WARNING: ODEBUG bug in device_release

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: a083db76 Linux 4.19.107
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17ffebede00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c32f76aaadd644de
dashboard link: https://syzkaller.appspot.com/bug?extid=638d26863dce42057400
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+638d26...@syzkaller.appspotmail.com

input: syz1 as /devices/virtual/input/input452
------------[ cut here ]------------
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x90 kernel/workqueue.c:4941
WARNING: CPU: 1 PID: 378 at lib/debugobjects.c:325 debug_print_object+0x160/0x250 lib/debugobjects.c:325
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 378 Comm: kworker/u4:3 Not tainted 4.19.107-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186
__warn.cold+0x20/0x46 kernel/panic.c:541
report_bug+0x262/0x2a0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037
RIP: 0010:debug_print_object+0x160/0x250 lib/debugobjects.c:325
Code: dd 60 0f ab 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 bf 00 00 00 48 8b 14 dd 60 0f ab 87 48 c7 c7 a0 04 ab 87 e8 fb 02 e7 fd <0f> 0b 83 05 c3 b6 37 06 01 48 83 c4 20 5b 5d 41 5c 41 5d c3 48 89
RSP: 0000:ffff8880a8e878e8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8152c6e1 RDI: ffffed10151d0f0f
RBP: 0000000000000001 R08: ffff8880a8e740c0 R09: ffffed1015ce3ee3
R10: ffffed1015ce3ee2 R11: ffff8880ae71f717 R12: ffffffff88b9faa0
R13: ffffffff81581220 R14: ffffffff8b8cd948 R15: ffff8880a860dae0
__debug_check_no_obj_freed lib/debugobjects.c:785 [inline]
debug_check_no_obj_freed+0x2a3/0x42e lib/debugobjects.c:817
kfree+0xbb/0x220 mm/slab.c:3821
kvfree+0x59/0x60 mm/util.c:452
device_release+0x76/0x210 drivers/base/core.c:926
kobject_cleanup lib/kobject.c:662 [inline]
kobject_release lib/kobject.c:691 [inline]
kref_put include/linux/kref.h:70 [inline]
kobject_put+0x17c/0x270 lib/kobject.c:708
netdev_run_todo+0x4f1/0x740 net/core/dev.c:8981
default_device_exit_batch+0x309/0x3c0 net/core/dev.c:9766
ops_exit_list.isra.0+0xef/0x140 net/core/net_namespace.c:156
cleanup_net+0x3bf/0x850 net/core/net_namespace.c:553
process_one_work+0x91f/0x1640 kernel/workqueue.c:2153
worker_thread+0x96/0xe20 kernel/workqueue.c:2296
kthread+0x34a/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

======================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 78d697fc Linux 4.14.172
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1504aa2de00000
kernel config: https://syzkaller.appspot.com/x/.config?x=31ad682bcda9b93f
dashboard link: https://syzkaller.appspot.com/bug?extid=9a1face8397e903cbf80

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+9a1fac...@syzkaller.appspotmail.com

ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x90 kernel/workqueue.c:4850
------------[ cut here ]------------
WARNING: CPU: 0 PID: 22 at lib/debugobjects.c:287 debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287

Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 22 Comm: kworker/u4:1 Not tainted 4.14.172-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:

__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x13e/0x194 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x2f/0x30 kernel/panic.c:547
report_bug+0x20a/0x248 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963
RIP: 0010:debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8880a9a2f900 EFLAGS: 00010082
RAX: 0000000000000061 RBX: 0000000000000003 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff86ac0860 RDI: ffffed1015345f16
RBP: ffffffff86abbae0 R08: 0000000000000061 R09: 0000000000000000
R10: fffffbfff14a8ce1 R11: ffff8880a9a1e5c0 R12: ffffffff813b94a0
R13: 0000000000000000 R14: ffffffff8a6e3348 R15: ffff8880a403ba10
__debug_check_no_obj_freed lib/debugobjects.c:747 [inline]
debug_check_no_obj_freed+0x3cd/0x6e4 lib/debugobjects.c:776
kfree+0xbb/0x260 mm/slab.c:3814
kvfree+0x45/0x50 mm/util.c:416
device_release+0x15f/0x1a0 drivers/base/core.c:833
kobject_cleanup lib/kobject.c:646 [inline]
kobject_release lib/kobject.c:675 [inline]
kref_put include/linux/kref.h:70 [inline]
kobject_put+0x13e/0x1f0 lib/kobject.c:692
netdev_run_todo+0x4a9/0x710 net/core/dev.c:7954
default_device_exit_batch+0x2e7/0x380 net/core/dev.c:8740
ops_exit_list.isra.0+0xef/0x140 net/core/net_namespace.c:145
cleanup_net+0x3bb/0x820 net/core/net_namespace.c:484
process_one_work+0x813/0x1540 kernel/workqueue.c:2114
worker_thread+0x5d1/0x1070 kernel/workqueue.c:2248
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 78d697fc Linux 4.14.172
git tree: linux-4.14.y

console output: https://syzkaller.appspot.com/x/log.txt?x=134fd81de00000
kernel config: https://syzkaller.appspot.com/x/.config?x=3484a1ea90b8523a

dashboard link: https://syzkaller.appspot.com/bug?extid=9a1face8397e903cbf80
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=106be4b1e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+9a1fac...@syzkaller.appspotmail.com

device veth0_macvtap entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready

ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x90 kernel/workqueue.c:4850

IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready
------------[ cut here ]------------
WARNING: CPU: 0 PID: 2212 at lib/debugobjects.c:287 debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287
IPv6: ADDRCONF(NETDEV_UP): veth1_virt_wifi: link is not ready

Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 2212 Comm: kworker/u4:3 Not tainted 4.14.172-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net

device veth1_macvtap entered promiscuous mode

Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x13e/0x194 lib/dump_stack.c:58

IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready
panic+0x1f9/0x42d kernel/panic.c:183
IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0

__warn.cold+0x2f/0x30 kernel/panic.c:547
report_bug+0x20a/0x248 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963
RIP: 0010:debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287

RSP: 0018:ffff8880a427f900 EFLAGS: 00010082

RAX: 0000000000000061 RBX: 0000000000000003 RCX: 0000000000000000

RDX: 0000000000000000 RSI: ffffffff86e453c0 RDI: ffffed101484ff16

RBP: ffffffff86abbae0 R08: 0000000000000061 R09: 0000000000000000

R10: fffffbfff14a8ce1 R11: ffff8880a4276040 R12: ffffffff813b94a0
R13: 0000000000000000 R14: ffffffff8a731bc8 R15: ffff8880994bac78

__debug_check_no_obj_freed lib/debugobjects.c:747 [inline]
debug_check_no_obj_freed+0x3cd/0x6e4 lib/debugobjects.c:776
kfree+0xbb/0x260 mm/slab.c:3814
kvfree+0x45/0x50 mm/util.c:416
device_release+0x15f/0x1a0 drivers/base/core.c:833

batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready

kobject_cleanup lib/kobject.c:646 [inline]
kobject_release lib/kobject.c:675 [inline]
kref_put include/linux/kref.h:70 [inline]
kobject_put+0x13e/0x1f0 lib/kobject.c:692
netdev_run_todo+0x4a9/0x710 net/core/dev.c:7954
default_device_exit_batch+0x2e7/0x380 net/core/dev.c:8740

batman_adv: batadv0: Interface activated: batadv_slave_0
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!

ops_exit_list.isra.0+0xef/0x140 net/core/net_namespace.c:145
cleanup_net+0x3bb/0x820 net/core/net_namespace.c:484
process_one_work+0x813/0x1540 kernel/workqueue.c:2114
worker_thread+0x5d1/0x1070 kernel/workqueue.c:2248

IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready
batman_adv: batadv0: Interface activated: batadv_slave_1

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.