BUG: sleeping function called from invalid context in __do_page_fault

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 7d80e121 Linux 4.14.136
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13e2258a600000
kernel config: https://syzkaller.appspot.com/x/.config?x=4ca439d79e42214b
dashboard link: https://syzkaller.appspot.com/bug?extid=88ac58c27ce07fff6b76
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15a1598a600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1160e9aa600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+88ac58...@syzkaller.appspotmail.com

audit: type=1400 audit(1565061361.122:36): avc: denied { map } for
pid=6899 comm="syz-executor131" path="/root/syz-executor131694240"
dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
IPVS: ftp: loaded support on port[0] = 21
overlayfs: fs on 'file0' does not support file handles, falling back to
index=off.
BUG: sleeping function called from invalid context at
arch/x86/mm/fault.c:1366
in_atomic(): 0, irqs_disabled(): 1, pid: 6901, name: syz-executor131
no locks held by syz-executor131/6901.
irq event stamp: 1423
hardirqs last enabled at (1423): [<ffffffff861be55b>]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
hardirqs last enabled at (1423): [<ffffffff861be55b>]
_raw_spin_unlock_irqrestore+0x6b/0xe0 kernel/locking/spinlock.c:192
hardirqs last disabled at (1422): [<ffffffff861be7ef>]
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (1422): [<ffffffff861be7ef>]
_raw_spin_lock_irqsave+0x6f/0xcd kernel/locking/spinlock.c:160
softirqs last enabled at (1360): [<ffffffff8545820b>] sock_net
include/net/sock.h:2328 [inline]
softirqs last enabled at (1360): [<ffffffff8545820b>]
unix_create1+0x42b/0x500 net/unix/af_unix.c:793
softirqs last disabled at (1358): [<ffffffff85458165>]
init_waitqueue_func_entry include/linux/wait.h:91 [inline]
softirqs last disabled at (1358): [<ffffffff85458165>]
unix_create1+0x385/0x500 net/unix/af_unix.c:786
CPU: 0 PID: 6901 Comm: syz-executor131 Not tainted 4.14.136 #32
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
___might_sleep.cold+0x1bd/0x1f6 kernel/sched/core.c:6039
__might_sleep+0x93/0xb0 kernel/sched/core.c:5992
__do_page_fault+0x2ed/0xb80 arch/x86/mm/fault.c:1366
do_page_fault+0x71/0x511 arch/x86/mm/fault.c:1498
page_fault+0x25/0x50 arch/x86/entry/entry_64.S:1120
RIP: 0010:atomic_inc arch/x86/include/asm/atomic.h:92 [inline]
RIP: 0010:__lock_acquire+0x20c/0x4620 kernel/locking/lockdep.c:3378
RSP: 0018:ffff88808bf67480 EFLAGS: 00010086
RAX: ffffffffffffffff RBX: 0000000000000001 RCX: 0000000000000001
RDX: 1ffff110101ba8a8 RSI: 0000000000000000 RDI: ffff888080dd4540
RBP: ffff88808bf67630 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888084e7a640 R12: ffff888080dd4538
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3991
kernfs_get_active fs/kernfs/dir.c:421 [inline]
kernfs_get_active+0xb6/0xe0 fs/kernfs/dir.c:412
kernfs_fop_poll+0x11f/0x280 fs/kernfs/file.c:841
do_select+0x8c0/0x13b0 fs/select.c:513
core_sys_select+0x461/0x6d0 fs/select.c:656
do_pselect fs/select.c:733 [inline]
SYSC_pselect6 fs/select.c:774 [inline]
SyS_pselect6+0x3f2/0x460 fs/select.c:759
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441d99
RSP: 002b:00007ffd826c0108 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441d99
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000040
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000140 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000402ba0 R14: 0000000000000000 R15: 0000000000000000
BUG: unable to handle kernel NULL pointer dereference at 0000000000000137
IP: atomic_inc arch/x86/include/asm/atomic.h:92 [inline]
IP: __lock_acquire+0x20c/0x4620 kernel/locking/lockdep.c:3378
PGD 844ba067 P4D 844ba067 PUD 9ae72067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 6901 Comm: syz-executor131 Tainted: G W 4.14.136
#32
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff888084e7a640 task.stack: ffff88808bf60000
RIP: 0010:atomic_inc arch/x86/include/asm/atomic.h:92 [inline]
RIP: 0010:__lock_acquire+0x20c/0x4620 kernel/locking/lockdep.c:3378
RSP: 0018:ffff88808bf67480 EFLAGS: 00010086
RAX: ffffffffffffffff RBX: 0000000000000001 RCX: 0000000000000001
RDX: 1ffff110101ba8a8 RSI: 0000000000000000 RDI: ffff888080dd4540
RBP: ffff88808bf67630 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888084e7a640 R12: ffff888080dd4538
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
FS: 000000000158e880(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000137 CR3: 000000008b7d8000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3991
kernfs_get_active fs/kernfs/dir.c:421 [inline]
kernfs_get_active+0xb6/0xe0 fs/kernfs/dir.c:412
kernfs_fop_poll+0x11f/0x280 fs/kernfs/file.c:841
do_select+0x8c0/0x13b0 fs/select.c:513
core_sys_select+0x461/0x6d0 fs/select.c:656
do_pselect fs/select.c:733 [inline]
SYSC_pselect6 fs/select.c:774 [inline]
SyS_pselect6+0x3f2/0x460 fs/select.c:759
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441d99
RSP: 002b:00007ffd826c0108 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441d99
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000040
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000140 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000402ba0 R14: 0000000000000000 R15: 0000000000000000
Code: 00 fc ff df 41 89 f5 4b 8d 7c ec 08 48 89 fa 48 c1 ea 03 80 3c 02 00
0f 85 bf 2e 00 00 4b 8b 44 ec 08 48 85 c0 0f 84 15 ff ff ff <f0> ff 80 38
01 00 00 49 8d b3 78 08 00 00 48 ba 00 00 00 00 00
RIP: atomic_inc arch/x86/include/asm/atomic.h:92 [inline] RSP:
ffff88808bf67480
RIP: __lock_acquire+0x20c/0x4620 kernel/locking/lockdep.c:3378 RSP:
ffff88808bf67480
CR2: 0000000000000137
---[ end trace d7ca4bb2b86ae2a7 ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches