BUG: sleeping function called from invalid context in htb_destroy

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: f6e27dbb Linux 4.14.146
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1016928f600000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb75afefe94a0801
dashboard link: https://syzkaller.appspot.com/bug?extid=bdc10f2a2adb0a5b7fad
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=141eee2b600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=153f5147600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bdc10f...@syzkaller.appspotmail.com

audit: type=1400 audit(1570255637.264:36): avc: denied { map } for
pid=6830 comm="syz-executor228" path="/root/syz-executor228672207"
dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
IPVS: ftp: loaded support on port[0] = 21
BUG: sleeping function called from invalid context at
kernel/workqueue.c:2816
in_atomic(): 1, irqs_disabled(): 0, pid: 6832, name: syz-executor228
2 locks held by syz-executor228/6832:
#0: (rtnl_mutex){+.+.}, at: [<ffffffff84d8f03a>] rtnl_lock
net/core/rtnetlink.c:72 [inline]
#0: (rtnl_mutex){+.+.}, at: [<ffffffff84d8f03a>]
rtnetlink_rcv_msg+0x33a/0xb70 net/core/rtnetlink.c:4280
#1: (&qdisc_rx_lock){+...}, at: [<ffffffff84ea174e>] spin_lock_bh
include/linux/spinlock.h:322 [inline]
#1: (&qdisc_rx_lock){+...}, at: [<ffffffff84ea174e>] sch_tree_lock
include/net/sch_generic.h:355 [inline]
#1: (&qdisc_rx_lock){+...}, at: [<ffffffff84ea174e>]
red_change+0x32e/0x1030 net/sched/sch_red.c:199
Preemption disabled at:
[<ffffffff84ea174e>] spin_lock_bh include/linux/spinlock.h:322 [inline]
[<ffffffff84ea174e>] sch_tree_lock include/net/sch_generic.h:355 [inline]
[<ffffffff84ea174e>] red_change+0x32e/0x1030 net/sched/sch_red.c:199
CPU: 1 PID: 6832 Comm: syz-executor228 Not tainted 4.14.146 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x197 lib/dump_stack.c:53
___might_sleep.cold+0x1bd/0x1f6 kernel/sched/core.c:6039
__might_sleep+0x93/0xb0 kernel/sched/core.c:5992
start_flush_work kernel/workqueue.c:2816 [inline]
flush_work+0xdb/0x730 kernel/workqueue.c:2884
__cancel_work_timer+0x2f0/0x480 kernel/workqueue.c:2956
cancel_work_sync+0x18/0x20 kernel/workqueue.c:2992
htb_destroy+0x26/0x420 net/sched/sch_htb.c:1246
qdisc_destroy+0x157/0x320 net/sched/sch_generic.c:725
red_change+0x4d4/0x1030 net/sched/sch_red.c:205
qdisc_change net/sched/sch_api.c:1144 [inline]
tc_modify_qdisc+0xc5a/0x1270 net/sched/sch_api.c:1409
rtnetlink_rcv_msg+0x3eb/0xb70 net/core/rtnetlink.c:4285
netlink_rcv_skb+0x14f/0x3c0 net/netlink/af_netlink.c:2432
rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4297
netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
netlink_unicast+0x45d/0x640 net/netlink/af_netlink.c:1312
netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x70a/0x840 net/socket.c:2062
__sys_sendmsg+0xb9/0x140 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2103
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x446519
RSP: 002b:00007f2551573d98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006dbc68 RCX: 0000000000446519
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004
RBP: 00000000006dbc60 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00000000006dbc6c
R13: 00000000004aeac4 R14: b35d2484a6425def R15: 10eb52a57aaf8377


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches