page:ffffea0000e98000 refcount:0 mapcount:0 mapping:0000000000000000 index:0x9 pfn:0x3a600
======================================================
WARNING: possible circular locking dependency detected
5.16.0-rc6-syzkaller #0 Not tainted
------------------------------------------------------
kworker/u4:19/18768 is trying to acquire lock:
ffffffff8bb73338 ((console_sem).lock){-.-.}-{2:2}, at: down_trylock+0xe/0x60 kernel/locking/semaphore.c:138

but task is already holding lock:
ffff88813fffacd8 (&zone->lock){..-.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
ffff88813fffacd8 (&zone->lock){..-.}-{2:2}, at: free_pcppages_bulk+0x418/0x8a0 mm/page_alloc.c:1511

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #4 (&zone->lock){..-.}-{2:2}:
       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
       _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
       spin_lock include/linux/spinlock.h:349 [inline]
       rmqueue_bulk+0xb4/0x1090 mm/page_alloc.c:3017
       __rmqueue_pcplist mm/page_alloc.c:3616 [inline]
       rmqueue_pcplist mm/page_alloc.c:3654 [inline]
       rmqueue mm/page_alloc.c:3682 [inline]
       get_page_from_freelist+0x15a4/0x2f50 mm/page_alloc.c:4146
       __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369
       alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191
       __get_free_pages mm/page_alloc.c:5418 [inline]
       get_zeroed_page+0x10/0x40 mm/page_alloc.c:5427
       pud_alloc_one include/asm-generic/pgalloc.h:166 [inline]
       __pud_alloc+0x37/0x170 mm/memory.c:4834
       pud_alloc include/linux/mm.h:2276 [inline]
       preallocate_vmalloc_pages arch/x86/mm/init_64.c:1314 [inline]
       mem_init+0x2d6/0x352 arch/x86/mm/init_64.c:1353
       mm_init+0xbe/0xe6 init/main.c:838
       start_kernel+0x18e/0x49b init/main.c:982
       secondary_startup_64_no_verify+0xb0/0xbb

-> #3 (lock#2){-.-.}-{2:2}:
       local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
       rmqueue_pcplist mm/page_alloc.c:3644 [inline]
       rmqueue mm/page_alloc.c:3682 [inline]
       get_page_from_freelist+0x4aa/0x2f50 mm/page_alloc.c:4146
       __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369
       alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191
       __stack_depot_save+0x3b5/0x4f0 lib/stackdepot.c:359
       kasan_save_stack+0x38/0x50 mm/kasan/common.c:40
       __kasan_record_aux_stack+0xf5/0x120 mm/kasan/generic.c:348
       task_work_add+0x3a/0x190 kernel/task_work.c:38
       task_tick_numa kernel/sched/fair.c:2884 [inline]
       task_tick_fair+0x798/0xf40 kernel/sched/fair.c:11173
       scheduler_tick+0x20a/0x540 kernel/sched/core.c:5243
       update_process_times+0x191/0x200 kernel/time/timer.c:1790
       tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
       tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1428
       __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
       __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
       hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
       local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
       __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
       sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
       asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
       __nr_to_section include/linux/mmzone.h:1386 [inline]
       __pfn_to_section include/linux/mmzone.h:1470 [inline]
       lookup_page_ext+0x78/0x100 mm/page_ext.c:209
       __set_page_owner+0x26/0x2d0 mm/page_owner.c:175
       prep_new_page mm/page_alloc.c:2418 [inline]
       get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4149
       __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369
       alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191
       __stack_depot_save+0x3b5/0x4f0 lib/stackdepot.c:359
       kasan_save_stack+0x38/0x50 mm/kasan/common.c:40
       kasan_set_track+0x21/0x30 mm/kasan/common.c:46
       kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
       ____kasan_slab_free mm/kasan/common.c:366 [inline]
       ____kasan_slab_free mm/kasan/common.c:328 [inline]
       __kasan_slab_free+0xff/0x130 mm/kasan/common.c:374
       kasan_slab_free include/linux/kasan.h:235 [inline]
       slab_free_hook mm/slub.c:1723 [inline]
       slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1749
       slab_free mm/slub.c:3513 [inline]
       kfree+0xf6/0x560 mm/slub.c:4561
       ima_calc_file_hash_tfm+0x31b/0x3b0 security/integrity/ima/ima_crypto.c:499
       ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline]
       ima_calc_file_hash+0x19d/0x4b0 security/integrity/ima/ima_crypto.c:572
       ima_collect_measurement+0x4c9/0x570 security/integrity/ima/ima_api.c:254
       process_measurement+0xd37/0x1920 security/integrity/ima/ima_main.c:337
       ima_file_mmap+0x10a/0x130 security/integrity/ima/ima_main.c:412
       security_mmap_file+0x15f/0x1b0 security/security.c:1586
       vm_mmap_pgoff+0xd3/0x290 mm/util.c:515
       vm_mmap+0x92/0xc0 mm/util.c:538
       elf_map+0x229/0x2a0 fs/binfmt_elf.c:392
       load_elf_interp fs/binfmt_elf.c:637 [inline]
       load_elf_binary+0x1d63/0x4b00 fs/binfmt_elf.c:1228
       search_binary_handler fs/exec.c:1723 [inline]
       exec_binprm fs/exec.c:1764 [inline]
       bprm_execve fs/exec.c:1833 [inline]
       bprm_execve+0x7ef/0x19b0 fs/exec.c:1795
       kernel_execve+0x370/0x460 fs/exec.c:1976
       try_to_run_init_process+0x14/0x4e init/main.c:1436
       kernel_init+0x136/0x1d0 init/main.c:1555
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

