bisecting fixing commit since c4ff839de17f38b0ae0f8983b5c5186f8a389238 building syzkaller on eefc07f2541beeb1bcd50b1d75f40b5f04af2b06 testing commit c4ff839de17f38b0ae0f8983b5c5186f8a389238 with gcc (GCC) 8.4.1 20210217 kernel signature: 5c083070afd667c9d2c8890ca33e2cf10904a35d90d350eb355cf652b0618892 all runs: crashed: possible deadlock in sk_clone_lock testing current HEAD 78fec1611cbf7b0bdaddfdbf174a3a2463663bff testing commit 78fec1611cbf7b0bdaddfdbf174a3a2463663bff with gcc (GCC) 8.4.1 20210217 kernel signature: 214c4fd8941f693eaa01a7bb3aa34742e5e2dc7d430d5ba1e3d88c421e511c79 all runs: crashed: possible deadlock in sk_clone_lock revisions tested: 2, total time: 22m25.25193591s (build: 15m42.085950953s, test: 6m21.062007116s) the crash still happens on HEAD commit msg: Linux 4.19.183 crash: possible deadlock in sk_clone_lock wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 ===================================================== IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 4.19.183-syzkaller #0 Not tainted ----------------------------------------------------- syz-executor.2/9854 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire: 0000000046db7529 (hugetlb_lock){+.+.}, at: spin_lock include/linux/spinlock.h:329 [inline] 0000000046db7529 (hugetlb_lock){+.+.}, at: free_huge_page mm/hugetlb.c:1294 [inline] 0000000046db7529 (hugetlb_lock){+.+.}, at: free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1256 and this task is already holding: 00000000bd4f8a1e (slock-AF_INET){+.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] 00000000bd4f8a1e (slock-AF_INET){+.-.}, at: tcp_close+0x521/0xf00 net/ipv4/tcp.c:2434 which would create a new lock dependency: IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready (slock-AF_INET){+.-.} -> (hugetlb_lock){+.+.} ieee80211 phy10: Selected rate control algorithm 'minstrel_ht' but this new dependency connects a SOFTIRQ-irq-safe lock: IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready (slock-AF_INET){+.-.} ... which became SOFTIRQ-irq-safe at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] sk_clone_lock+0x3b3/0x1280 net/core/sock.c:1671 inet_csk_clone_lock+0x15/0x3c0 net/ipv4/inet_connection_sock.c:821 tcp_create_openreq_child+0x24/0x1a20 net/ipv4/tcp_minisocks.c:452 wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 tcp_v4_syn_recv_sock+0xa0/0xfa0 net/ipv4/tcp_ipv4.c:1429 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 tcp_check_req+0x3dd/0x1590 net/ipv4/tcp_minisocks.c:789 tcp_v4_rcv+0x1f06/0x3bb0 net/ipv4/tcp_ipv4.c:1773 ip_local_deliver_finish+0x3be/0x9a0 net/ipv4/ip_input.c:215 NF_HOOK include/linux/netfilter.h:289 [inline] ip_local_deliver+0x164/0x4b0 net/ipv4/ip_input.c:256 dst_input include/net/dst.h:461 [inline] ip_rcv_finish+0x159/0x240 net/ipv4/ip_input.c:414 NF_HOOK include/linux/netfilter.h:289 [inline] ip_rcv+0xc1/0x2f0 net/ipv4/ip_input.c:524 __netif_receive_skb_one_core+0x112/0x1a0 net/core/dev.c:4954 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5066 netif_receive_skb_internal+0xca/0x300 net/core/dev.c:5156 napi_skb_finish net/core/dev.c:5600 [inline] napi_gro_receive+0x215/0x330 net/core/dev.c:5631 receive_buf+0xdb2/0x5790 drivers/net/virtio_net.c:1072 virtnet_receive drivers/net/virtio_net.c:1336 [inline] virtnet_poll+0x50b/0xe40 drivers/net/virtio_net.c:1441 ieee80211 phy11: Selected rate control algorithm 'minstrel_ht' napi_poll net/core/dev.c:6272 [inline] net_rx_action+0x454/0xe30 net/core/dev.c:6338 IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready __do_softirq+0x25f/0x919 kernel/softirq.c:292 IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:412 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 exiting_irq arch/x86/include/asm/apic.h:535 [inline] do_IRQ+0x10f/0x1c0 arch/x86/kernel/irq.c:258 ret_from_intr+0x0/0x1e arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] _flat_send_IPI_mask+0x13f/0x190 arch/x86/kernel/apic/apic_flat_64.c:63 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 flat_send_IPI_mask+0x2b/0x40 arch/x86/kernel/apic/apic_flat_64.c:70 default_send_IPI_single+0x66/0x90 arch/x86/kernel/apic/ipi.c:133 native_send_call_func_single_ipi+0x55/0x70 arch/x86/kernel/smp.c:136 arch_send_call_function_single_ipi arch/x86/include/asm/smp.h:121 [inline] generic_exec_single+0x108/0x3a0 kernel/smp.c:179 smp_call_function_single+0x15c/0x360 kernel/smp.c:299 smp_call_function_many+0x521/0x7a0 kernel/smp.c:434 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready smp_call_function+0x36/0x60 kernel/smp.c:492 on_each_cpu+0x2a/0x180 kernel/smp.c:602 text_poke_bp+0x109/0x1b0 arch/x86/kernel/alternative.c:836 __jump_label_transform.isra.0+0x337/0x4e0 arch/x86/kernel/jump_label.c:103 arch_jump_label_transform+0x2f/0x40 arch/x86/kernel/jump_label.c:111 __jump_label_update+0xf7/0x130 kernel/jump_label.c:383 jump_label_update kernel/jump_label.c:768 [inline] jump_label_update+0x120/0x2b0 kernel/jump_label.c:747 static_key_disable_cpuslocked+0x10d/0x160 kernel/jump_label.c:172 ieee80211 phy12: Selected rate control algorithm 'minstrel_ht' static_key_disable+0x15/0x20 kernel/jump_label.c:180 IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready once_deferred+0x52/0x80 lib/once.c:18 process_one_work+0x7b9/0x15a0 kernel/workqueue.c:2152 wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 worker_thread+0x85/0xb60 kernel/workqueue.c:2295 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 to a SOFTIRQ-irq-unsafe lock: (hugetlb_lock){+.+.} ... which became SOFTIRQ-irq-unsafe at: ... lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3041 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hugetlb_lock); ieee80211 phy13: Selected rate control algorithm 'minstrel_ht' local_irq_disable(); lock(slock-AF_INET); lock(hugetlb_lock); lock(slock-AF_INET); *** DEADLOCK *** 3 locks held by syz-executor.2/9854: #0: 000000000ae8c595 (&sb->s_type->i_mutex_key#13){+.+.}, at: inode_lock include/linux/fs.h:748 [inline] #0: 000000000ae8c595 (&sb->s_type->i_mutex_key#13){+.+.}, at: __sock_release+0x7d/0x290 net/socket.c:578 #1: 0000000094d3489f (sk_lock-AF_INET){+.+.}, at: lock_sock include/net/sock.h:1510 [inline] #1: 0000000094d3489f (sk_lock-AF_INET){+.+.}, at: tcp_close+0x1f/0xf00 net/ipv4/tcp.c:2344 #2: 00000000bd4f8a1e (slock-AF_INET){+.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] #2: 00000000bd4f8a1e (slock-AF_INET){+.-.}, at: tcp_close+0x521/0xf00 net/ipv4/tcp.c:2434 the dependencies between SOFTIRQ-irq-safe lock and the holding lock: -> (slock-AF_INET){+.-.} ops: 12590 { HARDIRQ-ON-W at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:334 [inline] lock_sock_nested+0x3a/0x100 net/core/sock.c:2864 lock_sock include/net/sock.h:1510 [inline] inet_autobind+0x13/0x160 net/ipv4/af_inet.c:179 inet_dgram_connect+0x1db/0x270 net/ipv4/af_inet.c:569 __sys_connect+0x20d/0x2d0 net/socket.c:1663 __do_sys_connect net/socket.c:1674 [inline] __se_sys_connect net/socket.c:1671 [inline] __x64_sys_connect+0x6e/0xb0 net/socket.c:1671 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe IN-SOFTIRQ-W at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] sk_clone_lock+0x3b3/0x1280 net/core/sock.c:1671 inet_csk_clone_lock+0x15/0x3c0 net/ipv4/inet_connection_sock.c:821 tcp_create_openreq_child+0x24/0x1a20 net/ipv4/tcp_minisocks.c:452 tcp_v4_syn_recv_sock+0xa0/0xfa0 net/ipv4/tcp_ipv4.c:1429 tcp_check_req+0x3dd/0x1590 