FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
================================
WARNING: inconsistent lock state
4.19.106-syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz-executor.2/8820 [HC0[0]:SC1[1]:HE1:SE0] takes:
000000003e27cc71 (&(&local->client_conns_lock)->rlock){+.?.}, at: spin_lock include/linux/spinlock.h:329 [inline]
000000003e27cc71 (&(&local->client_conns_lock)->rlock){+.?.}, at: rxrpc_put_one_client_conn net/rxrpc/conn_client.c:949 [inline]
000000003e27cc71 (&(&local->client_conns_lock)->rlock){+.?.}, at: rxrpc_put_client_conn+0x666/0xc00 net/rxrpc/conn_client.c:1002
{SOFTIRQ-ON-W} state was registered at:
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144
spin_lock include/linux/spinlock.h:329 [inline]
rxrpc_get_client_conn net/rxrpc/conn_client.c:309 [inline]
rxrpc_connect_call+0x301/0x4630 net/rxrpc/conn_client.c:702
rxrpc_new_client_call+0x8c6/0x1850 net/rxrpc/call_object.c:291
rxrpc_new_client_call_for_sendmsg net/rxrpc/sendmsg.c:596 [inline]
rxrpc_do_sendmsg+0xf2e/0x1bc1 net/rxrpc/sendmsg.c:652
rxrpc_sendmsg+0x4a8/0x5b0 net/rxrpc/af_rxrpc.c:593
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:632
___sys_sendmsg+0x3e2/0x920 net/socket.c:2115
__sys_sendmmsg+0x195/0x470 net/socket.c:2210
__do_sys_sendmmsg net/socket.c:2239 [inline]
__se_sys_sendmmsg net/socket.c:2236 [inline]
__x64_sys_sendmmsg+0x99/0x100 net/socket.c:2236
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
irq event stamp: 7740
hardirqs last enabled at (7740): [<ffffffff871f84d7>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
hardirqs last enabled at (7740): [<ffffffff871f84d7>] _raw_spin_unlock_irqrestore+0x67/0xe0 kernel/locking/spinlock.c:184
hardirqs last disabled at (7739): [<ffffffff8156a101>] rcu_irq_enter_irqson+0x71/0x140 kernel/rcu/tree.c:1007
softirqs last enabled at (6928): [<ffffffff87400650>] __do_softirq+0x650/0x93c kernel/softirq.c:318
softirqs last disabled at (7641): [<ffffffff813e406b>] invoke_softirq kernel/softirq.c:372 [inline]
softirqs last disabled at (7641): [<ffffffff813e406b>] irq_exit+0x17b/0x1c0 kernel/softirq.c:412
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&(&local->client_conns_lock)->rlock);
<Interrupt>
lock(&(&local->client_conns_lock)->rlock);
*** DEADLOCK ***
2 locks held by syz-executor.2/8820:
#0: 000000004b0e820d (&(ptlock_ptr(page))->rlock#2){+.+.}, at: spin_lock include/linux/spinlock.h:329 [inline]
#0: 000000004b0e820d (&(ptlock_ptr(page))->rlock#2){+.+.}, at: zap_pte_range mm/memory.c:1299 [inline]
#0: 000000004b0e820d (&(ptlock_ptr(page))->rlock#2){+.+.}, at: zap_pmd_range mm/memory.c:1440 [inline]
#0: 000000004b0e820d (&(ptlock_ptr(page))->rlock#2){+.+.}, at: zap_pud_range mm/memory.c:1469 [inline]
#0: 000000004b0e820d (&(ptlock_ptr(page))->rlock#2){+.+.}, at: zap_p4d_range mm/memory.c:1490 [inline]
#0: 000000004b0e820d (&(ptlock_ptr(page))->rlock#2){+.+.}, at: unmap_page_range+0x838/0x1de0 mm/memory.c:1511
#1: 00000000594ee970 (rcu_callback){....}, at: __rcu_reclaim kernel/rcu/rcu.h:226 [inline]
#1: 00000000594ee970 (rcu_callback){....}, at: rcu_do_batch kernel/rcu/tree.c:2584 [inline]
#1: 00000000594ee970 (rcu_callback){....}, at: invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
#1: 00000000594ee970 (rcu_callback){....}, at: __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
#1: 00000000594ee970 (rcu_callback){....}, at: rcu_process_callbacks+0xbff/0x17f0 kernel/rcu/tree.c:2881
stack backtrace:
CPU: 0 PID: 8820 Comm: syz-executor.2 Not tainted 4.19.106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
print_usage_bug.cold+0x327/0x425 kernel/locking/lockdep.c:2540
valid_state kernel/locking/lockdep.c:2553 [inline]
mark_lock_irq kernel/locking/lockdep.c:2747 [inline]
mark_lock+0xc71/0x11b0 kernel/locking/lockdep.c:3127
mark_irqflags kernel/locking/lockdep.c:3005 [inline]
__lock_acquire+0xc62/0x49c0 kernel/locking/lockdep.c:3368
lock_acquire+0x170/0x400 kernel/locking/lockdep.c:3903
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144
spin_lock include/linux/spinlock.h:329 [inline]
rxrpc_put_one_client_conn net/rxrpc/conn_client.c:949 [inline]
rxrpc_put_client_conn+0x666/0xc00 net/rxrpc/conn_client.c:1002
rxrpc_put_connection net/rxrpc/ar-internal.h:951 [inline]
rxrpc_rcu_destroy_call+0xb6/0x1e0 net/rxrpc/call_object.c:657
__rcu_reclaim kernel/rcu/rcu.h:236 [inline]
rcu_do_batch kernel/rcu/tree.c:2584 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
rcu_process_callbacks+0xb2d/0x17f0 kernel/rcu/tree.c:2881
__do_softirq+0x26c/0x93c kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x17b/0x1c0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
</IRQ>
RIP: 0010:__tlb_remove_page_size+0xfd/0x4b0 mm/memory.c:304
Code: 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 11 03 00 00 48 b8 00 00 00 00 00 fc ff df 44 8b 65 08 4a 8d 7c e5 10 <45> 8d 6c 24 01 48 89 fa 48 c1 ea 03 44 89 6d 08 80 3c 02 00 0f 85
RSP: 0018:ffff8880440cf730 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffff8880440cf998 RCX: ffffffff81902b54
RDX: 1ffff110132d7201 RSI: ffffffff81902b62 RDI: ffff8880996b9b70
RBP: ffff8880996b9000 R08: ffff8880a93b8240 R09: fffff940004ad257
R10: fffff940004ad256 R11: ffffea00025692b3 R12: 000000000000016c
R13: dead000000000100 R14: ffffea0002569280 R15: ffff8880440cf9c0
__tlb_remove_page include/asm-generic/tlb.h:161 [inline]
zap_pte_range mm/memory.c:1341 [inline]
zap_pmd_range mm/memory.c:1440 [inline]
zap_pud_range mm/memory.c:1469 [inline]
zap_p4d_range mm/memory.c:1490 [inline]
unmap_page_range+0xe47/0x1de0 mm/memory.c:1511
unmap_single_vma+0x196/0x300 mm/memory.c:1556
unmap_vmas+0xa9/0x180 mm/memory.c:1586
exit_mmap+0x2b2/0x510 mm/mmap.c:3091
__mmput kernel/fork.c:1015 [inline]
mmput+0x14e/0x4a0 kernel/fork.c:1036
exit_mm kernel/exit.c:546 [inline]
do_exit+0xac8/0x2f30 kernel/exit.c:867
do_group_exit+0x125/0x350 kernel/exit.c:983
get_signal+0x3ec/0x1f90 kernel/signal.c:2583
do_signal+0x8f/0x1710 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x22b/0x2b0 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45c479
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8a8f188cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000076bf28 RCX: 000000000045c479
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000076bf28
RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000076bf2c
R13: 00007ffc386017bf R14: 00007f8a8f1899c0 R15: 000000000076bf2c
FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x0000007a (sector = 1)
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_1
device bridge_slave_1 left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_0 left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
device hsr_slave_1 left promiscuous mode
device hsr_slave_0 left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
bond0 (unregistering): Releasing backup interface bond_slave_1
bond0 (unregistering): Releasing backup interface bond_slave_0
bond0 (unregistering): Released all slaves
audit: type=1400 audit(1582883230.441:196): avc: denied { map } for pid=979 comm="syz-executor.2" path="/sys/kernel/debug/kcov" dev="debugfs" ino=30 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
IPVS: ftp: loaded support on port[0] = 21
chnl_net:caif_netlink_parms(): no params data found
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered disabled state
device bridge_slave_0 entered promiscuous mode
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_1 entered promiscuous mode
bond0: Enslaving bond_slave_0 as an active interface with an up link
bond0: Enslaving bond_slave_1 as an active interface with an up link
IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
team0: Port device team_slave_0 added
IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
team0: Port device team_slave_1 added
batman_adv: batadv0: Adding interface: batadv_slave_0
batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
batman_adv: batadv0: Adding interface: batadv_slave_1
batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
device hsr_slave_0 entered promiscuous mode
device hsr_slave_1 entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
8021q: adding VLAN 0 to HW filter on device bond0
IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
bridge0: port 1(bridge_slave_0) entered disabled state
bridge0: port 2(bridge_slave_1) entered disabled state
IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
8021q: adding VLAN 0 to HW filter on device team0
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
8021q: adding VLAN 0 to HW filter on device batadv0
IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth1_virt_wifi: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready
IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
device veth0_vlan entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
device veth1_vlan entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
device veth0_macvtap entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready
device veth1_macvtap entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready
batman_adv: batadv0: Interface activated: batadv_slave_0
IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready
batman_adv: batadv0: Interface activated: batadv_slave_1
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
netlink: 'syz-executor.2': attribute type 4 has an invalid length.
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
netlink: 'syz-executor.2': attribute type 4 has an invalid length.
netlink: 'syz-executor.2': attribute type 4 has an invalid length.
input: syz1 as /devices/virtual/input/input7
input: syz1 as /devices/virtual/input/input8