=============================
[ BUG: Invalid wait context ]
6.12.0-rc5-next-20241101-syzkaller #0 Not tainted
-----------------------------
syz-executor/5831 is trying to lock:
ffffffff8ea73c58 (stack_list_lock){-.-.}-{3:3}, at: add_stack_record_to_list mm/page_owner.c:182 [inline]
ffffffff8ea73c58 (stack_list_lock){-.-.}-{3:3}, at: inc_stack_record_count mm/page_owner.c:214 [inline]
ffffffff8ea73c58 (stack_list_lock){-.-.}-{3:3}, at: __set_page_owner+0x5cb/0x800 mm/page_owner.c:329
other info that might help us debug this:
context-{2:2}
4 locks held by syz-executor/5831:
 #0: ffffffff8e939ee0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #0: ffffffff8e939ee0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8e939ee0 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_list_internal+0x4e8/0xe30 net/core/dev.c:5890
 #1: ffffffff8e939ee0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #1: ffffffff8e939ee0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8e939ee0 (rcu_read_lock){....}-{1:3}, at: ip_local_deliver_finish+0x230/0x5f0 net/ipv4/ip_input.c:232
 #2: ffff888020bc8e98 (slock-AF_INET/1){+.-.}-{3:3}, at: tcp_v4_rcv+0x2d58/0x37f0 net/ipv4/tcp_ipv4.c:2346
 #3: ffff8880b863e798 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
stack backtrace:
CPU: 0 UID: 0 PID: 5831 Comm: syz-executor Not tainted 6.12.0-rc5-next-20241101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline]
 check_wait_context kernel/locking/lockdep.c:4898 [inline]
 __lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5176
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
 add_stack_record_to_list mm/page_owner.c:182 [inline]
 inc_stack_record_count mm/page_owner.c:214 [inline]
 __set_page_owner+0x5cb/0x800 mm/page_owner.c:329
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541
 prep_new_page mm/page_alloc.c:1549 [inline]
 get_page_from_freelist+0x3725/0x3870 mm/page_alloc.c:3495
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4771
 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
 stack_depot_save_flags+0x666/0x830 lib/stackdepot.c:627
 kasan_save_stack+0x4f/0x60 mm/kasan/common.c:48
 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
 task_work_add+0xd9/0x490 kernel/task_work.c:77
 task_tick_numa kernel/sched/fair.c:3607 [inline]
 task_tick_fair+0x58c/0x7b0 kernel/sched/fair.c:13054
 sched_tick+0x219/0x610 kernel/sched/core.c:5606
 update_process_times+0x202/0x230 kernel/time/timer.c:2524
 tick_sched_handle kernel/time/tick-sched.c:276 [inline]
 tick_nohz_handler+0x37c/0x500 kernel/time/tick-sched.c:297
 __run_hrtimer kernel/time/hrtimer.c:1691 [inline]
 __hrtimer_run_queues+0x551/0xd50 kernel/time/hrtimer.c:1755
 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1817
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:unwind_next_frame+0x1767/0x22d0 arch/x86/kernel/unwind_orc.c:648
Code: 49 0f bf 06 48 01 c3 4c 89 ef 48 89 de 4c 89 fa eb 45 48 8b 54 24 10 48 8d 5a 02 48 83 c2 03 48 89 d8 48 c1 e8 03 0f b6 04 28 <84> c0 0f 85 81 0a 00 00 48 89 d0 48 c1 e8 03 0f b6 04 28 84 c0 0f
RSP: 0018:ffffc900000062f0 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: ffffffff90af975a RCX: 0000000000000000
RDX: ffffffff90af975b RSI: 0000000000000001 RDI: ffffc90000006420
RBP: dffffc0000000000 R08: ffffc9000000641f R09: 0000000000000000
R10: ffffc90000006410 R11: fffff52000000c84 R12: ffffc90003dc8000
R13: ffffc900000063c0 R14: ffffffff81f1beac R15: ffffc90000006410
 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2338 [inline]
 slab_free mm/slub.c:4598 [inline]
 kmem_cache_free+0x195/0x410 mm/slub.c:4700
 skb_kfree_head net/core/skbuff.c:1084 [inline]
 skb_free_head net/core/skbuff.c:1098 [inline]
 skb_release_data+0x677/0x8a0 net/core/skbuff.c:1125
 skb_release_all net/core/skbuff.c:1190 [inline]
 __kfree_skb+0x55/0x70 net/core/skbuff.c:1204
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3436 [inline]
 tcp_ack+0x2442/0x6bc0 net/ipv4/tcp_input.c:4032
 tcp_rcv_established+0xc00/0x2020 net/ipv4/tcp_input.c:6253
 tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915
 tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2350
 ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233
 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314
 ip_local_deliver net/ipv4/ip_input.c:254 [inline]
 dst_input include/net/dst.h:460 [inline]
 ip_sublist_rcv_finish+0x3be/0x4f0 net/ipv4/ip_input.c:580
 ip_list_rcv_finish net/ipv4/ip_input.c:630 [inline]
 ip_sublist_rcv+0x75d/0xab0 net/ipv4/ip_input.c:638
 ip_list_rcv+0x42b/0x480 net/ipv4/ip_input.c:672
 __netif_receive_skb_list_ptype net/core/dev.c:5715 [inline]
 __netif_receive_skb_list_core+0x94e/0x980 net/core/dev.c:5762
 __netif_receive_skb_list net/core/dev.c:5814 [inline]
 netif_receive_skb_list_internal+0xa51/0xe30 net/core/dev.c:5905
 gro_normal_list include/net/gro.h:515 [inline]
 napi_complete_done+0x2b5/0x870 net/core/dev.c:6256
 virtqueue_napi_complete drivers/net/virtio_net.c:697 [inline]
 virtnet_poll+0x2db0/0x3980 drivers/net/virtio_net.c:2831
 __napi_poll+0xcb/0x490 net/core/dev.c:6838
 napi_poll net/core/dev.c:6907 [inline]
 net_rx_action+0x89b/0x1240 net/core/dev.c:7029
 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
 common_interrupt+0xb9/0xd0 arch/x86/kernel/irq.c:278
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:prep_new_page mm/page_alloc.c:1560 [inline]
RIP: 0010:get_page_from_freelist+0x3741/0x3870 mm/page_alloc.c:3495
Code: 8b 9c 24 8c 00 00 00 89 da e8 0b f9 fe ff 45 85 ed 74 13 81 e3 00 00 04 00 74 0b 4c 89 f7 44 89 ee e8 33 cc fe ff 8b 44 24 0c <89> c5 83 e5 04 c1 ed 02 48 01 ed 49 8d 5e 08 48 89 d8 48 c1 e8 03
RSP: 0018:ffffc90003dc7110 EFLAGS: 00000246
RAX: 0000000000000901 RBX: 0000000000000cc0 RCX: ffffc90003dc7003
RDX: 0000000000000000 RSI: ffffffff8c0ae700 RDI: ffffffff8c6054c0
RBP: 0000000000000004 R08: ffffffff901d0fb7 R09: 1ffffffff203a1f6
R10: dffffc0000000000 R11: fffffbfff203a1f7 R12: ffff88813fffd990
R13: 0000000000000000 R14: ffffea0000a3e880 R15: ffff88813fffbcf8
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4771
 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
 get_free_pages_noprof+0xc/0x30 mm/page_alloc.c:4818
 poll_get_entry fs/select.c:168 [inline]
 __pollwait+0x134/0x430 fs/select.c:223
 poll_wait include/linux/poll.h:45 [inline]
 pipe_poll+0xe9/0x4a0 fs/pipe.c:673
 vfs_poll include/linux/poll.h:84 [inline]
 do_select+0x118d/0x1d50 fs/select.c:535
 core_sys_select+0x6f4/0x910 fs/select.c:678
 do_pselect fs/select.c:760 [inline]
 __do_sys_pselect6 fs/select.c:803 [inline]
 __se_sys_pselect6+0x323/0x3f0 fs/select.c:794
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1fc617e4dc
Code: 29 44 24 30 80 3d 7b f0 18 00 00 4c 89 4c 24 40 4c 8d 4c 24 40 48 c7 44 24 48 08 00 00 00 74 2e 4c 89 ea b8 0e 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7c 48 8b 54 24 58 64 48 2b 14 25 28 00 00 00
RSP: 002b:00007ffd2b28d660 EFLAGS: 00000202 ORIG_RAX: 000000000000010e
RAX: ffffffffffffffda RBX: 00007ffd2b28d790 RCX: 00007f1fc617e4dc
RDX: 0000000000000000 RSI: 00007ffd2b28d790 RDI: 0000000000000023
RBP: 00007ffd2b28dbe0 R08: 00007ffd2b28d690 R09: 00007ffd2b28d6a0
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffd2b28da30
R13: 0000000000000000 R14: 00007ffd2b28dab0 R15: 00007ffd2b28d820
 </TASK>
----------------
Code disassembly (best guess):
   0:	49 0f bf 06          	movswq (%r14),%rax
   4:	48 01 c3             	add    %rax,%rbx
   7:	4c 89 ef             	mov    %r13,%rdi
   a:	48 89 de             	mov    %rbx,%rsi
   d:	4c 89 fa             	mov    %r15,%rdx
  10:	eb 45                	jmp    0x57
  12:	48 8b 54 24 10       	mov    0x10(%rsp),%rdx
  17:	48 8d 5a 02          	lea    0x2(%rdx),%rbx
  1b:	48 83 c2 03          	add    $0x3,%rdx
  1f:	48 89 d8             	mov    %rbx,%rax
  22:	48 c1 e8 03          	shr    $0x3,%rax
  26:	0f b6 04 28          	movzbl (%rax,%rbp,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	0f 85 81 0a 00 00    	jne    0xab3
  32:	48 89 d0             	mov    %rdx,%rax
  35:	48 c1 e8 03          	shr    $0x3,%rax
  39:	0f b6 04 28          	movzbl (%rax,%rbp,1),%eax
  3d:	84 c0                	test   %al,%al
  3f:	0f                   	.byte 0xf