INFO: trying to register non-static key in flush_work

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=169c15ed200000
kernel config: https://syzkaller.appspot.com/x/.config?x=fdadf290ea9fc6f9
dashboard link: https://syzkaller.appspot.com/bug?extid=0acd8269674543f16e8d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0acd82...@syzkaller.appspotmail.com

audit: type=1804 audit(1554980888.627:583): pid=19035 uid=0 auid=4294967295
ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
op="invalid_pcr" cause="open_writers" comm="syz-executor.5"
name="/root/syzkaller-testdir853591711/syzkaller.D5D9Pf/2557/bus"
dev="sda1" ino=17281 res=1
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 1 PID: 19013 Comm: syz-executor.2 Not tainted 4.14.111 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
register_lock_class+0x2fd/0x1730 kernel/locking/lockdep.c:768
__lock_acquire+0x147/0x45e0 kernel/locking/lockdep.c:3374
lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3994
flush_work+0xae/0x730 kernel/workqueue.c:2881
__cancel_work_timer+0x2f0/0x480 kernel/workqueue.c:2956
cancel_work_sync+0x18/0x20 kernel/workqueue.c:2992
smc_close_active+0x6d2/0xc10 net/smc/smc_close.c:206
smc_release+0x45f/0x640 net/smc/af_smc.c:131
__sock_release+0xd3/0x2c0 net/socket.c:602
sock_close+0x1b/0x30 net/socket.c:1139
__fput+0x277/0x7a0 fs/file_table.c:210
____fput+0x16/0x20 fs/file_table.c:244
task_work_run+0x119/0x190 kernel/task_work.c:113
get_signal+0x1689/0x1a80 kernel/signal.c:2220
do_signal+0x86/0x1980 arch/x86/kernel/signal.c:809
exit_to_usermode_loop+0x15c/0x220 arch/x86/entry/common.c:159
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
do_syscall_64+0x4a9/0x630 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4582f9
RSP: 002b:00007fb95cfe3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000120
RAX: fffffffffffffe00 RBX: 0000000000000004 RCX: 00000000004582f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb95cfe46d4
R13: 00000000004be089 R14: 00000000004ce830 R15: 00000000ffffffff
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
audit: type=1804 audit(1554980890.867:584): pid=19075 uid=0 auid=4294967295
ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
op="invalid_pcr" cause="open_writers" comm="syz-executor.5"
name="/root/syzkaller-testdir853591711/syzkaller.D5D9Pf/2558/bus"
dev="sda1" ino=17281 res=1
kobject: 'loop0' (ffff888061e6e4e0): kobject_uevent_env
kobject: 'loop0' (ffff888061e6e4e0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
audit: type=1804 audit(1554980893.007:585): pid=19106 uid=0 auid=4294967295
ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
op="invalid_pcr" cause="open_writers" comm="syz-executor.5"
name="/root/syzkaller-testdir853591711/syzkaller.D5D9Pf/2559/bus"
dev="sda1" ino=17877 res=1
kobject: 'loop0' (ffff888061e6e4e0): kobject_uevent_env
kobject: 'loop0' (ffff888061e6e4e0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
audit: type=1804 audit(1554980895.187:586): pid=19141 uid=0 auid=4294967295
ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
op="invalid_pcr" cause="open_writers" comm="syz-executor.5"
name="/root/syzkaller-testdir853591711/syzkaller.D5D9Pf/2560/bus"
dev="sda1" ino=17877 res=1
kobject: 'loop0' (ffff888061e6e4e0): kobject_uevent_env
kobject: 'loop0' (ffff888061e6e4e0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
kobject: 'loop0' (ffff888061e6e4e0): kobject_uevent_env
kobject: 'loop0' (ffff888061e6e4e0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop4' (ffff88809c3a7520): kobject_uevent_env
kobject: 'loop4' (ffff88809c3a7520): fill_kobj_path: path
= '/devices/virtual/block/loop4'
audit: type=1804 audit(1554980897.427:587): pid=19176 uid=0 auid=4294967295
ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
op="invalid_pcr" cause="open_writers" comm="syz-executor.5"
name="/root/syzkaller-testdir853591711/syzkaller.D5D9Pf/2561/bus"
dev="sda1" ino=17877 res=1


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y

console output: https://syzkaller.appspot.com/x/log.txt?x=1034bbc3200000

kernel config: https://syzkaller.appspot.com/x/.config?x=fdadf290ea9fc6f9
dashboard link: https://syzkaller.appspot.com/bug?extid=0acd8269674543f16e8d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1179d5bb200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10810dbb200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0acd82...@syzkaller.appspotmail.com

random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
audit: type=1400 audit(1555007022.352:36): avc: denied { map } for
pid=6909 comm="syz-executor027" path="/root/syz-executor027474892"
dev="sda1" ino=16461 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1

INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.

CPU: 1 PID: 6909 Comm: syz-executor027 Not tainted 4.14.111 #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
register_lock_class+0x2fd/0x1730 kernel/locking/lockdep.c:768
__lock_acquire+0x147/0x45e0 kernel/locking/lockdep.c:3374
lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3994
flush_work+0xae/0x730 kernel/workqueue.c:2881
__cancel_work_timer+0x2f0/0x480 kernel/workqueue.c:2956
cancel_work_sync+0x18/0x20 kernel/workqueue.c:2992
smc_close_active+0x6d2/0xc10 net/smc/smc_close.c:206
smc_release+0x45f/0x640 net/smc/af_smc.c:131
__sock_release+0xd3/0x2c0 net/socket.c:602
sock_close+0x1b/0x30 net/socket.c:1139
__fput+0x277/0x7a0 fs/file_table.c:210
____fput+0x16/0x20 fs/file_table.c:244
task_work_run+0x119/0x190 kernel/task_work.c:113

exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x7df/0x2c10 kernel/exit.c:874
do_group_exit+0x111/0x330 kernel/exit.c:977
SYSC_exit_group kernel/exit.c:988 [inline]
SyS_exit_group+0x1d/0x20 kernel/exit.c:986
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x43ed88
RSP: 002b:00007ffe79a72bd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ed88
RDX: 0000000000000000 RSI: 0000000