BUG: unable to handle kernel paging request in __run_timers

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 6a1d293238c1 Add linux-next specific files for 20181224
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=10563f00c00000
kernel config: https://syzkaller.appspot.com/x/.config?x=af046212050aa3ac
dashboard link: https://syzkaller.appspot.com/bug?extid=13311cb35ccb2637e228
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [andy.sh...@gmail.com b...@alien8.de
douly...@cn.fujitsu.com h...@zytor.com linux-...@vger.kernel.org
mi...@redhat.com pu...@hygon.cn rp...@linux.vnet.ibm.com tg...@linutronix.de
vba...@suse.cz ville....@linux.intel.com x...@kernel.org]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+13311c...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
kasan: GPF could be caused by NULL-ptr deref or user memory access
BUG: unable to handle kernel paging request at ffff88808a474580
#PF error: [PROT] [INSTR]
PGD c201067 P4D c201067 PUD 21ffff067 PMD a9617063 PTE 800000008a474163
Oops: 0011 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8541 Comm: kworker/u4:6 Not tainted 4.20.0-rc7-next-20181224 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
RIP: 0010:0xffff88808a474580
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 80 63 6c 6d 80 88
RSP: 0018:ffff8880ae6079b0 EFLAGS: 00010006
RAX: ffff88808a474580 RBX: ffff8880a9487928 RCX: ffffffff816ea433
RDX: 0000000000000100 RSI: ffffffff816e9f25 RDI: ffff8880a9487928
RBP: ffff8880ae607b00 R08: ffff8880972642c0 R09: ffffed1015cc5b90
R10: ffffed1015cc5b8f R11: ffff8880ae62dc7b R12: ffff8880ae607ad8
R13: 0000000000000100 R14: 0000000000000000 R15: ffff8880ae623bc0
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808a474580 CR3: 000000006b884000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
expire_timers kernel/time/timer.c:1358 [inline]
__run_timers+0x4a2/0xd50 kernel/time/timer.c:1681
run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1694
__do_softirq+0x30b/0xb11 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1b7/0x760 arch/x86/kernel/apic/apic.c:1062
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
</IRQ>
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:102 [inline]
RIP: 0010:__local_bh_enable_ip+0x18e/0x270 kernel/softirq.c:196
Code: 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 df 00 00 00 48 83
3d 2f 8e 45 08 00 0f 84 8f 00 00 00 fb 66 0f 1f 44 00 00 <65> 8b 05 6b 2d
b5 7e 85 c0 74 7f 5b 41 5c 41 5d 5d c3 80 3d 29 33
RSP: 0018:ffff888069327750 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13249d0 RBX: 0000000000000201 RCX: 1ffff11012e4c971
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff888097264b3c
RBP: ffff888069327768 R08: 0000000000000006 R09: ffff888097264b88
R10: ffff8880972642c0 R11: 0000000000000000 R12: ffffffff87d30a5d
R13: ffff8880972642c0 R14: 000000000000006f R15: dffffc0000000000
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
_raw_spin_unlock_bh+0x31/0x40 kernel/locking/spinlock.c:200
spin_unlock_bh include/linux/spinlock.h:374 [inline]
batadv_nc_purge_paths+0x36d/0x530 net/batman-adv/network-coding.c:482
batadv_nc_worker+0x3ae/0x920 net/batman-adv/network-coding.c:731
process_one_work+0xd0c/0x1ce0 kernel/workqueue.c:2153
worker_thread+0x143/0x14a0 kernel/workqueue.c:2296
kthread+0x357/0x430 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: ffff88808a474580
---[ end trace 9f3756620ea64638 ]---
general protection fault: 0000 [#2] PREEMPT SMP KASAN
CPU: 1 PID: 3 Comm: Tainted: G D 4.20.0-rc7-next-20181224 #1
RIP: 0010:0xffff88808a474580
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 80 63 6c 6d 80 88
RIP: 0010:__read_once_size include/linux/compiler.h:191 [inline]
RIP: 0010:get_running_cputimer include/linux/sched/cputime.h:85 [inline]
RIP: 0010:account_group_system_time include/linux/sched/cputime.h:149
[inline]
RIP: 0010:account_system_index_time+0xe8/0x5f0 kernel/sched/cputime.c:168
RSP: 0018:ffff8880ae6079b0 EFLAGS: 00010006
Code: 04 00 00 49 8b 84 24 00 07 00 00 48 ba 00 00 00 00 00 fc ff df 48 8d
b8 40 01 00 00 48 8d 88 28 01 00 00 48 89 fe 48 c1 ee 03 <0f> b6 14 16 48
89 fe 83 e6 07 40 38 f2 7f 08 84 d2 0f 85 93 03 00
RAX: ffff88808a474580 RBX: ffff8880a9487928 RCX: ffffffff816ea433
RSP: 0018:ffff8880ae707a80 EFLAGS: 00010006
RDX: 0000000000000100 RSI: ffffffff816e9f25 RDI: ffff8880a9487928
RAX: 0000000041b58ab3 RBX: 1ffff11015ce0f54 RCX: 0000000041b58bdb
RBP: ffff8880ae607b00 R08: ffff8880972642c0 R09: ffffed1015cc5b90
RDX: dffffc0000000000 RSI: 000000000836b17e RDI: 0000000041b58bf3
R10: ffffed1015cc5b8f R11: ffff8880ae62dc7b R12: ffff8880ae607ad8
RBP: ffff8880ae707b48 R08: ffff8880ae71f5f0 R09: fffffbfff1335b3d
R13: 0000000000000100 R14: 0000000000000000 R15: ffff8880ae623bc0
R10: fffffbfff1301b45 R11: ffffffff899ad9e3 R12: ffff8880a94c4440
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
R13: 0000000000251b9a R14: 0000000000000003 R15: ffff8880ae707b20
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CR2: ffff88808a474580 CR3: 000000006b884000 CR4: 00000000001406f0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
CR2: 00007fba193dedb8 CR3: 000000009aaf9000 CR4: 00000000001406e0
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.