 mm/readahead.c:209 ra_submit mm/internal.h:66 [inline] do_sync_mmap_readahead mm/filemap.c:2432 [inline] filemap_fault+0xa91/0x2400 mm/filemap.c:2508 __do_fault+0x116/0x4e0 mm/memory.c:3019 do_read_fault mm/memory.c:3430 [inline] do_fault mm/memory.c:3556 [inline] handle_pte_fault mm/memory.c:3787 [inline] __handle_mm_fault+0x2cbd/0x3f20 mm/memory.c:3911 handle_mm_fault+0x43f/0xb30 mm/memory.c:3948 do_user_addr_fault arch/x86/mm/fault.c:1475 [inline] __do_page_fault+0x5da/0xd60 arch/x86/mm/fault.c:1541 do_page_fault+0x71/0x581 arch/x86/mm/fault.c:1572 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143 RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 arch/x86/lib/copy_user_64.S:66 Code: 4c 8b 5e 38 4c 89 47 20 4c 89 4f 28 4c 89 57 30 4c 89 5f 38 48 8d 76 40 48 8d 7f 40 ff c9 75 b6 89 d1 83 e2 07 c1 e9 03 74 12 <4c> 8b 06 4c 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 RSP: 0018:ffff88805ba3f3b8 EFLAGS: 00010203 RAX: 0000000000040000 RBX: 0000000000000181 RCX: 0000000000000001 RDX: 0000000000000007 RSI: 0000000020000181 RDI: ffff88805a319be0 RBP: ffff88805ba3f3e8 R08: ffff88809598c4c0 R09: ffff88804c99e980 R10: 0000000000000000 R11: ffff88805a319bee R12: 000000000000000f R13: ffff88805a319be0 R14: 0000000020000000 R15: 000000000000000f kvm_vcpu_read_guest_page+0x40/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1843 kvm_fetch_guest_virt+0x14d/0x1d0 arch/x86/kvm/x86.c:5105 __do_insn_fetch_bytes+0x332/0x700 arch/x86/kvm/emulate.c:896 x86_decode_insn+0x187e/0x5690 arch/x86/kvm/emulate.c:5116 x86_emulate_instruction+0x846/0x1c80 arch/x86/kvm/x86.c:6408 kvm_mmu_page_fault+0x375/0x1740 arch/x86/kvm/mmu.c:5390 handle_ept_misconfig+0xb9/0x3e0 arch/x86/kvm/vmx/vmx.c:5134 vmx_handle_exit+0x279/0x1640 arch/x86/kvm/vmx/vmx.c:5847 vcpu_enter_guest+0x128a/0x6290 arch/x86/kvm/x86.c:7916 vcpu_run arch/x86/kvm/x86.c:7980 [inline] kvm_arch_vcpu_ioctl_run+0x425/0x16e0 arch/x86/kvm/x86.c:8180 kvm_vcpu_ioctl+0x4dc/0xfa0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2678 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29 Code: Bad RIP value. RSP: 002b:00007f82f06fcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82f06fd6d4 R13: 00000000004c0d61 R14: 00000000004d2bb8 R15: 00000000ffffffff