BUG: sleeping function called from invalid context at fs/buffer.c:1319 in_atomic(): 1, irqs_disabled(): 0, pid: 14584, name: syz-executor.3 2 locks held by syz-executor.3/14584: #0: 00000000b7249733 (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224 #1: 00000000b12a0f60 (pointers_lock){.+.+}, at: get_block+0x171/0x1510 fs/sysv/itree.c:217 Preemption disabled at: [<0000000000000000>] (null) CPU: 1 PID: 14584 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6192 __getblk_gfp fs/buffer.c:1319 [inline] __bread_gfp+0x3f/0x300 fs/buffer.c:1366 sb_bread include/linux/buffer_head.h:309 [inline] get_branch+0x2cd/0x640 fs/sysv/itree.c:104 get_block+0x194/0x1510 fs/sysv/itree.c:218 block_read_full_page+0x288/0xd10 fs/buffer.c:2259 read_pages.isra.0+0x329/0x5d0 mm/readahead.c:133 __do_page_cache_readahead+0x5c6/0x6c0 mm/readahead.c:211 ra_submit mm/internal.h:66 [inline] ondemand_readahead.isra.0+0x575/0xd40 mm/readahead.c:493 page_cache_sync_readahead mm/readahead.c:528 [inline] page_cache_sync_readahead+0x275/0x520 mm/readahead.c:510 generic_file_buffered_read mm/filemap.c:2115 [inline] generic_file_read_iter+0x1497/0x2b60 mm/filemap.c:2385 call_read_iter include/linux/fs.h:1815 [inline] new_sync_read fs/read_write.c:406 [inline] __vfs_read+0x518/0x750 fs/read_write.c:418 integrity_kernel_read+0x147/0x1f0 security/integrity/iint.c:200 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:364 [inline] ima_calc_file_shash security/integrity/ima/ima_crypto.c:393 [inline] ima_calc_file_hash+0x4b2/0x8a0 security/integrity/ima/ima_crypto.c:450 ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231 process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284 ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391 do_last fs/namei.c:3425 [inline] path_openat+0x7e4/0x2df0 fs/namei.c:3537 do_filp_open+0x18c/0x3f0 fs/namei.c:3567 do_sys_open+0x3b3/0x520 fs/open.c:1085 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7faea23d80c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007faea094a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007faea24f7f80 RCX: 00007faea23d80c9 RDX: 00000000000000bd RSI: 0000000000000800 RDI: 0000000020000140 RBP: 00007faea2433ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff640c668f R14: 00007faea094a300 R15: 0000000000022000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 14598 Comm: syz-executor.4 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0xa/0xf lib/fault-inject.c:149 __should_failslab+0x115/0x180 mm/failslab.c:32 should_failslab+0x5/0x10 mm/slab_common.c:1590 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] __do_kmalloc mm/slab.c:3725 [inline] __kmalloc+0x2ab/0x3c0 mm/slab.c:3736 kmalloc include/linux/slab.h:520 [inline] __do_sys_memfd_create mm/memfd.c:295 [inline] __se_sys_memfd_create+0xf8/0x440 mm/memfd.c:268 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f2b82d210c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2b81292f38 EFLAGS: 00000202 ORIG_RAX: 000000000000013f RAX: ffffffffffffffda RBX: 0000000000009e1b RCX: 00007f2b82d210c9 RDX: 00007f2b81292fdc RSI: 0000000000000000 RDI: 00007f2b82d7be81 RBP: 0000000000009e1b R08: 00007f2b81292e20 R09: ffffffffffffffff R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000040 R13: 00007f2b81292fdc R14: 00007f2b81292fe0 R15: 000000002000d0c0 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 14602 Comm: syz-executor.4 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0xa/0xf lib/fault-inject.c:149 __should_failslab+0x115/0x180 mm/failslab.c:32 should_failslab+0x5/0x10 mm/slab_common.c:1590 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x277/0x370 mm/slab.c:3557 shmem_alloc_inode+0x18/0x40 mm/shmem.c:3609 alloc_inode+0x5d/0x180 fs/inode.c:211 new_inode_pseudo fs/inode.c:911 [inline] new_inode+0x1d/0xf0 fs/inode.c:940 shmem_get_inode+0x96/0x8d0 mm/shmem.c:2196 __shmem_file_setup.part.0+0x7a/0x2b0 mm/shmem.c:3965 __shmem_file_setup mm/shmem.c:3959 [inline] shmem_file_setup+0x61/0x90 mm/shmem.c:4006 __do_sys_memfd_create mm/memfd.c:325 [inline] __se_sys_memfd_create+0x26b/0x440 mm/memfd.c:268 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f2b82d210c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2b81292f38 EFLAGS: 00000202 ORIG_RAX: 000000000000013f RAX: ffffffffffffffda RBX: 0000000000009e1b RCX: 00007f2b82d210c9 RDX: 00007f2b81292fdc RSI: 0000000000000000 RDI: 00007f2b82d7be81 RBP: 0000000000009e1b R08: 00007f2b81292e20 R09: ffffffffffffffff R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000040 R13: 00007f2b81292fdc R14: 00007f2b81292fe0 R15: 000000002000d0c0 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 attempt to access beyond end of device CPU: 0 PID: 14610 Comm: syz-executor.4 Tainted: G W 4.19.211-syzkaller #0 loop3: rw=0, want=3245519, limit=128 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0xa/0xf lib/fault-inject.c:149 Buffer I/O error on dev loop3, logical block 3245518, async page read __should_failslab+0x115/0x180 mm/failslab.c:32 should_failslab+0x5/0x10 mm/slab_common.c:1590 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x277/0x370 mm/slab.c:3557 __d_alloc+0x2b/0xa10 fs/dcache.c:1612 attempt to access beyond end of device d_alloc_pseudo+0x19/0x70 fs/dcache.c:1743 alloc_file_pseudo+0xc6/0x250 fs/file_table.c:224 loop3: rw=0, want=8769404, limit=128 __shmem_file_setup.part.0+0x102/0x2b0 mm/shmem.c:3976 __shmem_file_setup mm/shmem.c:3959 [inline] shmem_file_setup+0x61/0x90 mm/shmem.c:4006 Buffer I/O error on dev loop3, logical block 8769403, async page read __do_sys_memfd_create mm/memfd.c:325 [inline] __se_sys_memfd_create+0x26b/0x440 mm/memfd.c:268 attempt to access beyond end of device do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f2b82d210c9 loop3: rw=0, want=3245513, limit=128 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2b81292f38 EFLAGS: 00000202 ORIG_RAX: 000000000000013f RAX: ffffffffffffffda RBX: 0000000000009e1b RCX: 00007f2b82d210c9 RDX: 00007f2b81292fdc RSI: 0000000000000000 RDI: 00007f2b82d7be81 RBP: 0000000000009e1b R08: 00007f2b81292e20 R09: ffffffffffffffff R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000040 R13: 00007f2b81292fdc R14: 00007f2b81292fe0 R15: 000000002000d0c0 attempt to access beyond end of device BTRFS info (device loop5): using free space tree BTRFS info (device loop5): has skinny extents BTRFS info (device loop5): 4 enospc errors during balance audit: type=1804 audit(1674107576.585:60): pid=14611 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir1880538466/syzkaller.VRaYjo/186/file0/.log" dev="loop5" ino=263 res=1 BTRFS info (device loop5): unrecognized mount option 'ÿî§<< G4š¶mRŸ±â½ÆuÆÌëê0º‰wÆ2ÝËàíù†¶Žæ' loop3: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop3: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop3: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop3: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop3: rw=0, want=8768636, limit=128 new mount options do not match the existing superblock, will be ignored attempt to access beyond end of device loop3: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop3: rw=0, want=8073606, limit=128 audit: type=1800 audit(1674107577.005:61): pid=14584 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="/" dev="loop3" ino=2 res=0 REISERFS (device loop2): found reiserfs format "3.5" with non-standard journal REISERFS (device loop2): using ordered data mode reiserfs: using flush barriers REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22 REISERFS (device loop2): checking transaction log (loop2) REISERFS (device loop2): Using r5 hash to sort names reiserfs: enabling write barrier flush mode REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. audit: type=1804 audit(1674107577.525:62): pid=14703 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 14705 Comm: syz-executor.4 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0xa/0xf lib/fault-inject.c:149 __should_failslab+0x115/0x180 mm/failslab.c:32 should_failslab+0x5/0x10 mm/slab_common.c:1590 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x277/0x370 mm/slab.c:3557 kmem_cache_zalloc include/linux/slab.h:699 [inline] __alloc_file+0x21/0x340 fs/file_table.c:100 alloc_empty_file+0x6d/0x170 fs/file_table.c:150 alloc_file+0x5e/0x4d0 fs/file_table.c:192 alloc_file_pseudo+0x165/0x250 fs/file_table.c:231 __shmem_file_setup.part.0+0x102/0x2b0 mm/shmem.c:3976 __shmem_file_setup mm/shmem.c:3959 [inline] shmem_file_setup+0x61/0x90 mm/shmem.c:4006 __do_sys_memfd_create mm/memfd.c:325 [inline] __se_sys_memfd_create+0x26b/0x440 mm/memfd.c:268 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f2b82d210c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2b81292f38 EFLAGS: 00000202 ORIG_RAX: 000000000000013f RAX: ffffffffffffffda RBX: 0000000000009e1b