bisecting fixing commit since c6db52a88798e5a0dfef80041ad4d33cc8cf04eb
building syzkaller on 2420d1bcbcd9f5d5893c1aab8096cce81721dac2
testing commit c6db52a88798e5a0dfef80041ad4d33cc8cf04eb with gcc (GCC) 8.4.1 20210217
kernel signature: a87a2fe7acab25a137406227b248d1f4a8d259f05084af49296519c236a5b099
run #0: crashed: KASAN: use-after-free Read in tasklet_action
run #1: crashed: KASAN: use-after-free Read in bcm_can_tx
run #2: crashed: KASAN: use-after-free Read in bcm_can_tx
run #3: crashed: KASAN: use-after-free Read in bcm_can_tx
run #4: crashed: KASAN: use-after-free Read in hrtimer_debug_hint
run #5: crashed: KASAN: use-after-free Read in tasklet_action
run #6: crashed: KASAN: use-after-free Read in tasklet_action
run #7: crashed: WARNING: ODEBUG bug in enqueue_hrtimer
run #8: crashed: KASAN: use-after-free Read in tasklet_action
run #9: crashed: KASAN: use-after-free Read in bcm_can_tx
run #10: crashed: KASAN: use-after-free Read in bcm_can_tx
run #11: crashed: KASAN: use-after-free Read in bcm_can_tx
run #12: crashed: KASAN: use-after-free Read in hrtimer_debug_hint
run #13: crashed: KASAN: use-after-free Read in bcm_can_tx
run #14: crashed: KASAN: use-after-free Read in tasklet_action
run #15: crashed: KASAN: use-after-free Read in tasklet_action
run #16: crashed: KASAN: use-after-free Read in tasklet_action
run #17: crashed: WARNING: ODEBUG bug in bcm_remove_op
run #18: crashed: KASAN: use-after-free Read in bcm_can_tx
run #19: crashed: KASAN: use-after-free Write in __tasklet_schedule
testing current HEAD 7d7d1c0ab3eb7c8d8f63a126535018007823b207
testing commit 7d7d1c0ab3eb7c8d8f63a126535018007823b207 with gcc (GCC) 8.4.1 20210217
kernel signature: d0ad5df4c0699f00013b856ff826e07f32ecf86e26ce4d94da1f82294ccee276
run #0: crashed: KASAN: use-after-free Read in bcm_can_tx
run #1: crashed: KASAN: use-after-free Read in tasklet_action
run #2: crashed: KASAN: use-after-free Read in bcm_can_tx
run #3: crashed: KASAN: use-after-free Read in bcm_can_tx
run #4: crashed: KASAN: use-after-free Read in bcm_can_tx
run #5: crashed: KASAN: use-after-free Read in tasklet_action
run #6: crashed: KASAN: use-after-free Read in bcm_can_tx
run #7: crashed: possible deadlock in down_trylock
run #8: crashed: KASAN: use-after-free Read in bcm_can_tx
run #9: OK
revisions tested: 2, total time: 36m52.655175031s (build: 16m31.391649644s, test: 19m50.865515245s)
the crash still happens on HEAD
commit msg: Linux 4.14.232
crash: KASAN: use-after-free Read in bcm_can_tx
IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready
batman_adv: batadv0: Interface activated: batadv_slave_1
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: use-after-free in bcm_can_tx+0x5cc/0x6e0 net/can/bcm.c:304
Read of size 4 at addr ffff8881ecb485c4 by task kworker/u4:5/7046
CPU: 1 PID: 7046 Comm: kworker/u4:5 Not tainted 4.14.232-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x14b/0x1e7 lib/dump_stack.c:58
print_address_description.cold.6+0x9/0x1ca mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold.7+0x11a/0x2d3 mm/kasan/report.c:393
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
bcm_can_tx+0x5cc/0x6e0 net/can/bcm.c:304
bcm_tx_timeout_tsklet+0xed/0x260 net/can/bcm.c:422
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x15f/0x1a0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x149/0x5d0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:lock_release+0x446/0x820 kernel/locking/lockdep.c:4020
RSP: 0018:ffff8881daf0fc68 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 1ffff1103b5e1f90 RCX: 1ffff1103b5b596f
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000003 RDI: 0000000000000286
RBP: ffff8881daf0fd08 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000050 R11: ffff8881dadac300 R12: ffff8881dadac300
R13: 0000000000000002 R14: ffff8881dadac300 R15: ffff8881dadacb80
rcu_lock_release include/linux/rcupdate.h:247 [inline]
rcu_read_unlock include/linux/rcupdate.h:685 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:420 [inline]
batadv_nc_worker+0x194/0x630 net/batman-adv/network-coding.c:726
process_one_work+0x74f/0x1620 kernel/workqueue.c:2116
