EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue BUG: MAX_LOCKDEP_CHAINS too low! turning off the locking correctness validator. CPU: 1 PID: 25670 Comm: syz-executor.0 Not tainted 4.14.231-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 add_chain_cache kernel/locking/lockdep.c:2303 [inline] lookup_chain_cache_add kernel/locking/lockdep.c:2415 [inline] validate_chain kernel/locking/lockdep.c:2435 [inline] __lock_acquire.cold+0x19a/0x97c kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 lock_hrtimer_base kernel/time/hrtimer.c:148 [inline] __hrtimer_get_remaining+0x6a/0x1d0 kernel/time/hrtimer.c:1056 hrtimer_get_remaining include/linux/hrtimer.h:404 [inline] perf_swevent_cancel_hrtimer kernel/events/core.c:8788 [inline] perf_swevent_cancel_hrtimer kernel/events/core.c:8783 [inline] cpu_clock_event_stop kernel/events/core.c:8842 [inline] cpu_clock_event_del+0x78/0xc0 kernel/events/core.c:8857 event_sched_out+0x8b3/0x11b0 kernel/events/core.c:1867 group_sched_out+0x13e/0x3c0 kernel/events/core.c:1897 ctx_sched_out+0x4f4/0x9d0 kernel/events/core.c:2852 task_ctx_sched_out+0x5b/0x80 kernel/events/core.c:2320 perf_event_context_sched_out kernel/events/core.c:3035 [inline] __perf_event_task_sched_out+0x853/0x11d0 kernel/events/core.c:3126 perf_event_task_sched_out include/linux/perf_event.h:1104 [inline] prepare_task_switch kernel/sched/core.c:2601 [inline] context_switch kernel/sched/core.c:2773 [inline] __schedule+0xc74/0x1de0 kernel/sched/core.c:3384 preempt_schedule_irq+0xb0/0x140 kernel/sched/core.c:3611 retint_kernel+0x1b/0x2d RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:lock_acquire+0x1ec/0x3f0 kernel/locking/lockdep.c:4001 RSP: 0018:ffff888226e1fb88 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e1259 RBX: ffff88809fdaa140 RCX: 0000000000001ee6 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000286 RBP: ffff88809ba46468 R08: ffffffff8b99f1f0 R09: 0000000000040695 R10: ffff88809fdaa9f0 R11: ffff88809fdaa140 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 kernfs_drain fs/kernfs/dir.c:468 [inline] __kernfs_remove+0x727/0x920 fs/kernfs/dir.c:1293 kernfs_remove+0x1f/0x30 fs/kernfs/dir.c:1328 sysfs_remove_dir+0xb1/0xf0 fs/sysfs/dir.c:97 kobject_del lib/kobject.c:575 [inline] kobject_del+0x43/0xf0 lib/kobject.c:567 ext4_put_super+0x9db/0xf00 fs/ext4/super.c:923 generic_shutdown_super+0x144/0x370 fs/super.c:446 kill_block_super+0x95/0xe0 fs/super.c:1161 deactivate_locked_super+0x6c/0xd0 fs/super.c:319 deactivate_super+0x7f/0xa0 fs/super.c:350 cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183 task_work_run+0x11f/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x1ad/0x200 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x466459 RSP: 002b:00007f9e63093188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 000000000056bf60 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffcb9eebf6f R14: 00007f9e63093300 R15: 0000000000022000 EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue device batadv0 entered promiscuous mode lo: Cannot use loopback or non-ethernet device as HSR slave. device batadv0 left promiscuous mode lo: Cannot use loopback or non-ethernet device as HSR slave. device batadv0 entered promiscuous mode lo: Cannot use loopback or non-ethernet device as HSR slave. device batadv0 left promiscuous mode lo: Cannot use loopback or non-ethernet device as HSR slave. IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready EXT4-fs (sda1): re-mounted. Opts: mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains EXT4-fs (sda1): re-mounted. Opts: device batadv0 entered promiscuous mode lo: Cannot use loopback or non-ethernet device as HSR slave. device batadv0 left promiscuous mode lo: Cannot use loopback or non-ethernet device as HSR slave. mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains EXT4-fs (sda1): re-mounted. Opts: IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready EXT4-fs (sda1): re-mounted. Opts: EXT4-fs (sda1): re-mounted. Opts: device batadv0 entered promiscuous mode lo: Cannot use loopback or non-ethernet device as HSR slave. device batadv0 left promiscuous mode EXT4-fs (sda1): re-mounted. Opts: EXT4-fs (sda1): re-mounted. Opts: IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready netlink: 6 bytes leftover after parsing attributes in process `syz-executor.2'. EXT4-fs (sda1): re-mounted. Opts: IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets xt_TCPMSS: Only works on TCP SYN packets EXT4-fs error (device sda1): mb_free_blocks:1464: group 6, inode 14886: block 221224:freeing already freed block (bit 24616); block bitmap corrupt. EXT4-fs error (device sda1): ext4_mb_generate_buddy:754: group 6, block bitmap and bg descriptor inconsistent: 8151 vs 8152 free clusters EXT4-fs (sda1): pa ffff88808dbf7a20: logic 32768, phys. 221184, len 2048 EXT4-fs error (device sda1): ext4_mb_release_inode_pa:3891: group 6, free 2008, pa_free 2007 EXT4-fs error (device sda1): mb_free_blocks:1464: group 8, inode 14851: block 266280:freeing already freed block (bit 4136); block bitmap corrupt. EXT4-fs error (device sda1): ext4_mb_generate_buddy:754: group 8, block bitmap and bg descriptor inconsistent: 30551 vs 30552 free clusters EXT4-fs (sda1): pa ffff88803fbb7dc0: logic 32768, phys. 266240, len 2048 EXT4-fs error (device sda1): ext4_mb_release_inode_pa:3891: group 8, free 2008, pa_free 2007 netlink: 104 bytes leftover after parsing attributes in process `syz-executor.4'. EXT4-fs error (device sda1): mb_free_blocks:1464: group 11, inode 15014: block 364584:freeing already freed block (bit 4136); block bitmap corrupt. EXT4-fs error (device sda1): ext4_mb_generate_buddy:754: group 11, block bitmap and bg descriptor inconsistent: 28631 vs 28632 free clusters EXT4-fs (sda1): pa ffff88803fbb7b38: logic 32768, phys. 364544, len 2048 EXT4-fs error (device sda1): ext4_mb_release_inode_pa:3891: group 11, free 2008, pa_free 2007 netlink: 104 bytes leftover after parsing attributes in process `syz-executor.4'. ptrace attach of "/root/syz-executor.1"[26263] was attempted by "/root/syz-executor.1"[26264] ptrace attach of "/root/syz-executor.1"[26282] was attempted by "/root/syz-executor.1"[26283] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.4'. ptrace attach of "/root/syz-executor.5"[26305] was attempted by "/root/syz-executor.5"[26306] ptrace attach of "/root/syz-executor.1"[26310] was attempted by "/root/syz-executor.1"[26311] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. ptrace attach of "/root/syz-executor.1"[26334] was attempted by "/root/syz-executor.1"[26335] ptrace attach of "/root/syz-executor.0"[26332] was attempted by "/root/syz-executor.0"[26333] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. ptrace attach of ""[26349] was attempted by "/root/syz-executor.5"[26350] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.4'. ptrace attach of "/root/syz-executor.0"[26382] was attempted by "/root/syz-executor.0"[26383] ptrace attach of "/root/syz-executor.0"[26396] was attempted by "/root/syz-executor.0"[26397] batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves IPVS: ftp: loaded support on port[0] = 21 chnl_net:caif_netlink_parms(): no params data found bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode bond0: Enslaving bond_slave_0 as an active interface with an up link bond0: Enslaving bond_slave_1 as an active interface with an up link IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready team0: Port device team_slave_0 added IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added batman_adv: batadv0: Adding interface: batadv_slave_0 batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active batman_adv: batadv0: Adding interface: batadv_slave_1 batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready device hsr_slave_0 entered promiscuous mode device hsr_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready bridge0: port 1(bridge_slave_0) entered disabled state bridge0: port 2(bridge_slave_1) entered disabled state IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 8021q: adding VLAN 0 to HW filter on device batadv0 IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready device veth0_vlan entered promiscuous mode device veth1_vlan entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready device veth0_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready device veth1_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: batadv0: Interface activated: batadv_slave_0 IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'. batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode kauditd_printk_skb: 14 callbacks suppressed audit: type=1804 audit(1618865713.269:466): pid=26818 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir692573760/syzkaller.3bZSXx/377/bus" dev="sda1" ino=14486 res=1 team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 audit: type=1804 audit(1618865713.309:467): pid=26818 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir692573760/syzkaller.3bZSXx/377/bus" dev="sda1" ino=14486 res=1 bond0 (unregistering): Released all slaves audit: type=1804 audit(1618865713.309:468): pid=26818 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir692573760/syzkaller.3bZSXx/377/bus" dev="sda1" ino=14486 res=1 audit: type=1804 audit(1618865713.379:469): pid=26821 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir692573760/syzkaller.3bZSXx/377/bus" dev="sda1" ino=14486 res=1 audit: type=1804 audit(1618865713.599:470): pid=26818 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir692573760/syzkaller.3bZSXx/377/bus" dev="sda1" ino=14486 res=1 audit: type=1804 audit(1618865713.599:471): pid=26821 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir692573760/syzkaller.3bZSXx/377/bus" dev="sda1" ino=14486 res=1 audit: type=1804 audit(1618865713.599:472): pid=26818 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir692573760/syzkaller.3bZSXx/377/bus" dev="sda1" ino=14486 res=1 audit: type=1804 audit(1618865713.599:473): pid=26818 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir692573760/syzkaller.3bZSXx/377/bus" dev="sda1" ino=14486 res=1