bisecting fixing commit since 22fbc037cd32e4e6771d2271b565806cfb8c134c building syzkaller on 1a3f94087169f62f9a5832828f62b4900e98b781 testing commit 22fbc037cd32e4e6771d2271b565806cfb8c134c with gcc (GCC) 8.1.0 kernel signature: ae1e03a119ab672c30e4ead0181eb88c45fef225d1dd69609a7acb8f7fc55768 run #0: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #1: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #2: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #3: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #4: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #5: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #6: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #7: OK run #8: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #9: crashed: BUG: unable to handle kernel paging request in cfb_imageblit testing current HEAD eccc876724927ff3b9ff91f36f7b6b159e948f0c testing commit eccc876724927ff3b9ff91f36f7b6b159e948f0c with gcc (GCC) 8.1.0 kernel signature: 0c6d5899664b2694c47e49cebf96392fd1fce54293279919de26a885d91a84dc run #0: crashed: BUG: sleeping function called from invalid context in sta_info_move_state run #1: crashed: BUG: sleeping function called from invalid context in sta_info_move_state run #2: crashed: BUG: sleeping function called from invalid context in sta_info_move_state run #3: crashed: BUG: sleeping function called from invalid context in sta_info_move_state run #4: crashed: BUG: sleeping function called from invalid context in sta_info_move_state run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK revisions tested: 2, total time: 31m41.246598904s (build: 9m54.935816727s, test: 21m10.596866826s) the crash still happens on HEAD commit msg: Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs crash: BUG: sleeping function called from invalid context in sta_info_move_state BUG: sleeping function called from invalid context at net/mac80211/sta_info.c:1962 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 305, name: kworker/u4:4 4 locks held by kworker/u4:4/305: #0: ffff88811f475d38 ((wq_completion)phy6){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff88811f475d38 ((wq_completion)phy6){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff88811f475d38 ((wq_completion)phy6){+.+.}-{0:0}, at: process_one_work+0x1e6/0x600 kernel/workqueue.c:2243 #1: ffffc90000dd7e70 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline] #1: ffffc90000dd7e70 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #1: ffffc90000dd7e70 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: process_one_work+0x1e6/0x600 kernel/workqueue.c:2243 #2: ffff88811f674d00 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1021 [inline] #2: ffff88811f674d00 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0x36/0x420 net/mac80211/ibss.c:1683 #3: ffffffff847fbd40 (rcu_read_lock){....}-{1:2}, at: sta_info_insert_finish net/mac80211/sta_info.c:644 [inline] #3: ffffffff847fbd40 (rcu_read_lock){....}-{1:2}, at: sta_info_insert_rcu+0x1c6/0xde0 net/mac80211/sta_info.c:732 Preemption disabled at: [] __mutex_lock_common kernel/locking/mutex.c:955 [inline] [] __mutex_lock+0x70/0x9f0 kernel/locking/mutex.c:1103 CPU: 1 PID: 305 Comm: kworker/u4:4 Not tainted 5.10.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: phy6 ieee80211_iface_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xa3/0xc8 lib/dump_stack.c:118 ___might_sleep.cold.112+0xfb/0x10f kernel/sched/core.c:7298 sta_info_move_state+0x1a/0x2b0 net/mac80211/sta_info.c:1962 sta_info_free+0x11/0xd0 net/mac80211/sta_info.c:274 sta_info_insert_rcu+0xd4/0xde0 net/mac80211/sta_info.c:738 ieee80211_ibss_finish_sta+0x9e/0x120 net/mac80211/ibss.c:592 ieee80211_ibss_work+0x10a/0x420 net/mac80211/ibss.c:1700 process_one_work+0x273/0x600 kernel/workqueue.c:2272 worker_thread+0x38/0x380 kernel/workqueue.c:2418 kthread+0x145/0x170 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 ============================= [ BUG: Invalid wait context ] 5.10.0-rc3-syzkaller #0 Tainted: G W ----------------------------- kworker/u4:4/305 is trying to lock: ffff88811f61a9d0 (&local->chanctx_mtx){+.+.}-{3:3}, at: ieee80211_recalc_min_chandef+0x1f/0x90 net/mac80211/util.c:2740 other info that might help us debug this: context-{4:4} 4 locks held by kworker/u4:4/305: #0: ffff88811f475d38 ((wq_completion)phy6){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline] #0: ffff88811f475d38 ((wq_completion)phy6){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff88811f475d38 ((wq_completion)phy6){+.+.}-{0:0}, at: process_one_work+0x1e6/0x600 kernel/workqueue.c:2243 #1: ffffc90000dd7e70 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:615 [inline] #1: ffffc90000dd7e70 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #1: ffffc90000dd7e70 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: process_one_work+0x1e6/0x600 kernel/workqueue.c:2243 #2: ffff88811f674d00 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1021 [inline] #2: ffff88811f674d00 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0x36/0x420 net/mac80211/ibss.c:1683 #3: ffffffff847fbd40 (rcu_read_lock){....}-{1:2}, at: sta_info_insert_finish net/mac80211/sta_info.c:644 [inline] #3: ffffffff847fbd40 (rcu_read_lock){....}-{1:2}, at: sta_info_insert_rcu+0x1c6/0xde0 net/mac80211/sta_info.c:732 stack backtrace: CPU: 1 PID: 305 Comm: kworker/u4:4 Tainted: G W 5.10.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: phy6 ieee80211_iface_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xa3/0xc8 lib/dump_stack.c:118 print_lock_invalid_wait_context kernel/locking/lockdep.c:4483 [inline] check_wait_context kernel/locking/lockdep.c:4544 [inline] __lock_acquire.cold.75+0x29c/0x2b7 kernel/locking/lockdep.c:4781 lock_acquire+0xf9/0x420 kernel/locking/lockdep.c:5436 __mutex_lock_common kernel/locking/mutex.c:956 [inline] __mutex_lock+0x94/0x9f0 kernel/locking/mutex.c:1103 ieee80211_recalc_min_chandef+0x1f/0x90 net/mac80211/util.c:2740 sta_info_move_state+0x140/0x2b0 net/mac80211/sta_info.c:2019 sta_info_free+0x11/0xd0 net/mac80211/sta_info.c:274 sta_info_insert_rcu+0xd4/0xde0 net/mac80211/sta_info.c:738 ieee80211_ibss_finish_sta+0x9e/0x120 net/mac80211/ibss.c:592 ieee80211_ibss_work+0x10a/0x420 net/mac80211/ibss.c:1700 process_one_work+0x273/0x600 kernel/workqueue.c:2272 worker_thread+0x38/0x380 kernel/workqueue.c:2418 kthread+0x145/0x170 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50