wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 Bluetooth: hci5: command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready BUG: sleeping function called from invalid context at net/mac80211/sta_info.c:1850 in_atomic(): 0, irqs_disabled(): 0, pid: 33, name: kworker/u4:2 4 locks held by kworker/u4:2/33: #0: 000000006b290127 ((wq_completion)"%s"wiphy_name(local->hw.wiphy)){+.+.}, at: process_one_work+0x767/0x1570 kernel/workqueue.c:2126 #1: 00000000c49430db ((work_completion)(&sdata->work)){+.+.}, at: process_one_work+0x79c/0x1570 kernel/workqueue.c:2130 capability: warning: `syz-executor.2' uses deprecated v2 capabilities in a way that may be insecure #2: 00000000c968d03f (&wdev->mtx){+.+.}, at: sdata_lock net/mac80211/ieee80211_i.h:990 [inline] #2: 00000000c968d03f (&wdev->mtx){+.+.}, at: ieee80211_ibss_work+0x85/0xe10 net/mac80211/ibss.c:1675 #3: 000000003a0e54d6 (rcu_read_lock){....}, at: sta_info_insert_finish net/mac80211/sta_info.c:573 [inline] #3: 000000003a0e54d6 (rcu_read_lock){....}, at: sta_info_insert_rcu+0x48e/0x2310 net/mac80211/sta_info.c:661 Preemption disabled at: [] rcu_lockdep_current_cpu_online kernel/rcu/tree.c:1076 [inline] [] rcu_lockdep_current_cpu_online+0x32/0x1b0 kernel/rcu/tree.c:1068 IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready CPU: 1 PID: 33 Comm: kworker/u4:2 Not tainted 4.19.159-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: phy4 ieee80211_iface_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2fe lib/dump_stack.c:118 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6196 sta_info_move_state+0x32/0x900 net/mac80211/sta_info.c:1850 sta_info_free+0x55/0x390 net/mac80211/sta_info.c:260 sta_info_insert_rcu+0x517/0x2310 net/mac80211/sta_info.c:667 wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 ieee80211_ibss_finish_sta+0x25b/0x360 net/mac80211/ibss.c:601 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 ieee80211_ibss_work+0x2b6/0xe10 net/mac80211/ibss.c:1692 IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready ieee80211_iface_work+0x7ba/0x8a0 net/mac80211/iface.c:1366 process_one_work+0x864/0x1570 kernel/workqueue.c:2155 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. syz-executor.2 calls setitimer() with new_value NULL pointer. Misfeature support will be removed netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. bond0: Releasing backup interface bond_slave_1 netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'. audit: type=1326 audit(1606047415.763:2): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=9855 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x460d1a code=0x0 audit: type=1326 audit(1606047416.493:3): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=9855 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x460d1a code=0x0 Dev loop4: unable to read RDB block 2 loop4: unable to read partition table loop4: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop4 () failed (rc=-5) Dev loop4: unable to read RDB block 2 loop4: unable to read partition table loop4: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop4 () failed (rc=-5) Dev loop3: unable to read RDB block 11 loop3: unable to read partition table loop3: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop3 () failed (rc=-5) Dev loop3: unable to read RDB block 11 loop3: unable to read partition table loop3: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop3 () failed (rc=-5) Dev loop2: unable to read RDB block 11 loop2: unable to read partition table loop2: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop2 () failed (rc=-5) audit: type=1326 audit(1606047418.863:4): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=10145 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x460d1a code=0x0 Dev loop2: unable to read RDB block 11 loop2: unable to read partition table loop2: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop2 () failed (rc=-5) Dev loop2: unable to read RDB block 11 loop2: unable to read partition table loop2: partition table beyond EOD, truncated audit: type=1326 audit(1606047419.633:5): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=10145 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x460d1a code=0x0 Dev loop0: unable to read RDB block 1 loop0: unable to read partition table loop0: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop0 () failed (rc=-5) Dev loop0: unable to read RDB block 1 loop0: unable to read partition table loop0: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop0 () failed (rc=-5) Dev loop0: unable to read RDB block 1 loop0: unable to read partition table loop0: partition table beyond EOD, truncated Dev loop2: unable to read RDB block 11 loop2: unable to read partition table loop2: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop2 () failed (rc=-5) audit: type=1326 audit(1606047421.303:6): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=10330 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x460d1a code=0x0 audit: type=1326 audit(1606047422.093:7): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=10330 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x460d1a code=0x0 tmpfs: No value for mount option 'hu' tmpfs: No value for mount option 'hu'