net/ipv4/tcp_minisocks.c:789 tcp_v4_rcv+0x1f06/0x3bb0 net/ipv4/tcp_ipv4.c:1773 ip_local_deliver_finish+0x3be/0x9a0 net/ipv4/ip_input.c:215 NF_HOOK include/linux/netfilter.h:289 [inline] ip_local_deliver+0x164/0x4b0 net/ipv4/ip_input.c:256 dst_input include/net/dst.h:461 [inline] ip_rcv_finish+0x159/0x240 net/ipv4/ip_input.c:414 NF_HOOK include/linux/netfilter.h:289 [inline] ip_rcv+0xc1/0x2f0 net/ipv4/ip_input.c:524 __netif_receive_skb_one_core+0x112/0x1a0 net/core/dev.c:4954 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5066 netif_receive_skb_internal+0xca/0x300 net/core/dev.c:5156 napi_skb_finish net/core/dev.c:5600 [inline] napi_gro_receive+0x215/0x330 net/core/dev.c:5631 receive_buf+0xdb2/0x5790 drivers/net/virtio_net.c:1072 virtnet_receive drivers/net/virtio_net.c:1336 [inline] virtnet_poll+0x50b/0xe40 drivers/net/virtio_net.c:1441 napi_poll net/core/dev.c:6272 [inline] net_rx_action+0x454/0xe30 net/core/dev.c:6338 __do_softirq+0x25f/0x919 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:535 [inline] do_IRQ+0x10f/0x1c0 arch/x86/kernel/irq.c:258 ret_from_intr+0x0/0x1e arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] _flat_send_IPI_mask+0x13f/0x190 arch/x86/kernel/apic/apic_flat_64.c:63 flat_send_IPI_mask+0x2b/0x40 arch/x86/kernel/apic/apic_flat_64.c:70 default_send_IPI_single+0x66/0x90 arch/x86/kernel/apic/ipi.c:133 native_send_call_func_single_ipi+0x55/0x70 arch/x86/kernel/smp.c:136 arch_send_call_function_single_ipi arch/x86/include/asm/smp.h:121 [inline] generic_exec_single+0x108/0x3a0 kernel/smp.c:179 smp_call_function_single+0x15c/0x360 kernel/smp.c:299 smp_call_function_many+0x521/0x7a0 kernel/smp.c:434 smp_call_function+0x36/0x60 kernel/smp.c:492 on_each_cpu+0x2a/0x180 kernel/smp.c:602 text_poke_bp+0x109/0x1b0 arch/x86/kernel/alternative.c:836 __jump_label_transform.isra.0+0x337/0x4e0 arch/x86/kernel/jump_label.c:103 arch_jump_label_transform+0x2f/0x40 arch/x86/kernel/jump_label.c:111 __jump_label_update+0xf7/0x130 kernel/jump_label.c:383 jump_label_update kernel/jump_label.c:768 [inline] jump_label_update+0x120/0x2b0 kernel/jump_label.c:747 static_key_disable_cpuslocked+0x10d/0x160 kernel/jump_label.c:172 static_key_disable+0x15/0x20 kernel/jump_label.c:180 once_deferred+0x52/0x80 lib/once.c:18 process_one_work+0x7b9/0x15a0 kernel/workqueue.c:2152 worker_thread+0x85/0xb60 kernel/workqueue.c:2295 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 INITIAL USE at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:334 [inline] lock_sock_nested+0x3a/0x100 net/core/sock.c:2864 lock_sock include/net/sock.h:1510 [inline] inet_autobind+0x13/0x160 net/ipv4/af_inet.c:179 inet_dgram_connect+0x1db/0x270 net/ipv4/af_inet.c:569 __sys_connect+0x20d/0x2d0 net/socket.c:1663 __do_sys_connect net/socket.c:1674 [inline] __se_sys_connect net/socket.c:1671 [inline] __x64_sys_connect+0x6e/0xb0 net/socket.c:1671 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe } ... key at: [] af_family_slock_keys+0x10/0x1a0 ... acquired at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] free_huge_page mm/hugetlb.c:1294 [inline] free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1256 __put_compound_page+0x65/0xa0 mm/swap.c:96 __put_page+0x5d/0x290 mm/swap.c:112 put_page include/linux/mm.h:963 [inline] __skb_frag_unref include/linux/skbuff.h:2833 [inline] skb_release_data+0x249/0x760 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1466 [inline] tcp_write_queue_purge+0x243/0x7b0 net/ipv4/tcp.c:2543 tcp_v4_destroy_sock+0xa1/0x630 net/ipv4/tcp_ipv4.c:1989 inet_csk_destroy_sock+0x11a/0x390 net/ipv4/inet_connection_sock.c:872 tcp_close+0x821/0xf00 net/ipv4/tcp.c:2498 inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x185/0x1e0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: -> (hugetlb_lock){+.