=============================
WARNING: suspicious RCU usage
4.14.154 #0 Not tainted
-----------------------------
include/linux/radix-tree.h:238 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syz-executor.1/18243:
#0: (&sb->s_type->i_mutex_key#12){+.+.}, at: [<ffffffff8177534e>] inode_lock include/linux/fs.h:718 [inline]
#0: (&sb->s_type->i_mutex_key#12){+.+.}, at: [<ffffffff8177534e>] shmem_add_seals+0x15e/0x1060 mm/shmem.c:2810
#1: (&(&mapping->tree_lock)->rlock){-.-.}, at: [<ffffffff81775524>] spin_lock_irq include/linux/spinlock.h:342 [inline]
#1: (&(&mapping->tree_lock)->rlock){-.-.}, at: [<ffffffff81775524>] shmem_tag_pins mm/shmem.c:2665 [inline]
#1: (&(&mapping->tree_lock)->rlock){-.-.}, at: [<ffffffff81775524>] shmem_wait_for_pins mm/shmem.c:2706 [inline]
#1: (&(&mapping->tree_lock)->rlock){-.-.}, at: [<ffffffff81775524>] shmem_add_seals+0x334/0x1060 mm/shmem.c:2822
stack backtrace:
CPU: 1 PID: 18243 Comm: syz-executor.1 Not tainted 4.14.154 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:4665
radix_tree_deref_slot include/linux/radix-tree.h:238 [inline]
radix_tree_deref_slot include/linux/radix-tree.h:236 [inline]
shmem_tag_pins mm/shmem.c:2667 [inline]
shmem_wait_for_pins mm/shmem.c:2706 [inline]
shmem_add_seals+0x9e0/0x1060 mm/shmem.c:2822
shmem_fcntl+0xf7/0x130 mm/shmem.c:2857
do_fcntl+0x190/0xe10 fs/fcntl.c:421
SYSC_fcntl fs/fcntl.c:463 [inline]
SyS_fcntl+0xd5/0x110 fs/fcntl.c:448
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a639
RSP: 002b:00007f7c2f38cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000048
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a639
RDX: 0000000000000008 RSI: 0000000000000409 RDI: 0000000000000005
RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7c2f38d6d4
R13: 00000000004c1068 R14: 00000000004d3c60 R15: 00000000ffffffff
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18321 comm=syz-executor.4
nla_parse: 2 callbacks suppressed
netlink: 2220 bytes leftover after parsing attributes in process `syz-executor.0'.
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0
syz-executor.2 invoked oom-killer: gfp_mask=0x14280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=1000
syz-executor.2 cpuset=syz2 mems_allowed=0-1
CPU: 0 PID: 18320 Comm: syz-executor.2 Not tainted 4.14.154 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
dump_header+0x177/0x6cd mm/oom_kill.c:422
oom_kill_process.cold+0x10/0xadd mm/oom_kill.c:861
out_of_memory mm/oom_kill.c:1084 [inline]
out_of_memory+0x2ee/0x1180 mm/oom_kill.c:1023
__alloc_pages_may_oom mm/page_alloc.c:3344 [inline]
__alloc_pages_slowpath+0x2251/0x2930 mm/page_alloc.c:4033
__alloc_pages_nodemask+0x62c/0x7a0 mm/page_alloc.c:4198
alloc_pages_vma+0xc9/0x4c0 mm/mempolicy.c:2077
alloc_zeroed_user_highpage_movable include/linux/highmem.h:184 [inline]
wp_page_copy+0xb13/0x1410 mm/memory.c:2497
do_wp_page+0x24b/0x12b0 mm/memory.c:2784
handle_pte_fault mm/memory.c:4005 [inline]
__handle_mm_fault+0x1d4a/0x3470 mm/memory.c:4113
handle_mm_fault+0x293/0x7c0 mm/memory.c:4150
__do_page_fault+0x4c1/0xb80 arch/x86/mm/fault.c:1420
do_page_fault+0x71/0x511 arch/x86/mm/fault.c:1495
page_fault+0x25/0x50 arch/x86/entry/entry_64.S:1122
RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 arch/x86/lib/copy_user_64.S:181
RSP: 0018:ffff8881f667fb30 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000500
RDX: 0000000000001000 RSI: ffff888200c70b00 RDI: 00000000201fd000
RBP: ffff8881f667fb60 R08: ffffed104018e200 R09: 0000000000000000
R10: ffffed104018e1ff R11: ffff888200c70fff R12: 00000000201fc500
R13: ffff888200c70000 R14: 00007ffffffff000 R15: 00000000201fd500
copy_page_to_iter_iovec lib/iov_iter.c:206 [inline]
copy_page_to_iter+0x31b/0xc40 lib/iov_iter.c:723
pipe_to_user+0xb0/0x160 fs/splice.c:1237
splice_from_pipe_feed fs/splice.c:502 [inline]
__splice_from_pipe+0x348/0x780 fs/splice.c:626
vmsplice_to_user+0x197/0x1c0 fs/splice.c:1272
SYSC_vmsplice fs/splice.c:1353 [inline]
SyS_vmsplice+0x131/0x160 fs/splice.c:1334
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a639
RSP: 002b:00007f7457e1cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a639
RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000004
RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7457e1d6d4
R13: 00000000004ca5cf R14: 00000000004e2600 R15: 00000000ffffffff
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18324 comm=syz-executor.4
Mem-Info:
active_anon:1338845 inactive_anon:1203 isolated_anon:0
active_file:271 inactive_file:341 isolated_file:45
unevictable:0 dirty:68 writeback:50 unstable:0
slab_reclaimable:14069 slab_unreclaimable:118767
mapped:52588 shmem:333 pagetables:22747 bounce:0
free:25087 free_pcp:235 free_cma:0
Node 0 active_anon:1919496kB inactive_anon:2568kB active_file:736kB inactive_file:1028kB unevictable:0kB isolated(anon):0kB isolated(file):180kB mapped:209924kB dirty:116kB writeback:140kB shmem:1280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 464896kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
Node 1 active_anon:3429784kB inactive_anon:2244kB active_file:348kB inactive_file:232kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:428kB dirty:156kB writeback:60kB shmem:52kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 98304kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
Node 0 DMA free:10476kB min:216kB low:268kB high:320kB active_anon:4484kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:32kB pagetables:12kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 2580 2580 2580
Node 0 DMA32 free:36388kB min:36468kB low:45584kB high:54700kB active_anon:1914892kB inactive_anon:2568kB active_file:780kB inactive_file:4184kB unevictable:0kB writepending:112kB present:3129332kB managed:2644872kB mlocked:0kB kernel_stack:11840kB pagetables:38504kB bounce:0kB free_pcp:880kB local_pcp:320kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0
Node 0 Normal free:0kB min:0kB low:0kB high:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0
lowmem_reserve[]: 0 0 0 0
Node 1 Normal free:56112kB min:53420kB low:66772kB high:80124kB active_anon:3424932kB inactive_anon:2244kB active_file:1848kB inactive_file:3212kB unevictable:0kB writepending:216kB present:3932160kB managed:3870204kB mlocked:0kB kernel_stack:19552kB pagetables:52308kB bounce:0kB free_pcp:272kB local_pcp:88kB free_cma:0kB
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=18317 comm=syz-executor.0
lowmem_reserve[]: 0 0 0 0
Node 0 DMA: 5*4kB (UMEH) 35*8kB (UMEH) 24*16kB (UMEH) 4*32kB (MH) 3*64kB (UME) 2*128kB (ME) 2*256kB (UE) 3*512kB (UME) 3*1024kB (UME) 2*2048kB (UE) 0*4096kB = 10476kB
Node 0 DMA32: 942*4kB (UME) 1045*8kB (UME) 742*16kB (UMEH) 303*32kB (UMH) 39*64kB (UME) 2*128kB (ME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 36448kB
Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
Node 1 Normal: 490*4kB (UME) 827*8kB (UMEH) 391*16kB (UMEH) 739*32kB (UMEH) 229*64kB (UMEH) 28*128kB (UMH) 17*256kB (UMH) 1*512kB (M) 1*1024kB (H) 0*2048kB 0*4096kB = 62608kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
1900 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
333233 pages reserved
0 pages cma reserved
Out of memory: Kill process 18302 (syz-executor.4) score 1007 or sacrifice child
udevd invoked oom-killer: gfp_mask=0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null), order=1, oom_score_adj=-1000
udevd cpuset=/ mems_allowed=0-1
CPU: 0 PID: 15399 Comm: udevd Not tainted 4.14.154 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
dump_header+0x177/0x6cd mm/oom_kill.c:422
oom_kill_process.cold+0x10/0xadd mm/oom_kill.c:861
out_of_memory mm/oom_kill.c:1084 [inline]
out_of_memory+0x2ee/0x1180 mm/oom_kill.c:1023
__alloc_pages_may_oom mm/page_alloc.c:3344 [inline]
__alloc_pages_slowpath+0x2251/0x2930 mm/page_alloc.c:4033
__alloc_pages_nodemask+0x62c/0x7a0 mm/page_alloc.c:4198
__alloc_pages include/linux/gfp.h:484 [inline]
__alloc_pages_node include/linux/gfp.h:497 [inline]
kmem_getpages mm/slab.c:1419 [inline]
cache_grow_begin+0x80/0x400 mm/slab.c:2676
fallback_alloc+0x1fd/0x2c0 mm/slab.c:3217
____cache_alloc_node+0x1be/0x1d0 mm/slab.c:3285
__do_cache_alloc mm/slab.c:3354 [inline]
slab_alloc mm/slab.c:3382 [inline]
kmem_cache_alloc+0x1f3/0x780 mm/slab.c:3550
getname_flags fs/namei.c:138 [inline]
getname_flags+0xcb/0x580 fs/namei.c:128
user_path_at_empty+0x2f/0x50 fs/namei.c:2630
SYSC_readlinkat fs/stat.c:394 [inline]
SyS_readlinkat fs/stat.c:382 [inline]
SYSC_readlink fs/stat.c:421 [inline]
SyS_readlink+0xb7/0x290 fs/stat.c:418
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f7d00e83577
RSP: 002b:00007fff0e44e5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000059
RAX: ffffffffffffffda RBX: 00000000024c4030 RCX: 00007f7d00e83577
RDX: 0000000000000400 RSI: 00007fff0e44e5c0 RDI: 00007fff0e44eaa0
RBP: 00007fff0e44f2e0 R08: 00007fff0e44f2e0 R09: 00007f7d00ed7dc0
R10: 7665642f7379732f R11: 0000000000000246 R12: 00007fff0e44eaa0
R13: 0000000000000400 R14: 00000000024c4030 R15: 00000000024fca00
Mem-Info:
active_anon:1339472 inactive_anon:1200 isolated_anon:0
active_file:22 inactive_file:17 isolated_file:0
unevictable:0 dirty:0 writeback:0 unstable:0
slab_reclaimable:14128 slab_unreclaimable:118672
mapped:52254 shmem:333 pagetables:22706 bounce:0
free:25470 free_pcp:63 free_cma:0
Node 0 active_anon:1923388kB inactive_anon:2568kB active_file:136kB inactive_file:232kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:208972kB dirty:0kB writeback:0kB shmem:1280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 464896kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
Node 1 active_anon:3434504kB inactive_anon:2232kB active_file:12kB inactive_file:120kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:52kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 98304kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
Node 0 DMA free:10492kB min:216kB low:268kB high:320kB active_anon:4484kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:32kB pagetables:12kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 2580 2580 2580
Node 0 DMA32 free:36876kB min:36468kB low:45584kB high:54700kB active_anon:1918904kB inactive_anon:2568kB active_file:148kB inactive_file:120kB unevictable:0kB writepending:0kB present:3129332kB managed:2644872kB mlocked:0kB kernel_stack:11840kB pagetables:38512kB bounce:0kB free_pcp:312kB local_pcp:76kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0
Node 0 Normal free:0kB min:0kB low:0kB high:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0
Node 1 Normal free:53920kB min:53420kB low:66772kB high:80124kB active_anon:3434504kB inactive_anon:2232kB active_file:0kB inactive_file:44kB unevictable:0kB writepending:0kB present:3932160kB managed:3870204kB mlocked:0kB kernel_stack:19488kB pagetables:52300kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0
Node 0 DMA: 5*4kB (UMEH) 37*8kB (UMEH) 24*16kB (UMEH) 4*32kB (MH) 3*64kB (UME) 2*128kB (ME) 2*256kB (UE) 3*512kB (UME) 3*1024kB (UME) 2*2048kB (UE) 0*4096kB = 10492kB
Node 0 DMA32: 1113*4kB (UME) 1062*8kB (UME) 740*16kB (UME) 301*32kB (UME) 38*64kB (UM) 2*128kB (ME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 37108kB
Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
Node 1 Normal: 104*4kB (UME) 654*8kB (UMEH) 279*16kB (UMEH) 708*32kB (UMEH) 215*64kB (UMEH) 15*128kB (UMH) 16*256kB (UMH) 1*512kB (M) 1*1024kB (H) 0*2048kB 0*4096kB = 54080kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
605 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
333233 pages reserved
0 pages cma reserved
Out of memory: Kill process 23920 (syz-executor.2) score 1007 or sacrifice child
Killed process 23920 (syz-executor.2) total-vm:73512kB, anon-rss:16612kB, file-rss:34816kB, shmem-rss:0kB
selinux_nlmsg_perm: 9 callbacks suppressed
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18411 comm=syz-executor.4
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18410 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18424 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=37500 sclass=netlink_route_socket pig=18425 comm=syz-executor.5