------------[ cut here ]------------ WARNING: CPU: 3 PID: 7572 at kernel/sched/fair.c:5479 set_next_entity+0x6c2/0x9f0 kernel/sched/fair.c:5479 Modules linked in: CPU: 3 UID: 0 PID: 7572 Comm: syz-executor.3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:set_next_entity+0x6c2/0x9f0 kernel/sched/fair.c:5479 Code: fc ff df 4c 89 f2 48 c1 ea 03 80 3c 02 00 0f 85 fb 02 00 00 49 8b bc 24 78 01 00 00 48 89 da e8 e4 19 08 00 e9 bc fc ff ff 90 <0f> 0b 90 e9 00 fb ff ff 90 0f 0b 90 e9 84 fa ff ff 48 c7 c3 ff ff RSP: 0018:ffffc9000685f470 EFLAGS: 00010086 RAX: dffffc0000000000 RBX: 00000011de672a95 RCX: 1ffffffff2156e4c RDX: 1ffff1100d487483 RSI: ffff88803254c400 RDI: ffff88803254c458 RBP: ffff88803254c400 R08: 1ffff1100d4e7482 R09: fffffbfff2156812 R10: ffffffff90ab4097 R11: 0000000000000001 R12: ffff88806a43a3c0 R13: ffff88806a43a418 R14: ffff88806a43a538 R15: 0000000000000001 FS: 00007f0fb03be6c0(0000) GS:ffff8880d69bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020adc000 CR3: 0000000033d88000 CR4: 0000000000352ef0 Call Trace: set_next_task_fair+0x59/0x350 kernel/sched/fair.c:13216 put_prev_set_next_task kernel/sched/sched.h:2475 [inline] pick_next_task kernel/sched/core.c:6296 [inline] __schedule+0x16b0/0x5de0 kernel/sched/core.c:6902 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:7145 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12 count_memcg_events+0x40c/0x4f0 mm/memcontrol.c:848 count_memcg_events_mm include/linux/memcontrol.h:980 [inline] count_memcg_event_mm include/linux/memcontrol.h:987 [inline] mm_account_fault mm/memory.c:6229 [inline] handle_mm_fault+0x27b/0xd10 mm/memory.c:6390 do_user_addr_fault+0x7a6/0x1370 arch/x86/mm/fault.c:1387 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x5c/0xb0 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] RIP: 0010:raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] RIP: 0010:copy_to_user_iter lib/iov_iter.c:25 [inline] RIP: 0010:iterate_iovec include/linux/iov_iter.h:52 [inline] RIP: 0010:iterate_and_advance2 include/linux/iov_iter.h:302 [inline] RIP: 0010:iterate_and_advance include/linux/iov_iter.h:328 [inline] RIP: 0010:_copy_to_iter+0x4e6/0x16f0 lib/iov_iter.c:185 Code: 45 e8 3e 98 d9 fc 48 8b 4c 24 18 48 8b 44 24 28 89 ee 4c 8d 34 01 4c 89 f7 e8 96 f6 3f fd 0f 01 cb 48 89 e9 4c 89 ff 4c 89 f6 a4 0f 1f 00 0f 01 ca 48 89 e8 48 29 eb 48 29 c8 48 01 44 24 28 RSP: 0018:ffffc9000685f950 EFLAGS: 00050246 RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000e80 RDX: 0000000000000000 RSI: ffff888013da3180 RDI: 0000000020adc000 RBP: 0000000000001000 R08: 0000000000000000 R09: ffffed10027b47ff R10: ffff888013da3fff R11: 0000000000000000 R12: 0000000000adbb80 R13: ffffc9000685fd50 R14: ffff888013da3000 R15: 0000000020adbe80 copy_page_to_iter lib/iov_iter.c:362 [inline] copy_page_to_iter+0x12a/0x1e0 lib/iov_iter.c:349 process_vm_rw_pages mm/process_vm_access.c:45 [inline] process_vm_rw_single_vec mm/process_vm_access.c:118 [inline] process_vm_rw_core.constprop.0+0x5ad/0x970 mm/process_vm_access.c:216 process_vm_rw+0x2ff/0x360 mm/process_vm_access.c:284 __do_sys_process_vm_readv mm/process_vm_access.c:296 [inline] __se_sys_process_vm_readv mm/process_vm_access.c:292 [inline] __x64_sys_process_vm_readv+0xe2/0x1c0 mm/process_vm_access.c:292 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0faf67cae9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0fb03be0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000136 RAX: ffffffffffffffda RBX: 00007f0faf79bf80 RCX: 00007f0faf67cae9 RDX: 0000000000000002 RSI: 0000000020008400 RDI: 0000000000000153 RBP: 00007f0faf6c847a R08: 0000000000000286 R09: 0000000000000000 R10: 0000000020008640 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f0faf79bf80 R15: 00007fff9ada35d8 ---------------- Code disassembly (best guess): 0: 45 e8 3e 98 d9 fc rex.RB call 0xfcd99844 6: 48 8b 4c 24 18 mov 0x18(%rsp),%rcx b: 48 8b 44 24 28 mov 0x28(%rsp),%rax 10: 89 ee mov %ebp,%esi 12: 4c 8d 34 01 lea (%rcx,%rax,1),%r14 16: 4c 89 f7 mov %r14,%rdi 19: e8 96 f6 3f fd call 0xfd3ff6b4 1e: 0f 01 cb stac 21: 48 89 e9 mov %rbp,%rcx 24: 4c 89 ff mov %r15,%rdi 27: 4c 89 f6 mov %r14,%rsi * 2a: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi) <-- trapping instruction 2c: 0f 1f 00 nopl (%rax) 2f: 0f 01 ca clac 32: 48 89 e8 mov %rbp,%rax 35: 48 29 eb sub %rbp,%rbx 38: 48 29 c8 sub %rcx,%rax 3b: 48 01 44 24 28 add %rax,0x28(%rsp)