bisecting fixing commit since 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae building syzkaller on c2c1d1dd603b7d66d283253ffbd61b8692712bd2 testing commit 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae with gcc (GCC) 8.4.1 20210217 kernel signature: 370a75762bd0ff0293a9d15750a835921139000bde2e3626959026d87a868258 run #0: crashed: possible deadlock in sk_clone_lock run #1: crashed: inconsistent lock state in free_huge_page run #2: crashed: inconsistent lock state in free_huge_page run #3: crashed: inconsistent lock state in free_huge_page run #4: crashed: inconsistent lock state in free_huge_page run #5: crashed: inconsistent lock state in free_huge_page run #6: crashed: inconsistent lock state in free_huge_page run #7: crashed: inconsistent lock state in free_huge_page run #8: crashed: inconsistent lock state in free_huge_page run #9: crashed: inconsistent lock state in free_huge_page run #10: crashed: inconsistent lock state in free_huge_page run #11: crashed: inconsistent lock state in free_huge_page run #12: crashed: inconsistent lock state in free_huge_page run #13: crashed: inconsistent lock state in free_huge_page run #14: crashed: inconsistent lock state in free_huge_page run #15: crashed: inconsistent lock state in free_huge_page run #16: crashed: possible deadlock in sk_clone_lock run #17: crashed: possible deadlock in sk_clone_lock run #18: crashed: possible deadlock in sk_clone_lock run #19: crashed: possible deadlock in sk_clone_lock testing current HEAD 670d6552eda8ff0c5f396d3d6f0174237917c66c testing commit 670d6552eda8ff0c5f396d3d6f0174237917c66c with gcc (GCC) 8.4.1 20210217 kernel signature: 0456b126cf83d5c7b7d448a399b83fcb4123d5e7db5a6d11184d80271fc81656 run #0: crashed: inconsistent lock state in free_huge_page run #1: crashed: inconsistent lock state in free_huge_page run #2: crashed: inconsistent lock state in free_huge_page run #3: crashed: inconsistent lock state in free_huge_page run #4: crashed: inconsistent lock state in free_huge_page run #5: crashed: inconsistent lock state in free_huge_page run #6: crashed: possible deadlock in sk_clone_lock run #7: crashed: possible deadlock in sk_clone_lock run #8: crashed: possible deadlock in sk_clone_lock run #9: crashed: possible deadlock in sk_clone_lock revisions tested: 2, total time: 32m53.581063014s (build: 14m26.215837326s, test: 18m4.412067797s) the crash still happens on HEAD commit msg: Linux 4.14.227 crash: possible deadlock in sk_clone_lock ===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 4.14.227-syzkaller #0 Not tainted ----------------------------------------------------- syz-executor904/20125 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire: (hugetlb_lock){+.+.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] (hugetlb_lock){+.+.}, at: [] free_huge_page mm/hugetlb.c:1309 [inline] (hugetlb_lock){+.+.}, at: [] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1271 and this task is already holding: (slock-AF_INET){+.-.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] (slock-AF_INET){+.-.}, at: [] tcp_close+0x517/0xef0 net/ipv4/tcp.c:2234 which would create a new lock dependency: (slock-AF_INET){+.-.} -> (hugetlb_lock){+.+.} but this new dependency connects a SOFTIRQ-irq-safe lock: (slock-AF_INET){+.-.} ... which became SOFTIRQ-irq-safe at: mark_irqflags kernel/locking/lockdep.c:3072 [inline] __lock_acquire+0x1241/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] sk_clone_lock+0x3c7/0x1190 net/core/sock.c:1666 inet_csk_clone_lock+0x13/0x3c0 net/ipv4/inet_connection_sock.c:815 tcp_create_openreq_child+0x24/0x1860 net/ipv4/tcp_minisocks.c:437 tcp_v4_syn_recv_sock+0xa0/0xfc0 net/ipv4/tcp_ipv4.c:1358 tcp_check_req+0x3c7/0x14a0 net/ipv4/tcp_minisocks.c:764 tcp_v4_rcv+0x1bc0/0x37c0 net/ipv4/tcp_ipv4.c:1701 ip_local_deliver_finish+0x3a7/0x9a0 net/ipv4/ip_input.c:216 NF_HOOK include/linux/netfilter.h:250 [inline] ip_local_deliver+0x15c/0x490 net/ipv4/ip_input.c:257 dst_input include/net/dst.h:476 [inline] ip_rcv_finish+0x640/0x1950 net/ipv4/ip_input.c:396 NF_HOOK include/linux/netfilter.h:250 [inline] ip_rcv+0x91f/0x1320 net/ipv4/ip_input.c:493 __netif_receive_skb_core+0x1d03/0x2fe0 net/core/dev.c:4474 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:4512 netif_receive_skb_internal+0xcc/0x4d0 net/core/dev.c:4585 napi_skb_finish net/core/dev.c:4946 [inline] napi_gro_receive+0x28e/0x380 net/core/dev.c:4977 receive_buf+0xed9/0x4900 drivers/net/virtio_net.c:852 virtnet_receive drivers/net/virtio_net.c:1098 [inline] virtnet_poll+0x4d8/0x9b0 drivers/net/virtio_net.c:1189 napi_poll net/core/dev.c:5596 [inline] net_rx_action+0x42d/0xe20 net/core/dev.c:5662 __do_softirq+0x247/0x9a2 kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x15f/0x1a0 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] do_IRQ+0x116/0x1d0 arch/x86/kernel/irq.c:242 ret_from_intr+0x0/0x1e unwind_get_return_address arch/x86/kernel/unwind_frame.c:18 [inline] unwind_get_return_address+0x4f/0xa0 arch/x86/kernel/unwind_frame.c:13 __save_stack_trace+0x7e/0xd0 arch/x86/kernel/stacktrace.c:45 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:551 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:536 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] kmem_cache_alloc_trace+0x13b/0x3f0 mm/slab.c:3616 kmalloc include/linux/slab.h:488 [inline] kernfs_get_open_node fs/kernfs/file.c:572 [inline] kernfs_fop_open+0x73c/0xbc0 fs/kernfs/file.c:718 do_dentry_open+0x3e4/0xde0 fs/open.c:777 vfs_open+0xfc/0x240 fs/open.c:888 do_last fs/namei.c:3428 [inline] path_openat+0xb6f/0x2760 fs/namei.c:3569 do_filp_open+0x16b/0x220 fs/namei.c:3603 do_sys_open+0x1d0/0x350 fs/open.c:1081 SYSC_open fs/open.c:1099 [inline] SyS_open+0x19/0x20 fs/open.c:1094 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb to a SOFTIRQ-irq-unsafe lock: (hugetlb_lock){+.+.} ... which became SOFTIRQ-irq-unsafe at: ... mark_irqflags kernel/locking/lockdep.c:3090 [inline] __lock_acquire+0x6d9/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x25d/0x4f0 mm/hugetlb.c:3034 proc_sys_call_handler.isra.20+0x162/0x1f0 fs/proc/proc_sysctl.c:598 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:616 __vfs_write+0xdb/0x840 fs/read_write.c:480 vfs_write+0x150/0x4f0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hugetlb_lock); local_irq_disable(); lock(slock-AF_INET); lock(hugetlb_lock); lock(slock-AF_INET); *** DEADLOCK *** 3 locks held by syz-executor904/20125: #0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #0: (&sb->s_type->i_mutex_key#13){+.+.}, at: [] __sock_release+0x7d/0x2a0 net/socket.c:601 #1: (sk_lock-AF_INET){+.+.}, at: [] lock_sock include/net/sock.h:1471 [inline] #1: (sk_lock-AF_INET){+.+.}, at: [] tcp_close+0x1f/0xef0 net/ipv4/tcp.c:2144 #2: (slock-AF_INET){+.-.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] #2: (slock-AF_INET){+.-.}, at: [] tcp_close+0x517/0xef0 net/ipv4/tcp.c:2234 the dependencies between SOFTIRQ-irq-safe lock and the holding lock: -> (slock-AF_INET){+.-.} ops: 4507876 { HARDIRQ-ON-W at: mark_irqflags kernel/locking/lockdep.c:3086 [inline] __lock_acquire+0xef4/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:176 spin_lock_bh include/linux/spinlock.h:322 [inline] lock_sock_nested+0x3a/0x100 net/core/sock.c:2788 lock_sock include/net/sock.h:1471 [inline] inet_autobind+0x13/0x160 net/ipv4/af_inet.c:178 inet_dgram_connect+0x109/0x230 net/ipv4/af_inet.c:538 SYSC_connect net/socket.c:1655 [inline] SyS_connect+0x199/0x2b0 net/socket.c:1636 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb IN-SOFTIRQ-W at: mark_irqflags kernel/locking/lockdep.c:3072 [inline] __lock_acquire+0x1241/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] sk_clone_lock+0x3c7/0x1190 net/core/sock.c:1666 inet_csk_clone_lock+0x13/0x3c0 net/ipv4/inet_connection_sock.c:815 tcp_create_openreq_child+0x24/0x1860 net/ipv4/tcp_minisocks.c:437 tcp_v4_syn_recv_sock+0xa0/0xfc0 net/ipv4/tcp_ipv4.c:1358 tcp_check_req+0x3c7/0x14a0 net/ipv4/tcp_minisocks.c:764 tcp_v4_rcv+0x1bc0/0x37c0 net/ipv4/tcp_ipv4.c:1701 ip_local_deliver_finish+0x3a7/0x9a0 net/ipv4/ip_input.c:216 NF_HOOK include/linux/netfilter.h:250 [inline] ip_local_deliver+0x15c/0x490 net/ipv4/ip_input.c:257 dst_input include/net/dst.h:476 [inline] ip_rcv_finish+0x640/0x1950 net/ipv4/ip_input.c:396 NF_HOOK include/linux/netfilter.h:250 [inline] ip_rcv+0x91f/0x1320 net/ipv4/ip_input.c:493 __netif_receive_skb_core+0x1d03/0x2fe0 net/core/dev.c:4474 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:4512 netif_receive_skb_internal+0xcc/0x4d0 net/core/dev.c:4585 napi_skb_finish net/core/dev.c:4946 [inline] napi_gro_receive+0x28e/0x380 net/core/dev.c:4977 receive_buf+0xed9/0x4900 drivers/net/virtio_net.c:852 virtnet_receive drivers/net/virtio_net.c:1098 [inline] virtnet_poll+0x4d8/0x9b0 drivers/net/virtio_net.c:1189 napi_poll net/core/dev.c:5596 [inline] net_rx_action+0x42d/0xe20 net/core/dev.c:5662 __do_softirq+0x247/0x9a2 kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x15f/0x1a0 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] do_IRQ+0x116/0x1d0 arch/x86/kernel/irq.c:242 ret_from_intr+0x0/0x1e unwind_get_return_address arch/x86/kernel/unwind_frame.c:18 [inline] unwind_get_return_address+0x4f/0xa0 arch/x86/kernel/unwind_frame.c:13 __save_stack_trace+0x7e/0xd0 arch/x86/kernel/stacktrace.c:45 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:551 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:536 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] kmem_cache_alloc_trace+0x13b/0x3f0 mm/slab.c:3616 kmalloc include/linux/slab.h:488 [inline] kernfs_get_open_node fs/kernfs/file.c:572 [inline] kernfs_fop_open+0x73c/0xbc0 fs/kernfs/file.c:718 do_dentry_open+0x3e4/0xde0 fs/open.c:777 vfs_open+0xfc/0x240 fs/open.c:888 do_last fs/namei.c:3428 [inline] path_openat+0xb6f/0x2760 fs/namei.c:3569 do_filp_open+0x16b/0x220 fs/namei.c:3603 do_sys_open+0x1d0/0x350 fs/open.c:1081 SYSC_open fs/open.c:1099 [inline] SyS_open+0x19/0x20 fs/open.c:1094 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb INITIAL USE at: __lock_acquire+0x701/0x42d0 kernel/locking/lockdep.c:3452 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:176 spin_lock_bh include/linux/spinlock.h:322 [inline] lock_sock_nested+0x3a/0x100 net/core/sock.c:2788 lock_sock include/net/sock.h:1471 [inline] inet_autobind+0x13/0x160 net/ipv4/af_inet.c:178 inet_dgram_connect+0x109/0x230 net/ipv4/af_inet.c:538 SYSC_connect net/socket.c:1655 [inline] SyS_connect+0x199/0x2b0 net/socket.c:1636 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb } ... key at: [] af_family_slock_keys+0x10/0x180 ... acquired at: check_irq_usage kernel/locking/lockdep.c:1697 [inline] check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline] check_prev_add kernel/locking/lockdep.c:1910 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x202a/0x42d0 kernel/locking/lockdep.c:3491 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page mm/hugetlb.c:1309 [inline] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1271 __put_compound_page+0x67/0xa0 mm/swap.c:95 __put_page+0x5d/0x280 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] __skb_frag_unref include/linux/skbuff.h:2829 [inline] skb_release_data+0x20d/0x820 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1425 [inline] tcp_write_queue_purge include/net/tcp.h:1631 [inline] tcp_v4_destroy_sock+0x223/0x970 net/ipv4/tcp_ipv4.c:1904 inet_csk_destroy_sock+0x146/0x3a0 net/ipv4/inet_connection_sock.c:866 tcp_close+0x7fa/0xef0 net/ipv4/tcp.c:2298 inet_release+0xd9/0x1c0 net/ipv4/af_inet.c:425 __sock_release+0xc2/0x2a0 net/socket.c:602 sock_close+0x10/0x20 net/socket.c:1139 __fput+0x232/0x740 fs/file_table.c:210 ____fput+0x9/0x10 fs/file_table.c:244 task_work_run+0xe5/0x170 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x98b/0x2c90 kernel/exit.c:868 do_group_exit+0xf8/0x2c0 kernel/exit.c:965 get_signal+0x2f6/0x1a90 kernel/signal.c:2423 do_signal+0x7f/0x18b0 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x11e/0x190 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: -> (hugetlb_lock){+.+.} ops: 1274188 { HARDIRQ-ON-W at: mark_irqflags kernel/locking/lockdep.c:3086 [inline] __lock_acquire+0xef4/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x25d/0x4f0 mm/hugetlb.c:3034 proc_sys_call_handler.isra.20+0x162/0x1f0 fs/proc/proc_sysctl.c:598 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:616 __vfs_write+0xdb/0x840 fs/read_write.c:480 vfs_write+0x150/0x4f0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb SOFTIRQ-ON-W at: mark_irqflags kernel/locking/lockdep.c:3090 [inline] __lock_acquire+0x6d9/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x25d/0x4f0 mm/hugetlb.c:3034 proc_sys_call_handler.isra.20+0x162/0x1f0 fs/proc/proc_sysctl.c:598 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:616 __vfs_write+0xdb/0x840 fs/read_write.c:480 vfs_write+0x150/0x4f0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb INITIAL USE at: __lock_acquire+0x701/0x42d0 kernel/locking/lockdep.c:3452 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x25d/0x4f0 mm/hugetlb.c:3034 proc_sys_call_handler.isra.20+0x162/0x1f0 fs/proc/proc_sysctl.c:598 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:616 __vfs_write+0xdb/0x840 fs/read_write.c:480 vfs_write+0x150/0x4f0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb } ... key at: [] hugetlb_lock+0x18/0x15e0 ... acquired at: check_irq_usage kernel/locking/lockdep.c:1697 [inline] check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline] check_prev_add kernel/locking/lockdep.c:1910 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x202a/0x42d0 kernel/locking/lockdep.c:3491 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page mm/hugetlb.c:1309 [inline] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1271 __put_compound_page+0x67/0xa0 mm/swap.c:95 __put_page+0x5d/0x280 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] __skb_frag_unref include/linux/skbuff.h:2829 [inline] skb_release_data+0x20d/0x820 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1425 [inline] tcp_write_queue_purge include/net/tcp.h:1631 [inline] tcp_v4_destroy_sock+0x223/0x970 net/ipv4/tcp_ipv4.c:1904 inet_csk_destroy_sock+0x146/0x3a0 net/ipv4/inet_connection_sock.c:866 tcp_close+0x7fa/0xef0 net/ipv4/tcp.c:2298 inet_release+0xd9/0x1c0 net/ipv4/af_inet.c:425 __sock_release+0xc2/0x2a0 net/socket.c:602 sock_close+0x10/0x20 net/socket.c:1139 __fput+0x232/0x740 fs/file_table.c:210 ____fput+0x9/0x10 fs/file_table.c:244 task_work_run+0xe5/0x170 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x98b/0x2c90 kernel/exit.c:868 do_group_exit+0xf8/0x2c0 kernel/exit.c:965 get_signal+0x2f6/0x1a90 kernel/signal.c:2423 do_signal+0x7f/0x18b0 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x11e/0x190 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb stack backtrace: CPU: 1 PID: 20125 Comm: syz-executor904 Not tainted 4.14.227-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1e7 lib/dump_stack.c:58 print_bad_irq_dependency kernel/locking/lockdep.c:1609 [inline] check_usage.cold.45+0x89b/0xd10 kernel/locking/lockdep.c:1641 check_irq_usage kernel/locking/lockdep.c:1697 [inline] check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline] check_prev_add kernel/locking/lockdep.c:1910 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x202a/0x42d0 kernel/locking/lockdep.c:3491 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page mm/hugetlb.c:1309 [inline] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1271 __put_compound_page+0x67/0xa0 mm/swap.c:95 __put_page+0x5d/0x280 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] __skb_frag_unref include/linux/skbuff.h:2829 [inline] skb_release_data+0x20d/0x820 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1425 [inline] tcp_write_queue_purge include/net/tcp.h:1631 [inline] tcp_v4_destroy_sock+0x223/0x970 net/ipv4/tcp_ipv4.c:1904 inet_csk_destroy_sock+0x146/0x3a0 net/ipv4/inet_connection_sock.c:866 tcp_close+0x7fa/0xef0 net/ipv4/tcp.c:2298 inet_release+0xd9/0x1c0 net/ipv4/af_inet.c:425 __sock_release+0xc2/0x2a0 net/socket.c:602 sock_close+0x10/0x20 net/socket.c:1139 __fput+0x232/0x740 fs/file_table.c:210 ____fput+0x9/0x10 fs/file_table.c:244 task_work_run+0xe5/0x170 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x98b/0x2c90 kernel/exit.c:868 do_group_exit+0xf8/0x2c0 kernel/exit.c:965 get_signal+0x2f6/0x1a90 kernel/signal.c:2423 do_signal+0x7f/0x18b0 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x11e/0x190 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x44d5e9 RSP: 002b:00007fde96b5f318 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00000000004cb408 RCX: 000000000044d5e9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000004cb408 RBP: 00000000004cb400 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000049b2c0 R13: 00007fff52a7971f R14: 00007fde96b5f400 R15: 0000000000022000 batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves