bisecting fixing commit since 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae building syzkaller on 04201c0669446145fd9c347c5538da0ca13ff29b testing commit 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae with gcc (GCC) 8.4.1 20210217 kernel signature: 3758804e4350df3c17cba112e40da29c08615596b7f82b43453954aa893c315b all runs: crashed: inconsistent lock state in free_huge_page testing current HEAD 7d7d1c0ab3eb7c8d8f63a126535018007823b207 testing commit 7d7d1c0ab3eb7c8d8f63a126535018007823b207 with gcc (GCC) 8.4.1 20210217 kernel signature: 57339d9bb28f7fb330498358bdcddd5cbe77d2f66bafecbcc55c8ea2ff2a4c74 all runs: crashed: inconsistent lock state in free_huge_page revisions tested: 2, total time: 26m15.248607603s (build: 18m58.345371072s, test: 6m40.073702218s) the crash still happens on HEAD commit msg: Linux 4.14.232 crash: inconsistent lock state in free_huge_page IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 ================================ WARNING: inconsistent lock state 4.14.232-syzkaller #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. syz-executor.5/8330 [HC1[1]:SC1[1]:HE0:SE0] takes: (hugetlb_lock){?.+.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] (hugetlb_lock){?.+.}, at: [] free_huge_page mm/hugetlb.c:1309 [inline] (hugetlb_lock){?.+.}, at: [] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1271 {HARDIRQ-ON-W} state was registered at: mark_irqflags kernel/locking/lockdep.c:3086 [inline] __lock_acquire+0xef4/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x25d/0x4f0 mm/hugetlb.c:3034 proc_sys_call_handler.isra.20+0x162/0x1f0 fs/proc/proc_sysctl.c:598 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:616 __vfs_write+0xdb/0x840 fs/read_write.c:480 vfs_write+0x150/0x4f0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb irq event stamp: 136555 hardirqs last enabled at (136554): [] __do_softirq+0x1e1/0x9a2 kernel/softirq.c:272 hardirqs last disabled at (136555): [] common_interrupt+0x95/0x9a arch/x86/entry/entry_64.S:576 softirqs last enabled at (136544): [] pppoe_flush_dev drivers/net/ppp/pppoe.c:334 [inline] softirqs last enabled at (136544): [] pppoe_device_event+0x1fd/0x640 drivers/net/ppp/pppoe.c:353 softirqs last disabled at (136553): [] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (136553): [] irq_exit+0x15f/0x1a0 kernel/softirq.c:409 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(hugetlb_lock); lock(hugetlb_lock); *** DEADLOCK *** 4 locks held by syz-executor.5/8330: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 #1: (rcu_read_lock){....}, at: [] batadv_check_known_mac_addr+0x0/0x3e0 #2: (console_lock){+.+.}, at: [] console_trylock_spinning kernel/printk/printk.c:1650 [inline] #2: (console_lock){+.+.}, at: [] vprintk_emit+0x1ab/0x4e0 kernel/printk/printk.c:1922 #3: (&(&virtscsi_vq->vq_lock)->rlock){-.-.}, at: [] virtscsi_vq_done+0x8d/0x120 drivers/scsi/virtio_scsi.c:219 stack backtrace: CPU: 1 PID: 8330 Comm: syz-executor.5 Not tainted 4.14.232-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1e7 lib/dump_stack.c:58 print_usage_bug.cold.46+0x433/0x563 kernel/locking/lockdep.c:2589 valid_state kernel/locking/lockdep.c:2602 [inline] mark_lock_irq kernel/locking/lockdep.c:2796 [inline] mark_lock+0xc00/0x11a0 kernel/locking/lockdep.c:3194 mark_irqflags kernel/locking/lockdep.c:3069 [inline] __lock_acquire+0x1214/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page mm/hugetlb.c:1309 [inline] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1271 __put_compound_page+0x67/0xa0 mm/swap.c:95 __put_page+0x5d/0x280 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] bio_check_pages_dirty+0x24d/0x470 block/bio.c:1794 dio_bio_complete+0x3d9/0x690 fs/direct-io.c:553 dio_bio_end_aio+0x41/0x430 fs/direct-io.c:358 bio_endio.part.11+0x245/0x5d0 block/bio.c:1918 bio_endio+0x9/0x10 block/bio.c:1888 req_bio_endio block/blk-core.c:204 [inline] blk_update_request+0x284/0x9b0 block/blk-core.c:2765 scsi_end_request+0x74/0x940 drivers/scsi/scsi_lib.c:659 scsi_io_completion+0x99b/0x18c0 drivers/scsi/scsi_lib.c:885 scsi_finish_command+0x39d/0x560 drivers/scsi/scsi.c:248 scsi_softirq_done+0x2b2/0x360 drivers/scsi/scsi_lib.c:1671 __blk_mq_complete_request+0x2c6/0x640 block/blk-mq.c:571 blk_mq_complete_request+0x44/0x50 block/blk-mq.c:591 scsi_mq_done+0x61/0x260 drivers/scsi/scsi_lib.c:1979 virtscsi_complete_cmd+0x4eb/0x8d0 drivers/scsi/virtio_scsi.c:207 virtscsi_vq_done+0xa7/0x120 drivers/scsi/virtio_scsi.c:223 virtscsi_req_done+0xa1/0xc0 drivers/scsi/virtio_scsi.c:238 vring_interrupt+0x100/0x1c0 drivers/virtio/virtio_ring.c:954 __handle_irq_event_percpu+0xdc/0x6c0 kernel/irq/handle.c:147 handle_irq_event_percpu+0x64/0x120 kernel/irq/handle.c:187 handle_irq_event+0xa2/0x130 kernel/irq/handle.c:204 handle_edge_irq+0x206/0x780 kernel/irq/chip.c:770 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x37/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x98/0x1d0 arch/x86/kernel/irq.c:230 common_interrupt+0x9a/0x9a arch/x86/entry/entry_64.S:576 RIP: 0010:ffs arch/x86/include/asm/bitops.h:427 [inline] RIP: 0010:__do_softirq+0x20c/0x9a2 kernel/softirq.c:276 RSP: 0018:ffff8880ba707f28 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff6e RAX: 1ffffffff11e10c3 RBX: ffff88809065c280 RCX: 1ffff110120cb96f RDX: 0000000000000000 RSI: ffff88809065cb58 RDI: ffff88809065cb04 RBP: ffff8880ba707f98 R08: ffff88809065cb78 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x15f/0x1a0 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x149/0x5d0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:console_unlock+0xabf/0xe50 kernel/printk/printk.c:2408 RSP: 0018:ffff8880aa5bee98 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e10c1 RBX: 0000000000000200 RCX: 1ffff110120cb96f RDX: 0000000000000000 RSI: ffff88809065cb58 RDI: 0000000000000286 RBP: ffff8880aa5bef10 R08: ffff88809065cb78 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffffffff8961e5a0 R15: ffffffff8961e570 vprintk_emit+0x32f/0x4e0 kernel/printk/printk.c:1923 vprintk_default+0x1a/0x20 kernel/printk/printk.c:1963 vprintk_func+0x49/0x130 kernel/printk/printk_safe.c:409 printk+0x91/0xab kernel/printk/printk.c:1996 batadv_check_known_mac_addr.cold.7+0x17/0x30 net/batman-adv/hard-interface.c:520 batadv_hard_if_event+0x1c7/0xda0 net/batman-adv/hard-interface.c:1030 notifier_call_chain+0xd6/0x150 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401 call_netdevice_notifiers_info+0x4b/0x60 net/core/dev.c:1667 call_netdevice_notifiers net/core/dev.c:1683 [inline] dev_set_mac_address net/core/dev.c:6962 [inline] dev_set_mac_address+0x1b8/0x2f0 net/core/dev.c:6947 do_setlink+0x5d9/0x2c80 net/core/rtnetlink.c:2047 rtnl_newlink+0xefd/0x1630 net/core/rtnetlink.c:2660 rtnetlink_rcv_msg+0x34c/0x9e0 net/core/rtnetlink.c:4316 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:4328 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x639/0xbe0 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1e4/0x2c0 net/socket.c:1731 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x418eec RSP: 002b:00007ffc071e27d0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000001494320 RCX: 0000000000418eec RDX: 000000000000002c RSI: 0000000001494370 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffc071e2814 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000001494370 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 device veth1_vlan entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready device veth0_vlan entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready device veth1_vlan entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready device veth0_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready device veth1_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready device veth0_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready Bluetooth: hci0 command 0x0419 tx timeout Bluetooth: hci4 command 0x0419 tx timeout Bluetooth: hci3 command 0x0419 tx timeout Bluetooth: hci1 command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready Bluetooth: hci5 command 0x0419 tx timeout device veth1_macvtap entered promiscuous mode Bluetooth: hci2 command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_0 IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_0 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready