WARNING: ODEBUG bug in batadv_nc_mesh_free

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: a844dc4c Linux 4.14.158
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17f040aee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c02bef505ffc02ff
dashboard link: https://syzkaller.appspot.com/bug?extid=bfac910608fbccfb6b96
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bfac91...@syzkaller.appspotmail.com

0 pages HighMem/MovableOnly
335858 pages reserved
0 pages cma reserved
ODEBUG: assert_init not available (active state 0) object type: timer_list
hint: (null)
------------[ cut here ]------------
WARNING: CPU: 0 PID: 29922 at lib/debugobjects.c:287
debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 29922 Comm: syz-executor.2 Not tainted 4.14.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x2f/0x2f kernel/panic.c:547
report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963
RIP: 0010:debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff88820f6af148 EFLAGS: 00010086
RAX: 0000000000000061 RBX: 0000000000000005 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff86cc43c0 RDI: ffffed1041ed5e1f
RBP: ffff88820f6af170 R08: 0000000000000061 R09: 0000000000000001
R10: 0000000000000000 R11: ffff8880906fa680 R12: ffffffff86cbf6a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8881fedae0b0
debug_object_assert_init lib/debugobjects.c:656 [inline]
debug_object_assert_init+0x22f/0x300 lib/debugobjects.c:627
debug_timer_assert_init kernel/time/timer.c:707 [inline]
debug_assert_init kernel/time/timer.c:755 [inline]
del_timer+0x67/0xf0 kernel/time/timer.c:1150
try_to_grab_pending+0x263/0x620 kernel/workqueue.c:1225
__cancel_work_timer+0xb4/0x480 kernel/workqueue.c:2915
cancel_delayed_work_sync+0x1b/0x20 kernel/workqueue.c:3076
batadv_nc_mesh_free+0x46/0x11e net/batman-adv/network-coding.c:1887
batadv_mesh_free+0x75/0x160 net/batman-adv/main.c:231
batadv_mesh_init+0x59a/0x670 net/batman-adv/main.c:216
batadv_softif_init_late+0xa33/0xca0 net/batman-adv/soft-interface.c:856
register_netdevice+0x28e/0xca0 net/core/dev.c:7598
rtnl_newlink+0x1441/0x1700 net/core/rtnetlink.c:2732
rtnetlink_rcv_msg+0x3da/0xb70 net/core/rtnetlink.c:4306
netlink_rcv_skb+0x14f/0x3c0 net/netlink/af_netlink.c:2432
rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4318
netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
netlink_unicast+0x44d/0x650 net/netlink/af_netlink.c:1312
netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
SYSC_sendto+0x206/0x310 net/socket.c:1763
SyS_sendto+0x40/0x50 net/socket.c:1731
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x414613
RSP: 002b:00007fffbe3b5c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000a72200 RCX: 0000000000414613
RDX: 000000000000003c RSI: 0000000000a72250 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fffbe3b5c80 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000a72250 R15: 0000000000000003
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 84f5ad46 Linux 4.14.162
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10f7513ee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=67bcc84091a71c98

dashboard link: https://syzkaller.appspot.com/bug?extid=bfac910608fbccfb6b96
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13df2869e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bfac91...@syzkaller.appspotmail.com

DMA:
2569
69*4kB

ODEBUG: assert_init not available (active state 0) object type: timer_list
hint: (null)
------------[ cut here ]------------

WARNING: CPU: 1 PID: 7553 at lib/debugobjects.c:287

debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 7553 Comm: syz-executor.0 Not tainted 4.14.162-syzkaller #0
(UME)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183

3*8kB
(M)
__warn.cold+0x2f/0x2f kernel/panic.c:547
4*16kB (ME)

report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295

10*32kB

do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963

(UME)

RIP: 0010:debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287

8*64kB
RSP: 0018:ffff888166b87148 EFLAGS: 00010086

RAX: 0000000000000061 RBX: 0000000000000005 RCX: 0000000000000000

RDX: 0000000000000000 RSI: ffffffff87049200 RDI: ffffed102cd70e1f
RBP: ffff888166b87170 R08: 0000000000000061 R09: 0000000000000001
R10: 0000000000000000 R11: ffff88808c7602c0 R12: ffffffff86cbf760
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88809355e4b0

debug_object_assert_init lib/debugobjects.c:656 [inline]
debug_object_assert_init+0x22f/0x300 lib/debugobjects.c:627

(UME)

debug_timer_assert_init kernel/time/timer.c:707 [inline]
debug_assert_init kernel/time/timer.c:755 [inline]
del_timer+0x67/0xf0 kernel/time/timer.c:1150

7*128kB
try_to_grab_pending+0x263/0x620 kernel/workqueue.c:1225
__cancel_work_timer+0xb4/0x480 kernel/workqueue.c:2921
(UME) 3*256kB
cancel_delayed_work_sync+0x1b/0x20 kernel/workqueue.c:3082

batadv_nc_mesh_free+0x46/0x11e net/batman-adv/network-coding.c:1887
batadv_mesh_free+0x75/0x160 net/batman-adv/main.c:231

(UME)

batadv_mesh_init+0x59a/0x670 net/batman-adv/main.c:216
batadv_softif_init_late+0xa33/0xca0 net/batman-adv/soft-interface.c:856

1*512kB
register_netdevice+0x28e/0xca0 net/core/dev.c:7599
rtnl_newlink+0x1441/0x1700 net/core/rtnetlink.c:2732
(E)
3*1024kB

rtnetlink_rcv_msg+0x3da/0xb70 net/core/rtnetlink.c:4306
netlink_rcv_skb+0x14f/0x3c0 net/netlink/af_netlink.c:2432

(UME)

rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4318
netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
netlink_unicast+0x44d/0x650 net/netlink/af_netlink.c:1312

2*2048kB

netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
SYSC_sendto+0x206/0x310 net/socket.c:1763

(UE)
SyS_sendto+0x40/0x50 net/socket.c:1731
0*4096kB
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
= 10540kB
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x414c43
RSP: 002b:00007ffdef7624a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000a72200 RCX: 0000000000414c43

RDX: 000000000000003c RSI: 0000000000a72250 RDI: 0000000000000003

RBP: 0000000000000000 R08: 00007ffdef7624b0 R09: 000000000000000c