-> #2 (&rq->__lock){-.-.}-{2:2}:
       _raw_spin_lock_nested+0x30/0x40 kernel/locking/spinlock.c:368
       raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478
       raw_spin_rq_lock kernel/sched/sched.h:1316 [inline]
       rq_lock kernel/sched/sched.h:1614 [inline]
       task_fork_fair+0x68/0x520 kernel/sched/fair.c:11193
       sched_post_fork+0x340/0x480 kernel/sched/core.c:4448
       copy_process+0x460e/0x75a0 kernel/fork.c:2406
       kernel_clone+0xe7/0xab0 kernel/fork.c:2582
       kernel_thread+0xb5/0xf0 kernel/fork.c:2634
       rest_init+0x23/0x3e0 init/main.c:690
       start_kernel+0x47a/0x49b init/main.c:1135
       secondary_startup_64_no_verify+0xb0/0xbb

-> #1 (&p->pi_lock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
       try_to_wake_up+0xab/0x15a0 kernel/sched/core.c:4003
       up+0x75/0xb0 kernel/locking/semaphore.c:190
       __up_console_sem+0xa4/0xc0 kernel/printk/printk.c:254
       console_unlock+0x567/0xb70 kernel/printk/printk.c:2727
       vprintk_emit+0x198/0x4f0 kernel/printk/printk.c:2245
       dev_vprintk_emit+0x36e/0x3b2 drivers/base/core.c:4594
       dev_printk_emit+0xba/0xf1 drivers/base/core.c:4605
       __dev_printk+0xcf/0xf5 drivers/base/core.c:4617
       _dev_info+0xd7/0x109 drivers/base/core.c:4663
       usb_disconnect.cold+0x25/0x78e drivers/usb/core/hub.c:2207
       hub_port_connect drivers/usb/core/hub.c:5197 [inline]
       hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
       port_event drivers/usb/core/hub.c:5643 [inline]
       hub_event+0x1c9c/0x4460 drivers/usb/core/hub.c:5725
       process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
       process_scheduled_works kernel/workqueue.c:2361 [inline]
       worker_thread+0x85c/0x11f0 kernel/workqueue.c:2447
       kthread+0x405/0x4f0 kernel/kthread.c:327
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

-> #0 ((console_sem).lock){-.-.}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3063 [inline]
       check_prevs_add kernel/locking/lockdep.c:3186 [inline]
       validate_chain kernel/locking/lockdep.c:3801 [inline]
       __lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5027
       lock_acquire kernel/locking/lockdep.c:5637 [inline]
       lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
       down_trylock+0xe/0x60 kernel/locking/semaphore.c:138
       __down_trylock_console_sem+0x40/0x120 kernel/printk/printk.c:237
       console_trylock kernel/printk/printk.c:2542 [inline]
       console_trylock_spinning kernel/printk/printk.c:1843 [inline]
       vprintk_emit+0x146/0x4f0 kernel/printk/printk.c:2244
       vprintk+0x80/0x90 kernel/printk/printk_safe.c:50
       _printk+0xba/0xed kernel/printk/printk.c:2266
       __dump_page+0x3ec/0xd80 mm/debug.c:91
       dump_page+0x50/0xa0 mm/debug.c:183
       __free_one_page+0xa10/0xe30 mm/page_alloc.c:1071
       free_pcppages_bulk+0x533/0x8a0 mm/page_alloc.c:1531
       free_unref_page_commit.constprop.0+0x4cf/0x6f0 mm/page_alloc.c:3375
       free_unref_page+0x236/0x690 mm/page_alloc.c:3408
       io_mem_free.part.0+0xb0/0xb9 fs/io_uring.c:8841
       io_mem_free fs/io_uring.c:8836 [inline]
       io_ring_ctx_free fs/io_uring.c:9380 [inline]
       io_ring_exit_work+0xa0c/0xbd0 fs/io_uring.c:9533
       process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
       worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
       kthread+0x405/0x4f0 kernel/kthread.c:327
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

other info that might help us debug this:

Chain exists of:
  (console_sem).lock --> lock#2 --> &zone->lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&zone->lock);
                               lock(lock#2);
                               lock(&zone->lock);
  lock((console_sem).lock);

 *** DEADLOCK ***

4 locks held by kworker/u4:19/18768:
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
 #1: ffffc9000a6cfdb0 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
 #2: ffff8880b9d35620 (lock#2){-.-.}-{2:2}, at: free_unref_page+0x18c/0x690 mm/page_alloc.c:3407
 #3: ffff88813fffacd8 (&zone->lock){..-.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
 #3: ffff88813fffacd8 (&zone->lock){..-.}-{2:2}, at: free_pcppages_bulk+0x418/0x8a0 mm/page_alloc.c:1511

stack backtrace:
CPU: 1 PID: 18768 Comm: kworker/u4:19 Not tainted 5.16.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound io_ring_exit_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2143
 check_prev_add kernel/locking/lockdep.c:3063 [inline]
 check_prevs_add kernel/locking/lockdep.c:3186 [inline]
 validate_chain kernel/locking/lockdep.c:3801 [inline]
 __lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5027
 lock_acquire kernel/locking/lockdep.c:5637 [inline]
 lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162
 down_trylock+0xe/0x60 kernel/locking/semaphore.c:138
 __down_trylock_console_sem+0x40/0x120 kernel/printk/printk.c:237
 console_trylock kernel/printk/printk.c:2542 [inline]
 console_trylock_spinning kernel/printk/printk.c:1843 [inline]
 vprintk_emit+0x146/0x4f0 kernel/printk/printk.c:2244
 vprintk+0x80/0x90 kernel/printk/printk_safe.c:50
 _printk+0xba/0xed kernel/printk/printk.c:2266
 __dump_page+0x3ec/0xd80 mm/debug.c:91
 dump_page+0x50/0xa0 mm/debug.c:183
 __free_one_page+0xa10/0xe30 mm/page_alloc.c:1071
 free_pcppages_bulk+0x533/0x8a0 mm/page_alloc.c:1531
 free_unref_page_commit.constprop.0+0x4cf/0x6f0 mm/page_alloc.c:3375
 free_unref_page+0x236/0x690 mm/page_alloc.c:3408
 io_mem_free.part.0+0xb0/0xb9 fs/io_uring.c:8841
 io_mem_free fs/io_uring.c:8836 [inline]
 io_ring_ctx_free fs/io_uring.c:9380 [inline]
 io_ring_exit_work+0xa0c/0xbd0 fs/io_uring.c:9533
 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
flags: 0xfff00000000008(dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000008 ffffc9000a6cfa48 ffffea0001d3ec08 0000000000000000
raw: 0000000000000009 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page->flags & (((1UL << 26) - 1) & ~0))
page_owner tracks the page as freed
page last allocated via order 9, migratetype Unmovable, gfp_mask 0x552dc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO|__GFP_ACCOUNT), pid 19147, ts 670101088613, free_ts 670836166529
 prep_new_page mm/page_alloc.c:2418 [inline]
 get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4149
 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369
 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191
 __get_free_pages+0x8/0x40 mm/page_alloc.c:5418
 io_allocate_scq_urings fs/io_uring.c:10318 [inline]
 io_uring_create fs/io_uring.c:10436 [inline]
 io_uring_setup.cold+0x1136/0x2454 fs/io_uring.c:10526
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1338 [inline]
 free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1389
 free_unref_page_prepare mm/page_alloc.c:3309 [inline]
 free_unref_page+0x19/0x690 mm/page_alloc.c:3388
 io_mem_free.part.0+0xb0/0xb9 fs/io_uring.c:8841
 io_mem_free fs/io_uring.c:8836 [inline]
 io_ring_ctx_free fs/io_uring.c:9381 [inline]
 io_ring_exit_work+0xa4c/0xbd0 fs/io_uring.c:9533
 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
------------[ cut here ]------------
kernel BUG at mm/page_alloc.c:1071!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 18768 Comm: kworker/u4:19 Not tainted 5.16.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound io_ring_exit_work
RIP: 0010:__free_one_page+0xa10/0xe30 mm/page_alloc.c:1071
Code: 43 34 85 c0 0f 84 79 f9 ff ff 48 c7 c6 60 51 b7 89 48 89 ef e8 51 e8 f6 ff 0f 0b 48 c7 c6 40 50 b7 89 4c 89 ef e8 40 e8 f6 ff <0f> 0b 0f 0b 48 c7 c6 a0 50 b7 89 4c 89 ef e8 2d e8 f6 ff 0f 0b 48
RSP: 0018:ffffc9000a6cf948 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffffc9000a6cfa40 RCX: 0000000000000000
RDX: ffff88807cebd700 RSI: ffffffff81b3f250 RDI: 0000000000000003
RBP: 000000000003a600 R08: 0000000000000018 R09: 00000000ffffffff
R10: ffffffff8903e29f R11: 00000000ffffffff R12: 0000000000000009
R13: ffffea0000e98000 R14: 0000000000000000 R15: ffff88813fffa700
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f47e2453745 CR3: 000000007c3c5000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 free_pcppages_bulk+0x533/0x8a0 mm/page_alloc.c:1531
 free_unref_page_commit.constprop.0+0x4cf/0x6f0 mm/page_alloc.c:3375
 free_unref_page+0x236/0x690 mm/page_alloc.c:3408
 io_mem_free.part.0+0xb0/0xb9 fs/io_uring.c:8841
 io_mem_free fs/io_uring.c:8836 [inline]
 io_ring_ctx_free fs/io_uring.c:9380 [inline]
 io_ring_exit_work+0xa0c/0xbd0 fs/io_uring.c:9533
 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace b6f5f6948284a906 ]---
RIP: 0010:__free_one_page+0xa10/0xe30 mm/page_alloc.c:1071
Code: 43 34 85 c0 0f 84 79 f9 ff ff 48 c7 c6 60 51 b7 89 48 89 ef e8 51 e8 f6 ff 0f 0b 48 c7 c6 40 50 b7 89 4c 89 ef e8 40 e8 f6 ff <0f> 0b 0f 0b 48 c7 c6 a0 50 b7 89 4c 89 ef e8 2d e8 f6 ff 0f 0b 48
RSP: 0018:ffffc9000a6cf948 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffffc9000a6cfa40 RCX: 0000000000000000
RDX: ffff88807cebd700 RSI: ffffffff81b3f250 RDI: 0000000000000003
RBP: 000000000003a600 R08: 0000000000000018 R09: 00000000ffffffff
R10: ffffffff8903e29f R11: 00000000ffffffff R12: 0000000000000009
R13: ffffea0000e98000 R14: 0000000000000000 R15: ffff88813fffa700
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f47e2453745 CR3: 000000007c3c5000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400