INFO: rcu detected stall in ndisc_alloc_skb

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: ef4ab8447aa2 selftests: bpf: install script with_addr.sh
git tree: bpf-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14a28b6e400000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e7e2279c0020d5f
dashboard link: https://syzkaller.appspot.com/bug?extid=ea7d9cb314b4ab49a18a
compiler: gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ea7d9c...@syzkaller.appspotmail.com

CPU: 1 PID: 5702 Comm: rsyslogd Not tainted 4.19.0-rc6+ #118
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
rcu: (detected by 0, t=10712 jiffies, g=90369, q=135)
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
rcu: All QSes seen, last rcu_preempt kthread activity 10548
(4295003843-4294993295), jiffies_till_next_fqs=1, root ->qsmask 0x0
syz-executor0 R
running task
warn_alloc.cold.119+0xb7/0x1bd mm/page_alloc.c:3426
22896 7592 5826 0x8010000c
Call Trace:
<IRQ>
sched_show_task.cold.83+0x2b6/0x30a kernel/sched/core.c:5296
__alloc_pages_slowpath+0x2667/0x2d80 mm/page_alloc.c:4297
print_other_cpu_stall.cold.79+0xa83/0xba5 kernel/rcu/tree.c:1430
check_cpu_stall kernel/rcu/tree.c:1557 [inline]
__rcu_pending kernel/rcu/tree.c:3276 [inline]
rcu_pending kernel/rcu/tree.c:3319 [inline]
rcu_check_callbacks+0xafc/0x1990 kernel/rcu/tree.c:2665
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
slab_alloc_node mm/slab.c:3327 [inline]
kmem_cache_alloc_node+0xe3/0x730 mm/slab.c:3642
__alloc_skb+0x119/0x770 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:997 [inline]
ndisc_alloc_skb+0x144/0x340 net/ipv6/ndisc.c:403
ndisc_send_rs+0x331/0x6e0 net/ipv6/ndisc.c:669
update_process_times+0x2d/0x70 kernel/time/timer.c:1636
addrconf_rs_timer+0x314/0x690 net/ipv6/addrconf.c:3836
tick_sched_handle+0x9f/0x180 kernel/time/tick-sched.c:164
tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1274
__run_hrtimer kernel/time/hrtimer.c:1398 [inline]
__hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1460
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1518
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1029 [inline]
smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1054
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788
[inline]
RIP: 0010:slab_alloc_node mm/slab.c:3329 [inline]
RIP: 0010:kmem_cache_alloc_node+0x247/0x730 mm/slab.c:3642
Code: 3f 7e 0f 85 32 ff ff ff e8 a5 7f 3e ff e9 28 ff ff ff e8 0c e3 c2 ff
48 83 3d 5c f4 6f 07 00 0f 84 33 01 00 00 4c 89 ff 57 9d <0f> 1f 44 00 00
e9 bf fe ff ff 31 d2 be a5 01 00 00 48 c7 c7 62 23
RSP: 0000:ffff8801dae07450 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 0000000000480020 RCX: ffffffff8184e1ca
RDX: 0000000000000004 RSI: ffffffff8184e1e4 RDI: 0000000000000286
RBP: ffff8801dae074c0 R08: ffff880193c38700 R09: fffffbfff12812c4
R10: ffff8801dae06098 R11: ffffffff89409623 R12: ffff8801d9a04040
R13: ffff8801d9a04040 R14: 0000000000000000 R15: 0000000000000286
__alloc_skb+0x119/0x770 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:997 [inline]
ndisc_alloc_skb+0x144/0x340 net/ipv6/ndisc.c:403
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
ndisc_send_rs+0x331/0x6e0 net/ipv6/ndisc.c:669
addrconf_rs_timer+0x314/0x690 net/ipv6/addrconf.c:3836
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
__do_softirq+0x30b/0xad8 kernel/softirq.c:292
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x17f/0x1c0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
__do_softirq+0x30b/0xad8 kernel/softirq.c:292
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788
[inline]
RIP: 0010:console_unlock+0xfdf/0x1160 kernel/printk/printk.c:2409
Code: c1 e8 03 42 80 3c 20 00 0f 85 d1 00 00 00 48 83 3d cd 54 cd 07 00 0f
84 bc 00 00 00 e8 ca 37 1a 00 48 8b bd b0 fe ff ff 57 9d <0f> 1f 44 00 00
e9 cc f9 ff ff 48 8b bd c8 fe ff ff e8 3b d8 5d 00
RSP: 0000:ffff8801bccde450 EFLAGS: 00000293
ORIG_RAX: ffffffffffffff13
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x17f/0x1c0 kernel/softirq.c:412
RAX: ffff8801bd36a180 RBX: 0000000000000200 RCX: ffffffff8184e1ca
RDX: 0000000000000000 RSI: ffffffff81649dc6 RDI: 0000000000000293
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
RBP: ffff8801bccde5b8 R08: ffff8801bd36a180 R09: fffffbfff12720c0
R10: fffffbfff12720c0 R11: ffffffff89390603 R12: dffffc0000000000
R13: ffffffff84885bf0 R14: dffffc0000000000 R15: ffffffff899428d0
vprintk_emit+0x33d/0x930 kernel/printk/printk.c:1922
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788
[inline]
RIP: 0010:slab_alloc mm/slab.c:3385 [inline]
RIP: 0010:kmem_cache_alloc+0x297/0x730 mm/slab.c:3552
Code: 7e 0f 85 cf fe ff ff e8 06 60 3e ff e9 c5 fe ff ff e8 6d c3 c2 ff 48
83 3d bd d4 6f 07 00 0f 84 3b 03 00 00 48 8b 7d d0 57 9d <0f> 1f 44 00 00
e9 54 fe ff ff 31 d2 be a5 01 00 00 48 c7 c7 62 23
RSP: 0000:ffff8801980a7748 EFLAGS: 00000286
vprintk_default+0x28/0x30 kernel/printk/printk.c:1963
ORIG_RAX: ffffffffffffff13
vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
RAX: 0000000000000000 RBX: 0000000000480020 RCX: ffffc90001e5c000
printk+0xa7/0xcf kernel/printk/printk.c:1996
RDX: 0000000000000004 RSI: ffffffff8184e1e4 RDI: 0000000000000286
RBP: ffff8801980a77b0 R08: ffff880193c38700 R09: fffffbfff12812c4
R10: ffff8801980a6390 R11: ffffffff89409623 R12: 0000000000000000
dump_unreclaimable_slab.cold.22+0xd8/0xe5 mm/slab_common.c:1371
R13: ffff8801d9a04040 R14: ffff8801d9a04040 R15: 0000000000480020
dump_header+0x7cc/0xf72 mm/oom_kill.c:447
skb_clone+0x1bb/0x500 net/core/skbuff.c:1280
____bpf_clone_redirect net/core/filter.c:2079 [inline]
bpf_clone_redirect+0xb9/0x490 net/core/filter.c:2066
bpf_prog_41f2bcae09cd4ac3+0x194/0x1000
oom_kill_process.cold.27+0x10/0x903 mm/oom_kill.c:953
out_of_memory+0xa84/0x1430 mm/oom_kill.c:1120
__alloc_pages_may_oom mm/page_alloc.c:3522 [inline]
__alloc_pages_slowpath+0x2318/0x2d80 mm/page_alloc.c:4235
rcu: rcu_preempt kthread starved for 10548 jiffies! g90369 f0x2
RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: RCU grace-period kthread stack dump:
rcu_preempt R
running task 22736 10 2 0x80000000
Call Trace:
context_switch kernel/sched/core.c:2825 [inline]
__schedule+0x86c/0x1ed0 kernel/sched/core.c:3473
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
schedule+0xfe/0x460 kernel/sched/core.c:3517
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
schedule_timeout+0x140/0x260 kernel/time/timer.c:1804
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
__do_cache_alloc mm/slab.c:3356 [inline]
slab_alloc mm/slab.c:3384 [inline]
kmem_cache_alloc_trace+0x214/0x750 mm/slab.c:3618
rcu_gp_kthread+0x9d9/0x2310 kernel/rcu/tree.c:2194
kmalloc include/linux/slab.h:513 [inline]
syslog_print kernel/printk/printk.c:1297 [inline]
do_syslog+0xb9b/0x1690 kernel/printk/printk.c:1465
kmsg_read+0x8f/0xc0 fs/proc/kmsg.c:40
proc_reg_read+0x2a3/0x3d0 fs/proc/inode.c:231
__vfs_read+0x117/0x9b0 fs/read_write.c:416
vfs_read+0x17f/0x3c0 fs/read_write.c:452
ksys_read+0x101/0x260 fs/read_write.c:578
__do_sys_read fs/read_write.c:588 [inline]
__se_sys_read fs/read_write.c:586 [inline]
__x64_sys_read+0x73/0xb0 fs/read_write.c:586
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5bbee581fd
Code: Bad RIP value.
RSP: 002b:00007f5bbc3f7e30 EFLAGS: 00000293
ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000001bc9ce0 RCX: 00007f5bbee581fd
RDX: 0000000000000fff RSI: 00007f5bbdc2c5a0 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000001bb5260 R09: 0000000000000000
R10: 6b205d3334383630 R11: 0000000000000293 R12: 000000000065e420
R13: 00007f5bbc3f89c0 R14: 00007f5bbf49d040 R15: 0000000000000003
warn_alloc_show_mem: 1 callbacks suppressed
Mem-Info:
active_anon:48193 inactive_anon:137 isolated_anon:0
active_file:16 inactive_file:15 isolated_file:0
unevictable:0 dirty:0 writeback:0 unstable:0
slab_reclaimable:9165 slab_unreclaimable:1475206
mapped:8194 shmem:144 pagetables:402 bounce:0
free:13771 free_pcp:443 free_cma:0
Node 0 active_anon:192772kB inactive_anon:548kB active_file:64kB
inactive_file:60kB unevictable:0kB isolated(anon):0kB isolated(file):0kB
mapped:32776kB dirty:0kB writeback:0kB shmem:576kB shmem_thp: 0kB
shmem_pmdmapped: 0kB anon_thp: 178176kB writeback_tmp:0kB unstable:0kB
all_unreclaimable? yes
Node 0
DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB
inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB
writepending:0kB present:15992kB managed:15908kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB
free_cma:0kB
lowmem_reserve[]:
0
2819
6323
6323
Node 0
DMA32 free:25264kB min:30060kB low:37572kB high:45084kB active_anon:0kB
inactive_anon:0kB active_file:4kB inactive_file:0kB unevictable:0kB
writepending:0kB present:3129332kB managed:2890736kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:248kB local_pcp:0kB
free_cma:0kB
lowmem_reserve[]:
0
0
3503
3503
Node 0
Normal free:13912kB min:37352kB low:46688kB high:56024kB
active_anon:192772kB inactive_anon:548kB active_file:60kB
inactive_file:60kB unevictable:0kB writepending:0kB present:4718592kB
managed:3588044kB mlocked:0kB kernel_stack:5248kB pagetables:1608kB
bounce:0kB free_pcp:1524kB local_pcp:1456kB free_cma:0kB
lowmem_reserve[]:
kthread+0x35a/0x420 kernel/kthread.c:246
0
0
0
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413
0
ICMPv6: ndisc: ndisc_alloc_skb failed to allocate an skb
Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB
syz-executor0: page allocation failure: order:0, mode:0x484020(GFP_ATOMIC|
__GFP_COMP), nodemask=(null)
(U)
syz-executor0 cpuset=
2*64kB
syz0
(U)
mems_allowed=0
1*128kB
CPU: 0 PID: 7592 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #118
(U)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
1*256kB (U)
Call Trace:
0*512kB
<IRQ>
1*1024kB
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
(U)
1*2048kB
warn_alloc.cold.119+0xb7/0x1bd mm/page_alloc.c:3426
(M)
3*4096kB
(M)
= 15908kB
Node 0
__alloc_pages_slowpath+0x2667/0x2d80 mm/page_alloc.c:4297
DMA32:
4*4kB
(UM)
2*8kB (M)
3*16kB
(M)
3*32kB
(M)
4*64kB
(UM)
4*128kB
(UM)
3*256kB
(M)
4*512kB
(UM)
3*1024kB
(UM)
3*2048kB
(M)
3*4096kB
(M)
= 25264kB
Node 0
Normal:
942*4kB
(UME)
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
338*8kB
(UMEH)
149*16kB
(UME)
84*32kB
(UMEH)
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
25*64kB (UM)
2*128kB
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
(UH)
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
0*256kB
slab_alloc_node mm/slab.c:3327 [inline]
kmem_cache_alloc_node+0xe3/0x730 mm/slab.c:3642
1*512kB
(H)
__alloc_skb+0x119/0x770 net/core/skbuff.c:193
0*1024kB
0*2048kB 0*4096kB
= 13912kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0
hugepages_size=1048576kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0
hugepages_size=2048kB
175 total pagecache pages
0 pages in swap cache
alloc_skb include/linux/skbuff.h:997 [inline]
ndisc_alloc_skb+0x144/0x340 net/ipv6/ndisc.c:403
Swap cache stats: add 0, delete 0, find 0/0
ndisc_send_rs+0x331/0x6e0 net/ipv6/ndisc.c:669
Free swap = 0kB
addrconf_rs_timer+0x314/0x690 net/ipv6/addrconf.c:3836
Total swap = 0kB
1965979 pages RAM
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
0 pages HighMem/MovableOnly
342307 pages reserved
0 pages cma reserved
ICMPv6: ndisc: ndisc_alloc_skb failed to allocate an skb
rsyslogd: page allocation failure: order:0, mode:0x484020(GFP_ATOMIC|
__GFP_COMP), nodemask=(null)
rsyslogd cpuset=
/
mems_allowed=0
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
__do_softirq+0x30b/0xad8 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x17f/0x1c0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788
[inline]
RIP: 0010:slab_alloc mm/slab.c:3385 [inline]
RIP: 0010:kmem_cache_alloc+0x297/0x730 mm/slab.c:3552
Code: 7e 0f 85 cf fe ff ff e8 06 60 3e ff e9 c5 fe ff ff e8 6d c3 c2 ff 48
83 3d bd d4 6f 07 00 0f 84 3b 03 00 00 48 8b 7d d0 57 9d <0f> 1f 44 00 00
e9 54 fe ff ff 31 d2 be a5 01 00 00 48 c7 c7 62 23
RSP: 0000:ffff8801980a7748 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 0000000000480020 RCX: ffffc90001e5c000
RDX: 0000000000000004 RSI: ffffffff8184e1e4 RDI: 0000000000000286
RBP: ffff8801980a77b0 R08: ffff880193c38700 R09: fffffbfff12812c4
R10: ffff8801980a6390 R11: ffffffff89409623 R12: 0000000000000000
R13: ffff8801d9a04040 R14: ffff8801d9a04040 R15: 0000000000480020
skb_clone+0x1bb/0x500 net/core/skbuff.c:1280
____bpf_clone_redirect net/core/filter.c:2079 [inline]
bpf_clone_redirect+0xb9/0x490 net/core/filter.c:2066
bpf_prog_41f2bcae09cd4ac3+0x194/0x1000
Mem-Info:
CPU: 1 PID: 5702 Comm: rsyslogd Not tainted 4.19.0-rc6+ #118
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
active_anon:48193 inactive_anon:137 isolated_anon:0
active_file:16 inactive_file:15 isolated_file:0
unevictable:0 dirty:0 writeback:0 unstable:0
slab_reclaimable:9165 slab_unreclaimable:1475206
mapped:8194 shmem:144 pagetables:402 bounce:0
free:13771 free_pcp:443 free_cma:0
Call Trace:
Node 0 active_anon:192772kB inactive_anon:548kB active_file:64kB
inactive_file:60kB unevictable:0kB isolated(anon):0kB isolated(file):0kB
mapped:32776kB dirty:0kB writeback:0kB shmem:576kB shmem_thp: 0kB
shmem_pmdmapped: 0kB anon_thp: 178176kB writeback_tmp:0kB unstable:0kB
all_unreclaimable? yes
<IRQ>
Node 0
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB
inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB
writepending:0kB present:15992kB managed:15908kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB
free_cma:0kB
lowmem_reserve[]:
warn_alloc.cold.119+0xb7/0x1bd mm/page_alloc.c:3426
0
2819
6323
6323
__alloc_pages_slowpath+0x2667/0x2d80 mm/page_alloc.c:4297
Node 0
DMA32 free:25264kB min:30060kB low:37572kB high:45084kB active_anon:0kB
inactive_anon:0kB active_file:4kB inactive_file:0kB unevictable:0kB
writepending:0kB present:3129332kB managed:2890736kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:248kB local_pcp:248kB
free_cma:0kB
lowmem_reserve[]:
0
0
3503
3503
Node 0
Normal free:13912kB min:37352kB low:46688kB high:56024kB
active_anon:192772kB inactive_anon:548kB active_file:60kB
inactive_file:60kB unevictable:0kB writepending:0kB present:4718592kB
managed:3588044kB mlocked:0kB kernel_stack:5248kB pagetables:1608kB
bounce:0kB free_pcp:1524kB local_pcp:68kB free_cma:0kB
lowmem_reserve[]: 0
0
0
0
Node 0 DMA:
1*4kB
(U)
0*8kB
0*16kB
1*32kB
(U)
2*64kB
(U)
1*128kB
(U)
1*256kB
(U)
0*512kB
1*1024kB
(U)
1*2048kB
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
(M)
3*4096kB
(M)
= 15908kB
Node 0
DMA32:
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
4*4kB
(UM)
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
2*8kB
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
(M)
slab_alloc_node mm/slab.c:3327 [inline]
kmem_cache_alloc_node+0xe3/0x730 mm/slab.c:3642
3*16kB
(M)
__alloc_skb+0x119/0x770 net/core/skbuff.c:193
3*32kB
(M)
4*64kB
(UM)
4*128kB
(UM)
3*256kB
alloc_skb include/linux/skbuff.h:997 [inline]
ndisc_alloc_skb+0x144/0x340 net/ipv6/ndisc.c:403
(M)
ndisc_send_rs+0x331/0x6e0 net/ipv6/ndisc.c:669
4*512kB
addrconf_rs_timer+0x314/0x690 net/ipv6/addrconf.c:3836
(UM)
3*1024kB
(UM)
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
3*2048kB
(M)
3*4096kB
(M)
= 25264kB
Node 0
Normal:
942*4kB
(UME)
338*8kB
(UMEH)
149*16kB
(UME)
84*32kB
(UMEH)
25*64kB
(UM)
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
2*128kB
(UH)
0*256kB
1*512kB
(H)
0*1024kB
0*2048kB
0*4096kB
= 13912kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0
hugepages_size=1048576kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0
hugepages_size=2048kB
175 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
1965979 pages RAM
0 pages HighMem/MovableOnly
__do_softirq+0x30b/0xad8 kernel/softirq.c:292
342307 pages reserved
0 pages cma reserved
ICMPv6: ndisc: ndisc_alloc_skb failed to allocate an skb
syz-executor0: page allocation failure: order:0, mode:0x484020(GFP_ATOMIC|
__GFP_COMP), nodemask=(null)
syz-executor0 cpuset=
syz0
mems_allowed=0
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x17f/0x1c0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788
[inline]
RIP: 0010:console_unlock+0xfdf/0x1160 kernel/printk/printk.c:2409
Code: c1 e8 03 42 80 3c 20 00 0f 85 d1 00 00 00 48 83 3d cd 54 cd 07 00 0f
84 bc 00 00 00 e8 ca 37 1a 00 48 8b bd b0 fe ff ff 57 9d <0f> 1f 44 00 00
e9 cc f9 ff ff 48 8b bd c8 fe ff ff e8 3b d8 5d 00
RSP: 0000:ffff8801bccde450 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff8801bd36a180 RBX: 0000000000000200 RCX: ffffffff8184e1ca
RDX: 0000000000000000 RSI: ffffffff81649dc6 RDI: 0000000000000293
RBP: ffff8801bccde5b8 R08: ffff8801bd36a180 R09: fffffbfff12720c0
R10: fffffbfff12720c0 R11: ffffffff89390603 R12: dffffc0000000000
R13: ffffffff84885bf0 R14: dffffc0000000000 R15: ffffffff899428d0
vprintk_emit+0x33d/0x930 kernel/printk/printk.c:1922
vprintk_default+0x28/0x30 kernel/printk/printk.c:1963
vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
printk+0xa7/0xcf kernel/printk/printk.c:1996
dump_unreclaimable_slab.cold.22+0xd8/0xe5 mm/slab_common.c:1371
dump_header+0x7cc/0xf72 mm/oom_kill.c:447
oom_kill_process.cold.27+0x10/0x903 mm/oom_kill.c:953
out_of_memory+0xa84/0x1430 mm/oom_kill.c:1120
__alloc_pages_may_oom mm/page_alloc.c:3522 [inline]
__alloc_pages_slowpath+0x2318/0x2d80 mm/page_alloc.c:4235
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
__do_cache_alloc mm/slab.c:3356 [inline]
slab_alloc mm/slab.c:3384 [inline]
kmem_cache_alloc_trace+0x214/0x750 mm/slab.c:3618
kmalloc include/linux/slab.h:513 [inline]
syslog_print kernel/printk/printk.c:1297 [inline]
do_syslog+0xb9b/0x1690 kernel/printk/printk.c:1465
kmsg_read+0x8f/0xc0 fs/proc/kmsg.c:40
proc_reg_read+0x2a3/0x3d0 fs/proc/inode.c:231
__vfs_read+0x117/0x9b0 fs/read_write.c:416
vfs_read+0x17f/0x3c0 fs/read_write.c:452
ksys_read+0x101/0x260 fs/read_write.c:578
__do_sys_read fs/read_write.c:588 [inline]
__se_sys_read fs/read_write.c:586 [inline]
__x64_sys_read+0x73/0xb0 fs/read_write.c:586
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5bbee581fd
Code: Bad RIP value.
RSP: 002b:00007f5bbc3f7e30 EFLAGS: 00000293 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000001bc9ce0 RCX: 00007f5bbee581fd
RDX: 0000000000000fff RSI: 00007f5bbdc2c5a0 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000001bb5260 R09: 0000000000000000
R10: 6b205d3334383630 R11: 0000000000000293 R12: 000000000065e420
R13: 00007f5bbc3f89c0 R14: 00007f5bbf49d040 R15: 0000000000000003
CPU: 0 PID: 7592 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #118
Mem-Info:
active_anon:48193 inactive_anon:137 isolated_anon:0
active_file:16 inactive_file:15 isolated_file:0
unevictable:0 dirty:0 writeback:0 unstable:0
slab_reclaimable:9165 slab_unreclaimable:1475206
mapped:8194 shmem:144 pagetables:402 bounce:0
free:13771 free_pcp:443 free_cma:0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Node 0 active_anon:192772kB inactive_anon:548kB active_file:64kB
inactive_file:60kB unevictable:0kB isolated(anon):0kB isolated(file):0kB
mapped:32776kB dirty:0kB writeback:0kB shmem:576kB shmem_thp: 0kB
shmem_pmdmapped: 0kB anon_thp: 178176kB writeback_tmp:0kB unstable:0kB
all_unreclaimable? yes
Call Trace:
Node 0
<IRQ>
DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB
inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB
writepending:0kB present:15992kB managed:15908kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB
free_cma:0kB
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
lowmem_reserve[]:
0
warn_alloc.cold.119+0xb7/0x1bd mm/page_alloc.c:3426
2819
6323 6323
Node 0 DMA32 free:25264kB min:30060kB low:37572kB high:45084kB
active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:0kB
unevictable:0kB writepending:0kB present:3129332kB managed:2890736kB
mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:248kB
local_pcp:0kB free_cma:0kB
__alloc_pages_slowpath+0x2667/0x2d80 mm/page_alloc.c:4297
lowmem_reserve[]:
0
0 3503
3503
Node 0
Normal free:13912kB min:37352kB low:46688kB high:56024kB
active_anon:192772kB inactive_anon:548kB active_file:60kB
inactive_file:60kB unevictable:0kB writepending:0kB present:4718592kB
managed:3588044kB mlocked:0kB kernel_stack:5248kB pagetables:1608kB
bounce:0kB free_pcp:1524kB local_pcp:1456kB free_cma:0kB
lowmem_reserve[]:
0
0
0
0
Node 0 DMA:
1*4kB
(U)
0*8kB
0*16kB
1*32kB
(U)
2*64kB
(U)
1*128kB
(U)
1*256kB
(U)
0*512kB
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
1*1024kB
(U)
1*2048kB
(M)
3*4096kB
(M)
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
= 15908kB
Node 0
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
DMA32:
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
4*4kB
slab_alloc_node mm/slab.c:3327 [inline]
kmem_cache_alloc_node+0xe3/0x730 mm/slab.c:3642
(UM)
2*8kB
__alloc_skb+0x119/0x770 net/core/skbuff.c:193
(M)
3*16kB
(M)
3*32kB
(M)
4*64kB
alloc_skb include/linux/skbuff.h:997 [inline]
ndisc_alloc_skb+0x144/0x340 net/ipv6/ndisc.c:403
(UM)
ndisc_send_rs+0x331/0x6e0 net/ipv6/ndisc.c:669
4*128kB
addrconf_rs_timer+0x314/0x690 net/ipv6/addrconf.c:3836
(UM)
3*256kB
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
(M)
4*512kB
(UM)
3*1024kB
(UM)
3*2048kB
(M)
3*4096kB
(M)
= 25264kB
Node 0
Normal:
942*4kB
(UME)
338*8kB
(UMEH)
149*16kB
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
(UME)
84*32kB
(UMEH)
25*64kB
(UM)
2*128kB
(UH)
0*256kB
1*512kB
(H)
0*1024kB
0*2048kB
0*4096kB
= 13912kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0
hugepages_size=1048576kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0
hugepages_size=2048kB
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
175 total pagecache pages
0 pages in swap cache
__do_softirq+0x30b/0xad8 kernel/softirq.c:292
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
342307 pages reserved
0 pages cma reserved
ICMPv6: ndisc: ndisc_alloc_skb failed to allocate an skb
rsyslogd: page allocation failure: order:0, mode:0x484020(GFP_ATOMIC|
__GFP_COMP), nodemask=(null)
rsyslogd cpuset=
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x17f/0x1c0 kernel/softirq.c:412
/
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
mems_allowed=0
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788
[inline]
RIP: 0010:slab_alloc mm/slab.c:3385 [inline]
RIP: 0010:kmem_cache_alloc+0x297/0x730 mm/slab.c:3552
Code: 7e 0f 85 cf fe ff ff e8 06 60 3e ff e9 c5 fe ff ff e8 6d c3 c2 ff 48
83 3d bd d4 6f 07 00 0f 84 3b 03 00 00 48 8b 7d d0 57 9d <0f> 1f 44 00 00
e9 54 fe ff ff 31 d2 be a5 01 00 00 48 c7 c7 62 23
RSP: 0000:ffff8801980a7748 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 0000000000480020 RCX: ffffc90001e5c000
RDX: 0000000000000004 RSI: ffffffff8184e1e4 RDI: 0000000000000286
RBP: ffff8801980a77b0 R08: ffff880193c38700 R09: fffffbfff12812c4
R10: ffff8801980a6390 R11: ffffffff89409623 R12: 0000000000000000
R13: ffff8801d9a04040 R14: ffff8801d9a04040 R15: 0000000000480020
skb_clone+0x1bb/0x500 net/core/skbuff.c:1280
____bpf_clone_redirect net/core/filter.c:2079 [inline]
bpf_clone_redirect+0xb9/0x490 net/core/filter.c:2066
bpf_prog_41f2bcae09cd4ac3+0x194/0x1000
CPU: 1 PID: 5702 Comm: rsyslogd Not tainted 4.19.0-rc6+ #118
ICMPv6: ndisc: ndisc_alloc_skb failed to allocate an skb
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
syz-executor0: page allocation failure: order:0, mode:0x484020(GFP_ATOMIC|
__GFP_COMP), nodemask=(null)
warn_alloc.cold.119+0xb7/0x1bd mm/page_alloc.c:3426
syz-executor0 cpuset=
syz0
mems_allowed=0
__alloc_pages_slowpath+0x2667/0x2d80 mm/page_alloc.c:4297
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
slab_alloc_node mm/slab.c:3327 [inline]
kmem_cache_alloc_node+0xe3/0x730 mm/slab.c:3642
__alloc_skb+0x119/0x770 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:997 [inline]
ndisc_alloc_skb+0x144/0x340 net/ipv6/ndisc.c:403
ndisc_send_rs+0x331/0x6e0 net/ipv6/ndisc.c:669
addrconf_rs_timer+0x314/0x690 net/ipv6/addrconf.c:3836
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
__do_softirq+0x30b/0xad8 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x17f/0x1c0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788
[inline]
RIP: 0010:console_unlock+0xfdf/0x1160 kernel/printk/printk.c:2409
Code: c1 e8 03 42 80 3c 20 00 0f 85 d1 00 00 00 48 83 3d cd 54 cd 07 00 0f
84 bc 00 00 00 e8 ca 37 1a 00 48 8b bd b0 fe ff ff 57 9d <0f> 1f 44 00 00
e9 cc f9 ff ff 48 8b bd c8 fe ff ff e8 3b d8 5d 00
RSP: 0000:ffff8801bccde450 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff8801bd36a180 RBX: 0000000000000200 RCX: ffffffff8184e1ca
RDX: 0000000000000000 RSI: ffffffff81649dc6 RDI: 0000000000000293
RBP: ffff8801bccde5b8 R08: ffff8801bd36a180 R09: fffffbfff12720c0
R10: fffffbfff12720c0 R11: ffffffff89390603 R12: dffffc0000000000
R13: ffffffff84885bf0 R14: dffffc0000000000 R15: ffffffff899428d0
vprintk_emit+0x33d/0x930 kernel/printk/printk.c:1922
vprintk_default+0x28/0x30 kernel/printk/printk.c:1963
vprintk_func+0x7e/0x181 kernel/printk/printk_safe.c:398
printk+0xa7/0xcf kernel/printk/printk.c:1996
dump_unreclaimable_slab.cold.22+0xd8/0xe5 mm/slab_common.c:1371
dump_header+0x7cc/0xf72 mm/oom_kill.c:447
oom_kill_process.cold.27+0x10/0x903 mm/oom_kill.c:953
out_of_memory+0xa84/0x1430 mm/oom_kill.c:1120
__alloc_pages_may_oom mm/page_alloc.c:3522 [inline]
__alloc_pages_slowpath+0x2318/0x2d80 mm/page_alloc.c:4235
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
__do_cache_alloc mm/slab.c:3356 [inline]
slab_alloc mm/slab.c:3384 [inline]
kmem_cache_alloc_trace+0x214/0x750 mm/slab.c:3618
kmalloc include/linux/slab.h:513 [inline]
syslog_print kernel/printk/printk.c:1297 [inline]
do_syslog+0xb9b/0x1690 kernel/printk/printk.c:1465
kmsg_read+0x8f/0xc0 fs/proc/kmsg.c:40
proc_reg_read+0x2a3/0x3d0 fs/proc/inode.c:231
__vfs_read+0x117/0x9b0 fs/read_write.c:416
vfs_read+0x17f/0x3c0 fs/read_write.c:452
ksys_read+0x101/0x260 fs/read_write.c:578
__do_sys_read fs/read_write.c:588 [inline]
__se_sys_read fs/read_write.c:586 [inline]
__x64_sys_read+0x73/0xb0 fs/read_write.c:586
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5bbee581fd
Code: Bad RIP value.
RSP: 002b:00007f5bbc3f7e30 EFLAGS: 00000293 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000001bc9ce0 RCX: 00007f5bbee581fd
RDX: 0000000000000fff RSI: 00007f5bbdc2c5a0 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000001bb5260 R09: 0000000000000000
R10: 6b205d3334383630 R11: 0000000000000293 R12: 000000000065e420
R13: 00007f5bbc3f89c0 R14: 00007f5bbf49d040 R15: 0000000000000003
warn_alloc_show_mem: 1 callbacks suppressed
CPU: 0 PID: 7592 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #118
Mem-Info:
active_anon:48193 inactive_anon:137 isolated_anon:0
active_file:16 inactive_file:15 isolated_file:0
unevictable:0 dirty:0 writeback:0 unstable:0
slab_reclaimable:9165 slab_unreclaimable:1475206
mapped:8194 shmem:144 pagetables:402 bounce:0
free:13771 free_pcp:443 free_cma:0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Node 0 active_anon:192772kB inactive_anon:548kB active_file:64kB
inactive_file:60kB unevictable:0kB isolated(anon):0kB isolated(file):0kB
mapped:32776kB dirty:0kB writeback:0kB shmem:576kB shmem_thp: 0kB
shmem_pmdmapped: 0kB anon_thp: 178176kB writeback_tmp:0kB unstable:0kB
all_unreclaimable? yes
Call Trace:
Node 0
<IRQ>
DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB
inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB
writepending:0kB present:15992kB managed:15908kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB
free_cma:0kB
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
lowmem_reserve[]:
0
warn_alloc.cold.119+0xb7/0x1bd mm/page_alloc.c:3426
2819
6323
6323
Node 0
__alloc_pages_slowpath+0x2667/0x2d80 mm/page_alloc.c:4297
DMA32 free:25264kB min:30060kB low:37572kB high:45084kB active_anon:0kB
inactive_anon:0kB active_file:4kB inactive_file:0kB unevictable:0kB
writepending:0kB present:3129332kB managed:2890736kB mlocked:0kB
kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:248kB local_pcp:0kB
free_cma:0kB
lowmem_reserve[]:
0
0
3503 3503
Node 0 Normal free:13912kB min:37352kB low:46688kB high:56024kB
active_anon:192772kB inactive_anon:548kB active_file:60kB
inactive_file:60kB unevictable:0kB writepending:0kB present:4718592kB
managed:3588044kB mlocked:0kB kernel_stack:5248kB pagetables:1608kB
bounce:0kB free_pcp:1524kB local_pcp:1456kB free_cma:0kB
lowmem_reserve[]:
0 0
0
0
Node 0 DMA:
1*4kB
(U)
0*8kB
0*16kB
1*32kB
(U)
2*64kB
(U) 1*128kB
(U)
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
1*256kB
(U)
0*512kB
1*1024kB
(U)
1*2048kB
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
(M)
3*4096kB
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
(M) = 15908kB
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
Node 0
slab_alloc_node mm/slab.c:3327 [inline]
kmem_cache_alloc_node+0xe3/0x730 mm/slab.c:3642
DMA32:
4*4kB
__alloc_skb+0x119/0x770 net/core/skbuff.c:193
(UM)
2*8kB
(M)
3*16kB
(M)
3*32kB
(M)
alloc_skb include/linux/skbuff.h:997 [inline]
ndisc_alloc_skb+0x144/0x340 net/ipv6/ndisc.c:403
4*64kB
ndisc_send_rs+0x331/0x6e0 net/ipv6/ndisc.c:669
(UM)
addrconf_rs_timer+0x314/0x690 net/ipv6/addrconf.c:3836
4*128kB
(UM)
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
3*256kB
(M)
4*512kB
(UM)
3*1024kB
(UM)
3*2048kB
(M)
3*4096kB
(M)
= 25264kB
Node 0
Normal:
942*4kB
(UME)
338*8kB
(UMEH)
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
149*16kB
(UME)
84*32kB
(UMEH)
25*64kB
(UM)
2*128kB
(UH)
0*256kB
1*512kB
(H)
0*1024kB
0*2048kB
0*4096kB
= 13912kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0
hugepages_size=1048576kB
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0
hugepages_size=2048kB
175 total pagecache pages
__do_softirq+0x30b/0xad8 kernel/softirq.c:292
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
342307 pages reserved
0 pages cma reserved
ICMPv6: ndisc: ndisc_alloc_skb failed to allocate an skb
rsyslogd: page allocation failure: order:0, mode:0x484020(GFP_ATOMIC|
__GFP_COMP), nodemask=(null)
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x17f/0x1c0 kernel/softirq.c:412
rsyslogd cpuset=
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
/
mems_allowed=0
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788
[inline]
RIP: 0010:slab_alloc mm/slab.c:3385 [inline]
RIP: 0010:kmem_cache_alloc+0x297/0x730 mm/slab.c:3552
Code: 7e 0f 85 cf fe ff ff e8 06 60 3e ff e9 c5 fe ff ff e8 6d c3 c2 ff 48
83 3d bd d4 6f 07 00 0f 84 3b 03 00 00 48 8b 7d d0 57 9d <0f> 1f 44 00 00
e9 54 fe ff ff 31 d2 be a5 01 00 00 48 c7 c7 62 23
RSP: 0000:ffff8801980a7748 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 0000000000480020 RCX: ffffc90001e5c000
RDX: 0000000000000004 RSI: ffffffff8184e1e4 RDI: 0000000000000286
RBP: ffff8801980a77b0 R08: ffff880193c38700 R09: fffffbfff12812c4
R10: ffff8801980a6390 R11: ffffffff89409623 R12: 0000000000000000
R13: ffff8801d9a04040 R14: ffff8801d9a04040 R15: 0000000000480020
skb_clone+0x1bb/0x500 net/core/skbuff.c:1280
____bpf_clone_redirect net/core/filter.c:2079 [inline]
bpf_clone_redirect+0xb9/0x490 net/core/filter.c:2066
bpf_prog_41f2bcae09cd4ac3+0x194/0x1000
CPU: 1 PID: 5702 Comm: rsyslogd Not tainted 4.19.0-rc6+ #118
ICMPv6: ndisc: ndisc_alloc_skb failed to allocate an skb
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
warn_alloc.cold.119+0xb7/0x1bd mm/page_alloc.c:3426
syz-executor0: page allocation failure: order:0, mode:0x484020(GFP_ATOMIC|
__GFP_COMP), nodemask=(null)
syz-executor0 cpuset=
syz0 mems_allowed=0
__alloc_pages_slowpath+0x2667/0x2d80 mm/page_alloc.c:4297
__alloc_pages_nodemask+0xa80/0xde0 mm/page_alloc.c:4390
__alloc_pages include/linux/gfp.h:473 [inline]
__alloc_pages_node include/linux/gfp.h:486 [inline]
kmem_getpages mm/slab.c:1409 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2677
fallback_alloc+0x203/0x2e0 mm/slab.c:3219
____cache_alloc_node+0x1c7/0x1e0 mm/slab.c:3287
slab_alloc_node mm/slab.c:3327 [inline]
kmem_cache_alloc_node+0xe3/0x730 mm/slab.c:3642
__alloc_skb+0x119/0x770 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:997 [inline]
ndisc_alloc_skb+0x144/0x340 net/ipv6/ndisc.c:403
ndisc_send_rs+0x331/0x6e0 net/ipv6/ndisc.c:669
addrconf_rs_timer+0x314/0x690 net/ipv6/addrconf.c:3836
call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7e5/0xc70 kernel/time/timer.c:1682


