WARNING: locking bug in finish_task

WARNING: locking bug in finish_task_switch
Status: upstream: reported C repro on 2020/01/13 19:34
Reported-by: syzbot+edec84a8b77e5a0cae31@syzkaller.appspotmail.com
First crash: 282d, last: 8d09h

Cause bisection: introduced by (bisect log):

commit 7152c88e556bcbee525689063c260cd296f295a8
Author: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Date: Tue Oct 18 19:44:11 2016 +0000

[media] c8sectpfe: don't break long lines

Crash: WARNING in nf_unregister_net_hook (log)
Repro: C syz .config

Sample crash report:

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 0 PID: 16583 at kernel/locking/lockdep.c:183 hlock_class kernel/locking/lockdep.c:183 [inline]
WARNING: CPU: 0 PID: 16583 at kernel/locking/lockdep.c:183 hlock_class kernel/locking/lockdep.c:172 [inline]
WARNING: CPU: 0 PID: 16583 at kernel/locking/lockdep.c:183 check_wait_context kernel/locking/lockdep.c:4054 [inline]
WARNING: CPU: 0 PID: 16583 at kernel/locking/lockdep.c:183 __lock_acquire+0x1a51/0x4c50 kernel/locking/lockdep.c:4305
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 16583 Comm: syz-executor246 Not tainted 5.7.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:221
 __warn.cold+0x2f/0x35 kernel/panic.c:582
 report_bug+0x27b/0x2f0 lib/bug.c:195
 fixup_bug arch/x86/kernel/traps.c:175 [inline]
 fixup_bug arch/x86/kernel/traps.c:170 [inline]
 do_error_trap+0x12b/0x220 arch/x86/kernel/traps.c:267
 do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:286
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:hlock_class kernel/locking/lockdep.c:183 [inline]
RIP: 0010:hlock_class kernel/locking/lockdep.c:172 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4054 [inline]
RIP: 0010:__lock_acquire+0x1a51/0x4c50 kernel/locking/lockdep.c:4305
Code: 90 ca 89 8a e8 10 d6 57 00 8b 0d da 8a 30 09 85 c9 0f 85 7e ed ff ff 48 c7 c6 40 98 2b 88 48 c7 c7 c0 97 2b 88 e8 37 2f eb ff <0f> 0b 31 d2 e9 6f ec ff ff 8b 94 24 58 01 00 00 85 d2 0f 84 6f 03
RSP: 0018:ffffc9000816f610 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000
RDX: 0000000040000000 RSI: ffffffff815ce7f1 RDI: fffff5200102deb4
RBP: 000000000000062b R08: ffff88809f3c2040 R09: fffffbfff13366fd
R10: ffffffff899b37e3 R11: fffffbfff13366fc R12: ffff88809f3c2040
R13: 000000000000002b R14: 0000000000000001 R15: dffffc0000000000
 lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
 finish_lock_switch kernel/sched/core.c:3105 [inline]
 finish_task_switch+0x13f/0x750 kernel/sched/core.c:3206
 context_switch kernel/sched/core.c:3370 [inline]
 __schedule+0x93f/0x1ff0 kernel/sched/core.c:4083
 preempt_schedule_irq+0xb0/0x150 kernel/sched/core.c:4341
 retint_kernel+0x1b/0x2b
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:759 [inline]
RIP: 0010:lock_acquire+0x267/0x8f0 kernel/locking/lockdep.c:4937
Code: 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 c6 05 00 00 48 83 3d c5 36 3b 08 00 0f 84 65 04 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 48 03 44 24 08 48 c7
RSP: 0018:ffffc9000816fa70 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff132980c RBX: ffff88809f3c2040 RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffffffff8c336c98 RDI: 0000000000000282
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff8c468417 R11: fffffbfff188d082 R12: 0000000000000000
R13: ffff888095e6d138 R14: 0000000000000000 R15: 0000000000000000
 flush_workqueue+0x11f/0x14f0 kernel/workqueue.c:2779
 hci_dev_open+0xdb/0x280 net/bluetooth/hci_core.c:1651
 hci_sock_bind+0x427/0x1140 net/bluetooth/hci_sock.c:1200
 __sys_bind+0x20e/0x250 net/socket.c:1662
 __do_sys_bind net/socket.c:1673 [inline]
 __se_sys_bind net/socket.c:1671 [inline]
 __x64_sys_bind+0x6f/0xb0 net/socket.c:1671
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x446ca9
Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 06 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f45bde1edb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031
RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 0000000000446ca9
RDX: 0000000000000006 RSI: 0000000020000080 RDI: 0000000000000004
RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc2c
R13: 00007ffc436c210f R14: 00007f45bde1f9c0 R15: 20c49ba5e353f7cf
Shutting down cpus with NMI
Kernel Offset: disabled
Rebooting in 86400 seconds..

Fix bisection attempts:
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro
ci-upstream-kasan-gce-root	2020/10/12 02:38	upstream	bbf5c979	bd28eb9d	.config	log	report	syz	C
ci-upstream-kasan-gce-root	2020/09/11 16:41	upstream	581cb3a2	bd28eb9d	.config	log	report	syz	C
ci-upstream-kasan-gce-root	2020/08/10 17:36	upstream	fc80c51f	bd28eb9d	.config	log	report	syz	C
ci-upstream-kasan-gce-root	2020/07/10 23:22	upstream	aa0c9086	bd28eb9d	.config	log	report	syz	C

Crashes (8):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-upstream-kasan-gce-root	2020/05/24 21:32	upstream	caffb99b	bd28eb9d	.config	log	report	syz	C	davem@davemloft.net, johan.hedberg@gmail.com, kuba@kernel.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org
ci-upstream-kasan-gce-selinux-root	2020/05/24 19:53	upstream	caffb99b	bd28eb9d	.config	log	report	syz	C	davem@davemloft.net, johan.hedberg@gmail.com, kuba@kernel.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org
ci-upstream-linux-next-kasan-gce-root	2020/05/21 07:41	linux-next	ac935d22	c61086ab	.config	log	report	syz	C	davem@davemloft.net, johan.hedberg@gmail.com, kuba@kernel.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org
ci-upstream-linux-next-kasan-gce-root	2020/05/18 10:18	linux-next	ac935d22	37bccd4e	.config	log	report	syz	C	davem@davemloft.net, johan.hedberg@gmail.com, kuba@kernel.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org
ci-upstream-linux-next-kasan-gce-root	2020/03/17 18:29	linux-next	770fbb32	749688d2	.config	log	report	syz	C	davem@davemloft.net, johan.hedberg@gmail.com, kuba@kernel.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org
ci-upstream-linux-next-kasan-gce-root	2020/01/12 00:12	linux-next	6c09d7db	4c04afaa	.config	log	report	syz	C	davem@davemloft.net, johan.hedberg@gmail.com, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org
ci-upstream-kasan-gce-root	2020/05/18 06:50	upstream	b9bbe6ed	37bccd4e	.config	log	report			davem@davemloft.net, johan.hedberg@gmail.com, kuba@kernel.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org
ci-upstream-kasan-gce-root	2020/03/07 08:59	upstream	fb279f4e	fd2a5f28	.config	log	report			davem@davemloft.net, johan.hedberg@gmail.com, kuba@kernel.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org