BUG: MAX_LOCKDEP_CHAINS too low! turning off the locking correctness validator. CPU: 0 PID: 1005 Comm: syz-executor.3 Not tainted 4.14.232-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 add_chain_cache kernel/locking/lockdep.c:2303 [inline] lookup_chain_cache_add kernel/locking/lockdep.c:2415 [inline] validate_chain kernel/locking/lockdep.c:2435 [inline] __lock_acquire.cold+0x19a/0x97c kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 perf_ctx_lock kernel/events/core.c:161 [inline] perf_event_context_sched_in kernel/events/core.c:3266 [inline] __perf_event_task_sched_in+0x42c/0x8c0 kernel/events/core.c:3324 perf_event_task_sched_in include/linux/perf_event.h:1087 [inline] finish_task_switch+0x3c9/0x610 kernel/sched/core.c:2664 context_switch kernel/sched/core.c:2811 [inline] __schedule+0x893/0x1de0 kernel/sched/core.c:3384 preempt_schedule_irq+0xb0/0x140 kernel/sched/core.c:3611 retint_kernel+0x1b/0x2d RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:lock_acquire+0x1ec/0x3f0 kernel/locking/lockdep.c:4001 RSP: 0018:ffff8882289a7928 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff02 RAX: 1ffffffff11e1259 RBX: ffff888061df8600 RCX: 0000000000006c06 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000286 RBP: ffff8880b2e129a8 R08: ffffffff8b9c5af0 R09: 0000000000040758 R10: ffff888061df8eb0 R11: ffff888061df8600 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 kernfs_drain fs/kernfs/dir.c:468 [inline] __kernfs_remove+0x727/0x920 fs/kernfs/dir.c:1293 kernfs_remove_by_name_ns+0x55/0x90 fs/kernfs/dir.c:1487 kernfs_remove_by_name include/linux/kernfs.h:529 [inline] remove_files+0x96/0x1c0 fs/sysfs/group.c:29 sysfs_remove_group+0x87/0x100 fs/sysfs/group.c:245 sysfs_remove_groups fs/sysfs/group.c:269 [inline] sysfs_remove_groups+0x5c/0xa0 fs/sysfs/group.c:261 device_remove_groups drivers/base/core.c:1071 [inline] device_remove_attrs+0xaf/0x150 drivers/base/core.c:1253 device_del+0x3b6/0xa80 drivers/base/core.c:2081 rollback_registered_many+0x6d6/0xba0 net/core/dev.c:7227 rollback_registered+0xca/0x170 net/core/dev.c:7245 unregister_netdevice_queue+0x1b4/0x360 net/core/dev.c:8266 unregister_netdevice include/linux/netdevice.h:2443 [inline] __tun_detach+0xca2/0xf60 drivers/net/tun.c:584 tun_detach drivers/net/tun.c:594 [inline] tun_chr_close+0x41/0x60 drivers/net/tun.c:2727 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x1ad/0x200 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x4665f9 RSP: 002b:00007f7580e9e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 000000000056bf60 RCX: 00000000004665f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00000000004bfce1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffe84b85c5f R14: 00007f7580e9e300 R15: 0000000000022000 x_tables: ip_tables: icmp match: only valid for protocol 1 x_tables: ip_tables: icmp match: only valid for protocol 1 x_tables: ip_tables: icmp match: only valid for protocol 1 x_tables: ip_tables: icmp match: only valid for protocol 1 audit: type=1804 audit(1620651628.321:1082): pid=1125 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.3" name="/root/syzkaller-testdir056874304/syzkaller.UAdOXZ/364/file0/bus" dev="ramfs" ino=278855 res=1 audit: type=1804 audit(1620651628.351:1083): pid=1125 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.3" name="/root/syzkaller-testdir056874304/syzkaller.UAdOXZ/364/file0/bus" dev="ramfs" ino=278855 res=1 audit: type=1804 audit(1620651628.581:1084): pid=1126 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.3" name="/root/syzkaller-testdir056874304/syzkaller.UAdOXZ/364/file0/file0/bus" dev="ramfs" ino=278858 res=1 audit: type=1804 audit(1620651628.581:1085): pid=1126 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.3" name="/root/syzkaller-testdir056874304/syzkaller.UAdOXZ/364/file0/file0/bus" dev="ramfs" ino=278858 res=1 audit: type=1804 audit(1620651628.851:1086): pid=1132 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.3" name="/root/syzkaller-testdir056874304/syzkaller.UAdOXZ/365/file0/bus" dev="ramfs" ino=278879 res=1 audit: type=1804 audit(1620651628.881:1087): pid=1132 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.3" name="/root/syzkaller-testdir056874304/syzkaller.UAdOXZ/365/file0/bus" dev="ramfs" ino=278879 res=1 audit: type=1804 audit(1620651629.701:1088): pid=1172 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.3" name="/root/syzkaller-testdir056874304/syzkaller.UAdOXZ/366/file0/bus" dev="ramfs" ino=278252 res=1 audit: type=1804 audit(1620651629.701:1089): pid=1172 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.3" name="/root/syzkaller-testdir056874304/syzkaller.UAdOXZ/366/file0/bus" dev="ramfs" ino=278252 res=1 audit: type=1804 audit(1620651629.851:1090): pid=1186 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir153787725/syzkaller.nyvyK6/1408/file0/bus" dev="ramfs" ino=278941 res=1 audit: type=1804 audit(1620651629.871:1091): pid=1186 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir153787725/syzkaller.nyvyK6/1408/file0/bus" dev="ramfs" ino=278941 res=1 netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. ubi0: attaching mtd0 ubi0: scanning is finished ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 ubi0: VID header offset: 64 (aligned 64), data offset: 128 ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 974424446 ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 ubi0: detaching mtd0 ubi0: background thread "ubi_bgt0d" started, PID 1513 ubi0: mtd0 is detached ubi0: attaching mtd0 ubi0: scanning is finished ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 ubi0: VID header offset: 64 (aligned 64), data offset: 128 ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 974424446 ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 ubi0: background thread "ubi_bgt0d" started, PID 1586 ubi: mtd0 is already attached to ubi0 ubi0: detaching mtd0 ubi0: mtd0 is detached ubi0: attaching mtd0 ubi0: scanning is finished ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 ubi0: VID header offset: 64 (aligned 64), data offset: 128 ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 974424446 ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 ubi: mtd0 is already attached to ubi0 ubi0: background thread "ubi_bgt0d" started, PID 1652 ubi: mtd0 is already attached to ubi0 ubi: mtd0 is already attached to ubi0 ubi0: detaching mtd0 ubi0: mtd0 is detached IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready