================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz-executor/2985 [HC0[0]:SC1[1]:HE0:SE0] takes: ffffffff89aba480 (fs_reclaim){+.?.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline] ffffffff89aba480 (fs_reclaim){+.?.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4636 [inline] ffffffff89aba480 (fs_reclaim){+.?.}-{0:0}, at: slab_alloc_node mm/slub.c:4974 [inline] ffffffff89aba480 (fs_reclaim){+.?.}-{0:0}, at: __do_kmalloc_node mm/slub.c:5413 [inline] ffffffff89aba480 (fs_reclaim){+.?.}-{0:0}, at: __kmalloc_node_track_caller_noprof+0xcc/0x820 mm/slub.c:5545 {SOFTIRQ-ON-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline] fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389 might_alloc include/linux/sched/mm.h:316 [inline] xa_alloc include/linux/xarray.h:876 [inline] mem_cgroup_alloc mm/memcontrol.c:4160 [inline] mem_cgroup_css_alloc+0x7e/0x1ce0 mm/memcontrol.c:4225 cgroup_init_subsys+0x223/0x700 kernel/cgroup/cgroup.c:6434 cgroup_init+0x569/0xe50 kernel/cgroup/cgroup.c:6561 start_kernel+0x470/0x490 init/main.c:1181 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x158 irq event stamp: 1434599 hardirqs last enabled at (1434598): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (1434598): [] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:221 hardirqs last disabled at (1434599): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:153 [inline] hardirqs last disabled at (1434599): [] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:181 softirqs last enabled at (1434592): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last enabled at (1434592): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last enabled at (1434592): [] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 softirqs last disabled at (1434595): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last disabled at (1434595): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last disabled at (1434595): [] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(fs_reclaim); lock(fs_reclaim); *** DEADLOCK *** locks held by syz-executor/2985: 7, last CPU#0: #0: ffffffff89a33c70 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline] #0: ffffffff89a33c70 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline] #0: ffffffff89a33c70 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x4b13/0x8110 kernel/fork.c:2311 #1: ffff88810ffb4b40 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #1: ffff88810ffb4b40 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2150 mm/mmap.c:1716 #2: ffff88810e6bbf40 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline] #2: ffff88810e6bbf40 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2150 mm/mmap.c:1723 #3: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 mm/pgtable-generic.c:290 #4: ffff888135ff1858 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #4: ffff888135ff1858 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 mm/pgtable-generic.c:404 #5: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #5: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #5: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 mm/pgtable-generic.c:290 #6: ffff888130b1f4f8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1354 [inline] #6: ffff888130b1f4f8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range mm/memory.c:1490 [inline] #6: ffff888130b1f4f8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pud_range mm/memory.c:1527 [inline] #6: ffff888130b1f4f8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_p4d_range mm/memory.c:1551 [inline] #6: ffff888130b1f4f8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_page_range+0xd57/0x5630 mm/memory.c:1637 stack backtrace: CPU: 0 UID: 0 PID: 2985 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_usage_bug.part.0+0x258/0x340 kernel/locking/lockdep.c:4086 print_usage_bug kernel/locking/lockdep.c:4054 [inline] valid_state kernel/locking/lockdep.c:4100 [inline] mark_lock_irq kernel/locking/lockdep.c:4311 [inline] mark_lock+0x956/0x1020 kernel/locking/lockdep.c:4797 mark_usage kernel/locking/lockdep.c:4686 [inline] __lock_acquire+0x7f1/0x1f40 kernel/locking/lockdep.c:5242 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline] fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389 might_alloc include/linux/sched/mm.h:316 [inline] slab_pre_alloc_hook mm/slub.c:4636 [inline] slab_alloc_node mm/slub.c:4974 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_node_track_caller_noprof+0xcc/0x820 mm/slub.c:5545 alloc_dr drivers/base/devres.c:141 [inline] devm_kmalloc+0xa5/0x2b0 drivers/base/devres.c:951 devm_kzalloc include/linux/device/devres.h:50 [inline] mt_allocate_report_data+0x59/0xcc0 drivers/hid/hid-multitouch.c:714 mt_find_report_data drivers/hid/hid-multitouch.c:764 [inline] mt_event+0x1bf/0x270 drivers/hid/hid-multitouch.c:1589 hid_process_event+0x37d/0x5a0 drivers/hid/hid-core.c:1572 hid_process_report drivers/hid/hid-core.c:1730 [inline] hid_report_raw_event+0xb14/0x14c0 drivers/hid/hid-core.c:2109 __hid_input_report.constprop.0+0x349/0x470 drivers/hid/hid-core.c:2180 hid_ctrl+0x4a4/0x560 drivers/hid/usbhid/hid-core.c:486 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xdaf/0x3820 drivers/usb/gadget/udc/dummy_hcd.c:2023 __run_hrtimer kernel/time/hrtimer.c:2074 [inline] __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__folio_dup_file_rmap include/linux/rmap.h:503 [inline] RIP: 0010:folio_dup_file_rmap_pte include/linux/rmap.h:544 [inline] RIP: 0010:copy_present_ptes mm/memory.c:1274 [inline] RIP: 0010:copy_pte_range mm/memory.c:1402 [inline] RIP: 0010:copy_pmd_range mm/memory.c:1490 [inline] RIP: 0010:copy_pud_range mm/memory.c:1527 [inline] RIP: 0010:copy_p4d_range mm/memory.c:1551 [inline] RIP: 0010:copy_page_range+0x2664/0x5630 mm/memory.c:1637 Code: b2 ee a9 ff 45 85 ed 0f 85 30 eb ff ff e8 34 f4 a9 ff 48 c7 c6 a0 97 ba 87 48 89 df e8 95 10 fc ff 90 0f 0b 90 e9 13 eb ff ff 17 f4 a9 ff 48 8b bc 24 e8 00 00 00 be 04 00 00 00 e8 d5 2c 15 RSP: 0018:ffffc900005c7560 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffea0004c9a980 RCX: ffffffff820b1c2c RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff888111b33c80 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffffea0004c9a980 R13: 0000000000000000 R14: 0000000000007b99 R15: dffffc0000000000 dup_mmap+0x1205/0x2150 mm/mmap.c:1819 dup_mm kernel/fork.c:1543 [inline] copy_mm kernel/fork.c:1595 [inline] copy_process+0x4b1e/0x8110 kernel/fork.c:2311 kernel_clone+0x176/0x9d0 kernel/fork.c:2771 __do_sys_clone+0xd9/0x120 kernel/fork.c:2913 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f19b6c76c12 Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 RSP: 002b:00007ffe26ff9710 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007ffe26ff9710 RCX: 00007f19b6c76c12 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 00007ffe26ff989c R08: 0000000000000000 R09: 0000000000000001 R10: 00005555747677d0 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000002a R14: 000000000007658b R15: 00007ffe26ff98f0 BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:322 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 2985, name: syz-executor preempt_count: 102, expected: 0 RCU nest depth: 2, expected: 0 INFO: lockdep is turned off. irq event stamp: 1434599 hardirqs last enabled at (1434598): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (1434598): [] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:221 hardirqs last disabled at (1434599): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:153 [inline] hardirqs last disabled at (1434599): [] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:181 softirqs last enabled at (1434592): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last enabled at (1434592): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last enabled at (1434592): [] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 softirqs last disabled at (1434595): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last disabled at (1434595): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last disabled at (1434595): [] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 0 UID: 0 PID: 2985 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9264 might_alloc include/linux/sched/mm.h:322 [inline] slab_pre_alloc_hook mm/slub.c:4636 [inline] slab_alloc_node mm/slub.c:4974 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_node_track_caller_noprof+0x473/0x820 mm/slub.c:5545 alloc_dr drivers/base/devres.c:141 [inline] devm_kmalloc+0xa5/0x2b0 drivers/base/devres.c:951 devm_kzalloc include/linux/device/devres.h:50 [inline] mt_allocate_report_data+0x59/0xcc0 drivers/hid/hid-multitouch.c:714 mt_find_report_data drivers/hid/hid-multitouch.c:764 [inline] mt_event+0x1bf/0x270 drivers/hid/hid-multitouch.c:1589 hid_process_event+0x37d/0x5a0 drivers/hid/hid-core.c:1572 hid_process_report drivers/hid/hid-core.c:1730 [inline] hid_report_raw_event+0xb14/0x14c0 drivers/hid/hid-core.c:2109 __hid_input_report.constprop.0+0x349/0x470 drivers/hid/hid-core.c:2180 hid_ctrl+0x4a4/0x560 drivers/hid/usbhid/hid-core.c:486 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xdaf/0x3820 drivers/usb/gadget/udc/dummy_hcd.c:2023 __run_hrtimer kernel/time/hrtimer.c:2074 [inline] __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__folio_dup_file_rmap include/linux/rmap.h:503 [inline] RIP: 0010:folio_dup_file_rmap_pte include/linux/rmap.h:544 [inline] RIP: 0010:copy_present_ptes mm/memory.c:1274 [inline] RIP: 0010:copy_pte_range mm/memory.c:1402 [inline] RIP: 0010:copy_pmd_range mm/memory.c:1490 [inline] RIP: 0010:copy_pud_range mm/memory.c:1527 [inline] RIP: 0010:copy_p4d_range mm/memory.c:1551 [inline] RIP: 0010:copy_page_range+0x2664/0x5630 mm/memory.c:1637 Code: b2 ee a9 ff 45 85 ed 0f 85 30 eb ff ff e8 34 f4 a9 ff 48 c7 c6 a0 97 ba 87 48 89 df e8 95 10 fc ff 90 0f 0b 90 e9 13 eb ff ff 17 f4 a9 ff 48 8b bc 24 e8 00 00 00 be 04 00 00 00 e8 d5 2c 15 RSP: 0018:ffffc900005c7560 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffea0004c9a980 RCX: ffffffff820b1c2c RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff888111b33c80 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffffea0004c9a980 R13: 0000000000000000 R14: 0000000000007b99 R15: dffffc0000000000 dup_mmap+0x1205/0x2150 mm/mmap.c:1819 dup_mm kernel/fork.c:1543 [inline] copy_mm kernel/fork.c:1595 [inline] copy_process+0x4b1e/0x8110 kernel/fork.c:2311 kernel_clone+0x176/0x9d0 kernel/fork.c:2771 __do_sys_clone+0xd9/0x120 kernel/fork.c:2913 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f19b6c76c12 Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 RSP: 002b:00007ffe26ff9710 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007ffe26ff9710 RCX: 00007f19b6c76c12 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 00007ffe26ff989c R08: 0000000000000000 R09: 0000000000000001 R10: 00005555747677d0 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000002a R14: 000000000007658b R15: 00007ffe26ff98f0 ---------------- Code disassembly (best guess): 0: b2 ee mov $0xee,%dl 2: a9 ff 45 85 ed test $0xed8545ff,%eax 7: 0f 85 30 eb ff ff jne 0xffffeb3d d: e8 34 f4 a9 ff call 0xffa9f446 12: 48 c7 c6 a0 97 ba 87 mov $0xffffffff87ba97a0,%rsi 19: 48 89 df mov %rbx,%rdi 1c: e8 95 10 fc ff call 0xfffc10b6 21: 90 nop 22: 0f 0b ud2 24: 90 nop 25: e9 13 eb ff ff jmp 0xffffeb3d * 2a: e8 17 f4 a9 ff call 0xffa9f446 <-- trapping instruction 2f: 48 8b bc 24 e8 00 00 mov 0xe8(%rsp),%rdi 36: 00 37: be 04 00 00 00 mov $0x4,%esi 3c: e8 .byte 0xe8 3d: d5 rex2 3e: 2c 15 sub $0x15,%al