RCX: 00007f2b82d210c9 RDX: 00007f2b81292fdc RSI: 0000000000000000 RDI: 00007f2b82d7be81 RBP: 0000000000009e1b R08: 00007f2b81292e20 R09: ffffffffffffffff R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000040 R13: 00007f2b81292fdc R14: 00007f2b81292fe0 R15: 000000002000d0c0 audit: type=1804 audit(1674107577.535:63): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.535:64): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.535:65): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.535:66): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 9pnet: Insufficient options for proto=fd kauditd_printk_skb: 80 callbacks suppressed audit: type=1804 audit(1674107577.785:147): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 VFS: Found a Xenix FS (block size = 512) on device loop3 VFS: Found a Xenix FS (block size = 512) on device loop2 9pnet: Insufficient options for proto=fd attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 BUG: sleeping function called from invalid context at fs/buffer.c:1319 in_atomic(): 1, irqs_disabled(): 0, pid: 14713, name: syz-executor.2 2 locks held by syz-executor.2/14713: #0: 00000000f856b081 (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224 #1: 00000000b12a0f60 (pointers_lock){.+.+}, at: get_block+0x171/0x1510 fs/sysv/itree.c:217 Preemption disabled at: [<0000000000000000>] (null) CPU: 0 PID: 14713 Comm: syz-executor.2 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6192 __getblk_gfp fs/buffer.c:1319 [inline] __bread_gfp+0x3f/0x300 fs/buffer.c:1366 sb_bread include/linux/buffer_head.h:309 [inline] get_branch+0x2cd/0x640 fs/sysv/itree.c:104 get_block+0x194/0x1510 fs/sysv/itree.c:218 block_read_full_page+0x288/0xd10 fs/buffer.c:2259 read_pages.isra.0+0x329/0x5d0 mm/readahead.c:133 __do_page_cache_readahead+0x5c6/0x6c0 mm/readahead.c:211 ra_submit mm/internal.h:66 [inline] ondemand_readahead.isra.0+0x575/0xd40 mm/readahead.c:493 page_cache_sync_readahead mm/readahead.c:528 [inline] page_cache_sync_readahead+0x275/0x520 mm/readahead.c:510 generic_file_buffered_read mm/filemap.c:2115 [inline] generic_file_read_iter+0x1497/0x2b60 mm/filemap.c:2385 call_read_iter include/linux/fs.h:1815 [inline] new_sync_read fs/read_write.c:406 [inline] __vfs_read+0x518/0x750 fs/read_write.c:418 integrity_kernel_read+0x147/0x1f0 security/integrity/iint.c:200 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:364 [inline] ima_calc_file_shash security/integrity/ima/ima_crypto.c:393 [inline] ima_calc_file_hash+0x4b2/0x8a0 security/integrity/ima/ima_crypto.c:450 ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231 process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284 ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391 do_last fs/namei.c:3425 [inline] path_openat+0x7e4/0x2df0 fs/namei.c:3537 do_filp_open+0x18c/0x3f0 fs/namei.c:3567 do_sys_open+0x3b3/0x520 fs/open.c:1085 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fc66ba820c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc669ff4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007fc66bba1f80 RCX: 00007fc66ba820c9 RDX: 00000000000000bd RSI: 0000000000000800 RDI: 0000000020000140 RBP: 00007fc66baddae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff344d94bf R14: 00007fc669ff4300 R15: 0000000000022000 attempt to access beyond end of device loop2: rw=0, want=3245519, limit=128 attempt to access beyond end of device loop2: rw=0, want=8769404, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 14724 Comm: syz-executor.4 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0xa/0xf lib/fault-inject.c:149 __should_failslab+0x115/0x180 mm/failslab.c:32 should_failslab+0x5/0x10 mm/slab_common.c:1590 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc_trace+0x284/0x380 mm/slab.c:3623 kmalloc include/linux/slab.h:515 [inline] kzalloc include/linux/slab.h:709 [inline] aa_alloc_file_ctx security/apparmor/include/file.h:60 [inline] apparmor_file_alloc_security+0x394/0xad0 security/apparmor/lsm.c:438 security_file_alloc+0x40/0x90 security/security.c:880 __alloc_file+0xd8/0x340 fs/file_table.c:105 alloc_empty_file+0x6d/0x170 fs/file_table.c:150 alloc_file+0x5e/0x4d0 fs/file_table.c:192 alloc_file_pseudo+0x165/0x250 fs/file_table.c:231 __shmem_file_setup.part.0+0x102/0x2b0 mm/shmem.c:3976 __shmem_file_setup mm/shmem.c:3959 [inline] shmem_file_setup+0x61/0x90 mm/shmem.c:4006 __do_sys_memfd_create mm/memfd.c:325 [inline] __se_sys_memfd_create+0x26b/0x440 mm/memfd.c:268 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f2b82d210c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2b81292f38 EFLAGS: 00000202 ORIG_RAX: 000000000000013f RAX: ffffffffffffffda RBX: 0000000000009e1b RCX: 00007f2b82d210c9 RDX: 00007f2b81292fdc RSI: 0000000000000000 RDI: 00007f2b82d7be81 RBP: 0000000000009e1b R08: 00007f2b81292e20 R09: ffffffffffffffff R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000040 R13: 00007f2b81292fdc R14: 00007f2b81292fe0 R15: 000000002000d0c0 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 14731 Comm: syz-executor.4 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0xa/0xf lib/fault-inject.c:149 __should_failslab+0x115/0x180 mm/failslab.c:32 should_failslab+0x5/0x10 mm/slab_common.c:1590 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x277/0x370 mm/slab.c:3557 vm_area_alloc+0x1c/0x110 kernel/fork.c:321 mmap_region+0xa2a/0x16b0 mm/mmap.c:1727 do_mmap+0x8e8/0x1080 mm/mmap.c:1530 do_mmap_pgoff include/linux/mm.h:2329 [inline] vm_mmap_pgoff+0x197/0x200 mm/util.c:357 ksys_mmap_pgoff+0x45f/0x5a0 mm/mmap.c:1580 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f2b82d21112 Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 b8 ff ff ff 64 RSP: 002b:00007f2b81292f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 0000000000000022 RCX: 00007f2b82d21112 RDX: 0000000000000003 RSI: 0000000008400000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000009e19 R13: 00007f2b81292fdc R14: 00007f2b81292fe0 R15: 000000002000d0c2 FAULT_INJECTION: forcing a failure. name fail_page_alloc, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 14741 Comm: syz-executor.4 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0xa/0xf lib/fault-inject.c:149 should_fail_alloc_page mm/page_alloc.c:3088 [inline] prepare_alloc_pages mm/page_alloc.c:4346 [inline] __alloc_pages_nodemask+0x239/0x2890 mm/page_alloc.c:4393 alloc_pages_current+0x193/0x2a0 mm/mempolicy.c:2197 alloc_pages include/linux/gfp.h:532 [inline] pmd_alloc_one arch/x86/include/asm/pgalloc.h:102 [inline] __pmd_alloc+0x37/0x440 mm/memory.c:4417 pmd_alloc include/linux/mm.h:1850 [inline] __handle_mm_fault+0x1760/0x41c0 mm/memory.c:4266 handle_mm_fault+0x436/0xb10 mm/memory.c:4336 __do_page_fault+0x68e/0xd60 arch/x86/mm/fault.c:1412 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205 RIP: 0033:0x7f2b82cbe0c0 Code: e8 e5 fe ff ff 41 89 c7 85 c0 78 40 3d ff 00 00 00 7f 2f 49 8b 45 10 49 3b 45 08 0f 84 19 01 00 00 45 85 ff 74 0c 49 8b 55 00 <44> 88 3c 02 49 8b 45 10 48 83 c0 01 49 89 45 10 eb be 66 0f 1f 44 RSP: 002b:00007f2b81292600 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00007f2b81292660 RCX: 0000000000000001 RDX: 00007f2b78e73000 RSI: 0000000000000000 RDI: 00007f2b81292700 RBP: 00007f2b81292660 R08: 0000000000000009 R09: 0000000000000184 R10: 0000000000000010 R11: 00007f2b81292660 R12: 00007f2b81292670 R13: 00007f2b81292700 R14: 00007f2b82d8dbe0 R15: 00000000000000b5 syz-executor.4 invoked oom-killer: gfp_mask=0x0(), nodemask=(null), order=0, oom_score_adj=1000 syz-executor.4 cpuset=/ mems_allowed=0-1 CPU: 1 PID: 14741 Comm: syz-executor.4 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 dump_header+0x15d/0xc3f mm/oom_kill.c:443 oom_kill_process.cold+0x10/0x692 mm/oom_kill.c:956 out_of_memory mm/oom_kill.c:1114 [inline] out_of_memory+0x1072/0x1390 mm/oom_kill.c:1064 pagefault_out_of_memory+0x102/0x120 mm/oom_kill.c:1157 mm_fault_error+0x106/0x390 arch/x86/mm/fault.c:1040 __do_page_fault+0xc34/0xd60 arch/x86/mm/fault.c:1440 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205 RIP: 0033:0x7f2b82cbe0c0 Code: e8 e5 fe ff ff 41 89 c7 85 c0 78 40 3d ff 00 00 00 7f 2f 49 8b 45 10 49 3b 45 08 0f 84 19 01 00 00 45 85 ff 74 0c 49 8b 55 00 <44> 88 3c 02 49 8b 45 10 48 83 c0 01 49 89 45 10 eb be 66 0f 1f 44 RSP: 002b:00007f2b81292600 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00007f2b81292660 RCX: 0000000000000001 RDX: 00007f2b78e73000 RSI: 0000000000000000 RDI: 00007f2b81292700 RBP: 00007f2b81292660 R08: 0000000000000009 R09: 0000000000000184 R10: 0000000000000010 R11: 00007f2b81292660 R12: 00007f2b81292670 R13: 00007f2b81292700 R14: 00007f2b82d8dbe0 R15: 00000000000000b5 Mem-Info: active_anon:270361 inactive_anon:21691 isolated_anon:0 active_file:16372 inactive_file:23651 isolated_file:0 unevictable:0 dirty:12064 writeback:0 unstable:0 slab_reclaimable:18893 slab_unreclaimable:130833 mapped:31363 shmem:22154 pagetables:1287 bounce:0 free:1177910 free_pcp:317 free_cma:0 Node 0 active_anon:1081444kB inactive_anon:86764kB active_file:65372kB inactive_file:94604kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:125452kB dirty:48252kB writeback:0kB shmem:88616kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 999424kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 1 active_anon:0kB inactive_anon:0kB active_file:116kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 0 DMA free:15908kB min:204kB low:252kB high:300kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2693 2695 2695 2695 Node 0 DMA32 free:654268kB min:35996kB low:44992kB high:53988kB active_anon:1081444kB inactive_anon:86764kB active_file:65372kB inactive_file:94604kB unevictable:0kB writepending:48252kB present:3129332kB managed:2763452kB mlocked:0kB kernel_stack:8672kB pagetables:5148kB bounce:0kB free_pcp:1264kB local_pcp:476kB free_cma:0kB lowmem_reserve[]: 0 0 1 1 1 Node 0 Normal free:8kB min:24kB low:28kB high:32kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:2000kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 0 Node 1 Normal free:4039408kB min:53876kB low:67344kB high:80812kB active_anon:0kB inactive_anon:0kB active_file:116kB inactive_file:0kB unevictable:0kB writepending:4kB present:4194304kB managed:4128248kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 0 Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB Node 0 DMA32: 6321*4kB (UE) 276*8kB (UE) 64*16kB (UME) 111*32kB (UME) 139*64kB (UME) 55*128kB (UME) 8*256kB (M) 4*512kB (UME) 4*1024kB (UME) 2*2048kB (UM) 145*4096kB (M) = 654212kB Node 0 Normal: 0*4kB 1*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB Node 1 Normal: 98*4kB (UME) 399*8kB (UE) 309*16kB (UME) 71*32kB (UME) 31*64kB (UME) 18*128kB (UME) 14*256kB (UME) 5*512kB (UME) 2*1024kB (M) 1*2048kB (U) 980*4096kB (M) = 4039408kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 62246 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 2097051 pages RAM 0 pages HighMem/MovableOnly 369649 pages reserved 0 pages cma reserved Out of memory (oom_kill_allocating_task): Kill process 14741 (syz-executor.4) score 0 or sacrifice child Killed process 14735 (syz-executor.4) total-vm:195848kB, anon-rss:2520kB, file-rss:14336kB, shmem-rss:0kB oom_reaper: reaped process 14735 (syz-executor.4), now anon-rss:0kB, file-rss:14336kB, shmem-rss:4kB VFS: Found a Xenix FS (block size = 512) on device loop2 9pnet: Insufficient options for proto=fd attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245519, limit=128 attempt to access beyond end of device loop2: rw=0, want=8769404, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 BTRFS info (device loop5): using free space tree BTRFS info (device loop5): has skinny extents audit: type=1804 audit(1674107577.785:148): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.785:149): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.785:150): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.785:151): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.785:152): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.785:153): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.785:154): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.785:155): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 audit: type=1804 audit(1674107577.785:156): pid=14704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir3320500242/syzkaller.Qvu1V4/215/file0" dev="sda1" ino=14602 res=1 VFS: Found a Xenix FS (block size = 512) on device loop4 BTRFS info (device loop5): 4 enospc errors during balance BTRFS info (device loop5): unrecognized mount option 'ÿî§<< G4š¶mRŸ±â½ÆuÆÌëê0º‰wÆ2ÝËàíù†¶Žæ' VFS: Found a Xenix FS (block size = 512) on device loop1 VFS: Found a Xenix FS (block size = 512) on device loop3 VFS: Found a Xenix FS (block size = 512) on device loop4 9pnet: Insufficient options for proto=fd VFS: Found a Xenix FS (block size = 512) on device loop1 VFS: Found a Xenix FS (block size = 512) on device loop2 9pnet: Insufficient options for proto=fd attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 buffer_io_error: 44 callbacks suppressed Buffer I/O error on dev loop2, logical block 3245512, async page read attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 Buffer I/O error on dev loop2, logical block 8767867, async page read attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 Buffer I/O error on dev loop2, logical block 13269809, async page read attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 Buffer I/O error on dev loop2, logical block 8073605, async page read attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 Buffer I/O error on dev loop2, logical block 3245515, async page read attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 Buffer I/O error on dev loop2, logical block 8768635, async page read attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 Buffer I/O error on dev loop2, logical block 13466417, async page read attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 Buffer I/O error on dev loop2, logical block 8073605, async page read BUG: sleeping function called from invalid context at fs/buffer.c:1319 in_atomic(): 1, irqs_disabled(): 0, pid: 14888, name: syz-executor.2 2 locks held by syz-executor.2/14888: #0: 0000000029e9012f (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224 #1: 00000000b12a0f60 (pointers_lock){.+.+}, at: get_block+0x171/0x1510 fs/sysv/itree.c:217 Preemption disabled at: [<0000000000000000>] (null) CPU: 0 PID: 14888 Comm: syz-executor.2 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6192 __getblk_gfp fs/buffer.c:1319 [inline] __bread_gfp+0x3f/0x300 fs/buffer.c:1366 sb_bread include/linux/buffer_head.h:309 [inline] get_branch+0x2cd/0x640 fs/sysv/itree.c:104 get_block+0x194/0x1510 fs/sysv/itree.c:218 block_read_full_page+0x288/0xd10 fs/buffer.c:2259 read_pages.isra.0+0x329/0x5d0 mm/readahead.c:133 __do_page_cache_readahead+0x5c6/0x6c0 mm/readahead.c:211 ra_submit mm/internal.h:66 [inline] ondemand_readahead.isra.0+0x575/0xd40 mm/readahead.c:493 page_cache_sync_readahead mm/readahead.c:528 [inline] page_cache_sync_readahead+0x275/0x520 mm/readahead.c:510 generic_file_buffered_read mm/filemap.c:2115 [inline] generic_file_read_iter+0x1497/0x2b60 mm/filemap.c:2385 call_read_iter include/linux/fs.h:1815 [inline] new_sync_read fs/read_write.c:406 [inline] __vfs_read+0x518/0x750 fs/read_write.c:418 integrity_kernel_read+0x147/0x1f0 security/integrity/iint.c:200 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:364 [inline] ima_calc_file_shash security/integrity/ima/ima_crypto.c:393 [inline] ima_calc_file_hash+0x4b2/0x8a0 security/integrity/ima/ima_crypto.c:450 ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231 process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284 ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391 do_last fs/namei.c:3425 [inline] path_openat+0x7e4/0x2df0 fs/namei.c:3537 do_filp_open+0x18c/0x3f0 fs/namei.c:3567 do_sys_open+0x3b3/0x520 fs/open.c:1085 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fc66ba820c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc669ff4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007fc66bba1f80 RCX: 00007fc66ba820c9 RDX: 00000000000000bd RSI: 0000000000000800 RDI: 0000000020000140 RBP: 00007fc66baddae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff344d94bf R14: 00007fc669ff4300 R15: 0000000000022000 attempt to access beyond end of device loop2: rw=0, want=3245519, limit=128 Buffer I/O error on dev loop2, logical block 3245518, async page read attempt to access beyond end of device loop2: rw=0, want=8769404, limit=128 Buffer I/O error on dev loop2, logical block 8769403, async page read attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 VFS: Found a Xenix FS (block size = 512) on device loop4 VFS: Found a Xenix FS (block size = 512) on device loop3 BTRFS info (device loop5): using free space tree BTRFS info (device loop5): has skinny extents VFS: Found a Xenix FS (block size = 512) on device loop1 VFS: Found a Xenix FS (block size = 512) on device loop2 9pnet: Insufficient options for proto=fd attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 BUG: sleeping function called from invalid context at fs/buffer.c:1319 in_atomic(): 1, irqs_disabled(): 0, pid: 14918, name: syz-executor.2 2 locks held by syz-executor.2/14918: #0: 000000007cd7783f (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224 #1: 00000000b12a0f60 (pointers_lock){.+.+}, at: get_block+0x171/0x1510 fs/sysv/itree.c:217 Preemption disabled at: [<0000000000000000>] (null) CPU: 0 PID: 14918 Comm: syz-executor.2 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6192 __getblk_gfp fs/buffer.c:1319 [inline] __bread_gfp+0x3f/0x300 fs/buffer.c:1366 sb_bread include/linux/buffer_head.h:309 [inline] get_branch+0x2cd/0x640 fs/sysv/itree.c:104 get_block+0x194/0x1510 fs/sysv/itree.c:218 block_read_full_page+0x288/0xd10 fs/buffer.c:2259 read_pages.isra.0+0x329/0x5d0 mm/readahead.c:133 __do_page_cache_readahead+0x5c6/0x6c0 mm/readahead.c:211 ra_submit mm/internal.h:66 [inline] ondemand_readahead.isra.0+0x575/0xd40 mm/readahead.c:493 page_cache_sync_readahead mm/readahead.c:528 [inline] page_cache_sync_readahead+0x275/0x520 mm/readahead.c:510 generic_file_buffered_read mm/filemap.c:2115 [inline] generic_file_read_iter+0x1497/0x2b60 mm/filemap.c:2385 call_read_iter include/linux/fs.h:1815 [inline] new_sync_read fs/read_write.c:406 [inline] __vfs_read+0x518/0x750 fs/read_write.c:418 integrity_kernel_read+0x147/0x1f0 security/integrity/iint.c:200 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:364 [inline] ima_calc_file_shash security/integrity/ima/ima_crypto.c:393 [inline] ima_calc_file_hash+0x4b2/0x8a0 security/integrity/ima/ima_crypto.c:450 ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231 process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284 ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391 do_last fs/namei.c:3425 [inline] path_openat+0x7e4/0x2df0 fs/namei.c:3537 do_filp_open+0x18c/0x3f0 fs/namei.c:3567 do_sys_open+0x3b3/0x520 fs/open.c:1085 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fc66ba820c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc669ff4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007fc66bba1f80 RCX: 00007fc66ba820c9 RDX: 00000000000000bd RSI: 0000000000000800 RDI: 0000000020000140 RBP: 00007fc66baddae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff344d94bf R14: 00007fc669ff4300 R15: 0000000000022000 attempt to access beyond end of device loop2: rw=0, want=3245519, limit=128 attempt to access beyond end of device loop2: rw=0, want=8769404, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 BTRFS info (device loop5): 4 enospc errors during balance BTRFS info (device loop5): unrecognized mount option 'ÿî§<< G4š¶mRŸ±â½ÆuÆÌëê0º‰wÆ2ÝËàíù†¶Žæ' BTRFS info (device loop5): unrecognized mount option 'ÿî§<< G4š¶mRŸ±â½ÆuÆÌëê0º‰wÆ2ÝËàíù†¶Žæ' VFS: Found a Xenix FS (block size = 512) on device loop4 VFS: Found a Xenix FS (block size = 512) on device loop2 9pnet: Insufficient options for proto=fd attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245519, limit=128 attempt to access beyond end of device loop2: rw=0, want=8769404, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 VFS: Found a Xenix FS (block size = 512) on device loop4 VFS: Found a Xenix FS (block size = 512) on device loop1 VFS: Found a Xenix FS (block size = 512) on device loop5 9pnet: Insufficient options for proto=fd kauditd_printk_skb: 165 callbacks suppressed audit: type=1804 audit(1674107583.526:322): pid=14989 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir1880538466/syzkaller.VRaYjo/189/file0" dev="sda1" ino=14597 res=1 attempt to access beyond end of device audit: type=1804 audit(1674107583.526:323): pid=14989 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir1880538466/syzkaller.VRaYjo/189/file0" dev="sda1" ino=14597 res=1 loop5: rw=0, want=3245513, limit=128 VFS: Found a Xenix FS (block size = 512) on device loop2 attempt to access beyond end of device loop5: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop5: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop5: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop5: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop5: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop5: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop5: rw=0, want=8073606, limit=128 BUG: sleeping function called from invalid context at fs/buffer.c:1319 in_atomic(): 1, irqs_disabled(): 0, pid: 14989, name: syz-executor.5 2 locks held by syz-executor.5/14989: #0: 000000006c3a0c49 (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224 #1: 00000000b12a0f60 (pointers_lock){.+.+}, at: get_block+0x171/0x1510 fs/sysv/itree.c:217 Preemption disabled at: [<0000000000000000>] (null) CPU: 0 PID: 14989 Comm: syz-executor.5 Tainted: G W 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6192 __getblk_gfp fs/buffer.c:1319 [inline] __bread_gfp+0x3f/0x300 fs/buffer.c:1366 sb_bread include/linux/buffer_head.h:309 [inline] get_branch+0x2cd/0x640 fs/sysv/itree.c:104 get_block+0x194/0x1510 fs/sysv/itree.c:218 block_read_full_page+0x288/0xd10 fs/buffer.c:2259 read_pages.isra.0+0x329/0x5d0 mm/readahead.c:133 __do_page_cache_readahead+0x5c6/0x6c0 mm/readahead.c:211 ra_submit mm/internal.h:66 [inline] ondemand_readahead.isra.0+0x575/0xd40 mm/readahead.c:493 page_cache_sync_readahead mm/readahead.c:528 [inline] page_cache_sync_readahead+0x275/0x520 mm/readahead.c:510 generic_file_buffered_read mm/filemap.c:2115 [inline] generic_file_read_iter+0x1497/0x2b60 mm/filemap.c:2385 call_read_iter include/linux/fs.h:1815 [inline] new_sync_read fs/read_write.c:406 [inline] __vfs_read+0x518/0x750 fs/read_write.c:418 integrity_kernel_read+0x147/0x1f0 security/integrity/iint.c:200 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:364 [inline] ima_calc_file_shash security/integrity/ima/ima_crypto.c:393 [inline] ima_calc_file_hash+0x4b2/0x8a0 security/integrity/ima/ima_crypto.c:450 ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231 process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284 ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391 do_last fs/namei.c:3425 [inline] path_openat+0x7e4/0x2df0 fs/namei.c:3537 do_filp_open+0x18c/0x3f0 fs/namei.c:3567 do_sys_open+0x3b3/0x520 fs/open.c:1085 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f39414650c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f393f9d7168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007f3941584f80 RCX: 00007f39414650c9 RDX: 00000000000000bd RSI: 0000000000000800 RDI: 0000000020000140 RBP: 00007f39414c0ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffcec29338f R14: 00007f393f9d7300 R15: 0000000000022000 attempt to access beyond end of device loop5: rw=0, want=3245519, limit=128 attempt to access beyond end of device loop5: rw=0, want=8769404, limit=128 attempt to access beyond end of device loop5: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop5: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop5: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop5: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop5: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop5: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop5: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop5: rw=0, want=8073606, limit=128 audit: type=1800 audit(1674107583.616:324): pid=14989 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="/" dev="loop5" ino=2 res=0 audit: type=1804 audit(1674107583.616:325): pid=14993 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir2349870369/syzkaller.4N2IvP/229/file0" dev="sda1" ino=14613 res=1 audit: type=1804 audit(1674107583.616:326): pid=14993 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir2349870369/syzkaller.4N2IvP/229/file0" dev="sda1" ino=14613 res=1 attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245519, limit=128 attempt to access beyond end of device loop2: rw=0, want=8769404, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245513, limit=128 attempt to access beyond end of device loop2: rw=0, want=8767868, limit=128 attempt to access beyond end of device loop2: rw=0, want=13269810, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 attempt to access beyond end of device loop2: rw=0, want=3245516, limit=128 attempt to access beyond end of device loop2: rw=0, want=8768636, limit=128 attempt to access beyond end of device loop2: rw=0, want=13466418, limit=128 attempt to access beyond end of device loop2: rw=0, want=8073606, limit=128 audit: type=1800 audit(1674107583.626:327): pid=14993 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="/" dev="loop2" ino=2 res=0 VFS: Found a Xenix FS (block size = 512) on device loop1 ---------------- Code disassembly (best guess): 0: 28 00 sub %al,(%rax) 2: 00 00 add %al,(%rax) 4: 75 05 jne 0xb 6: 48 83 c4 28 add $0x28,%rsp a: c3 retq b: e8 f1 19 00 00 callq 0x1a01 10: 90 nop 11: 48 89 f8 mov %rdi,%rax 14: 48 89 f7 mov %rsi,%rdi 17: 48 89 d6 mov %rdx,%rsi 1a: 48 89 ca mov %rcx,%rdx 1d: 4d 89 c2 mov %r8,%r10 20: 4d 89 c8 mov %r9,%r8 23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9 28: 0f 05 syscall * 2a: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 73 01 jae 0x33 32: c3 retq 33: 48 c7 c1 b8 ff ff ff mov $0xffffffffffffffb8,%rcx 3a: f7 d8 neg %eax 3c: 64 89 01 mov %eax,%fs:(%rcx) 3f: 48 rex.W