BUG: sleeping function called from invalid context in htb_destroy

Status: upstream: reported C repro on 2019/10/05 07:11
Reported-by: syzbot+bdc10f2a2adb0a5b7fad@syzkaller.appspotmail.com
First crash: 2514d, last: 2264d
Fix bisection the fix commit could be any of (bisect log):
  b98aebd29824 Linux 4.14.150
  56dfe6252c68 Linux 4.14.188
   
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: sleeping function called from invalid context in htb_destroy 5 syz, C done 2 1979d 2500d 1/1 fixed on 2021/04/22 11:27
▶ ▼ Last patch testing requests (6)
Created Duration User Patch Repo Result
2023/01/24 08:32 10m retest repro linux-4.14.y report log
2023/01/24 07:32 13m retest repro linux-4.14.y report log
2023/01/24 06:32 9m retest repro linux-4.14.y report log
2022/09/07 01:27 9m retest repro linux-4.14.y error
2022/09/07 00:27 8m retest repro linux-4.14.y report log
2022/09/06 23:27 9m retest repro linux-4.14.y report log
▶ ▼ Fix bisection attempts (8)
Created Duration User Patch Repo Result
2020/07/10 15:24 37m bisect fix linux-4.14.y OK (2) job log
2020/06/10 14:45 38m bisect fix linux-4.14.y OK (0) job log log
2020/05/11 14:05 39m bisect fix linux-4.14.y OK (0) job log log
2020/04/11 13:28 37m bisect fix linux-4.14.y OK (0) job log log
2020/03/12 12:50 38m bisect fix linux-4.14.y OK (0) job log log
2020/02/11 09:56 37m bisect fix linux-4.14.y OK (0) job log log
2020/01/12 09:19 36m bisect fix linux-4.14.y OK (0) job log log
2019/12/13 08:24 36m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
audit: type=1400 audit(1571829991.919:36): avc:  denied  { map } for  pid=6885 comm="syz-executor790" path="/root/syz-executor790262129" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
IPVS: ftp: loaded support on port[0] = 21
BUG: sleeping function called from invalid context at kernel/workqueue.c:2816
in_atomic(): 1, irqs_disabled(): 0, pid: 6888, name: syz-executor790
2 locks held by syz-executor790/6888:
 #0:  (rtnl_mutex){+.+.}, at: [<ffffffff84d9103a>] rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0:  (rtnl_mutex){+.+.}, at: [<ffffffff84d9103a>] rtnetlink_rcv_msg+0x33a/0xb70 net/core/rtnetlink.c:4280
 #1:  (&qdisc_rx_lock){+...}, at: [<ffffffff84ea378e>] spin_lock_bh include/linux/spinlock.h:322 [inline]
 #1:  (&qdisc_rx_lock){+...}, at: [<ffffffff84ea378e>] sch_tree_lock include/net/sch_generic.h:355 [inline]
 #1:  (&qdisc_rx_lock){+...}, at: [<ffffffff84ea378e>] red_change+0x32e/0x1030 net/sched/sch_red.c:199
Preemption disabled at:
[<ffffffff84ea378e>] spin_lock_bh include/linux/spinlock.h:322 [inline]
[<ffffffff84ea378e>] sch_tree_lock include/net/sch_generic.h:355 [inline]
[<ffffffff84ea378e>] red_change+0x32e/0x1030 net/sched/sch_red.c:199
CPU: 0 PID: 6888 Comm: syz-executor790 Not tainted 4.14.150 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x138/0x197 lib/dump_stack.c:53
 ___might_sleep.cold+0x1bd/0x1f6 kernel/sched/core.c:6039
 __might_sleep+0x93/0xb0 kernel/sched/core.c:5992
 start_flush_work kernel/workqueue.c:2816 [inline]
 flush_work+0xdb/0x730 kernel/workqueue.c:2884
 __cancel_work_timer+0x2f0/0x480 kernel/workqueue.c:2956
 cancel_work_sync+0x18/0x20 kernel/workqueue.c:2992
 htb_destroy+0x26/0x420 net/sched/sch_htb.c:1246
 qdisc_destroy+0x157/0x320 net/sched/sch_generic.c:725
 red_change+0x4d4/0x1030 net/sched/sch_red.c:205
 qdisc_change net/sched/sch_api.c:1144 [inline]
 tc_modify_qdisc+0xc5a/0x1270 net/sched/sch_api.c:1410
 rtnetlink_rcv_msg+0x3eb/0xb70 net/core/rtnetlink.c:4285
 netlink_rcv_skb+0x14f/0x3c0 net/netlink/af_netlink.c:2432
 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4297
 netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
 netlink_unicast+0x45d/0x640 net/netlink/af_netlink.c:1312
 netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xce/0x110 net/socket.c:656
 ___sys_sendmsg+0x70a/0x840 net/socket.c:2062
 __sys_sendmsg+0xb9/0x140 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2103
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4464d9
RSP: 002b:00007ff8d2e9fd98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006dbc58 RCX: 00000000004464d9
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004
RBP: 00000000006dbc50 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00000000006dbc5c
R13: 00000000004aea84 R14: b35d2484a6425def R15: 10eb52a57aaf8377

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/23 11:29 linux-4.14.y b98aebd29824 d0686497 .config console log report syz C ci2-linux-4-14
2019/10/23 07:11 linux-4.14.y b98aebd29824 d0686497 .config console log report syz C ci2-linux-4-14
2019/10/05 06:10 linux-4.14.y f6e27dbb1afa f3f7d9c8 .config console log report syz C ci2-linux-4-14
* Struck through repros no longer work on HEAD.