bisecting fixing commit since 97a8651cadce7c2b7c4d8f108b392eff31fe2c08 building syzkaller on 77e2b66864e69c17416614228723a1ebd3581ddc testing commit 97a8651cadce7c2b7c4d8f108b392eff31fe2c08 with gcc (GCC) 8.4.1 20210217 kernel signature: 3dcc79ca02d36a82934c980fa4921370b4a642ef9c2c4853439f2bf910dbc185 all runs: crashed: inconsistent lock state in free_huge_page testing current HEAD 9f84340f012ee60c12aacc03662bcdd67419a31a testing commit 9f84340f012ee60c12aacc03662bcdd67419a31a with gcc (GCC) 8.4.1 20210217 kernel signature: f6183737e357373ac2248f4e1fdb9a1dc5dbe732298f56a214deda192456d86c all runs: crashed: inconsistent lock state in free_huge_page revisions tested: 2, total time: 25m35.399428605s (build: 17m4.871924441s, test: 8m6.337275186s) the crash still happens on HEAD commit msg: Linux 4.19.196 crash: inconsistent lock state in free_huge_page ================================ WARNING: inconsistent lock state 4.19.196-syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. ksoftirqd/1/18 [HC0[0]:SC1[1]:HE1:SE0] takes: 000000001c6505de (hugetlb_lock){+.?.}, at: spin_lock include/linux/spinlock.h:329 [inline] 000000001c6505de (hugetlb_lock){+.?.}, at: free_huge_page mm/hugetlb.c:1301 [inline] 000000001c6505de (hugetlb_lock){+.?.}, at: free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1263 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3048 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe irq event stamp: 2110962 hardirqs last enabled at (2110962): [] __local_bh_enable_ip+0x160/0x250 kernel/softirq.c:194 hardirqs last disabled at (2110961): [] __local_bh_enable_ip+0x120/0x250 kernel/softirq.c:171 softirqs last enabled at (2110886): [] __do_softirq+0x62d/0x919 kernel/softirq.c:318 softirqs last disabled at (2110891): [] run_ksoftirqd+0x5e/0x100 kernel/softirq.c:653 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(hugetlb_lock); lock(hugetlb_lock); *** DEADLOCK *** 3 locks held by ksoftirqd/1/18: #0: 00000000d1241979 (rcu_read_lock){....}, at: __write_once_size include/linux/compiler.h:288 [inline] #0: 00000000d1241979 (rcu_read_lock){....}, at: __skb_unlink include/linux/skbuff.h:1920 [inline] #0: 00000000d1241979 (rcu_read_lock){....}, at: __skb_dequeue include/linux/skbuff.h:1936 [inline] #0: 00000000d1241979 (rcu_read_lock){....}, at: process_backlog+0x1d9/0x710 net/core/dev.c:5846 #1: 00000000d1241979 (rcu_read_lock){....}, at: __skb_pull include/linux/skbuff.h:2153 [inline] #1: 00000000d1241979 (rcu_read_lock){....}, at: ip_local_deliver_finish+0x125/0x9a0 net/ipv4/ip_input.c:193 #2: 00000000c40f150b (slock-AF_INET/1){+.-.}, at: tcp_v4_rcv+0x2866/0x3bb0 net/ipv4/tcp_ipv4.c:1828 stack backtrace: CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.19.196-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 print_usage_bug.cold.38+0x433/0x563 kernel/locking/lockdep.c:2545 valid_state kernel/locking/lockdep.c:2558 [inline] mark_lock_irq kernel/locking/lockdep.c:2752 [inline] mark_lock+0xd44/0x12f0 kernel/locking/lockdep.c:3132 mark_irqflags kernel/locking/lockdep.c:3010 [inline] __lock_acquire+0x131d/0x47c0 kernel/locking/lockdep.c:3373 lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] free_huge_page mm/hugetlb.c:1301 [inline] free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1263 __put_compound_page+0x65/0xa0 mm/swap.c:96 __put_page+0x5d/0x290 mm/swap.c:112 put_page include/linux/mm.h:963 [inline] __skb_frag_unref include/linux/skbuff.h:2833 [inline] skb_release_data+0x249/0x760 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1466 [inline] tcp_rtx_queue_unlink_and_free include/net/tcp.h:1769 [inline] tcp_clean_rtx_queue net/ipv4/tcp_input.c:3156 [inline] tcp_ack+0x1937/0x5740 net/ipv4/tcp_input.c:3691 tcp_rcv_established+0x58d/0x1e60 net/ipv4/tcp_input.c:5666 tcp_v4_do_rcv+0x52f/0x790 net/ipv4/tcp_ipv4.c:1547 tcp_v4_rcv+0x2ab8/0x3bb0 net/ipv4/tcp_ipv4.c:1832 ip_local_deliver_finish+0x3be/0x9a0 net/ipv4/ip_input.c:215 NF_HOOK include/linux/netfilter.h:289 [inline] ip_local_deliver+0x164/0x4b0 net/ipv4/ip_input.c:256 dst_input include/net/dst.h:461 [inline] ip_rcv_finish+0x159/0x240 net/ipv4/ip_input.c:414 NF_HOOK include/linux/netfilter.h:289 [inline] ip_rcv+0xc1/0x2f0 net/ipv4/ip_input.c:524 __netif_receive_skb_one_core+0x112/0x1a0 net/core/dev.c:4954 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5066 process_backlog+0x220/0x710 net/core/dev.c:5848 napi_poll net/core/dev.c:6272 [inline] net_rx_action+0x454/0xe30 net/core/dev.c:6338 __do_softirq+0x25f/0x919 kernel/softirq.c:292 run_ksoftirqd+0x5e/0x100 kernel/softirq.c:653 smpboot_thread_fn+0x55f/0x8a0 kernel/smpboot.c:164 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22