================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
sshd-session/5939 is leaving the kernel with locks still held!
1 lock held by sshd-session/5939:
#0: ffffffff8e7e5460 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e7e5460 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8e7e5460 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290
BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:323
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5939, name: sshd-session
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
CPU: 3 UID: 0 PID: 5939 Comm: sshd-session Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
__might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9162
might_alloc include/linux/sched/mm.h:323 [inline]
prepare_alloc_pages+0x44a/0x5f0 mm/page_alloc.c:4995
__alloc_frozen_pages_noprof+0x19a/0x2bc0 mm/page_alloc.c:5215
alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490
folio_alloc_mpol_noprof+0x36/0x260 mm/mempolicy.c:2509
vma_alloc_folio_noprof+0xed/0x1d0 mm/mempolicy.c:2544
folio_prealloc mm/memory.c:1193 [inline]
do_cow_fault mm/memory.c:5917 [inline]
do_fault+0x1e6/0x1750 mm/memory.c:6029
do_pte_missing mm/memory.c:4550 [inline]
handle_pte_fault mm/memory.c:6411 [inline]
__handle_mm_fault+0x187d/0x2a00 mm/memory.c:6549
handle_mm_fault+0x36d/0xa20 mm/memory.c:6718
do_user_addr_fault+0x5a3/0x12f0 arch/x86/mm/fault.c:1334
handle_page_fault arch/x86/mm/fault.c:1474 [inline]
exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fbb0d6688ec
Code: 1f 80 00 00 00 00 48 8b 31 8b 51 08 4c 01 fe 48 83 fa 26 74 0a 48 83 fa 08 0f 85 ef 3c ff ff 48 8b 51 10 48 83 c1 18 4c 01 fa <48> 89 16 48 39 d9 72 d4 4d 8b 9a 08 02 00 00 4d 85 db 0f 84 ec 0b
RSP: 002b:00007ffd2bde5450 EFLAGS: 00010202
RAX: 00007fbb0ce14308 RBX: 00007fbb0cec90c0 RCX: 00007fbb0ce82f98
RDX: 00007fbb0d1d4e92 RSI: 00007fbb0d2fd000 RDI: 00007fbb0cec9fc0
RBP: 00007ffd2bde5570 R08: 00007fbb0cec9180 R09: 00007fbb0cec9fc0
R10: 00007fbb0d652050 R11: 0000000000000000 R12: 00007ffd2bde5500
R13: 00007ffd2bde5500 R14: 00007fbb0d652050 R15: 00007fbb0ce00000
------------[ cut here ]------------
Voluntary context switch within RCU read-side critical section!
WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332, CPU#3: sshd-session/5939
Modules linked in:
CPU: 3 UID: 0 PID: 5939 Comm: sshd-session Tainted: G W syzkaller #0 PREEMPT(full)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332
Code: c1 ea 03 80 3c 02 00 0f 85 9b 0b 00 00 48 8b 53 28 b9 01 00 00 00 4c 89 ef e8 a3 cf fe ff e9 1d f9 ff ff 48 8d 3d 97 87 f0 0e <67> 48 0f b9 3a e9 99 f8 ff ff 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0018:ffffc9000334f5b0 EFLAGS: 00010002
RAX: 0000000000000001 RBX: ffff88806a73c280 RCX: ffffffff81eea731
RDX: 0000000000000000 RSI: ffffffff8c1c1e80 RDI: ffffffff90dfa2f0
RBP: ffff888024a7a500 R08: 0000000000000000 R09: fffffbfff21b81ca
R10: ffffffff90dc0e57 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888024a7a9c4 R14: ffff88806a73b240 R15: ffffffff90dc41e4
FS: 00007fbb0d451300(0000) GS:ffff8880d65e1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055f36ce00204 CR3: 0000000035d8a000 CR4: 0000000000352ef0
Call Trace:
__schedule+0x276/0x6820 kernel/sched/core.c:7043
__schedule_loop kernel/sched/core.c:7267 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7282
schedule_hrtimeout_range_clock+0x2d0/0x310 kernel/time/sleep_timeout.c:207
poll_schedule_timeout.constprop.0+0xbe/0x1b0 fs/select.c:241
do_poll fs/select.c:954 [inline]
do_sys_poll+0x9a9/0xe90 fs/select.c:1004
__do_sys_poll fs/select.c:1061 [inline]
__se_sys_poll fs/select.c:1049 [inline]
__x64_sys_poll+0x109/0x420 fs/select.c:1049
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbb0cca7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd2bde51e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000007
RAX: ffffffffffffffda RBX: 00007fbb0d451300 RCX: 00007fbb0cca7407
RDX: ffffffffffffffff RSI: 0000000000000002 RDI: 00007ffd2bde5250
RBP: 000055f36ce00200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffd2bde5250
R13: 00007ffd2bde52c0 R14: 000055f392348500 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: c1 ea 03 shr $0x3,%edx
3: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
7: 0f 85 9b 0b 00 00 jne 0xba8
d: 48 8b 53 28 mov 0x28(%rbx),%rdx
11: b9 01 00 00 00 mov $0x1,%ecx
16: 4c 89 ef mov %r13,%rdi
19: e8 a3 cf fe ff call 0xfffecfc1
1e: e9 1d f9 ff ff jmp 0xfffff940
23: 48 8d 3d 97 87 f0 0e lea 0xef08797(%rip),%rdi # 0xef087c1
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: e9 99 f8 ff ff jmp 0xfffff8cd
34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3b: fc ff df
3e: 48 rex.W
3f: 8d .byte 0x8d