bisecting fixing commit since 97a8651cadce7c2b7c4d8f108b392eff31fe2c08 building syzkaller on 77e2b66864e69c17416614228723a1ebd3581ddc testing commit 97a8651cadce7c2b7c4d8f108b392eff31fe2c08 with gcc (GCC) 8.4.1 20210217 kernel signature: b6721c022852128910687b6b15795a629037c5f942801715d90ca89c40b9c582 all runs: crashed: inconsistent lock state in free_huge_page testing current HEAD 6b7b0056defc6eb5c87bbe4690ccda547b2891aa testing commit 6b7b0056defc6eb5c87bbe4690ccda547b2891aa with gcc (GCC) 8.4.1 20210217 kernel signature: 06ca05389f5ecc6102f5df37e0cea41eba7be3990ddae82a4f891a362da1c0e5 all runs: crashed: inconsistent lock state in free_huge_page revisions tested: 2, total time: 30m22.765663345s (build: 20m31.332693985s, test: 9m20.712242446s) the crash still happens on HEAD commit msg: Linux 4.19.192 crash: inconsistent lock state in free_huge_page ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22 ================================ WARNING: inconsistent lock state 4.19.192-syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. ksoftirqd/1/18 [HC0[0]:SC1[1]:HE1:SE0] takes: 00000000afb446ca (hugetlb_lock){+.?.}, at: spin_lock include/linux/spinlock.h:329 [inline] 00000000afb446ca (hugetlb_lock){+.?.}, at: free_huge_page mm/hugetlb.c:1301 [inline] 00000000afb446ca (hugetlb_lock){+.?.}, at: free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1263 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3048 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe irq event stamp: 2249746 hardirqs last enabled at (2249746): [] seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline] hardirqs last enabled at (2249746): [] read_seqcount_begin include/linux/seqlock.h:164 [inline] hardirqs last enabled at (2249746): [] read_seqbegin include/linux/seqlock.h:440 [inline] hardirqs last enabled at (2249746): [] zone_span_seqbegin include/linux/memory_hotplug.h:65 [inline] hardirqs last enabled at (2249746): [] page_outside_zone_boundaries mm/page_alloc.c:491 [inline] hardirqs last enabled at (2249746): [] bad_range+0x26c/0x3b0 mm/page_alloc.c:520 hardirqs last disabled at (2249745): [] seqcount_lockdep_reader_access include/linux/seqlock.h:80 [inline] hardirqs last disabled at (2249745): [] read_seqcount_begin include/linux/seqlock.h:164 [inline] hardirqs last disabled at (2249745): [] read_seqbegin include/linux/seqlock.h:440 [inline] hardirqs last disabled at (2249745): [] zone_span_seqbegin include/linux/memory_hotplug.h:65 [inline] hardirqs last disabled at (2249745): [] page_outside_zone_boundaries mm/page_alloc.c:491 [inline] hardirqs last disabled at (2249745): [] bad_range+0xa0/0x3b0 mm/page_alloc.c:520 softirqs last enabled at (2249722): [] __do_softirq+0x62d/0x919 kernel/softirq.c:318 softirqs last disabled at (2249727): [] run_ksoftirqd+0x5e/0x100 kernel/softirq.c:653 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(hugetlb_lock); lock(hugetlb_lock); *** DEADLOCK *** 1 lock held by ksoftirqd/1/18: #0: 000000004e4f13b9 (rcu_read_lock){....}, at: __write_once_size include/linux/compiler.h:288 [inline] #0: 000000004e4f13b9 (rcu_read_lock){....}, at: __skb_unlink include/linux/skbuff.h:1920 [inline] #0: 000000004e4f13b9 (rcu_read_lock){....}, at: __skb_dequeue include/linux/skbuff.h:1936 [inline] #0: 000000004e4f13b9 (rcu_read_lock){....}, at: process_backlog+0x1d9/0x710 net/core/dev.c:5846 stack backtrace: CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.19.192-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 print_usage_bug.cold.38+0x433/0x563 kernel/locking/lockdep.c:2545 valid_state kernel/locking/lockdep.c:2558 [inline] mark_lock_irq kernel/locking/lockdep.c:2752 [inline] mark_lock+0xd44/0x12f0 kernel/locking/lockdep.c:3132 mark_irqflags kernel/locking/lockdep.c:3010 [inline] __lock_acquire+0x131d/0x47c0 kernel/locking/lockdep.c:3373 lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] free_huge_page mm/hugetlb.c:1301 [inline] free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1263 __put_compound_page+0x65/0xa0 mm/swap.c:96 __put_page+0x5d/0x290 mm/swap.c:112 put_page include/linux/mm.h:963 [inline] __skb_frag_unref include/linux/skbuff.h:2833 [inline] skb_frag_unref include/linux/skbuff.h:2845 [inline] skb_copy_ubufs+0xd9b/0x14b0 net/core/skbuff.c:1245 skb_orphan_frags_rx include/linux/skbuff.h:2638 [inline] __netif_receive_skb_core+0x1a9e/0x35a0 net/core/dev.c:4919 __netif_receive_skb_one_core+0xb6/0x1a0 net/core/dev.c:4952 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5066 process_backlog+0x220/0x710 net/core/dev.c:5848 napi_poll net/core/dev.c:6272 [inline] net_rx_action+0x454/0xe30 net/core/dev.c:6338 __do_softirq+0x25f/0x919 kernel/softirq.c:292 run_ksoftirqd+0x5e/0x100 kernel/softirq.c:653 smpboot_thread_fn+0x55f/0x8a0 kernel/smpboot.c:164 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415