bisecting fixing commit since 9fa690a2a016e1b55356835f047b952e67d3d73a building syzkaller on 5ed23f9aa677d71bc60f61df8e05046151868541 testing commit 9fa690a2a016e1b55356835f047b952e67d3d73a with gcc (GCC) 8.1.0 kernel signature: 872029729623cece3f51ca8fd520e2a0cd94a0de867190ca83c6bedf710cc8c1 all runs: crashed: BUG: sleeping function called from invalid context in __do_page_fault testing current HEAD 01364dad1d4577e27a57729d41053f661bb8a5b9 testing commit 01364dad1d4577e27a57729d41053f661bb8a5b9 with gcc (GCC) 8.1.0 kernel signature: 12e71667495306f223f8bc5a5c483800e1cc2f7799c0be2834295e063a0d68ec all runs: crashed: BUG: sleeping function called from invalid context in __do_page_fault revisions tested: 2, total time: 26m53.716545369s (build: 19m50.010577798s, test: 6m21.507557032s) the crash still happens on HEAD commit msg: Linux 4.14.174 crash: BUG: sleeping function called from invalid context in __do_page_fault IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1363 device veth0_macvtap entered promiscuous mode in_atomic(): 0, irqs_disabled(): 0, pid: 7670, name: syz-executor.3 IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready 3 locks held by syz-executor.3/7670: IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready #0: (&table[i].mutex){+.+.}, at: [] nfnl_lock net/netfilter/nfnetlink.c:61 [inline] #0: (&table[i].mutex){+.+.}, at: [] nfnetlink_rcv_msg+0x66f/0xa70 net/netfilter/nfnetlink.c:209 IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready #1: (rcu_read_lock){....}, at: [] ctnetlink_create_conntrack+0x17e/0xf10 net/netfilter/nf_conntrack_netlink.c:1785 IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready #2: (&mm->mmap_sem){++++}, at: [] __do_page_fault+0x289/0xb00 arch/x86/mm/fault.c:1349 Preemption disabled at: [] rcu_lockdep_current_cpu_online+0x37/0x140 kernel/rcu/tree.c:1185 IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready CPU: 0 PID: 7670 Comm: syz-executor.3 Not tainted 4.14.174-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 ___might_sleep.cold.87+0x1bb/0x1f4 kernel/sched/core.c:6041 __might_sleep+0x93/0xb0 kernel/sched/core.c:5994 __do_page_fault+0x2a6/0xb00 arch/x86/mm/fault.c:1363 do_page_fault+0x64/0x3fb arch/x86/mm/fault.c:1495 page_fault+0x25/0x50 arch/x86/entry/entry_64.S:1122 RIP: 0010: (null) RSP: 0018:ffff888082487098 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000003 RDX: 1ffffffff1165fd5 RSI: ffff8880824870d8 RDI: ffff888082487138 RBP: ffff8880824871c0 R08: dffffc0000000000 R09: 0000000000000001 R10: ffffed1010490e2c R11: ffff888082487167 R12: ffff888082487138 R13: ffff8880a80f7dc0 R14: ffffffff88b2fe70 R15: ffff888082487198 device veth1_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready BUG: unable to handle kernel NULL pointer dereference at (null) IP: (null) PGD a8a2e067 P4D a8a2e067 PUD a8a2f067 PMD 0 IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready Oops: 0010 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 0 PID: 7670 Comm: syz-executor.3 Tainted: G W 4.14.174-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 device veth0_vlan entered promiscuous mode task: ffff8880a87bc440 task.stack: ffff888082480000 RIP: 0010: (null) RSP: 0018:ffff888082487098 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000003 RDX: 1ffffffff1165fd5 RSI: ffff8880824870d8 RDI: ffff888082487138 RBP: ffff8880824871c0 R08: dffffc0000000000 R09: 0000000000000001 R10: ffffed1010490e2c R11: ffff888082487167 R12: ffff888082487138 R13: ffff8880a80f7dc0 R14: ffffffff88b2fe70 R15: ffff888082487198 FS: 00007fa7fad5a700(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fffb6a72ce0 CR3: 000000008a085000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 device veth1_vlan entered promiscuous mode DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: nfnetlink_parse_nat net/netfilter/nf_nat_core.c:747 [inline] nfnetlink_parse_nat_setup+0x1e6/0x320 net/netfilter/nf_nat_core.c:784 IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready ctnetlink_parse_nat_setup+0x61/0x3d0 net/netfilter/nf_conntrack_netlink.c:1421 ctnetlink_setup_nat net/netfilter/nf_conntrack_netlink.c:1496 [inline] ctnetlink_create_conntrack+0x39b/0xf10 net/netfilter/nf_conntrack_netlink.c:1840 IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready ctnetlink_new_conntrack+0x432/0xd30 net/netfilter/nf_conntrack_netlink.c:1964 device veth0_macvtap entered promiscuous mode nfnetlink_rcv_msg+0x89a/0xa70 net/netfilter/nfnetlink.c:214 netlink_rcv_skb+0x133/0x370 net/netlink/af_netlink.c:2433 IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready device veth1_macvtap entered promiscuous mode nfnetlink_rcv+0x176/0x1570 net/netfilter/nfnetlink.c:515 IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x600 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x730/0xbd0 net/netlink/af_netlink.c:1878 IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0xf0 net/socket.c:656 ___sys_sendmsg+0x625/0x920 net/socket.c:2062 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! __sys_sendmsg+0xc1/0x140 net/socket.c:2096 IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_0 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0xd/0x20 net/socket.c:2103 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! RIP: 0033:0x45b349 RSP: 002b:00007fa7fad59c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fa7fad5a6d4 RCX: 000000000045b349 IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready RDX: 0000000000000000 RSI: 0000000020000640 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000941 R14: 00000000004ca9f7 R15: 000000000075bf2c Code: Bad RIP value. RIP: (null) RSP: ffff888082487098 CR2: 0000000000000000 batman_adv: batadv0: Interface activated: batadv_slave_1 ---[ end trace 02bd69dbcc75a6d7 ]---