BUG: sleeping function called from invalid context at net/core/sock.c:2761 in_atomic(): 1, irqs_disabled(): 0, pid: 23, name: kworker/1:1 2 locks held by kworker/1:1/23: #0: ((wq_completion)"%s"name){+.+.}, at: [] __write_once_size include/linux/compiler.h:212 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] atomic_long_set include/asm-generic/atomic-long.h:57 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_data kernel/workqueue.c:618 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] set_work_pool_and_clear_pending kernel/workqueue.c:645 [inline] #0: ((wq_completion)"%s"name){+.+.}, at: [] process_one_work+0xad4/0x1be0 kernel/workqueue.c:2083 #1: ((work_completion)(&squeue->work)){+.+.}, at: [] process_one_work+0xb2f/0x1be0 kernel/workqueue.c:2087 CPU: 1 PID: 23 Comm: kworker/1:1 Not tainted 4.15.0-rc1+ #197 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: pdecrypt padata_serial_worker Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060 __might_sleep+0x95/0x190 kernel/sched/core.c:6013 lock_sock_nested+0x37/0x110 net/core/sock.c:2761 lock_sock include/net/sock.h:1465 [inline] af_alg_async_cb+0x86/0x1a0 crypto/af_alg.c:1039 aead_request_complete include/crypto/internal/aead.h:75 [inline] pcrypt_aead_serial+0x75/0xa0 crypto/pcrypt.c:123 padata_serial_worker+0x476/0x750 kernel/padata.c:348 process_one_work+0xbfd/0x1be0 kernel/workqueue.c:2112 worker_thread+0x223/0x1990 kernel/workqueue.c:2246 kthread+0x37a/0x440 kernel/kthread.c:238 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:441 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=42264 sclass=netlink_route_socket pig=25785 comm=syz-executor7 QAT: Invalid ioctl QAT: Invalid ioctl SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=25809 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=25809 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=25809 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=25809 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=25840 comm=syz-executor6 handle_userfault: 45 callbacks suppressed FAULT_FLAG_ALLOW_RETRY missing 31 CPU: 0 PID: 25979 Comm: syz-executor1 Tainted: G W 4.15.0-rc1+ #197 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 handle_userfault+0x12fa/0x24c0 fs/userfaultfd.c:427 do_anonymous_page mm/memory.c:3161 [inline] handle_pte_fault mm/memory.c:3934 [inline] __handle_mm_fault+0x2cc1/0x3ad0 mm/memory.c:4060 handle_mm_fault+0x334/0x8d0 mm/memory.c:4097 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1429 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1504 page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1094 RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 arch/x86/lib/copy_user_64.S:180 RSP: 0018:ffff8801c46a7828 EFLAGS: 00010202 RAX: 0000000000000004 RBX: 0000000000000204 RCX: 0000000000000204 RDX: 0000000000000204 RSI: ffff8801c57c56c0 RDI: 0000000020001000 RBP: ffff8801c46a7858 R08: ffffed0038af8b18 R09: ffffed0038af8b19 R10: 0000000000000041 R11: ffffed0038af8b18 R12: 0000000020001000 R13: ffff8801c57c56c0 R14: 00007ffffffff000 R15: 0000000020001204 copy_to_user include/linux/uaccess.h:155 [inline] semctl_main+0xa2c/0x2720 ipc/sem.c:1389 SYSC_semctl+0x22d/0x270 ipc/sem.c:1601 SyS_semctl+0x2c/0x40 ipc/sem.c:1569 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x4529d9 RSP: 002b:00007f69b920ac58 EFLAGS: 00000212 ORIG_RAX: 0000000000000042 RAX: ffffffffffffffda RBX: 00007f69b920b700 RCX: 00000000004529d9 RDX: 000000000000000d RSI: 0000000000000000 RDI: 0000000000058009 RBP: 0000000000a6f880 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020001000 R11: 0000000000000212 R12: 0000000000000000 R13: 0000000000a6f7ff R14: 00007f69b920b9c0 R15: 0000000000000018 audit: type=1326 audit(1511871919.196:5139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=25946 comm="syz-executor7" exe="/root/syz-executor7" sig=9 arch=c000003e syscall=202 compat=0 ip=0x4529d9 code=0x0 binder: 26007:26013 ioctl 40046205 8 returned -22 binder: 26007:26013 Release 1 refcount change on invalid ref 4 ret -22 binder: 26007:26013 IncRefs 0 refcount change on invalid ref 3 ret -22 binder: 26007:26013 Release 1 refcount change on invalid ref 2 ret -22 binder: 26007:26013 BC_ACQUIRE_DONE node 209 has no pending acquire request binder: 26013 RLIMIT_NICE not set binder: 26007:26013 ioctl c0306201 20002000 returned -11 binder: 26007:26013 unknown command 1784877669 binder: 26007:26013 ioctl c0306201 2000c000 returned -22 binder: 26007:26010 ioctl 40046205 8 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 26007:26010 ioctl 40046207 0 returned -16 binder: 26007:26013 ioctl c0306201 20002000 returned -11 binder: 26007:26013 unknown command 1784877669 binder: 26007:26013 ioctl c0306201 2000c000 returned -22 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 netlink: 2 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 2 bytes leftover after parsing attributes in process `syz-executor1'. binder: 26108:26109 ioctl c018620b 20000fe8 returned -14 binder: 26108:26109 got transaction with invalid data ptr binder: 26108:26109 transaction failed 29201/-14, size 88-48 line 2889 binder: 26108:26111 ioctl c018620b 20000fe8 returned -14 binder: BINDER_SET_CONTEXT_MGR already set binder: 26108:26109 ioctl 40046207 0 returned -16 binder_alloc: 26108: binder_alloc_buf, no vma binder: 26108:26111 transaction failed 29189/-3, size 88-48 line 2870 binder: send failed reply for transaction 214 to 26108:26109 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189