WARNING in process_one_work

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 14260788 Linux 4.19.86
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=116fc5eee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=be524a405430f6eb
dashboard link: https://syzkaller.appspot.com/bug?extid=1c9719d507a11f353114
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1c9719...@syzkaller.appspotmail.com

rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:4747
------------[ cut here ]------------
WARNING: CPU: 0 PID: 35 at net/batman-adv/bat_iv_ogm.c:597
batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:597 [inline]
WARNING: CPU: 0 PID: 35 at net/batman-adv/bat_iv_ogm.c:597
batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46
net/batman-adv/bat_iv_ogm.c:1853
netlink_rcv_skb+0x17d/0x460 net/netlink/af_netlink.c:2454
Kernel panic - not syncing: panic_on_warn set ...

rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4765
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x537/0x720 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:632
___sys_sendmsg+0x803/0x920 net/socket.c:2115
__sys_sendmsg+0x105/0x1d0 net/socket.c:2153
__do_sys_sendmsg net/socket.c:2162 [inline]
__se_sys_sendmsg net/socket.c:2160 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2160
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a639
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f4b60201c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f4b60201c90 RCX: 000000000045a639
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4b602026d4
R13: 00000000004c8d75 R14: 00000000004df5e0 R15: 0000000000000006
CPU: 0 PID: 35 Comm: kworker/u4:2 Not tainted 4.19.86-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
batman_adv: batadv0: Adding interface: veth139
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186
kobject: 'iosched' (00000000dfedb14a): kobject_cleanup, parent
(null)
batman_adv: batadv0: The MTU of interface veth139 is too small (1500) to
handle the transport of batman-adv packets. Packets going over this
interface will be fragmented on layer2 which could impact the performance.
Setting the MTU to 1560 would solve the problem.
__warn.cold+0x20/0x53 kernel/panic.c:541
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296
batman_adv: batadv0: Not using interface veth139 (retrying later):
interface not active
kobject: 'iosched' (00000000dfedb14a): calling ktype release
kobject: 'iosched': free name
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037
kobject: 'loop0' (00000000e9142d81): kobject_cleanup, parent
(null)
RIP: 0010:batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:597 [inline]
RIP: 0010:batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46
net/batman-adv/bat_iv_ogm.c:1853
Code: a4 ff ff e8 83 29 97 fa 48 c7 c7 00 55 fb 87 e8 8b 8d 81 fa e9 7d a4
ff ff e8 6d 29 97 fa 48 c7 c7 c0 51 fb 87 e8 75 8d 81 fa <0f> 0b e9 65 a4
ff ff e8 55 29 97 fa 48 c7 c7 c0 51 fb 87 e8 5d 8d
RSP: 0018:ffff8880a989fcc8 EFLAGS: 00010282
RAX: 0000000000000024 RBX: ffff88808c0a8388 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815595f6 RDI: ffffed1015313f8b
RBP: ffff8880a989fd30 R08: 0000000000000024 R09: ffffed1015d05079
kobject: 'loop0' (00000000e9142d81): calling ktype release
R10: ffffed1015d05078 R11: ffff8880ae8283c7 R12: ffff8880856b4a40
R13: ffff8880869e8dc0 R14: ffff88808c0a8340 R15: ffff8880856b4a40
process_one_work+0x989/0x1750 kernel/workqueue.c:2153
kobject: 'queue' (00000000fa2655ee): kobject_cleanup, parent
(null)
kobject: 'queue' (00000000fa2655ee): calling ktype release
worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246
kobject: 'queue': free name
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
kobject: '0' (000000007d3cbfc9): kobject_cleanup, parent (null)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 9b15f7fa Linux 4.19.104
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=131dfa31e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a97eb020c5d0af85

dashboard link: https://syzkaller.appspot.com/bug?extid=1c9719d507a11f353114
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145bd02de00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12e8a229e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1c9719...@syzkaller.appspotmail.com

rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4795
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x53a/0x730 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
------------[ cut here ]------------
WARNING: CPU: 1 PID: 130 at net/batman-adv/bat_iv_ogm.c:597 batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:597 [inline]
WARNING: CPU: 1 PID: 130 at net/batman-adv/bat_iv_ogm.c:597 batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46 net/batman-adv/bat_iv_ogm.c:1853

Kernel panic - not syncing: panic_on_warn set ...

sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:632
___sys_sendmsg+0x803/0x920 net/socket.c:2115
__sys_sendmsg+0x105/0x1d0 net/socket.c:2153
__do_sys_sendmsg net/socket.c:2162 [inline]
__se_sys_sendmsg net/socket.c:2160 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2160
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

RIP: 0033:0x4444f9
Code: e8 8c 07 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffcb7c5128 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004444f9

RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003

RBP: 0000000000000000 R08: 0000000000000001 R09: 00000000bb1414ac
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
CPU: 1 PID: 130 Comm: kworker/u4:2 Not tainted 4.19.104-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186

__warn.cold+0x20/0x53 kernel/panic.c:541
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296

do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037

RIP: 0010:batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:597 [inline]
RIP: 0010:batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46 net/batman-adv/bat_iv_ogm.c:1853

Code: 9c ff ff e8 13 91 36 fa 48 c7 c7 c0 d4 66 88 e8 5b f1 20 fa e9 4d 9c ff ff e8 fd 90 36 fa 48 c7 c7 80 d1 66 88 e8 45 f1 20 fa <0f> 0b e9 35 9c ff ff e8 e5 90 36 fa 48 c7 c7 80 d1 66 88 e8 2d f1
RSP: 0018:ffff8880a94ffcc8 EFLAGS: 00010282
RAX: 0000000000000024 RBX: ffff8880a8249688 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8155a136 RDI: ffffed101529ff8b
RBP: ffff8880a94ffd30 R08: 0000000000000024 R09: ffffed1015d25079
R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: ffff88808f05c1c0
R13: ffff88809e796d80 R14: ffff8880a8249640 R15: ffff88808f05c1c0
process_one_work+0x989/0x1750 kernel/workqueue.c:2153

worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246

ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

[syzbot]

syzbot suspects this issue was fixed by commit:

commit e8e9d2968a9d08bf5c683afca182f1537edebf8d
Author: Sven Eckelmann <sv...@narfation.org>
Date: Tue May 18 19:00:27 2021 +0000

batman-adv: Avoid WARN_ON timing related checks

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15bc2402300000
start commit: 9b15f7fa Linux 4.19.104
git tree: linux-4.19.y

kernel config: https://syzkaller.appspot.com/x/.config?x=a97eb020c5d0af85
dashboard link: https://syzkaller.appspot.com/bug?extid=1c9719d507a11f353114

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145bd02de00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12e8a229e00000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: batman-adv: Avoid WARN_ON timing related checks

For information about bisection process see: https://goo.gl/tpsmEJ#bisection