wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 hrtimer: interrupt took 45595 ns netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready BUG: sleeping function called from invalid context at net/mac80211/sta_info.c:1844 in_atomic(): 0, irqs_disabled(): 0, pid: 22, name: kworker/u4:1 4 locks held by kworker/u4:1/22: #0: ("%s"wiphy_name(local->hw.wiphy)){+.+.}, at: [] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2087 IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 #1: ((&sdata->work)){+.+.}, at: [] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2091 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 #2: (&wdev->mtx){+.+.}, at: [] sdata_lock net/mac80211/ieee80211_i.h:986 [inline] #2: (&wdev->mtx){+.+.}, at: [] ieee80211_ibss_work+0x72/0xc90 net/mac80211/ibss.c:1675 IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready IPVS: ftp: loaded support on port[0] = 21 #3: (rcu_read_lock){....}, at: [] sta_info_insert_finish net/mac80211/sta_info.c:553 [inline] #3: (rcu_read_lock){....}, at: [] sta_info_insert_rcu+0x48d/0x1f40 net/mac80211/sta_info.c:634 Preemption disabled at: [] rcu_lockdep_current_cpu_online kernel/rcu/tree.c:1185 [inline] [] rcu_lockdep_current_cpu_online+0x30/0x140 kernel/rcu/tree.c:1177 IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready CPU: 0 PID: 22 Comm: kworker/u4:1 Not tainted 4.14.208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: phy8 ieee80211_iface_work Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x283 lib/dump_stack.c:58 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6042 sta_info_move_state+0x32/0x930 net/mac80211/sta_info.c:1844 sta_info_free+0x50/0x330 net/mac80211/sta_info.c:260 sta_info_insert_rcu+0x23c/0x1f40 net/mac80211/sta_info.c:640 ieee80211_ibss_finish_sta+0x1db/0x2b0 net/mac80211/ibss.c:601 netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. ieee80211_ibss_work+0x260/0xc90 net/mac80211/ibss.c:1692 ieee80211_iface_work+0x690/0x770 net/mac80211/iface.c:1383 process_one_work+0x793/0x14a0 kernel/workqueue.c:2116 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready capability: warning: `syz-executor.5' uses deprecated v2 capabilities in a way that may be insecure netlink: 544 bytes leftover after parsing attributes in process `syz-executor.5'. netlink: 544 bytes leftover after parsing attributes in process `syz-executor.5'. Dev loop1: unable to read RDB block 8 loop1: unable to read partition table loop1: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop1 () failed (rc=-5) print_req_error: I/O error, dev loop1, sector 0 Buffer I/O error on dev loop1, logical block 0, async page read ldm_validate_partition_table(): Disk read failed. Dev loop1: unable to read RDB block 0 loop1: unable to read partition table loop1: partition table beyond EOD, truncated EXT4-fs (loop3): Unrecognized mount option "data_err=ignoĦe" or missing value EXT4-fs: Warning: mounting with data=journal disables delayed allocation and O_DIRECT support! EXT4-fs (loop5): unsupported descriptor size 16704 audit: type=1804 audit(1606185448.195:2): pid=9699 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir949678138/syzkaller.XUxc65/2/bus" dev="sda1" ino=15773 res=1 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. print_req_error: I/O error, dev loop3, sector 0 Buffer I/O error on dev loop3, logical block 0, async page read print_req_error: I/O error, dev loop3, sector 4 Buffer I/O error on dev loop3, logical block 2, async page read print_req_error: I/O error, dev loop3, sector 6 Buffer I/O error on dev loop3, logical block 3, async page read audit: type=1804 audit(1606185449.485:3): pid=9699 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir949678138/syzkaller.XUxc65/2/bus" dev="sda1" ino=15773 res=1 bridge0: port 2(bridge_slave_1) entered disabled state bridge0: port 1(bridge_slave_0) entered disabled state audit: type=1804 audit(1606185449.805:4): pid=9763 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir949678138/syzkaller.XUxc65/3/bus" dev="sda1" ino=15782 res=1 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 syz-executor.3 (9731) used greatest stack depth: 24400 bytes left IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. BTRFS: device fsid f90cac8b-044b-4fa8-8bee-4b8d3da88dc2 devid 1 transid 7 /dev/loop3 BTRFS info (device loop3): turning on flush-on-commit BTRFS info (device loop3): disk space caching is enabled BTRFS info (device loop3): has skinny extents BTRFS warning (device loop3): loop3 checksum verify failed on 5242880 wanted 42BCE6B8 found 7942559B level 0 BTRFS warning (device loop3): failed to read tree root BTRFS error (device loop3): open_ctree failed overlayfs: fs on 'file0' does not support file handles, falling back to index=off. BTRFS info (device loop3): turning on flush-on-commit overlayfs: fs on './file0' does not support file handles, falling back to index=off. BTRFS info (device loop3): disk space caching is enabled BTRFS info (device loop3): has skinny extents overlayfs: 'file0' not a directory overlayfs: './file0' not a directory BTRFS error (device loop3): open_ctree failed tmpfs: No value for mount option 'iu' netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 36 bytes leftover after parsing attributes in process `syz-executor.2'. bond0: Releasing backup interface bond_slave_0 BTRFS info (device loop3): turning on flush-on-commit overlayfs: fs on 'file0' does not support file handles, falling back to index=off. BTRFS info (device loop3): disk space caching is enabled overlayfs: fs on './file0' does not support file handles, falling back to index=off. BTRFS info (device loop3): has skinny extents netlink: 36 bytes leftover after parsing attributes in process `syz-executor.2'. BTRFS warning (device loop3): loop3 checksum verify failed on 5242880 wanted 42BCE6B8 found 7942559B level 0 BTRFS warning (device loop3): failed to read tree root BTRFS error (device loop3): open_ctree failed netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. BTRFS: device fsid 56103f85-bd13-4972-bf59-af2d09341302 devid 1 transid 7 /dev/loop4 netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. BTRFS info (device loop4): disk space caching is enabled netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. BTRFS info (device loop4): has skinny extents netlink: 36 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 36 bytes leftover after parsing attributes in process `syz-executor.5'. team0: Port device team_slave_1 removed team0: Port device team_slave_0 removed audit: type=1804 audit(1606185454.675:5): pid=10084 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir303265873/syzkaller.FXFBy8/9/file1/file0" dev="loop1" ino=3 res=1 x_tables: ip6_tables: rpfilter match: used from hooks PREROUTING/OUTPUT, but only valid from PREROUTING netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. audit: type=1804 audit(1606185455.445:6): pid=10096 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir303265873/syzkaller.FXFBy8/9/file1/file0" dev="loop1" ino=3 res=1 x_tables: ip_tables: rpfilter match: used from hooks PREROUTING/OUTPUT, but only valid from PREROUTING netlink: 36 bytes leftover after parsing attributes in process `syz-executor.2'. batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 audit: type=1804 audit(1606185455.745:7): pid=10139 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir303265873/syzkaller.FXFBy8/10/file1/file0" dev="loop1" ino=4 res=1 x_tables: ip_tables: rpfilter match: used from hooks PREROUTING/OUTPUT, but only valid from PREROUTING audit: type=1804 audit(1606185455.885:8): pid=10147 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir949678138/syzkaller.XUxc65/8/file0" dev="sda1" ino=15817 res=1