worker_thread+0xcc/0xee0 kernel/workqueue.c:2250
kthread+0x338/0x400 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Allocated by task 7770:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:551
kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:536
kmem_cache_alloc_trace+0x152/0x3f0 mm/slab.c:3618
kmalloc include/linux/slab.h:488 [inline]
kzalloc include/linux/slab.h:661 [inline]
bcm_tx_setup net/can/bcm.c:952 [inline]
bcm_sendmsg+0x1a3a/0x4680 net/can/bcm.c:1388
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xac/0xf0 net/socket.c:656
___sys_sendmsg+0x625/0x920 net/socket.c:2062
__sys_sendmsg+0xc1/0x140 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0xd/0x20 net/socket.c:2103
do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
Freed by task 7766:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xab/0x190 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xcc/0x270 mm/slab.c:3815
bcm_remove_op+0x1cd/0x240 net/can/bcm.c:781
bcm_release+0xe7/0x500 net/can/bcm.c:1540
__sock_release+0xc2/0x2a0 net/socket.c:602
sock_close+0x10/0x20 net/socket.c:1139
__fput+0x232/0x740 fs/file_table.c:210
____fput+0x9/0x10 fs/file_table.c:244
task_work_run+0xe5/0x170 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x14a/0x190 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
The buggy address belongs to the object at ffff8881ecb48480
which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 324 bytes inside of
1024-byte region [ffff8881ecb48480, ffff8881ecb48880)
The buggy address belongs to the page:
page:ffffea0007b2d200 count:1 mapcount:0 mapping:ffff8881ecb48000 index:0x0 compound_mapcount: 0
flags: 0x17ffe0000008100(slab|head)
raw: 017ffe0000008100 ffff8881ecb48000 0000000000000000 0000000100000007
raw: ffffea00078d1ea0 ffffea0007a9e820 ffff8881f6000ac0 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881ecb48480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ecb48500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881ecb48580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881ecb48600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ecb48680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
ODEBUG: activate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 7046 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 7046 Comm: kworker/u4:5 Tainted: G B 4.14.232-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
task: ffff8881dadac300 task.stack: ffff8881daf08000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f6707be8 EFLAGS: 00010082
RAX: 000000000000006a RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006a RSI: ffffffff86cbeca0 RDI: ffffed103ece0f74
RBP: ffff8881f6707c10 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab7270 R14: 0000000000000000 R15: ffffffff89c22848
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000481970 CR3: 0000000007e6a002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x26d/0x4b0 lib/debugobjects.c:477
debug_hrtimer_activate kernel/time/hrtimer.c:401 [inline]
debug_activate kernel/time/hrtimer.c:447 [inline]
enqueue_hrtimer+0x1f/0x330 kernel/time/hrtimer.c:844
hrtimer_start_range_ns+0x4d5/0x1040 kernel/time/hrtimer.c:970
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x15f/0x1a0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x149/0x5d0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:lock_release+0x446/0x820 kernel/locking/lockdep.c:4020
RSP: 0018:ffff8881daf0fc68 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 1ffff1103b5e1f90 RCX: 1ffff1103b5b596f
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000003 RDI: 0000000000000286
RBP: ffff8881daf0fd08 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000050 R11: ffff8881dadac300 R12: ffff8881dadac300
R13: 0000000000000002 R14: ffff8881dadac300 R15: ffff8881dadacb80
rcu_lock_release include/linux/rcupdate.h:247 [inline]
rcu_read_unlock include/linux/rcupdate.h:685 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:420 [inline]
batadv_nc_worker+0x194/0x630 net/batman-adv/network-coding.c:726
process_one_work+0x74f/0x1620 kernel/workqueue.c:2116
worker_thread+0xcc/0xee0 kernel/workqueue.c:2250
kthread+0x338/0x400 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 c6 1c a8 fc 48 89 75 d8 e8 3a fa 28 fb 48 8b 75 d8 eb
---[ end trace 60a9cc2b5a280fc3 ]---
ODEBUG: deactivate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 7046 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 7046 Comm: kworker/u4:5 Tainted: G B W 4.14.232-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
task: ffff8881dadac300 task.stack: ffff8881daf08000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f6707978 EFLAGS: 00010086
RAX: 000000000000006c RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006c RSI: ffffffff87041ee0 RDI: ffffed103ece0f26
RBP: ffff8881f67079a0 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab7270 R14: 0000000000000000 R15: ffff8881f6707a50
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000481970 CR3: 0000000007e6a002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_deactivate lib/debugobjects.c:527 [inline]
debug_object_deactivate+0x1eb/0x300 lib/debugobjects.c:491
debug_hrtimer_deactivate kernel/time/hrtimer.c:406 [inline]
debug_deactivate kernel/time/hrtimer.c:453 [inline]
__run_hrtimer kernel/time/hrtimer.c:1193 [inline]
__hrtimer_run_queues+0x1ba/0xad0 kernel/time/hrtimer.c:1287
hrtimer_interrupt+0x1ae/0x600 kernel/time/hrtimer.c:1321
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline]
smp_apic_timer_interrupt+0x11f/0x5d0 arch/x86/kernel/apic/apic.c:1104
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:192
RSP: 0018:ffff8881f6707d18 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: ffffffff814cd43b
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000001 RDI: 0000000000000286
RBP: ffff8881f6707d28 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed1047fff009 R11: 0000006c59c16852 R12: ffff8881f6725b80
R13: 0000006ad529235a R14: 0000000000000000 R15: ffff8881f6725c40
unlock_hrtimer_base kernel/time/hrtimer.c:778 [inline]
hrtimer_start_range_ns+0x5b7/0x1040 kernel/time/hrtimer.c:985
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x15f/0x1a0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x149/0x5d0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:lock_release+0x446/0x820 kernel/locking/lockdep.c:4020
RSP: 0018:ffff8881daf0fc68 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 1ffff1103b5e1f90 RCX: 1ffff1103b5b596f
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000003 RDI: 0000000000000286
RBP: ffff8881daf0fd08 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000050 R11: ffff8881dadac300 R12: ffff8881dadac300
R13: 0000000000000002 R14: ffff8881dadac300 R15: ffff8881dadacb80
rcu_lock_release include/linux/rcupdate.h:247 [inline]
rcu_read_unlock include/linux/rcupdate.h:685 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:420 [inline]
batadv_nc_worker+0x194/0x630 net/batman-adv/network-coding.c:726
process_one_work+0x74f/0x1620 kernel/workqueue.c:2116
worker_thread+0xcc/0xee0 kernel/workqueue.c:2250
kthread+0x338/0x400 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 c6 1c a8 fc 48 89 75 d8 e8 3a fa 28 fb 48 8b 75 d8 eb
---[ end trace 60a9cc2b5a280fc4 ]---
ODEBUG: activate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 17 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 17 Comm: ksoftirqd/1 Tainted: G B W 4.14.232-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8881f53f2480 task.stack: ffff8881f4c00000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f4c07a88 EFLAGS: 00010082
RAX: 000000000000006a RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006a RSI: ffffffff86cbeca0 RDI: ffffed103e980f48
RBP: ffff8881f4c07ab0 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab7270 R14: 0000000000000000 R15: ffffffff89c22848
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007eff9c0330d8 CR3: 0000000007e6a002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x26d/0x4b0 lib/debugobjects.c:477
debug_hrtimer_activate kernel/time/hrtimer.c:401 [inline]
debug_activate kernel/time/hrtimer.c:447 [inline]
enqueue_hrtimer+0x1f/0x330 kernel/time/hrtimer.c:844
hrtimer_start_range_ns+0x4d5/0x1040 kernel/time/hrtimer.c:970
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
run_ksoftirqd+0x57/0x1a0 kernel/softirq.c:670
smpboot_thread_fn+0x553/0x850 kernel/smpboot.c:164
kthread+0x338/0x400 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 c6 1c a8 fc 48 89 75 d8 e8 3a fa 28 fb 48 8b 75 d8 eb
---[ end trace 60a9cc2b5a280fc5 ]---
ODEBUG: deactivate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 17 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 17 Comm: ksoftirqd/1 Tainted: G B W 4.14.232-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8881f53f2480 task.stack: ffff8881f4c00000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f6707d08 EFLAGS: 00010086
RAX: 000000000000006c RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006c RSI: ffffffff87041ee0 RDI: ffffed103ece0f98
RBP: ffff8881f6707d30 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab7270 R14: 0000000000000000 R15: ffff8881f6707de0
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007eff9c0330d8 CR3: 0000000007e6a002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_deactivate lib/debugobjects.c:527 [inline]
debug_object_deactivate+0x1eb/0x300 lib/debugobjects.c:491
debug_hrtimer_deactivate kernel/time/hrtimer.c:406 [inline]
debug_deactivate kernel/time/hrtimer.c:453 [inline]
__run_hrtimer kernel/time/hrtimer.c:1193 [inline]
__hrtimer_run_queues+0x1ba/0xad0 kernel/time/hrtimer.c:1287
hrtimer_interrupt+0x1ae/0x600 kernel/time/hrtimer.c:1321
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline]
smp_apic_timer_interrupt+0x11f/0x5d0 arch/x86/kernel/apic/apic.c:1104
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:192
RSP: 0018:ffff8881f4c07bb0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: ffffffff814cd43b
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000001 RDI: 0000000000000286
RBP: ffff8881f4c07bc0 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed1047fff009 R11: 0000006c836dec23 R12: ffff8881f6725b80
R13: 0000006b03fc9da6 R14: 0000000000000000 R15: ffff8881f6725c40
unlock_hrtimer_base kernel/time/hrtimer.c:778 [inline]
hrtimer_start_range_ns+0x5b7/0x1040 kernel/time/hrtimer.c:985
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
run_ksoftirqd+0x57/0x1a0 kernel/softirq.c:670
smpboot_thread_fn+0x553/0x850 kernel/smpboot.c:164
kthread+0x338/0x400 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 c6 1c a8 fc 48 89 75 d8 e8 3a fa 28 fb 48 8b 75 d8 eb
---[ end trace 60a9cc2b5a280fc6 ]---
ODEBUG: activate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 30820 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 30820 Comm: kworker/1:1 Tainted: G B W 4.14.232-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events defense_work_handler
task: ffff8881cdaaa340 task.stack: ffff8881dfea0000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f6707c38 EFLAGS: 00010082
RAX: 000000000000006a RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006a RSI: ffffffff86cbeca0 RDI: ffffed103ece0f7e
RBP: ffff8881f6707c60 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab7270 R14: 0000000000000000 R15: ffffffff89c22848
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007eff9c0330d8 CR3: 0000000007e6a002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x26d/0x4b0 lib/debugobjects.c:477
debug_hrtimer_activate kernel/time/hrtimer.c:401 [inline]
debug_activate kernel/time/hrtimer.c:447 [inline]
enqueue_hrtimer+0x1f/0x330 kernel/time/hrtimer.c:844
hrtimer_start_range_ns+0x4d5/0x1040 kernel/time/hrtimer.c:970
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1016
do_softirq kernel/softirq.c:332 [inline]
do_softirq+0xee/0x160 kernel/softirq.c:319
__local_bh_enable_ip+0x130/0x150 kernel/softirq.c:185
local_bh_enable include/linux/bottom_half.h:32 [inline]
update_defense_level+0x307/0xe00 net/netfilter/ipvs/ip_vs_ctl.c:215
defense_work_handler+0x19/0xb0 net/netfilter/ipvs/ip_vs_ctl.c:229
process_one_work+0x74f/0x1620 kernel/workqueue.c:2116
worker_thread+0xcc/0xee0 kernel/workqueue.c:2250
kthread+0x338/0x400 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 c6 1c a8 fc 48 89 75 d8 e8 3a fa 28 fb 48 8b 75 d8 eb
---[ end trace 60a9cc2b5a280fc7 ]---