BUG: sleeping function called from invalid context at mm/slab.h:421 in_atomic(): 1, irqs_disabled(): 1, pid: 8549, name: syz-executor0 1 lock held by syz-executor0/8549: #0: (ptrval) (shrinker_rwsem){++++}, at: shrink_slab.part.39+0xe6/0xf90 mm/vmscan.c:509 irq event stamp: 470 hardirqs last enabled at (469): [] count_shadow_nodes+0xc0/0x2e0 mm/workingset.c:372 hardirqs last disabled at (470): [] interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625 softirqs last enabled at (402): [] __do_softirq+0x778/0xaf5 kernel/softirq.c:311 softirqs last disabled at (395): [] invoke_softirq kernel/softirq.c:365 [inline] softirqs last disabled at (395): [] irq_exit+0x1d1/0x200 kernel/softirq.c:405 CPU: 1 PID: 8549 Comm: syz-executor0 Not tainted 4.17.0-rc2+ #17 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 ___might_sleep.cold.87+0x11f/0x13a kernel/sched/core.c:6188 __might_sleep+0x95/0x190 kernel/sched/core.c:6141 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3378 [inline] __do_kmalloc mm/slab.c:3716 [inline] __kmalloc+0x2b9/0x760 mm/slab.c:3727 kmalloc_array include/linux/slab.h:631 [inline] kcalloc include/linux/slab.h:642 [inline] numa_crng_init drivers/char/random.c:798 [inline] crng_reseed+0x427/0x920 drivers/char/random.c:923 credit_entropy_bits+0x98d/0xa30 drivers/char/random.c:708 add_interrupt_randomness+0x494/0x860 drivers/char/random.c:1254 handle_irq_event_percpu+0xf9/0x1c0 kernel/irq/handle.c:191 handle_irq_event+0xa7/0x135 kernel/irq/handle.c:206 handle_edge_irq+0x20f/0x870 kernel/irq/chip.c:791 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x18c/0x2e7 arch/x86/kernel/irq_64.c:77 do_IRQ+0x78/0x190 arch/x86/kernel/irq.c:245 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:642 RIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:793 [inline] RIP: 0010:count_shadow_nodes+0xfc/0x2e0 mm/workingset.c:372 RSP: 0000:ffff880190ebf3f8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffffd9 RAX: ffff8801d6f10500 RBX: ffff880190ebf660 RCX: 1ffff1003ade21ab RDX: 0000000000000000 RSI: ffffffff81a56035 RDI: ffffffff88d18af8 RBP: ffff880190ebf420 R08: ffff8801d6f10d38 R09: 0000000000000006 R10: ffff8801d6f10500 R11: 0000000000000000 R12: ffff880190ebf680 R13: 0000000000000000 R14: ffff880190ebf678 R15: dffffc0000000000 do_shrink_slab mm/vmscan.c:374 [inline] shrink_slab.part.39+0x330/0xf90 mm/vmscan.c:531 shrink_slab+0xa1/0xc0 mm/vmscan.c:506 shrink_node+0x4f2/0x1740 mm/vmscan.c:2561 shrink_zones mm/vmscan.c:2794 [inline] do_try_to_free_pages+0x3c9/0x1240 mm/vmscan.c:2856 try_to_free_mem_cgroup_pages+0x475/0xc50 mm/vmscan.c:3146 reclaim_high.constprop.67+0x12f/0x1d0 mm/memcontrol.c:1862 mem_cgroup_handle_over_high+0x8d/0x130 mm/memcontrol.c:1887 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x274/0x310 arch/x86/entry/common.c:166 prepare_exit_to_usermode+0x32e/0x390 arch/x86/entry/common.c:196 retint_user+0x8/0x18 RIP: 0033:0x40a60d RSP: 002b:0000000000a3eac0 EFLAGS: 00010257 RAX: 0000001b2bc20000 RBX: 0000000000000033 RCX: 000000000040f3e0 RDX: 00000000000003e8 RSI: 0000000000a3f930 RDI: 00000000000000fc RBP: 00000000ffffffff R08: 0000000000000000 R09: 000000000230f940 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000013 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000001380 random: crng init done netlink: 'syz-executor3': attribute type 2 has an invalid length. A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. netlink: 'syz-executor3': attribute type 2 has an invalid length. A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. binder: 8616:8618 unknown command 9 binder: 8616:8618 ioctl c0306201 20008fd0 returned -22 binder: 8616:8631 unknown command 9 binder: 8616:8631 ioctl c0306201 20008fd0 returned -22 binder: 8671:8672 ioctl 89e1 20000140 returned -22 binder: 8671:8672 ioctl 5404 20000180 returned -22 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. binder: 8671:8672 ioctl 540f 200000c0 returned -22 binder_alloc: binder_alloc_mmap_handler: 8671 20000000-20002000 already mapped failed -16 : renamed from bcsh0 binder: 8671:8690 ioctl 89e1 20000140 returned -22 binder: 8671:8672 ioctl 5404 20000180 returned -22 binder: 8671:8690 ioctl 540f 200000c0 returned -22 netlink: 2 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 2 bytes leftover after parsing attributes in process `syz-executor0'. QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl binder: 9025:9026 ERROR: BC_REGISTER_LOOPER called without request binder: 9026 RLIMIT_NICE not set QAT: Invalid ioctl binder: 9026 RLIMIT_NICE not set binder: 9025:9095 got new transaction with bad transaction stack, transaction 16 has target 9025:9026 binder: 9025:9095 transaction failed 29201/-71, size 0-0 line 2875 binder: BINDER_SET_CONTEXT_MGR already set binder: 9025:9099 ioctl 40046207 0 returned -16 binder: 9025:9095 ERROR: BC_REGISTER_LOOPER called without request binder: 9095 RLIMIT_NICE not set binder_alloc: 9025: binder_alloc_buf, no vma binder: 9025:9099 transaction failed 29189/-3, size 0-0 line 2963 binder: 9095 RLIMIT_NICE not set binder: undelivered TRANSACTION_ERROR: 29189 binder: release 9025:9026 transaction 16 in, still active binder: send failed reply for transaction 16 to 9025:9095 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder: 9163:9187 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 unchecked MSR access error: WRMSR to 0x48 (tried to write 0x0000000000000003) at rIP: 0xffffffff811f64fd (vmx_vcpu_run+0x7fd/0x25f0) Call Trace: vcpu_run arch/x86/kvm/x86.c:7559 [inline] kvm_arch_vcpu_ioctl_run+0x33e/0x1690 arch/x86/kvm/x86.c:7736 kvm_vcpu_ioctl+0x79d/0x12e0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2560 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x1cf/0x16a0 fs/ioctl.c:684 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701 __do_sys_ioctl fs/ioctl.c:708 [inline] __se_sys_ioctl fs/ioctl.c:706 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x455389 RSP: 002b:00007f1a6d898c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f1a6d8996d4 RCX: 0000000000455389 RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000015 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000025a R14: 00000000006f6910 R15: 0000000000000000 unchecked MSR access error: RDMSR from 0x48 at rIP: 0xffffffff811f7c05 (vmx_vcpu_run+0x1f05/0x25f0) Call Trace: vcpu_run arch/x86/kvm/x86.c:7559 [inline] kvm_arch_vcpu_ioctl_run+0x33e/0x1690 arch/x86/kvm/x86.c:7736 kvm_vcpu_ioctl+0x79d/0x12e0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2560 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x1cf/0x16a0 fs/ioctl.c:684 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701 __do_sys_ioctl fs/ioctl.c:708 [inline] __se_sys_ioctl fs/ioctl.c:706 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x455389 RSP: 002b:00007f1a6d898c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f1a6d8996d4 RCX: 0000000000455389 RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000015 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000025a R14: 00000000006f6910 R15: 0000000000000000 binder: 9163:9187 transaction failed 29189/-22, size 24-16 line 2848 binder: 9163:9187 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 9163:9187 transaction failed 29189/-22, size 24-16 line 2848 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189