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[Dmitry Vyukov]

On Mon, Dec 31, 2018 at 8:42 AM syzbot
<syzbot+ea7d9c...@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: ef4ab8447aa2 selftests: bpf: install script with_addr.sh
> git tree: bpf-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=14a28b6e400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=7e7e2279c0020d5f
> dashboard link: https://syzkaller.appspot.com/bug?extid=ea7d9cb314b4ab49a18a
> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+ea7d9c...@syzkaller.appspotmail.com

Since this involves OOMs and looks like a one-off induced memory corruption:

#syz dup: kernel panic: corrupted stack end in wb_workfn

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/0000000000007beca9057e4c8c14%40google.com.
> For more options, visit https://groups.google.com/d/optout.

[Tetsuo Handa]

On 2018/12/31 16:49, Dmitry Vyukov wrote:
> On Mon, Dec 31, 2018 at 8:42 AM syzbot
> <syzbot+ea7d9c...@syzkaller.appspotmail.com> wrote:
>>
>> Hello,
>>
>> syzbot found the following crash on:
>>
>> HEAD commit: ef4ab8447aa2 selftests: bpf: install script with_addr.sh
>> git tree: bpf-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=14a28b6e400000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=7e7e2279c0020d5f
>> dashboard link: https://syzkaller.appspot.com/bug?extid=ea7d9cb314b4ab49a18a
>> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>>
>> Unfortunately, I don't have any reproducer for this crash yet.
>>
>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> Reported-by: syzbot+ea7d9c...@syzkaller.appspotmail.com
>
> Since this involves OOMs and looks like a one-off induced memory corruption:
>
> #syz dup: kernel panic: corrupted stack end in wb_workfn
>

Why?

RCU stall in this case is likely to be latency caused by flooding of printk().

[Dmitry Vyukov]

Just a hypothesis. OOMs lead to arbitrary memory corruptions, so can
cause stalls as well. But can be what you said too. I just thought
that cleaner dashboard is more useful than a large assorted pile of
crashes. If you think it's actionable in some way, feel free to undup.

[Tetsuo Handa]

On 2018/12/31 17:24, Dmitry Vyukov wrote:
>>> Since this involves OOMs and looks like a one-off induced memory corruption:
>>>
>>> #syz dup: kernel panic: corrupted stack end in wb_workfn
>>>
>>
>> Why?
>>
>> RCU stall in this case is likely to be latency caused by flooding of printk().
>
> Just a hypothesis. OOMs lead to arbitrary memory corruptions, so can
> cause stalls as well. But can be what you said too. I just thought
> that cleaner dashboard is more useful than a large assorted pile of
> crashes. If you think it's actionable in some way, feel free to undup.
>

We don't know why bpf tree is hitting this problem.
Let's continue monitoring this problem.

#syz undup

[Tetsuo Handa]

A report at 2019/01/05 10:08 from "no output from test machine (2)"
( https://syzkaller.appspot.com/text?tag=CrashLog&x=1700726f400000 )
says that there are flood of memory allocation failure messages.
Since continuous memory allocation failure messages itself is not
recognized as a crash, we might be misunderstanding that this problem
is not occurring recently. It will be nice if we can run testcases
which are executed on bpf-next tree.

[Dmitry Vyukov]

What exactly do you mean by running test cases on bpf-next tree?
syzbot tests bpf-next, so it executes lots of test cases on that tree.
One can also ask for patch testing on bpf-next tree to test a specific
test case.

[Tetsuo Handa]

On 2019/01/06 22:24, Dmitry Vyukov wrote:
>> A report at 2019/01/05 10:08 from "no output from test machine (2)"
>> ( https://syzkaller.appspot.com/text?tag=CrashLog&x=1700726f400000 )
>> says that there are flood of memory allocation failure messages.
>> Since continuous memory allocation failure messages itself is not
>> recognized as a crash, we might be misunderstanding that this problem
>> is not occurring recently. It will be nice if we can run testcases
>> which are executed on bpf-next tree.
>
> What exactly do you mean by running test cases on bpf-next tree?
> syzbot tests bpf-next, so it executes lots of test cases on that tree.
> One can also ask for patch testing on bpf-next tree to test a specific
> test case.

syzbot ran "some tests" before getting this report, but we can't find from
this report what the "some tests" are. If we could record all tests executed
in syzbot environments before getting this report, we could rerun the tests
(with manually examining where the source of memory consumption is) in local
environments.

Since syzbot is now using memcg, maybe we can test with sysctl_panic_on_oom == 1.
Any memory consumption that triggers global OOM killer could be considered as
a problem (e.g. memory leak or uncontrolled memory allocation).

[Dmitry Vyukov]

On Sun, Jan 6, 2019 at 2:47 PM Tetsuo Handa
<penguin...@i-love.sakura.ne.jp> wrote:
>
> On 2019/01/06 22:24, Dmitry Vyukov wrote:
> >> A report at 2019/01/05 10:08 from "no output from test machine (2)"
> >> ( https://syzkaller.appspot.com/text?tag=CrashLog&x=1700726f400000 )
> >> says that there are flood of memory allocation failure messages.
> >> Since continuous memory allocation failure messages itself is not
> >> recognized as a crash, we might be misunderstanding that this problem
> >> is not occurring recently. It will be nice if we can run testcases
> >> which are executed on bpf-next tree.
> >
> > What exactly do you mean by running test cases on bpf-next tree?
> > syzbot tests bpf-next, so it executes lots of test cases on that tree.
> > One can also ask for patch testing on bpf-next tree to test a specific
> > test case.
>
> syzbot ran "some tests" before getting this report, but we can't find from
> this report what the "some tests" are. If we could record all tests executed
> in syzbot environments before getting this report, we could rerun the tests
> (with manually examining where the source of memory consumption is) in local
> environments.

Filed https://github.com/google/syzkaller/issues/917 for this.

> Since syzbot is now using memcg, maybe we can test with sysctl_panic_on_oom == 1.
> Any memory consumption that triggers global OOM killer could be considered as
> a problem (e.g. memory leak or uncontrolled memory allocation).

Interesting idea. This will also alleviate the previous problem as I
think only a stream of OOMs currently produces 1+MB of output.

+Shakeel who was interested in catching more memcg-escaping allocations.

To do this we need a buy-in from kernel community to consider this as
a bug/something to fix in kernel. Systematic testing can't work gray
checks requiring humans to look at each case and some cases left as
being working-as-intended.

There are also 2 interesting points:
- testing of kernel without memcg-enabled (some kernel users
obviously do this); it's doable, but currently syzkaller have no
precedents/infrastructure to consider some output patterns as bugs or
not depending on kernel features
- false positives for minimized C reproducers that have memcg code
stripped off (people complain that reproducers are too large/complex
otherwise)

[Tetsuo Handa]

Dmitry Vyukov wrote:
> On Sun, Jan 6, 2019 at 2:47 PM Tetsuo Handa
> <penguin...@i-love.sakura.ne.jp> wrote:
> >
> > On 2019/01/06 22:24, Dmitry Vyukov wrote:
> > >> A report at 2019/01/05 10:08 from "no output from test machine (2)"
> > >> ( https://syzkaller.appspot.com/text?tag=CrashLog&x=1700726f400000 )
> > >> says that there are flood of memory allocation failure messages.
> > >> Since continuous memory allocation failure messages itself is not
> > >> recognized as a crash, we might be misunderstanding that this problem
> > >> is not occurring recently. It will be nice if we can run testcases
> > >> which are executed on bpf-next tree.
> > >
> > > What exactly do you mean by running test cases on bpf-next tree?
> > > syzbot tests bpf-next, so it executes lots of test cases on that tree.
> > > One can also ask for patch testing on bpf-next tree to test a specific
> > > test case.
> >
> > syzbot ran "some tests" before getting this report, but we can't find from
> > this report what the "some tests" are. If we could record all tests executed
> > in syzbot environments before getting this report, we could rerun the tests
> > (with manually examining where the source of memory consumption is) in local
> > environments.
>
> Filed https://github.com/google/syzkaller/issues/917 for this.

Thanks. Here is what I would suggest.

Let syz-fuzzer write to /dev/kmsg . But don't directly write syz-program lines.
Instead, just write the hash value of syz-program lines, and allow downloading
syz-program lines from external URL. Also, use the first 12 characters of the
hash value as comm name executing that syz-program lines. An example of console
output would look something like below.


[$(uptime)][$(caller_info)] executing program #0123456789abcdef0123456789abcdef
[$(uptime)][$(caller_info)] $(kernel_messages_caused_by_0123456789abcdef0123456789abcdef_are_here)
[$(uptime)][$(caller_info)] executing program #456789abcdef0123456789abcdef0123
[$(uptime)][$(caller_info)] $(kernel_messages_caused_by_456789abcdef0123456789abcdef0123_and_0123456789abcdef0123456789abcdef_are_here)
[$(uptime)][$(caller_info)] executing program #89abcdef0123456789abcdef01234567
[$(uptime)][$(caller_info)] $(kernel_messages_caused_by_89abcdef0123456789abcdef01234567_456789abcdef0123456789abcdef0123_and_0123456789abcdef0123456789abcdef_are_here)
[$(uptime)][$(caller_info)] BUG: unable to handle kernel paging request at $(address)
[$(uptime)][$(caller_info)] CPU: $(cpu) PID: $(pid) Comm: syz#89abcdef0123 Not tainted $(version) #$(build)
[$(uptime)][$(caller_info)] $(backtrace_of_caller_info_is_here)
[$(uptime)][$(caller_info)] Kernel panic - not syncing: Fatal exception

Then, we can build CrashLog by picking up all "executing program #" lines and
"latest lines up to available space" from console output like below.

[$(uptime)][$(caller_info)] executing program #0123456789abcdef0123456789abcdef
[$(uptime)][$(caller_info)] executing program #456789abcdef0123456789abcdef0123
[$(uptime)][$(caller_info)] executing program #89abcdef0123456789abcdef01234567
[$(uptime)][$(caller_info)] $(kernel_messages_caused_by_89abcdef0123456789abcdef01234567_456789abcdef0123456789abcdef0123_and_0123456789abcdef0123456789abcdef_are_here)
[$(uptime)][$(caller_info)] BUG: unable to handle kernel paging request at $(address)
[$(uptime)][$(caller_info)] CPU: $(cpu) PID: $(pid) Comm: syz89abcdef0123 Not tainted $(version) #$(build)
[$(uptime)][$(caller_info)] $(backtrace_of_caller_info_is_here)
[$(uptime)][$(caller_info)] Kernel panic - not syncing: Fatal exception

Then, we can understand that a crash happened when executing 89abcdef0123 and
download 89abcdef0123456789abcdef01234567 for analysis. Also, we can download
0123456789abcdef0123456789abcdef and 456789abcdef0123456789abcdef0123 as needed.

Honestly, since lines which follows "$(date) executing program $(num):" line can
become so long, it is difficult to find where previous/next kernel messages are.
If only one-liner "executing program #" output is used, it is easy to find
previous/next kernel messages.

The program referenced by "executing program #" would be made downloadable via
Web server or git repository. Maybe "executing program https://$server/$hash"
for the former case. But repeating "https://$server/" part would be redundant.

The question for me is, whether sysbot can detect hash collision with different
syz-program lines before writing the hash value to /dev/kmsg, and retry by modifying
syz-program lines in order to get a new hash value until collision is avoided.
If it is difficult, simpler choice like current Unix time and PID could be used
instead...

[Dmitry Vyukov]

Hummm, say, if you run syz-manager locally and report a bug, where
will the webserver and database that allows to download all satellite
info work? How long you need to keep this info and provide the web
service? You will also need to pay and maintain the server for... how
long? I don't see how this can work and how we can ask people to do
this. This frankly looks like overly complex solution to a problem
were simpler solutions will work. Keeping all info in a self-contained
file looks like the only option to make it work reliably.
It's also not possible to attribute kernel output to individual programs.

[Tetsuo Handa]

On 2019/01/19 21:16, Dmitry Vyukov wrote:
>> The question for me is, whether sysbot can detect hash collision with different
>> syz-program lines before writing the hash value to /dev/kmsg, and retry by modifying
>> syz-program lines in order to get a new hash value until collision is avoided.
>> If it is difficult, simpler choice like current Unix time and PID could be used
>> instead...
>
> Hummm, say, if you run syz-manager locally and report a bug, where
> will the webserver and database that allows to download all satellite
> info work? How long you need to keep this info and provide the web
> service? You will also need to pay and maintain the server for... how
> long? I don't see how this can work and how we can ask people to do
> this. This frankly looks like overly complex solution to a problem
> were simpler solutions will work. Keeping all info in a self-contained
> file looks like the only option to make it work reliably.
> It's also not possible to attribute kernel output to individual programs.

The first messages I want to look at is kernel output. Then, I look at
syz-program lines as needed. But current "a self-contained file" is
hard to find kernel output. Even if we keep both kernel output and
syz-program lines in a single file, we can improve readability by
splitting into kernel output section and syz-program section.

# Kernel output section start

[$(uptime)][$(caller_info)] executing program #0123456789abcdef0123456789abcdef
[$(uptime)][$(caller_info)] $(kernel_messages_caused_by_0123456789abcdef0123456789abcdef_are_here)
[$(uptime)][$(caller_info)] executing program #456789abcdef0123456789abcdef0123
[$(uptime)][$(caller_info)] $(kernel_messages_caused_by_456789abcdef0123456789abcdef0123_and_0123456789abcdef0123456789abcdef_are_here)
[$(uptime)][$(caller_info)] executing program #89abcdef0123456789abcdef01234567
[$(uptime)][$(caller_info)] $(kernel_messages_caused_by_89abcdef0123456789abcdef01234567_456789abcdef0123456789abcdef0123_and_0123456789abcdef0123456789abcdef_are_here)
[$(uptime)][$(caller_info)] BUG: unable to handle kernel paging request at $(address)
[$(uptime)][$(caller_info)] CPU: $(cpu) PID: $(pid) Comm: syz#89abcdef0123 Not tainted $(version) #$(build)
[$(uptime)][$(caller_info)] $(backtrace_of_caller_info_is_here)
[$(uptime)][$(caller_info)] Kernel panic - not syncing: Fatal exception

# Kernel output section end
# syzbot code section start
Program for #0123456789abcdef0123456789abcdef
$(program_lines_for_0123456789abcdef0123456789abcdef_is_here)
Program for #456789abcdef0123456789abcdef0123
$(program_lines_for_456789abcdef0123456789abcdef0123_is_here)
Program for #89abcdef0123456789abcdef01234567
$(program_lines_for_89abcdef0123456789abcdef01234567_is_here)
# syzbot code section end

[Dmitry Vyukov]

On Sat, Jan 19, 2019 at 2:10 PM Tetsuo Handa
<penguin...@i-love.sakura.ne.jp> wrote:
>
> On 2019/01/19 21:16, Dmitry Vyukov wrote:
> >> The question for me is, whether sysbot can detect hash collision with different
> >> syz-program lines before writing the hash value to /dev/kmsg, and retry by modifying
> >> syz-program lines in order to get a new hash value until collision is avoided.
> >> If it is difficult, simpler choice like current Unix time and PID could be used
> >> instead...
> >
> > Hummm, say, if you run syz-manager locally and report a bug, where
> > will the webserver and database that allows to download all satellite
> > info work? How long you need to keep this info and provide the web
> > service? You will also need to pay and maintain the server for... how
> > long? I don't see how this can work and how we can ask people to do
> > this. This frankly looks like overly complex solution to a problem
> > were simpler solutions will work. Keeping all info in a self-contained
> > file looks like the only option to make it work reliably.
> > It's also not possible to attribute kernel output to individual programs.
>
> The first messages I want to look at is kernel output. Then, I look at
> syz-program lines as needed. But current "a self-contained file" is
> hard to find kernel output.

I think everybody looks at kernel crash first, that's why we provide
kernel crash inline in the email so it's super easy to find. One does
not need to look at console output at all to read the crash message.
Console output is meant for more complex cases when a developer needs
to extract some long tail of custom information. We don't know what
exactly information a developer is looking for and it is different in
each case, so it's not possible to optimize for this. We preserve
console output intact to not destroy some potentially important
information. Say, if we start reordering messages, we lose timing
information and timing/interleaving information is important in some
cases.

[Tetsuo Handa]

On 2019/01/20 22:30, Dmitry Vyukov wrote:
>> The first messages I want to look at is kernel output. Then, I look at
>> syz-program lines as needed. But current "a self-contained file" is
>> hard to find kernel output.
>
> I think everybody looks at kernel crash first, that's why we provide
> kernel crash inline in the email so it's super easy to find. One does
> not need to look at console output at all to read the crash message.

I don't think so. Sometimes it happens that a backtrace of memory allocation
fault injection prior to the crash tells everything. But since such lines are
not immediately findable from a file containing console output, people fails
to understand what has happened.

And one (of my two suggestions) is about helping people to easily find kernel
messages from console output, by moving syzbot-program lines into a dedicated
location.

> Console output is meant for more complex cases when a developer needs
> to extract some long tail of custom information.

This "INFO: rcu detected stall in ndisc_alloc_skb" is exactly a case where only
syzbot-program lines can provide some clue. And the other (of my two suggestions)
is about preserving all syzbot-program lines in a file containing console output.

> We don't know what
> exactly information a developer is looking for and it is different in
> each case, so it's not possible to optimize for this.

I'm not asking to optimize. I'm asking to preserve all syzbot-program lines.

> We preserve
> console output intact to not destroy some potentially important
> information. Say, if we start reordering messages, we lose timing
> information and timing/interleaving information is important in some
> cases.

My suggestion is not a reordering of messages. It is a cross referencing.
The [$(uptime)] part acts as the timing information. Since inlining syzbot-program
line there makes difficult to find previous/next kernel messages, I'm suggesting
to move syzbot-program lines into a dedicated block and cross reference using some
identifiers like hash. There is no loss of timing information, and we can
reconstruct interleaved output (if needed) as long as identifiers are unique
within that report.

>
>> Even if we keep both kernel output and
>> syz-program lines in a single file, we can improve readability by
>> splitting into kernel output section and syz-program section.
>>
>> # Kernel output section start
>> [$(uptime)][$(caller_info)] executing program #0123456789abcdef0123456789abcdef
>> [$(uptime)][$(caller_info)] $(kernel_messages_caused_by_0123456789abcdef0123456789abcdef_are_here)
>> [$(uptime)][$(caller_info)] executing program #456789abcdef0123456789abcdef0123
>> [$(uptime)][$(caller_info)] $(kernel_messages_caused_by_456789abcdef0123456789abcdef0123_and_0123456789abcdef0123456789abcdef_are_here)
>> [$(uptime)][$(caller_info)] executing program #89abcdef0123456789abcdef01234567
>> [$(uptime)][$(caller_info)] $(kernel_messages_caused_by_89abcdef0123456789abcdef01234567_456789abcdef0123456789abcdef0123_and_0123456789abcdef0123456789abcdef_are_here)
>> [$(uptime)][$(caller_info)] BUG: unable to handle kernel paging request at $(address)
>> [$(uptime)][$(caller_info)] CPU: $(cpu) PID: $(pid) Comm: syz#89abcdef0123 Not tainted $(version) #$(build)
>> [$(uptime)][$(caller_info)] $(backtrace_of_caller_info_is_here)
>> [$(uptime)][$(caller_info)] Kernel panic - not syncing: Fatal exception
>> # Kernel output section end
>> # syzbot code section start
>> Program for #0123456789abcdef0123456789abcdef
>> $(program_lines_for_0123456789abcdef0123456789abcdef_is_here)
>> Program for #456789abcdef0123456789abcdef0123
>> $(program_lines_for_456789abcdef0123456789abcdef0123_is_here)
>> Program for #89abcdef0123456789abcdef01234567
>> $(program_lines_for_89abcdef0123456789abcdef01234567_is_here)
>> # syzbot code section end
>>
>

-------------------- Current output --------------------
[ 938.184721][T10912] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 938.193080][T10912] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[ 938.202030][T10912] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 938.210375][T10912] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
22:37:55 executing program 4:
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2)
write$binfmt_elf64(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c460000040000000000000000000000d40000004800000000000000000000000000000000001cca000000e4"], 0x2e)

[ 938.275686][T10912] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 938.300740][T10912] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
22:37:55 executing program 3:
bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xe, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x64, 0x4c000000}}, &(0x7f0000000200)='7R\xec\x1f\x83\"\x8e@\xb7Ec\x80!\xe8\x98\xb9\x0fc\x1e\xf9\x04`\x0e\x963kU\xd5:\n\x86\xfc\f`v\x92\xa0F\xa6R\xd10a\v7\x8cA\xd5taZ\xa8\x15\xb164\xd0\x98\xacm\x1c\x15\x8e}\xa9~\a?\x01\xbe\xfe\x04\f\xd2\x8b#A\x84J\x87\x02o\xb4\xd7\xaa\x83\xda\xfe\xfc\xf57\x90\xe0D\xcd\xd1Z\xe9\x99-\x82\xd0\'\a{\xe4\xef\x85\x83\xadJ\x8f\x88\xdeDH@\\\xea\xc4>\xc4\"\xdcl\a\x00\x00\x00\x00\x00\x00J\x88g\x1c\x19\xe52\xa2\x98\x06j8@iV\xb6Z\xdbR{,\xed\x05\x00c\xa5\xc8\x8fF\xd2\a\x11\xcdC1k\x8b\xb4[\xb16\xa6a\xe2\xe7\x8d\x88\x8d\xa8:\xc1\xcb\b', 0x2, 0x1074, &(0x7f0000014000)=""/4096, 0x0, 0x0, [0x3f000000]}, 0x48)

22:37:55 executing program 1:
r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000140)="a7e66891b3c4503a1061c17727c1d522854b5b6493f286a24a29c4741f0e38eef3c3f9843d3a0c490f0bb1e7d2d609accfefa8227ac2a7a79ae00d7c6f696bcd50d24eff01b9368c754ef748fe352124ced7d38607ec80d03d3ce497a5d65ef83da9366e221f7b509516091fb311b69319947307836405776778f944826f7364999fbc557e3d3a27e73b463ee362329e8d62294e51036508bb382c7830a2d4c728a3bfabeb544e0f3672a5019c9bc03bcd69c2e62721aabcc02386c74fd1e793610011348c794e5cee9763e05f0d3220e2da70007bd337bf4b1463c390ffb10611e8d0335e0ab726d63a4fc3dc3e16d18b536b6f8fc2d178c300d26ae9358d67")
ioctl$TIOCCONS(r0, 0x541d)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x1, {{0x2, 0x4e23, @multicast1}}}, 0x88)
read$FUSE(r0, 0x0, 0xfffffffffffffe69)

[ 938.449693][T10937] sg_write: data in/out 262108/4 bytes for SCSI command 0x0-- guessing data in;
[ 938.449693][T10937] program syz-executor4 not setting count and/or reply_len properly
22:37:56 executing program 2:
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='oom_adj\x00')
exit(0x0)
preadv(r0, &(0x7f0000001600), 0x0, 0x0)
ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000000)=0x20)

22:37:56 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
syz_mount_image$f2fs(&(0x7f0000000180)='f2fs\x00', &(0x7f00000001c0)='./file0\x00', 0x3d04, 0x0, 0x0, 0x4, &(0x7f0000002380)={[{@norecovery='norecovery'}, {@data_flush='data_flush'}, {@four_active_logs='active_logs=4'}, {@quota='quota'}, {@lazytime='lazytime'}, {@usrjquota={'usrjquota', 0x3d, 'security.SMACK64TRANSMUTE\x00'}}, {@jqfmt_vfsold='jqfmt=vfsold'}, {@discard='discard'}, {@jqfmt_vfsv0='jqfmt=vfsv0'}], [{@defcontext={'defcontext', 0x3d, 'system_u'}}, {@appraise='appraise'}, {@subj_role={'subj_role', 0x3d, '@\xb0#posix_acl_access'}}, {@dont_measure='dont_measure'}]})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)

22:37:56 executing program 1:
r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={<r1=>0x0}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000100)={r1, @in={{0x2, 0x4e21, @multicast2}}, 0xfffffffffffff177, 0x9, 0xd9e, 0x4, 0x100}, &(0x7f00000001c0)=0x98)
read$FUSE(r0, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000040)=0x7fffffff, 0x4)

22:37:56 executing program 4:
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2)
write$binfmt_elf64(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c460000040000000000000000000000d40000004c00000000000000000000000000000000001cca000000e4"], 0x2e)

22:37:56 executing program 3:
bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xe, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x64, 0x4c000000}}, &(0x7f0000000200)='7R\xec\x1f\x83\"\x8e@\xb7Ec\x80!\xe8\x98\xb9\x0fc\x1e\xf9\x04`\x0e\x963kU\xd5:\n\x86\xfc\f`v\x92\xa0F\xa6R\xd10a\v7\x8cA\xd5taZ\xa8\x15\xb164\xd0\x98\xacm\x1c\x15\x8e}\xa9~\a?\x01\xbe\xfe\x04\f\xd2\x8b#A\x84J\x87\x02o\xb4\xd7\xaa\x83\xda\xfe\xfc\xf57\x90\xe0D\xcd\xd1Z\xe9\x99-\x82\xd0\'\a{\xe4\xef\x85\x83\xadJ\x8f\x88\xdeDH@\\\xea\xc4>\xc4\"\xdcl\a\x00\x00\x00\x00\x00\x00J\x88g\x1c\x19\xe52\xa2\x98\x06j8@iV\xb6Z\xdbR{,\xed\x05\x00c\xa5\xc8\x8fF\xd2\a\x11\xcdC1k\x8b\xb4[\xb16\xa6a\xe2\xe7\x8d\x88\x8d\xa8:\xc1\xcb\b', 0x2, 0x1074, &(0x7f0000014000)=""/4096, 0x0, 0x0, [0x40000000]}, 0x48)

22:37:56 executing program 3:
bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xe, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x64, 0x4c000000}}, &(0x7f0000000200)='7R\xec\x1f\x83\"\x8e@\xb7Ec\x80!\xe8\x98\xb9\x0fc\x1e\xf9\x04`\x0e\x963kU\xd5:\n\x86\xfc\f`v\x92\xa0F\xa6R\xd10a\v7\x8cA\xd5taZ\xa8\x15\xb164\xd0\x98\xacm\x1c\x15\x8e}\xa9~\a?\x01\xbe\xfe\x04\f\xd2\x8b#A\x84J\x87\x02o\xb4\xd7\xaa\x83\xda\xfe\xfc\xf57\x90\xe0D\xcd\xd1Z\xe9\x99-\x82\xd0\'\a{\xe4\xef\x85\x83\xadJ\x8f\x88\xdeDH@\\\xea\xc4>\xc4\"\xdcl\a\x00\x00\x00\x00\x00\x00J\x88g\x1c\x19\xe52\xa2\x98\x06j8@iV\xb6Z\xdbR{,\xed\x05\x00c\xa5\xc8\x8fF\xd2\a\x11\xcdC1k\x8b\xb4[\xb16\xa6a\xe2\xe7\x8d\x88\x8d\xa8:\xc1\xcb\b', 0x2, 0x1074, &(0x7f0000014000)=""/4096, 0x0, 0x0, [0x43000000]}, 0x48)

22:37:56 executing program 4:
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2)
write$binfmt_elf64(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c460000040000000000000000000000d40000006800000000000000000000000000000000001cca000000e4"], 0x2e)

[ 939.167542][T10956] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
22:37:56 executing program 1:
r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0)
read$FUSE(r0, 0x0, 0x0)
setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000140)=ANY=[@ANYBLOB="6e61740000000000000000000000000000000000001842000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005810f528769d7fe60000000000000000000000000000000000000000000000080000000000000000000000000000000000008f93902e54bd6eee49bc89d5b50eb7c3e052d70064eef4bf3662c39f4d2a02ff3b3ea9b3ff0966d2295abf3525052e464025ac0019bf93103e68000222fd35d68a327e56f5ad1b43412cb6247787f783ea08e94f7d1ec55d6597df55dee150eb05600937a9e13d2afaac2edc72736559068a6f1d"], 0x78)
prctl$PR_GET_NAME(0x10, &(0x7f0000000040)=""/119)

[ 939.214806][T10956] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[ 939.276518][T10956] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 939.285099][T10956] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[ 939.336812][T10956] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 939.377329][T10956] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[ 939.411893][T10956] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 939.425615][T10956] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[ 942.734545][ T1043] ------------[ cut here ]------------
[ 942.740643][ T1043] kernel BUG at mm/page_alloc.c:3112!
[ 942.746017][ T1043] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 942.752096][ T1043] CPU: 0 PID: 1043 Comm: kcompactd0 Not tainted 5.0.0-rc2-next-20190116 #13
[ 942.760748][ T1043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 942.770806][ T1043] RIP: 0010:__isolate_free_page+0x4a8/0x680
[ 942.776697][ T1043] Code: 4c 39 e3 77 c0 0f b6 8d 74 ff ff ff b8 01 00 00 00 48 d3 e0 e9 11 fd ff ff 48 c7 c6 a0 65 52 88 4c 89 e7 e8 6a 14 10 00 0f 0b <0f> 0b 48 c7 c6 c0 66 52 88 4c 89 e7 e8 57 14 10 00 0f 0b 48 89 cf
[ 942.796291][ T1043] RSP: 0018:ffff8880a783ef58 EFLAGS: 00010003
[ 942.802345][ T1043] RAX: 0000000020000080 RBX: 0000000000000000 RCX: ffff88812fffc7e0
[ 942.810304][ T1043] RDX: 1ffff11025fff8fc RSI: 0000000000000008 RDI: ffff88812fffc7b0
[ 942.818281][ T1043] RBP: ffff8880a783f018 R08: ffff8880a78c8000 R09: ffffed1014f07df2
[ 942.826243][ T1043] R10: ffffed1014f07df1 R11: 0000000000000003 R12: ffff88812fffc7b0
[ 942.834209][ T1043] R13: 1ffff11014f07df2 R14: ffff88812fffc7b0 R15: ffff8880a783eff0
[ 942.842182][ T1043] FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
[ 942.851103][ T1043] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 942.857681][ T1043] CR2: 000000c4313a9410 CR3: 0000000009871000 CR4: 00000000001406f0
[ 942.865657][ T1043] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 942.873614][ T1043] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 942.881587][ T1043] Call Trace:
[ 942.884872][ T1043] ? lock_release+0xc40/0xc40
[ 942.889544][ T1043] ? rwlock_bug.part.0+0x90/0x90
[ 942.894489][ T1043] ? zone_watermark_ok+0x1b0/0x1b0
[ 942.899589][ T1043] ? trace_hardirqs_on+0xbd/0x310
[ 942.904619][ T1043] ? kasan_check_read+0x11/0x20
[ 942.909464][ T1043] compaction_alloc+0xd05/0x2970
-------------------- Current output --------------------

-------------------- My suggested output --------------------
[ 938.184721][T10912] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 938.193080][T10912] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[ 938.202030][T10912] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 938.210375][T10912] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[ 938.XXXXXX][ T$pid] 22:37:55 executing program #01234567:
[ 938.275686][T10912] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 938.300740][T10912] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[ 938.XXXXXX][ T$pid] 22:37:55 executing program #12345678:
[ 938.XXXXXX][ T$pid] 22:37:55 executing program #23456789:
[ 938.449693][T10937] sg_write: data in/out 262108/4 bytes for SCSI command 0x0-- guessing data in;
[ 938.449693][T10937] program syz-executor4 not setting count and/or reply_len properly
[ 939.XXXXXX][ T$pid] 22:37:56 executing program #3456789a:
[ 939.XXXXXX][ T$pid] 22:37:56 executing program #456789ab:
[ 939.XXXXXX][ T$pid] 22:37:56 executing program #56789abc:
[ 939.XXXXXX][ T$pid] 22:37:56 executing program #6789abcd:
[ 939.XXXXXX][ T$pid] 22:37:56 executing program #789abcde:
[ 939.XXXXXX][ T$pid] 22:37:56 executing program #89abcdef:
[ 939.XXXXXX][ T$pid] 22:37:56 executing program #9abcdef0:
[ 939.167542][T10956] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 939.XXXXXX][ T$pid] 22:37:56 executing program #abcdef01:
[ 939.214806][T10956] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[ 939.276518][T10956] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 939.285099][T10956] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[ 939.336812][T10956] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 939.377329][T10956] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[ 939.411893][T10956] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 939.425615][T10956] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[ 942.734545][ T1043] ------------[ cut here ]------------
[ 942.740643][ T1043] kernel BUG at mm/page_alloc.c:3112!
[ 942.746017][ T1043] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 942.752096][ T1043] CPU: 0 PID: 1043 Comm: kcompactd0 Not tainted 5.0.0-rc2-next-20190116 #13
[ 942.760748][ T1043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 942.770806][ T1043] RIP: 0010:__isolate_free_page+0x4a8/0x680
[ 942.776697][ T1043] Code: 4c 39 e3 77 c0 0f b6 8d 74 ff ff ff b8 01 00 00 00 48 d3 e0 e9 11 fd ff ff 48 c7 c6 a0 65 52 88 4c 89 e7 e8 6a 14 10 00 0f 0b <0f> 0b 48 c7 c6 c0 66 52 88 4c 89 e7 e8 57 14 10 00 0f 0b 48 89 cf
[ 942.796291][ T1043] RSP: 0018:ffff8880a783ef58 EFLAGS: 00010003
[ 942.802345][ T1043] RAX: 0000000020000080 RBX: 0000000000000000 RCX: ffff88812fffc7e0
[ 942.810304][ T1043] RDX: 1ffff11025fff8fc RSI: 0000000000000008 RDI: ffff88812fffc7b0
[ 942.818281][ T1043] RBP: ffff8880a783f018 R08: ffff8880a78c8000 R09: ffffed1014f07df2
[ 942.826243][ T1043] R10: ffffed1014f07df1 R11: 0000000000000003 R12: ffff88812fffc7b0
[ 942.834209][ T1043] R13: 1ffff11014f07df2 R14: ffff88812fffc7b0 R15: ffff8880a783eff0
[ 942.842182][ T1043] FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
[ 942.851103][ T1043] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 942.857681][ T1043] CR2: 000000c4313a9410 CR3: 0000000009871000 CR4: 00000000001406f0
[ 942.865657][ T1043] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 942.873614][ T1043] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 942.881587][ T1043] Call Trace:
[ 942.884872][ T1043] ? lock_release+0xc40/0xc40
[ 942.889544][ T1043] ? rwlock_bug.part.0+0x90/0x90
[ 942.894489][ T1043] ? zone_watermark_ok+0x1b0/0x1b0
[ 942.899589][ T1043] ? trace_hardirqs_on+0xbd/0x310
[ 942.904619][ T1043] ? kasan_check_read+0x11/0x20
[ 942.909464][ T1043] compaction_alloc+0xd05/0x2970

Program for #01234567
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2)
write$binfmt_elf64(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c460000040000000000000000000000d40000004800000000000000000000000000000000001cca000000e4"], 0x2e)

Program for #12345678
bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xe, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x64, 0x4c000000}}, &(0x7f0000000200)='7R\xec\x1f\x83\"\x8e@\xb7Ec\x80!\xe8\x98\xb9\x0fc\x1e\xf9\x04`\x0e\x963kU\xd5:\n\x86\xfc\f`v\x92\xa0F\xa6R\xd10a\v7\x8cA\xd5taZ\xa8\x15\xb164\xd0\x98\xacm\x1c\x15\x8e}\xa9~\a?\x01\xbe\xfe\x04\f\xd2\x8b#A\x84J\x87\x02o\xb4\xd7\xaa\x83\xda\xfe\xfc\xf57\x90\xe0D\xcd\xd1Z\xe9\x99-\x82\xd0\'\a{\xe4\xef\x85\x83\xadJ\x8f\x88\xdeDH@\\\xea\xc4>\xc4\"\xdcl\a\x00\x00\x00\x00\x00\x00J\x88g\x1c\x19\xe52\xa2\x98\x06j8@iV\xb6Z\xdbR{,\xed\x05\x00c\xa5\xc8\x8fF\xd2\a\x11\xcdC1k\x8b\xb4[\xb16\xa6a\xe2\xe7\x8d\x88\x8d\xa8:\xc1\xcb\b', 0x2, 0x1074, &(0x7f0000014000)=""/4096, 0x0, 0x0, [0x3f000000]}, 0x48)

Program for #23456789
r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000140)="a7e66891b3c4503a1061c17727c1d522854b5b6493f286a24a29c4741f0e38eef3c3f9843d3a0c490f0bb1e7d2d609accfefa8227ac2a7a79ae00d7c6f696bcd50d24eff01b9368c754ef748fe352124ced7d38607ec80d03d3ce497a5d65ef83da9366e221f7b509516091fb311b69319947307836405776778f944826f7364999fbc557e3d3a27e73b463ee362329e8d62294e51036508bb382c7830a2d4c728a3bfabeb544e0f3672a5019c9bc03bcd69c2e62721aabcc02386c74fd1e793610011348c794e5cee9763e05f0d3220e2da70007bd337bf4b1463c390ffb10611e8d0335e0ab726d63a4fc3dc3e16d18b536b6f8fc2d178c300d26ae9358d67")
ioctl$TIOCCONS(r0, 0x541d)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x1, {{0x2, 0x4e23, @multicast1}}}, 0x88)
read$FUSE(r0, 0x0, 0xfffffffffffffe69)

Program for #3456789a
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='oom_adj\x00')
exit(0x0)
preadv(r0, &(0x7f0000001600), 0x0, 0x0)
ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000000)=0x20)

Program for #456789ab
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
syz_mount_image$f2fs(&(0x7f0000000180)='f2fs\x00', &(0x7f00000001c0)='./file0\x00', 0x3d04, 0x0, 0x0, 0x4, &(0x7f0000002380)={[{@norecovery='norecovery'}, {@data_flush='data_flush'}, {@four_active_logs='active_logs=4'}, {@quota='quota'}, {@lazytime='lazytime'}, {@usrjquota={'usrjquota', 0x3d, 'security.SMACK64TRANSMUTE\x00'}}, {@jqfmt_vfsold='jqfmt=vfsold'}, {@discard='discard'}, {@jqfmt_vfsv0='jqfmt=vfsv0'}], [{@defcontext={'defcontext', 0x3d, 'system_u'}}, {@appraise='appraise'}, {@subj_role={'subj_role', 0x3d, '@\xb0#posix_acl_access'}}, {@dont_measure='dont_measure'}]})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)

Program for #56789abc
r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={<r1=>0x0}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000100)={r1, @in={{0x2, 0x4e21, @multicast2}}, 0xfffffffffffff177, 0x9, 0xd9e, 0x4, 0x100}, &(0x7f00000001c0)=0x98)
read$FUSE(r0, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000040)=0x7fffffff, 0x4)

Program for #6789abcd
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2)
write$binfmt_elf64(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c460000040000000000000000000000d40000004c00000000000000000000000000000000001cca000000e4"], 0x2e)

Program for #789abcde
bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xe, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x64, 0x4c000000}}, &(0x7f0000000200)='7R\xec\x1f\x83\"\x8e@\xb7Ec\x80!\xe8\x98\xb9\x0fc\x1e\xf9\x04`\x0e\x963kU\xd5:\n\x86\xfc\f`v\x92\xa0F\xa6R\xd10a\v7\x8cA\xd5taZ\xa8\x15\xb164\xd0\x98\xacm\x1c\x15\x8e}\xa9~\a?\x01\xbe\xfe\x04\f\xd2\x8b#A\x84J\x87\x02o\xb4\xd7\xaa\x83\xda\xfe\xfc\xf57\x90\xe0D\xcd\xd1Z\xe9\x99-\x82\xd0\'\a{\xe4\xef\x85\x83\xadJ\x8f\x88\xdeDH@\\\xea\xc4>\xc4\"\xdcl\a\x00\x00\x00\x00\x00\x00J\x88g\x1c\x19\xe52\xa2\x98\x06j8@iV\xb6Z\xdbR{,\xed\x05\x00c\xa5\xc8\x8fF\xd2\a\x11\xcdC1k\x8b\xb4[\xb16\xa6a\xe2\xe7\x8d\x88\x8d\xa8:\xc1\xcb\b', 0x2, 0x1074, &(0x7f0000014000)=""/4096, 0x0, 0x0, [0x40000000]}, 0x48)

Program for #89abcdef
bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xe, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x64, 0x4c000000}}, &(0x7f0000000200)='7R\xec\x1f\x83\"\x8e@\xb7Ec\x80!\xe8\x98\xb9\x0fc\x1e\xf9\x04`\x0e\x963kU\xd5:\n\x86\xfc\f`v\x92\xa0F\xa6R\xd10a\v7\x8cA\xd5taZ\xa8\x15\xb164\xd0\x98\xacm\x1c\x15\x8e}\xa9~\a?\x01\xbe\xfe\x04\f\xd2\x8b#A\x84J\x87\x02o\xb4\xd7\xaa\x83\xda\xfe\xfc\xf57\x90\xe0D\xcd\xd1Z\xe9\x99-\x82\xd0\'\a{\xe4\xef\x85\x83\xadJ\x8f\x88\xdeDH@\\\xea\xc4>\xc4\"\xdcl\a\x00\x00\x00\x00\x00\x00J\x88g\x1c\x19\xe52\xa2\x98\x06j8@iV\xb6Z\xdbR{,\xed\x05\x00c\xa5\xc8\x8fF\xd2\a\x11\xcdC1k\x8b\xb4[\xb16\xa6a\xe2\xe7\x8d\x88\x8d\xa8:\xc1\xcb\b', 0x2, 0x1074, &(0x7f0000014000)=""/4096, 0x0, 0x0, [0x43000000]}, 0x48)

Program for #9abcdef0
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2)
write$binfmt_elf64(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c460000040000000000000000000000d40000006800000000000000000000000000000000001cca000000e4"], 0x2e)

Program for #abcdef01
r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0)
read$FUSE(r0, 0x0, 0x0)
setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000140)=ANY=[@ANYBLOB="6e61740000000000000000000000000000000000001842000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005810f528769d7fe60000000000000000000000000000000000000000000000080000000000000000000000000000000000008f93902e54bd6eee49bc89d5b50eb7c3e052d70064eef4bf3662c39f4d2a02ff3b3ea9b3ff0966d2295abf3525052e464025ac0019bf93103e68000222fd35d68a327e56f5ad1b43412cb6247787f783ea08e94f7d1ec55d6597df55dee150eb05600937a9e13d2afaac2edc72736559068a6f1d"], 0x78)
prctl$PR_GET_NAME(0x10, &(0x7f0000000040)=""/119)
-------------------- My suggested output --------------------

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.