+.} ops: 27 { HARDIRQ-ON-W at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3041 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe SOFTIRQ-ON-W at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3041 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready INITIAL USE at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3041 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 } ... key at: [] hugetlb_lock+0x18/0x1740 ... acquired at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] free_huge_page mm/hugetlb.c:1294 [inline] free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1256 __put_compound_page+0x65/0xa0 mm/swap.c:96 __put_page+0x5d/0x290 mm/swap.c:112 put_page include/linux/mm.h:963 [inline] __skb_frag_unref include/linux/skbuff.h:2833 [inline] skb_release_data+0x249/0x760 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1466 [inline] tcp_write_queue_purge+0x243/0x7b0 net/ipv4/tcp.c:2543 tcp_v4_destroy_sock+0xa1/0x630 net/ipv4/tcp_ipv4.c:1989 ieee80211 phy14: Selected rate control algorithm 'minstrel_ht' inet_csk_destroy_sock+0x11a/0x390 net/ipv4/inet_connection_sock.c:872 tcp_close+0x821/0xf00 net/ipv4/tcp.c:2498 inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready task_work_run+0x108/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x185/0x1e0 arch/x86/entry/common.c:167 wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe stack backtrace: CPU: 1 PID: 9854 Comm: syz-executor.2 Not tainted 4.19.183-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 print_bad_irq_dependency kernel/locking/lockdep.c:1572 [inline] check_usage.cold.37+0x89b/0xccc kernel/locking/lockdep.c:1604 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 check_irq_usage kernel/locking/lockdep.c:1660 [inline] check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline] check_prev_add kernel/locking/lockdep.c:1870 [inline] check_prevs_add kernel/locking/lockdep.c:1978 [inline] validate_chain kernel/locking/lockdep.c:2419 [inline] __lock_acquire+0x21de/0x47c0 kernel/locking/lockdep.c:3415 ieee80211 phy15: Selected rate control algorithm 'minstrel_ht' IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready spin_lock include/linux/spinlock.h:329 [inline] free_huge_page mm/hugetlb.c:1294 [inline] free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1256 __put_compound_page+0x65/0xa0 mm/swap.c:96 __put_page+0x5d/0x290 mm/swap.c:112 put_page include/linux/mm.h:963 [inline] __skb_frag_unref include/linux/skbuff.h:2833 [inline] skb_release_data+0x249/0x760 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1466 [inline] tcp_write_queue_purge+0x243/0x7b0 net/ipv4/tcp.c:2543 tcp_v4_destroy_sock+0xa1/0x630 net/ipv4/tcp_ipv4.c:1989 inet_csk_destroy_sock+0x11a/0x390 net/ipv4/inet_connection_sock.c:872 tcp_close+0x821/0xf00 net/ipv4/tcp.c:2498 inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x185/0x1e0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x418e1b Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007ffed6651f30 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000418e1b RDX: 0000000000000000 RSI: 0000000000570e00 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ffed6652020 R11: 0000000000000293 R12: 00000000000003e8 R13: 000000000000d60b R14: 000000000056bf60 R15: 000000000056c008 Bluetooth: hci5: command 0x0419 tx timeout Bluetooth: hci0: command 0x0419 tx timeout Bluetooth: hci2: command 0x0419 tx timeout Bluetooth: hci1: command 0x0419 tx timeout Bluetooth: hci4: command 0x0419 tx timeout Bluetooth: hci3: command 0x0419 tx timeout nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.