====================================================== WARNING: possible circular locking dependency detected 5.13.0-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.0/8713 is trying to acquire lock: ffffffff8c29c040 (fs_reclaim){+.+.}-{0:0}, at: fs_reclaim_acquire+0xf7/0x160 mm/page_alloc.c:4586 but task is already holding lock: ffff8880b9c31620 (lock#2){-.-.}-{2:2}, at: __alloc_pages_bulk+0x4ad/0x1870 mm/page_alloc.c:5291 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (lock#2){-.-.}-{2:2}: local_lock_acquire include/linux/local_lock_internal.h:42 [inline] rmqueue_pcplist mm/page_alloc.c:3675 [inline] rmqueue mm/page_alloc.c:3713 [inline] get_page_from_freelist+0x4aa/0x2f80 mm/page_alloc.c:4175 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5386 alloc_pages+0x18c/0x2a0 mm/mempolicy.c:2272 stack_depot_save+0x39d/0x4e0 lib/stackdepot.c:303 kasan_save_stack+0x32/0x40 mm/kasan/common.c:40 kasan_record_aux_stack+0xe5/0x110 mm/kasan/generic.c:348 insert_work+0x48/0x370 kernel/workqueue.c:1332 __queue_work+0x5c1/0xed0 kernel/workqueue.c:1498 __queue_delayed_work+0x1c8/0x270 kernel/workqueue.c:1645 mod_delayed_work_on+0xdd/0x220 kernel/workqueue.c:1719 kblockd_mod_delayed_work_on+0x26/0x30 block/blk-core.c:1635 __blk_mq_delay_run_hw_queue+0x38d/0x640 block/blk-mq.c:1585 blk_mq_run_hw_queue+0x16c/0x2f0 block/blk-mq.c:1630 blk_mq_sched_insert_request+0x360/0x420 block/blk-mq-sched.c:479 blk_mq_submit_bio+0xe5f/0x1850 block/blk-mq.c:2296 __submit_bio_noacct_mq block/blk-core.c:1013 [inline] submit_bio_noacct block/blk-core.c:1046 [inline] submit_bio_noacct+0xad2/0xf20 block/blk-core.c:1029 submit_bio+0x1ea/0x470 block/blk-core.c:1108 submit_bh_wbc+0x5eb/0x7f0 fs/buffer.c:3050 __ext4_read_bh fs/ext4/super.c:158 [inline] ext4_read_bh_nowait+0x155/0x220 fs/ext4/super.c:170 ext4_read_bh_lock+0x5e/0x180 fs/ext4/super.c:195 ext4_bread_batch+0x396/0x550 fs/ext4/inode.c:932 __ext4_find_entry+0x482/0x1050 fs/ext4/namei.c:1599 ext4_lookup_entry fs/ext4/namei.c:1700 [inline] ext4_lookup fs/ext4/namei.c:1768 [inline] ext4_lookup+0x4fc/0x730 fs/ext4/namei.c:1759 lookup_open.isra.0+0x6a4/0x13d0 fs/namei.c:3193 open_last_lookups fs/namei.c:3285 [inline] path_openat+0x9b4/0x27e0 fs/namei.c:3491 do_filp_open+0x190/0x3d0 fs/namei.c:3521 do_open_execat+0x116/0x690 fs/exec.c:913 open_exec+0x42/0x70 fs/exec.c:948 load_elf_binary+0x586/0x4b40 fs/binfmt_elf.c:898 search_binary_handler fs/exec.c:1724 [inline] exec_binprm fs/exec.c:1765 [inline] bprm_execve fs/exec.c:1834 [inline] bprm_execve+0x821/0x19a0 fs/exec.c:1796 kernel_execve+0x370/0x460 fs/exec.c:1977 try_to_run_init_process+0x14/0x4e init/main.c:1386 kernel_init+0x12c/0x1d0 init/main.c:1502 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #1 (&pool->lock){-.-.}-{2:2}: __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151 __queue_work+0x366/0xed0 kernel/workqueue.c:1455 queue_work_on+0xee/0x110 kernel/workqueue.c:1525 queue_work include/linux/workqueue.h:507 [inline] schedule_work include/linux/workqueue.h:568 [inline] __vfree_deferred mm/vmalloc.c:2591 [inline] vfree_atomic+0xac/0xe0 mm/vmalloc.c:2609 free_thread_stack kernel/fork.c:292 [inline] release_task_stack kernel/fork.c:432 [inline] put_task_stack+0x2e0/0x4e0 kernel/fork.c:443 finish_task_switch.isra.0+0x77f/0xa50 kernel/sched/core.c:4595 context_switch kernel/sched/core.c:4686 [inline] __schedule+0x93c/0x2710 kernel/sched/core.c:5940 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6328 irqentry_exit+0x31/0x80 kernel/entry/common.c:427 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5593 __fs_reclaim_acquire mm/page_alloc.c:4564 [inline] fs_reclaim_acquire+0x117/0x160 mm/page_alloc.c:4578 might_alloc include/linux/sched/mm.h:198 [inline] slab_pre_alloc_hook mm/slab.h:485 [inline] slab_alloc_node mm/slub.c:2891 [inline] slab_alloc mm/slub.c:2978 [inline] __kmalloc_track_caller+0x59/0x320 mm/slub.c:4623 __do_krealloc mm/slab_common.c:1196 [inline] krealloc+0x87/0xf0 mm/slab_common.c:1229 add_sysfs_param+0xca/0x960 kernel/params.c:633 kernel_add_sysfs_param kernel/params.c:794 [inline] param_sysfs_builtin kernel/params.c:833 [inline] param_sysfs_init+0x359/0x498 kernel/params.c:952 do_one_initcall+0x103/0x650 init/main.c:1246 do_initcall_level init/main.c:1319 [inline] do_initcalls init/main.c:1335 [inline] do_basic_setup init/main.c:1355 [inline] kernel_init_freeable+0x6b8/0x741 init/main.c:1557 kernel_init+0x1a/0x1d0 init/main.c:1449 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #0 (fs_reclaim){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3051 [inline] check_prevs_add kernel/locking/lockdep.c:3174 [inline] validate_chain kernel/locking/lockdep.c:3789 [inline] __lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015 lock_acquire kernel/locking/lockdep.c:5625 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590 __fs_reclaim_acquire mm/page_alloc.c:4564 [inline] fs_reclaim_acquire+0x117/0x160 mm/page_alloc.c:4578 prepare_alloc_pages+0x15c/0x580 mm/page_alloc.c:5176 __alloc_pages+0x12f/0x500 mm/page_alloc.c:5375 alloc_pages+0x18c/0x2a0 mm/mempolicy.c:2272 stack_depot_save+0x39d/0x4e0 lib/stackdepot.c:303 save_stack+0x15e/0x1e0 mm/page_owner.c:120 __set_page_owner+0x50/0x290 mm/page_owner.c:181 prep_new_page mm/page_alloc.c:2445 [inline] __alloc_pages_bulk+0x8b9/0x1870 mm/page_alloc.c:5313 alloc_pages_bulk_array_node include/linux/gfp.h:557 [inline] vm_area_alloc_pages mm/vmalloc.c:2775 [inline] __vmalloc_area_node mm/vmalloc.c:2845 [inline] __vmalloc_node_range+0x39d/0x960 mm/vmalloc.c:2947 alloc_thread_stack_node kernel/fork.c:245 [inline] dup_task_struct kernel/fork.c:875 [inline] copy_process+0x8db/0x74c0 kernel/fork.c:1952 kernel_clone+0xe7/0xab0 kernel/fork.c:2509 __do_compat_sys_ia32_clone+0xac/0xe0 arch/x86/kernel/sys_ia32.c:254 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] do_int80_syscall_32+0x46/0x90 arch/x86/entry/common.c:132 entry_INT80_compat+0x71/0x76 arch/x86/entry/entry_64_compat.S:413 other info that might help us debug this: Chain exists of: fs_reclaim --> &pool->lock --> lock#2 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(lock#2); lock(&pool->lock); lock(lock#2); lock(fs_reclaim); *** DEADLOCK *** 1 lock held by syz-executor.0/8713: #0: ffff8880b9c31620 (lock#2){-.-.}-{2:2}, at: __alloc_pages_bulk+0x4ad/0x1870 mm/page_alloc.c:5291 stack backtrace: CPU: 0 PID: 8713 Comm: syz-executor.0 Not tainted 5.13.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96 check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2131 check_prev_add kernel/locking/lockdep.c:3051 [inline] check_prevs_add kernel/locking/lockdep.c:3174 [inline] validate_chain kernel/locking/lockdep.c:3789 [inline] __lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015 lock_acquire kernel/locking/lockdep.c:5625 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590 __fs_reclaim_acquire mm/page_alloc.c:4564 [inline] fs_reclaim_acquire+0x117/0x160 mm/page_alloc.c:4578 prepare_alloc_pages+0x15c/0x580 mm/page_alloc.c:5176 __alloc_pages+0x12f/0x500 mm/page_alloc.c:5375 alloc_pages+0x18c/0x2a0 mm/mempolicy.c:2272 stack_depot_save+0x39d/0x4e0 lib/stackdepot.c:303 save_stack+0x15e/0x1e0 mm/page_owner.c:120 __set_page_owner+0x50/0x290 mm/page_owner.c:181 prep_new_page mm/page_alloc.c:2445 [inline] __alloc_pages_bulk+0x8b9/0x1870 mm/page_alloc.c:5313 alloc_pages_bulk_array_node include/linux/gfp.h:557 [inline] vm_area_alloc_pages mm/vmalloc.c:2775 [inline] __vmalloc_area_node mm/vmalloc.c:2845 [inline] __vmalloc_node_range+0x39d/0x960 mm/vmalloc.c:2947 alloc_thread_stack_node kernel/fork.c:245 [inline] dup_task_struct kernel/fork.c:875 [inline] copy_process+0x8db/0x74c0 kernel/fork.c:1952 kernel_clone+0xe7/0xab0 kernel/fork.c:2509 __do_compat_sys_ia32_clone+0xac/0xe0 arch/x86/kernel/sys_ia32.c:254 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] do_int80_syscall_32+0x46/0x90 arch/x86/entry/common.c:132 entry_INT80_compat+0x71/0x76 arch/x86/entry/entry_64_compat.S:413 RIP: 0023:0x8096884 Code: 8b 44 24 04 89 41 08 c7 41 04 00 00 00 00 53 56 57 8b 74 24 24 8b 54 24 20 8b 5c 24 18 8b 7c 24 28 b8 78 00 00 00 89 19 cd 80 <5f> 5e 5b 85 c0 0f 8c 11 72 00 00 74 01 c3 89 f5 ff d3 e8 00 00 00 RSP: 002b:00000000086cfa50 EFLAGS: 00000292 ORIG_RAX: 0000000000000078 RAX: ffffffffffffffda RBX: 00000000003d0f00 RCX: 00000000f77697a4 RDX: 00000000f7769ba8 RSI: 00000000086cfa9c RDI: 00000000f7769ba8 RBP: 000000000816c000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 BUG: sleeping function called from invalid context at mm/page_alloc.c:5179 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 8713, name: syz-executor.0 INFO: lockdep is turned off. irq event stamp: 1930 hardirqs last enabled at (1929): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (1929): [] _raw_spin_unlock_irqrestore+0x50/0x70 kernel/locking/spinlock.c:191 hardirqs last disabled at (1930): [] __alloc_pages_bulk+0x1017/0x1870 mm/page_alloc.c:5291 softirqs last enabled at (1662): [] tipc_release+0xba5/0x1a00 net/tipc/socket.c:650 softirqs last disabled at (1660): [] spin_lock_bh include/linux/spinlock.h:359 [inline] softirqs last disabled at (1660): [] release_sock+0x1b/0x1b0 net/core/sock.c:3116 CPU: 0 PID: 8713 Comm: syz-executor.0 Not tainted 5.13.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96 ___might_sleep.cold+0x1f1/0x237 kernel/sched/core.c:9153 prepare_alloc_pages+0x3da/0x580 mm/page_alloc.c:5179 __alloc_pages+0x12f/0x500 mm/page_alloc.c:5375 alloc_pages+0x18c/0x2a0 mm/mempolicy.c:2272 stack_depot_save+0x39d/0x4e0 lib/stackdepot.c:303 save_stack+0x15e/0x1e0 mm/page_owner.c:120 __set_page_owner+0x50/0x290 mm/page_owner.c:181 prep_new_page mm/page_alloc.c:2445 [inline] __alloc_pages_bulk+0x8b9/0x1870 mm/page_alloc.c:5313 alloc_pages_bulk_array_node include/linux/gfp.h:557 [inline] vm_area_alloc_pages mm/vmalloc.c:2775 [inline] __vmalloc_area_node mm/vmalloc.c:2845 [inline] __vmalloc_node_range+0x39d/0x960 mm/vmalloc.c:2947 alloc_thread_stack_node kernel/fork.c:245 [inline] dup_task_struct kernel/fork.c:875 [inline] copy_process+0x8db/0x74c0 kernel/fork.c:1952 kernel_clone+0xe7/0xab0 kernel/fork.c:2509 __do_compat_sys_ia32_clone+0xac/0xe0 arch/x86/kernel/sys_ia32.c:254 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] do_int80_syscall_32+0x46/0x90 arch/x86/entry/common.c:132 entry_INT80_compat+0x71/0x76 arch/x86/entry/entry_64_compat.S:413 RIP: 0023:0x8096884 Code: 8b 44 24 04 89 41 08 c7 41 04 00 00 00 00 53 56 57 8b 74 24 24 8b 54 24 20 8b 5c 24 18 8b 7c 24 28 b8 78 00 00 00 89 19 cd 80 <5f> 5e 5b 85 c0 0f 8c 11 72 00 00 74 01 c3 89 f5 ff d3 e8 00 00 00 RSP: 002b:00000000086cfa50 EFLAGS: 00000292 ORIG_RAX: 0000000000000078 RAX: ffffffffffffffda RBX: 00000000003d0f00 RCX: 00000000f77697a4 RDX: 00000000f7769ba8 RSI: 00000000086cfa9c RDI: 00000000f7769ba8 RBP: 000000000816c000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000