BUG: unable to handle kernel paging request in shrink_slab

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 3ee15ba60e6b Add linux-next specific files for 20180712
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=151f3e78400000
kernel config: https://syzkaller.appspot.com/x/.config?x=fe1c3df2c7c0c81
dashboard link: https://syzkaller.appspot.com/bug?extid=94f86a3ca066d81607cd
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [ak...@linux-foundation.org arya...@virtuozzo.com
jba...@fb.com ktk...@virtuozzo.com linux-...@vger.kernel.org
linu...@kvack.org mho...@suse.com penguin...@I-love.SAKURA.ne.jp
s...@canb.auug.org.au shak...@google.com vdavyd...@gmail.com
wi...@infradead.org ying....@intel.com]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+94f86a...@syzkaller.appspotmail.com

kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffffea00073df600
PGD 21ffed067 P4D 21ffed067 PUD 21ffec067 PMD 800000021e8001e3
Oops: 0011 [#1] SMP KASAN
CPU: 0 PID: 1534 Comm: kswapd0 Not tainted 4.18.0-rc4-next-20180712+ #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:0xffffea00073df600
Code: ff ff 00 04 00 00 00 00 ad de 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00
fc ff 02 00 01 00 00 00 00 ad de 00 02 00 00 00 00
RSP: 0018:ffff8801d3e87310 EFLAGS: 00010246
RAX: ffffea00073df600 RBX: dffffc0000000000 RCX: ffffffff81a1b96d
RDX: 1ffff1003a5c0e86 RSI: ffff8801d3e87590 RDI: ffff8801d2e07430
RBP: ffff8801d3e87500 R08: ffff8801d3e76140 R09: ffffed003ae39498
R10: ffffed003ae39498 R11: ffff8801d71ca4c7 R12: ffff8801d3e87590
R13: ffff8801d2e07430 R14: ffff8801d2e07458 R15: ffffea00075a2e00
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffea00073df600 CR3: 0000000196beb000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
shrink_slab_memcg mm/vmscan.c:598 [inline]
shrink_slab+0x861/0xa60 mm/vmscan.c:671
shrink_node+0x429/0x16a0 mm/vmscan.c:2735
kswapd_shrink_node mm/vmscan.c:3457 [inline]
balance_pgdat+0x7ca/0x1010 mm/vmscan.c:3567
kswapd+0x82e/0x12f0 mm/vmscan.c:3789
kthread+0x345/0x410 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415
Modules linked in:
Dumping ftrace buffer:
(ftrace buffer empty)
CR2: ffffea00073df600
---[ end trace 4193c8a77915f27e ]---
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffffea00073df600
RIP: 0010:0xffffea00073df600
PGD 21ffed067
Code:
P4D 21ffed067
ff
PUD 21ffec067
ff
PMD 800000021e8001e3
00
04
Oops: 0011 [#2] SMP KASAN
00
CPU: 1 PID: 19154 Comm: syz-executor6 Tainted: G D
4.18.0-rc4-next-20180712+ #5
00
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
00
RIP: 0010:0xffffea00073df600
00
Code:
ad
ff
de
ff
00
00
00
04
00
00
00
00
00
00
00
00
00
ad
00
de
00
00
00
00 00
00
00
00
00
00
00
00
00
00
00
00
00
ff
00 00
ff
00
ff
00
ff
00
00
00
00
00
00
ff
00
ff
00
ff
00
ff
00
00
00
00
00
00
00
00
00
00
00
00
<00>
00
00
00
00
00
00
00
00
00
fc
00
ff
<00>
02
00
00
00
01
00
00
00
00
fc
00
ff
00 ad
02
de
00
00
01
02
00
00
00
00
00
00
00
00
ad
de
RSP: 0018:ffff8801d3e87310 EFLAGS: 00010246
00
02
RAX: ffffea00073df600 RBX: dffffc0000000000 RCX: ffffffff81a1b96d
00
RDX: 1ffff1003a5c0e86 RSI: ffff8801d3e87590 RDI: ffff8801d2e07430
00
RBP: ffff8801d3e87500 R08: ffff8801d3e76140 R09: ffffed003ae39498
00
R10: ffffed003ae39498 R11: ffff8801d71ca4c7 R12: ffff8801d3e87590
00
R13: ffff8801d2e07430 R14: ffff8801d2e07458 R15: ffffea00075a2e00
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
RSP: 0018:ffff8801cf56e0b0 EFLAGS: 00010246
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffea00073df600 CR3: 0000000196beb000 CR4: 00000000001406f0
RAX: ffffea00073df600 RBX: dffffc0000000000 RCX: ffffffff81a1b96d
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
RDX: 1ffff1003a5c0e86 RSI: ffff8801cf56e330 RDI: ffff8801d2e07430
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
RBP: ffff8801cf56e2a0 R08: ffff88019b6f4280 R09: ffffed003ae39410


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.