syz-executor2: vmalloc: allocation failure: 0 bytes, mode:0x24000c2(GFP_KERNEL|__GFP_HIGHMEM) CPU: 0 PID: 17244 Comm: syz-executor2 Not tainted 4.9.83-g72766d7 #42 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d02778f0 ffffffff81d95149 1ffff1003a04ef21 ffff8801b6e8e000 ffffffff83ab9360[ 99.407801] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor5/17256 caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62 0000000000000001 0000000000400000 ffff8801d0277a00 ffffffff81451e22 024000c2d0277940 0000000041b58ab3 ffffffff841958e5 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] warn_alloc+0x212/0x240 mm/page_alloc.c:3056 [] __vmalloc_node_range+0x3f5/0x5f0 mm/vmalloc.c:1722 [] __vmalloc_node mm/vmalloc.c:1744 [inline] [] __vmalloc_node_flags mm/vmalloc.c:1758 [inline] [] vmalloc+0x5b/0x70 mm/vmalloc.c:1773 [] sel_write_load+0x130/0xfd0 security/selinux/selinuxfs.c:514 [] __vfs_write+0x103/0x680 fs/read_write.c:510 [] vfs_write+0x189/0x530 fs/read_write.c:560 [] SYSC_pwrite64 fs/read_write.c:649 [inline] [] SyS_pwrite64+0x13f/0x170 fs/read_write.c:636 [] do_syscall_64+0x1a4/0x490 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x47/0xc5 CPU: 1 PID: 17256 Comm: syz-executor5 Not tainted 4.9.83-g72766d7 #42 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cf4e7678 ffffffff81d95149 0000000000000001 ffffffff83c18e00 ffffffff83f45ba0 ffff8801d3ffc800 0000000000000003 ffff8801cf4e76b8 ffffffff81dfc744 ffff8801cf4e76d0 ffffffff83f45ba0 dffffc0000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46 [] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62 [] ipcomp_alloc_tfms net/xfrm/xfrm_ipcomp.c:286 [inline] [] ipcomp_init_state+0x188/0x930 net/xfrm/xfrm_ipcomp.c:363 [] ipcomp4_init_state+0xb0/0x7d0 net/ipv4/ipcomp.c:137 [] __xfrm_init_state+0x3e7/0xb30 net/xfrm/xfrm_state.c:2096 [] xfrm_init_state+0x1a/0x20 net/xfrm/xfrm_state.c:2122 [] pfkey_msg2xfrm_state net/key/af_key.c:1289 [inline] [] pfkey_add+0x1fb9/0x3470 net/key/af_key.c:1506 [] pfkey_process+0x68b/0x750 net/key/af_key.c:2834 [] pfkey_sendmsg+0x3a9/0x760 net/key/af_key.c:3678 [] sock_sendmsg_nosec net/socket.c:635 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:645 [] ___sys_sendmsg+0x6d1/0x7e0 net/socket.c:1969 [] __sys_sendmsg+0xd6/0x190 net/socket.c:2003 [] SYSC_sendmsg net/socket.c:2014 [inline] [] SyS_sendmsg+0x2d/0x50 net/socket.c:2010 [] do_syscall_64+0x1a4/0x490 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x47/0xc5 Mem-Info: active_anon:58515 inactive_anon:44 isolated_anon:0 active_file:3687 inactive_file:8420 isolated_file:0 unevictable:0 dirty:66 writeback:0 unstable:0 slab_reclaimable:7208 slab_unreclaimable:60690 mapped:24304 shmem:50 pagetables:689 bounce:0 free:1467784 free_pcp:410 free_cma:0 Node 0 active_anon:225752kB inactive_anon:176kB active_file:14748kB inactive_file:33680kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:97176kB dirty:264kB writeback:0kB shmem:200kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 96256kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no DMA free:15908kB min:160kB low:200kB high:240kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2908 6410 6410 DMA32 free:2980076kB min:30592kB low:38240kB high:45888kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129292kB managed:2980720kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:644kB local_pcp:644kB free_cma:0kB lowmem_reserve[]: 0 0 3501 3501 Normal free:2883832kB min:36824kB low:46028kB high:55232kB active_anon:225752kB inactive_anon:176kB active_file:14748kB inactive_file:33680kB unevictable:0kB writepending:268kB present:4718592kB managed:3585212kB mlocked:0kB slab_reclaimable:28824kB slab_unreclaimable:242424kB kernel_stack:5728kB pagetables:2608kB bounce:0kB free_pcp:1300kB local_pcp:716kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB DMA32: 3*4kB (M) 4*8kB (M) 2*16kB (M) 3*32kB (M) 3*64kB (M) 3*128kB (M) 2*256kB (M) 4*512kB (M) 1*1024kB (M) 1*2048kB (M) 726*4096kB (M) = 2980076kB Normal: 919*4kB (UME) 353*8kB (UME) 241*16kB (UME) 214*32kB (UME) 124*64kB (UM) 21*128kB (UME) 12*256kB (UM) 9*512kB (UME) 8*1024kB (UME) 3*2048kB (ME) 692*4096kB (M) = 2884276kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 12158 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965969 pages RAM 0 pages HighMem/MovableOnly 320509 pages reserved syz-executor2: vmalloc: allocation failure: 0 bytes, mode:0x24000c2(GFP_KERNEL|__GFP_HIGHMEM) CPU: 1 PID: 17262 Comm: syz-executor2 Not tainted 4.9.83-g72766d7 #42 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801b1b478f0 ffffffff81d95149 1ffff10036368f21 ffff8801d3943000 ffffffff83ab9360 0000000000000001 0000000000400000 ffff8801b1b47a00 ffffffff81451e22 024000c2b1b47940 0000000041b58ab3 ffffffff841958e5 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] warn_alloc+0x212/0x240 mm/page_alloc.c:3056 [] __vmalloc_node_range+0x3f5/0x5f0 mm/vmalloc.c:1722 [] __vmalloc_node mm/vmalloc.c:1744 [inline] [] __vmalloc_node_flags mm/vmalloc.c:1758 [inline] [] vmalloc+0x5b/0x70 mm/vmalloc.c:1773 [] sel_write_load+0x130/0xfd0 security/selinux/selinuxfs.c:514 [] __vfs_write+0x103/0x680 fs/read_write.c:510 [] vfs_write+0x189/0x530 fs/read_write.c:560 [] SYSC_pwrite64 fs/read_write.c:649 [inline] [] SyS_pwrite64+0x13f/0x170 fs/read_write.c:636 [] do_syscall_64+0x1a4/0x490 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x47/0xc5 Mem-Info: active_anon:56432 inactive_anon:44 isolated_anon:0 active_file:3687 inactive_file:8423 isolated_file:0 unevictable:0 dirty:85 writeback:0 unstable:0 slab_reclaimable:7208 slab_unreclaimable:60615 mapped:24283 shmem:50 pagetables:636 bounce:0 free:1470073 free_pcp:514 free_cma:0 Node 0 active_anon:225728kB inactive_anon:176kB active_file:14748kB inactive_file:33692kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:97132kB dirty:340kB writeback:0kB shmem:200kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 98304kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no DMA free:15908kB min:160kB low:200kB high:240kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2908 6410 6410 DMA32 free:2980076kB min:30592kB low:38240kB high:45888kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129292kB managed:2980720kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:644kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 3501 3501 Normal free:2884308kB min:36824kB low:46028kB high:55232kB active_anon:225728kB inactive_anon:176kB active_file:14748kB inactive_file:33692kB unevictable:0kB writepending:340kB present:4718592kB managed:3585212kB mlocked:0kB slab_reclaimable:28832kB slab_unreclaimable:242460kB kernel_stack:5632kB pagetables:2544kB bounce:0kB free_pcp:1404kB local_pcp:708kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB DMA32: 3*4kB (M) 4*8kB (M) 2*16kB (M) 3*32kB (M) 3*64kB (M) 3*128kB (M) 2*256kB (M) 4*512kB (M) 1*1024kB (M) 1*2048kB (M) 726*4096kB (M) = 2980076kB Normal: 919*4kB (UME) 353*8kB (UME) 241*16kB (UME) 215*32kB (UME) 124*64kB (UM) 21*128kB (UME) 12*256kB (UM) 9*512kB (UME) 8*1024kB (UME) 3*2048kB (ME) 692*4096kB (M) = 2884308kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 12168 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965969 pages RAM 0 pages HighMem/MovableOnly 320509 pages reserved SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17277 comm=syz-executor3 audit: type=1400 audit(1519439930.778:45): avc: denied { dac_override } for pid=17269 comm="syz-executor4" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439930.778:46): avc: denied { net_admin } for pid=3872 comm="syz-executor2" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439930.778:47): avc: denied { sys_admin } for pid=17286 comm="syz-executor0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17295 comm=syz-executor3 audit: type=1400 audit(1519439930.928:48): avc: denied { net_raw } for pid=17298 comm="syz-executor4" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439930.928:49): avc: denied { ioctl } for pid=17302 comm="syz-executor7" path="socket:[38740]" dev="sockfs" ino=38740 ioctlcmd=0x745a scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. audit: type=1400 audit(1519439931.388:50): avc: denied { set_context_mgr } for pid=17400 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 audit: type=1400 audit(1519439931.438:51): avc: denied { call } for pid=17400 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 audit: type=1400 audit(1519439931.448:52): avc: denied { dac_override } for pid=17423 comm="syz-executor2" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439931.468:53): avc: denied { net_admin } for pid=3871 comm="syz-executor1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 binder: 17400:17419 got reply transaction with no transaction stack binder: 17400:17419 transaction failed 29201/-71, size 0-0 line 2920 binder: 17400:17419 ioctl c0286404 20000000 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 17400:17419 ioctl 40046207 0 returned -16 binder_alloc: 17400: binder_alloc_buf, no vma binder: 17400:17433 transaction failed 29189/-3, size 0-0 line 3127 binder: 17400:17419 got reply transaction with no transaction stack binder: 17400:17419 transaction failed 29201/-71, size 0-0 line 2920 binder_alloc: 17400: binder_alloc_buf, no vma binder: 17400:17404 transaction failed 29189/-3, size 0-0 line 3127 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29201 IPv6: NLM_F_REPLACE set, but no existing node found! audit_printk_skb: 3611 callbacks suppressed audit: type=1400 audit(1519439934.458:1258): avc: denied { net_admin } for pid=3879 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439934.458:1259): avc: denied { net_admin } for pid=14977 comm="syz-executor3" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439934.458:1260): avc: denied { net_admin } for pid=17701 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439934.468:1261): avc: denied { net_admin } for pid=14977 comm="syz-executor3" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439934.468:1262): avc: denied { net_admin } for pid=16172 comm="syz-executor4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439934.468:1263): avc: denied { net_admin } for pid=3871 comm="syz-executor1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439934.468:1264): avc: denied { net_admin } for pid=14977 comm="syz-executor3" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439934.468:1265): avc: denied { net_admin } for pid=11264 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439934.468:1266): avc: denied { net_admin } for pid=10719 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519439934.478:1267): avc: denied { net_admin } for pid=11264 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=18093 sclass=netlink_route_socket pig=17735 comm=syz-executor1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17750 comm=syz-executor1 mmap: syz-executor2 (17762): VmData 18640896 exceed data ulimit 2. Update limits or use boot option ignore_rlimit_data. binder: 17937:17939 transaction failed 29189/-22, size 0-0 line 3004 binder_alloc: binder_alloc_mmap_handler: 17937 20000000-20002000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 17937:17939 ioctl 40046207 0 returned -16 binder_alloc: 17937: binder_alloc_buf, no vma binder: 17937:17945 transaction failed 29189/-3, size 0-0 line 3127 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 17974:17978 ioctl c0306201 20007000 returned -14 sg_write: data in/out 196572/80 bytes for SCSI command 0x0-- guessing data in; program syz-executor4 not setting count and/or reply_len properly