lowmemorykiller: Killing 'syz-executor.5' (20417) (tgid 20417), adj 1000, to free 52612kB on behalf of 'syz-executor.4' (11832) because cache 65032kB is below limit 65536kB for oom_score_adj 12 Free memory is -15952kB above reserved ================================= [ INFO: inconsistent lock state ] 4.9.194+ #0 Not tainted --------------------------------- inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-R} usage. syz-executor.4/11832 [HC0[0]:SC0[0]:HE1:SE1] takes: (&mm->mmap_sem){+++++?}, at: [<00000000a925908a>] get_cmdline+0xa3/0x2d0 mm/util.c:641 mark_held_locks+0xb1/0x100 kernel/locking/lockdep.c:2660 __lockdep_trace_alloc kernel/locking/lockdep.c:2882 [inline] lockdep_trace_alloc+0x18c/0x2b0 kernel/locking/lockdep.c:2897 __alloc_pages_nodemask+0x143/0x1a80 mm/page_alloc.c:3803 __alloc_pages include/linux/gfp.h:433 [inline] __alloc_pages_node include/linux/gfp.h:446 [inline] alloc_pages_node include/linux/gfp.h:460 [inline] pmd_alloc_one arch/x86/include/asm/pgalloc.h:88 [inline] __pmd_alloc+0x4a/0x330 mm/memory.c:3742 pmd_alloc include/linux/mm.h:1625 [inline] alloc_new_pmd mm/mremap.c:64 [inline] move_page_tables+0xadb/0xd60 mm/mremap.c:212 shift_arg_pages+0x1ae/0x470 fs/exec.c:642 setup_arg_pages+0x60d/0x7c0 fs/exec.c:754 load_elf_binary+0xa84/0x4a90 fs/binfmt_elf.c:860 search_binary_handler fs/exec.c:1621 [inline] search_binary_handler+0x14f/0x700 fs/exec.c:1599 exec_binprm fs/exec.c:1663 [inline] do_execveat_common.isra.0+0xf81/0x1db0 fs/exec.c:1785 do_execve+0x3a/0x50 fs/exec.c:1829 run_init_process+0x33/0x37 init/main.c:904 try_to_run_init_process+0x18/0x48 init/main.c:913 kernel_init+0xf2/0x163 init/main.c:984 ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375 irq event stamp: 15839 hardirqs last enabled at (15839): [<00000000af3a624b>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:162 [inline] hardirqs last enabled at (15839): [<00000000af3a624b>] _raw_spin_unlock_irqrestore+0x5a/0x70 kernel/locking/spinlock.c:191 hardirqs last disabled at (15838): [<00000000981e2912>] rcu_read_unlock_special+0x3a/0xb30 kernel/rcu/tree_plugin.h:393 softirqs last enabled at (15172): [<000000007485fd36>] __do_softirq+0x474/0x964 kernel/softirq.c:314 softirqs last disabled at (15121): [<000000000416cf07>] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (15121): [<000000000416cf07>] irq_exit+0x119/0x160 kernel/softirq.c:409 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&mm->mmap_sem); lock(&mm->mmap_sem); *** DEADLOCK *** 2 locks held by syz-executor.4/11832: #0: (sb_writers#4){.+.+.+}, at: [<000000006b1fc578>] file_start_write include/linux/fs.h:2646 [inline] #0: (sb_writers#4){.+.+.+}, at: [<000000006b1fc578>] do_sendfile+0x93a/0xc00 fs/read_write.c:1401 #1: (shrinker_rwsem){++++..}, at: [<00000000fe6c52d5>] shrink_slab.part.0+0xb2/0xa20 mm/vmscan.c:472 stack backtrace: CPU: 0 PID: 11832 Comm: syz-executor.4 Not tainted 4.9.194+ #0 ffff8800aa90eb80 ffffffff81b67001 00000000000000f0 ffff88019f1c97c0 ffffffff83cb1200 ffff88019f1ca0e0 ffffffff84252000 ffff8800aa90ebf8 ffffffff81408710 0000000000000000 ffffffff00000001 0000000000000001 Call Trace: [<0000000016ca6406>] __dump_stack lib/dump_stack.c:15 [inline] [<0000000016ca6406>] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [<00000000ae931faf>] print_usage_bug kernel/locking/lockdep.c:2387 [inline] [<00000000ae931faf>] print_usage_bug.cold+0x452/0x5a2 kernel/locking/lockdep.c:2354 [<000000005278aff9>] valid_state kernel/locking/lockdep.c:2400 [inline] [<000000005278aff9>] mark_lock_irq kernel/locking/lockdep.c:2602 [inline] [<000000005278aff9>] mark_lock+0x6c7/0x12e0 kernel/locking/lockdep.c:3065 [<00000000c133b615>] mark_irqflags kernel/locking/lockdep.c:2958 [inline] [<00000000c133b615>] __lock_acquire+0x5be/0x4390 kernel/locking/lockdep.c:3302 [<000000007c61bbc0>] lock_acquire+0x133/0x3d0 kernel/locking/lockdep.c:3756 [<00000000a5098c6c>] down_read+0x44/0xb0 kernel/locking/rwsem.c:22 [<00000000a925908a>] get_cmdline+0xa3/0x2d0 mm/util.c:641 [<0000000002dd612e>] handle_lmk_event+0x169/0x920 drivers/staging/android/lowmemorykiller.c:116 [<000000007e1bf671>] lowmem_scan+0x6f3/0xb70 drivers/staging/android/lowmemorykiller.c:354 [<000000007ddb88cb>] do_shrink_slab mm/vmscan.c:399 [inline] [<000000007ddb88cb>] shrink_slab.part.0+0x3cf/0xa20 mm/vmscan.c:502 [<00000000674b5e0d>] shrink_slab mm/vmscan.c:466 [inline] [<00000000674b5e0d>] shrink_node+0x1ed/0x750 mm/vmscan.c:2604 [<000000002b35537c>] shrink_zones mm/vmscan.c:2751 [inline] [<000000002b35537c>] do_try_to_free_pages mm/vmscan.c:2793 [inline] [<000000002b35537c>] try_to_free_pages+0x397/0xbd0 mm/vmscan.c:3004 [<0000000069642fe7>] __perform_reclaim mm/page_alloc.c:3332 [inline] [<0000000069642fe7>] __alloc_pages_direct_reclaim mm/page_alloc.c:3354 [inline] [<0000000069642fe7>] __alloc_pages_slowpath mm/page_alloc.c:3704 [inline] [<0000000069642fe7>] __alloc_pages_nodemask+0x930/0x1a80 mm/page_alloc.c:3861 [<000000005919c7e6>] __alloc_pages include/linux/gfp.h:433 [inline] [<000000005919c7e6>] __alloc_pages_node include/linux/gfp.h:446 [inline] [<000000005919c7e6>] alloc_pages_node include/linux/gfp.h:460 [inline] [<000000005919c7e6>] __page_cache_alloc include/linux/pagemap.h:208 [inline] [<000000005919c7e6>] __do_page_cache_readahead+0x21d/0x880 mm/readahead.c:183 [<0000000015d6ebd5>] ra_submit mm/internal.h:61 [inline] [<0000000015d6ebd5>] ondemand_readahead+0x50c/0xb20 mm/readahead.c:486 [<00000000d7675fdf>] page_cache_sync_readahead mm/readahead.c:518 [inline] [<00000000d7675fdf>] page_cache_sync_readahead+0xab/0x100 mm/readahead.c:503 [<00000000fb2e6c1d>] do_generic_file_read mm/filemap.c:1866 [inline] [<00000000fb2e6c1d>] generic_file_read_iter+0x10cc/0x1ab0 mm/filemap.c:2122 [<0000000028fec382>] generic_file_splice_read+0x28c/0x4c0 fs/splice.c:309 [<00000000d3e4be8d>] do_splice_to+0x108/0x170 fs/splice.c:899 [<000000008674d084>] splice_direct_to_actor+0x246/0x820 fs/splice.c:971 [<00000000176b19b1>] do_splice_direct+0x1a5/0x260 fs/splice.c:1080 [<000000002ff75b40>] do_sendfile+0x503/0xc00 fs/read_write.c:1402 [<000000004d4399f2>] SYSC_sendfile64 fs/read_write.c:1463 [inline] [<000000004d4399f2>] SyS_sendfile64+0x145/0x160 fs/read_write.c:1449 [<0000000068763da3>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288 [<000000003e5270ca>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb lowmemorykiller: Killing 'syz-executor.5' (20493) (tgid 20493), adj 1000, to free 52588kB on behalf of 'kswapd0' (33) because cache 63992kB is below limit 65536kB for oom_score_adj 12 Free memory is -12732kB above reserved lowmemorykiller: Killing 'syz-executor.4' (22404) (tgid 22404), adj 1000, to free 52544kB on behalf of 'kswapd0' (33) because cache 63992kB is below limit 65536kB for oom_score_adj 12 Free memory is -8548kB above reserved lowmemorykiller: Killing 'syz-executor.1' (11333) (tgid 11333), adj 1000, to free 52536kB on behalf of 'kswapd0' (33) because cache 63992kB is below limit 65536kB for oom_score_adj 12 Free memory is 9820kB above reserved lowmemorykiller: Killing 'syz-executor.4' (11835) (tgid 11835), adj 1000, to free 52536kB on behalf of 'syz-executor.3' (11841) because cache 63964kB is below limit 65536kB for oom_score_adj 12 Free memory is 53444kB above reserved selinux_nlmsg_perm: 375 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 lowmemorykiller: Killing 'syz-executor.2' (21252) (tgid 21252), adj 1000, to free 52528kB on behalf of 'syz-executor.4' (11975) because cache 64032kB is below limit 65536kB for oom_score_adj 12 Free memory is -15896kB above reserved lowmemorykiller: Killing 'syz-executor.2' (21252) (tgid 21252), adj 1000, to free 52528kB on behalf of 'syz-executor.3' (11974) because cache 64032kB is below limit 65536kB for oom_score_adj 12 Free memory is -15896kB above reserved lowmemorykiller: Killing 'syz-executor.1' (5967) (tgid 5967), adj 1000, to free 52516kB on behalf of 'syz-executor.4' (11975) because cache 61032kB is below limit 65536kB for oom_score_adj 12 Free memory is -14860kB above reserved lowmemorykiller: Killing 'syz-executor.4' (22482) (tgid 22482), adj 1000, to free 52512kB on behalf of 'syz-executor.4' (11975) because cache 61032kB is below limit 65536kB for oom_score_adj 12 Free memory is -14860kB above reserved lowmemorykiller: Killing 'syz-executor.1' (11943) (tgid 11943), adj 1000, to free 52508kB on behalf of 'kswapd0' (33) because cache 59632kB is below limit 65536kB for oom_score_adj 12 Free memory is -13380kB above reserved SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11954 comm=syz-executor.0 lowmemorykiller: Killing 'syz-executor.2' (10085) (tgid 10085), adj 1000, to free 52500kB on behalf of 'kswapd0' (33) because cache 59220kB is below limit 65536kB for oom_score_adj 12 Free memory is -2732kB above reserved lowmemorykiller: Killing 'syz-executor.2' (22072) (tgid 22072), adj 1000, to free 52496kB on behalf of 'kswapd0' (33) because cache 59200kB is below limit 65536kB for oom_score_adj 12 Free memory is 33132kB above reserved lowmemorykiller: Killing 'syz-executor.2' (22428) (tgid 22428), adj 1000, to free 52476kB on behalf of 'kswapd0' (33) because cache 59204kB is below limit 65536kB for oom_score_adj 12 Free memory is 49376kB above reserved selinux_nlmsg_perm: 435 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0 lowmemorykiller: Killing 'syz-executor.4' (10638) (tgid 10638), adj 1000, to free 52472kB on behalf of 'syz-executor.1' (12463) because cache 59060kB is below limit 65536kB for oom_score_adj 12 Free memory is -15900kB above reserved lowmemorykiller: Killing 'syz-executor.4' (10638) (tgid 10638), adj 1000, to free 52472kB on behalf of 'syz-executor.5' (12465) because cache 58960kB is below limit 65536kB for oom_score_adj 12 Free memory is -15900kB above reserved lowmemorykiller: Killing 'syz-executor.5' (11961) (tgid 11961), adj 1000, to free 52472kB on behalf of 'kswapd0' (33) because cache 57960kB is below limit 65536kB for oom_score_adj 12 Free memory is -15280kB above reserved lowmemorykiller: Killing 'syz-executor.1' (10287) (tgid 10287), adj 1000, to free 52468kB on behalf of 'kswapd0' (33) because cache 57860kB is below limit 65536kB for oom_score_adj 12 Free memory is -12936kB above reserved SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0 lowmemorykiller: Killing 'syz-executor.5' (20925) (tgid 20925), adj 1000, to free 52464kB on behalf of 'kswapd0' (33) because cache 57532kB is below limit 65536kB for oom_score_adj 12 Free memory is -4924kB above reserved lowmemorykiller: Killing 'syz-executor.4' (5191) (tgid 5191), adj 1000, to free 52464kB on behalf of 'kswapd0' (33) because cache 57332kB is below limit 65536kB for oom_score_adj 12 Free memory is 8440kB above reserved lowmemorykiller: Killing 'syz-executor.2' (31416) (tgid 31416), adj 1000, to free 52460kB on behalf of 'kswapd0' (33) because cache 57332kB is below limit 65536kB for oom_score_adj 12 Free memory is 20340kB above reserved lowmemorykiller: Killing 'syz-executor.2' (11973) (tgid 11973), adj 1000, to free 52460kB on behalf of 'kswapd0' (33) because cache 57332kB is below limit 65536kB for oom_score_adj 12 Free memory is 31740kB above reserved lowmemorykiller: Killing 'syz-executor.2' (1831) (tgid 1831), adj 1000, to free 52456kB on behalf of 'kswapd0' (33) because cache 57332kB is below limit 65536kB for oom_score_adj 12 Free memory is 54272kB above reserved SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12457 comm=syz-executor.0