__dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10f/0x159 lib/fault-inject.c:149 should_fail_alloc_page mm/page_alloc.c:2891 [inline] prepare_alloc_pages mm/page_alloc.c:4124 [inline] __alloc_pages_nodemask+0x1d6/0x7a0 mm/page_alloc.c:4172 ===================================== __alloc_pages include/linux/gfp.h:484 [inline] __alloc_pages_node include/linux/gfp.h:497 [inline] kmem_getpages mm/slab.c:1419 [inline] cache_grow_begin+0x80/0x400 mm/slab.c:2676 WARNING: bad unlock balance detected! cache_alloc_refill mm/slab.c:3043 [inline] ____cache_alloc mm/slab.c:3125 [inline] ____cache_alloc mm/slab.c:3108 [inline] __do_cache_alloc mm/slab.c:3347 [inline] slab_alloc mm/slab.c:3382 [inline] kmem_cache_alloc_trace+0x6b2/0x790 mm/slab.c:3616 4.14.162-syzkaller #0 Not tainted ------------------------------------- kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] alloc_super fs/super.c:197 [inline] sget_userns+0xfe/0xc30 fs/super.c:516 syz-executor.1/19512 is trying to release lock ( sb_writers ) at: [] sb_end_write include/linux/fs.h:1500 [inline] [] mnt_drop_write+0x3e/0x50 fs/namespace.c:532 sget+0xd6/0x120 fs/super.c:572 but there are no more locks to release! other info that might help us debug this: 1 lock held by syz-executor.1/19512: mount_nodev+0x31/0xf0 fs/super.c:1175 #0: ovl_mount+0x2d/0x40 fs/overlayfs/super.c:1204 ( mount_fs+0x97/0x2a1 fs/super.c:1237 &type->s_umount_key vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046 #59 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x417/0x27d0 fs/namespace.c:2879 /1 ){+.+.} , at: [] alloc_super fs/super.c:251 [inline] , at: [] sget_userns+0x551/0xc30 fs/super.c:516 stack backtrace: SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xab/0x120 fs/namespace.c:3072 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45af49 RSP: 002b:00007fe0b2dc1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fe0b2dc1c90 RCX: 000000000045af49 RDX: 00000000200000c0 RSI: 0000000020000000 RDI: 000000000040000f RBP: 000000000075bf20 R08: 0000000020000100 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe0b2dc26d4 R13: 00000000004c8559 R14: 00000000004e0370 R15: 0000000000000003 CPU: 0 PID: 19512 Comm: syz-executor.1 Not tainted 4.14.162-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 print_unlock_imbalance_bug kernel/locking/lockdep.c:3548 [inline] print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3525 __lock_release kernel/locking/lockdep.c:3765 [inline] lock_release+0x616/0x940 kernel/locking/lockdep.c:4013 percpu_up_read_preempt_enable include/linux/percpu-rwsem.h:102 [inline] percpu_up_read include/linux/percpu-rwsem.h:108 [inline] __sb_end_write+0xc1/0x100 fs/super.c:1329 sb_end_write include/linux/fs.h:1500 [inline] mnt_drop_write+0x3e/0x50 fs/namespace.c:532 ovl_workdir_create.cold+0x101/0x10d fs/overlayfs/super.c:546 ovl_fill_super+0x100c/0x2660 fs/overlayfs/super.c:988 mount_nodev+0x52/0xf0 fs/super.c:1180 ovl_mount+0x2d/0x40 fs/overlayfs/super.c:1204 mount_fs+0x97/0x2a1 fs/super.c:1237 vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x417/0x27d0 fs/namespace.c:2879 SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xab/0x120 fs/namespace.c:3072 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45af49 RSP: 002b:00007f6d4de19c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045af49 RDX: 00000000200000c0 RSI: 0000000020000000 RDI: 000000000040000f RBP: 000000000075bf20 R08: 0000000020000100 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6d4de1a6d4 R13: 00000000004c8559 R14: 00000000004e0370 R15: 00000000ffffffff kobject: 'loop3' (ffff8880a42156a0): kobject_uevent_env kobject: 'loop3' (ffff8880a42156a0): fill_kobj_path: path = '/devices/virtual/block/loop3' XFS (loop0): Invalid superblock magic number kobject: 'loop3' (ffff8880a42156a0): kobject_uevent_env kobject: 'loop0' (ffff888097444f20): kobject_uevent_env kobject: 'loop3' (ffff8880a42156a0): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop0' (ffff888097444f20): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop2' (ffff8880a41ed620): kobject_uevent_env kobject: 'loop0' (ffff888097444f20): kobject_uevent_env kobject: 'loop2' (ffff8880a41ed620): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop0' (ffff888097444f20): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop2' (ffff8880a41ed620): kobject_uevent_env kobject: 'loop3' (ffff8880a42156a0): kobject_uevent_env kobject: 'loop2' (ffff8880a41ed620): fill_kobj_path: path = '/devices/virtual/block/loop2' kobject: 'loop3' (ffff8880a42156a0): fill_kobj_path: path = '/devices/virtual/block/loop3' ------------[ cut here ]------------ WARNING: CPU: 0 PID: 7198 at fs/namespace.c:1178 cleanup_mnt+0x104/0x150 fs/namespace.c:1178