QAT: Invalid ioctl sg_write: data in/out 36083/25 bytes for SCSI command 0xe2-- guessing data in; program syz-executor1 not setting count and/or reply_len properly ============================= WARNING: suspicious RCU usage 4.16.0-rc4+ #349 Not tainted ----------------------------- ./include/net/inet_sock.h:136 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor3/29550: #0: (sk_lock-AF_INET6){+.+.}, at: [<0000000088823e53>] lock_sock include/net/sock.h:1463 [inline] #0: (sk_lock-AF_INET6){+.+.}, at: [<0000000088823e53>] do_ipv6_setsockopt.isra.8+0x23d/0x39d0 net/ipv6/ipv6_sockglue.c:167 stack backtrace: CPU: 0 PID: 29550 Comm: syz-executor3 Not tainted 4.16.0-rc4+ #349 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592 ireq_opt_deref include/net/inet_sock.h:135 [inline] inet_csk_route_req+0x824/0xca0 net/ipv4/inet_connection_sock.c:543 dccp_v4_send_response+0xa7/0x650 net/dccp/ipv4.c:485 SELinux: policydb magic number 0x52920bac does not match expected magic number 0xf97cff8c dccp_v4_conn_request+0x9ee/0x11b0 net/dccp/ipv4.c:633 Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable dccp_v6_conn_request+0xd30/0x1410 net/dccp/ipv6.c:317 SELinux: failed to load policy SELinux: policydb magic number 0x52920bac does not match expected magic number 0xf97cff8c dccp_rcv_state_process+0x574/0x1620 net/dccp/input.c:612 dccp_v4_do_rcv+0xf1/0x160 net/dccp/ipv4.c:682 dccp_v6_do_rcv+0x86a/0xa70 net/dccp/ipv6.c:578 SELinux: failed to load policy sk_backlog_rcv include/net/sock.h:908 [inline] __release_sock+0x124/0x360 net/core/sock.c:2271 release_sock+0xa4/0x2a0 net/core/sock.c:2786 do_ipv6_setsockopt.isra.8+0x50a/0x39d0 net/ipv6/ipv6_sockglue.c:898 ipv6_setsockopt+0xd7/0x130 net/ipv6/ipv6_sockglue.c:922 dccp_setsockopt+0x85/0xd0 net/dccp/proto.c:576 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2975 SYSC_setsockopt net/socket.c:1849 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1828 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453e69 RSP: 002b:00007f52d8fbec68 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007f52d8fbf6d4 RCX: 0000000000453e69 RDX: 0000000000000037 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 000000000072bea0 R08: 0000000000000028 R09: 0000000000000000 R10: 00000000200000c0 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000523 R14: 00000000006f7be8 R15: 0000000000000000 ============================= WARNING: suspicious RCU usage 4.16.0-rc4+ #349 Not tainted ----------------------------- ./include/net/inet_sock.h:136 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor3/29550: #0: (sk_lock-AF_INET6){+.+.}, at: [<0000000088823e53>] lock_sock include/net/sock.h:1463 [inline] #0: (sk_lock-AF_INET6){+.+.}, at: [<0000000088823e53>] do_ipv6_setsockopt.isra.8+0x23d/0x39d0 net/ipv6/ipv6_sockglue.c:167 stack backtrace: CPU: 0 PID: 29550 Comm: syz-executor3 Not tainted 4.16.0-rc4+ #349 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592 ireq_opt_deref include/net/inet_sock.h:135 [inline] dccp_v4_send_response+0x4b6/0x650 net/dccp/ipv4.c:496 dccp_v4_conn_request+0x9ee/0x11b0 net/dccp/ipv4.c:633 dccp_v6_conn_request+0xd30/0x1410 net/dccp/ipv6.c:317 dccp_rcv_state_process+0x574/0x1620 net/dccp/input.c:612 dccp_v4_do_rcv+0xf1/0x160 net/dccp/ipv4.c:682 dccp_v6_do_rcv+0x86a/0xa70 net/dccp/ipv6.c:578 sk_backlog_rcv include/net/sock.h:908 [inline] __release_sock+0x124/0x360 net/core/sock.c:2271 release_sock+0xa4/0x2a0 net/core/sock.c:2786 do_ipv6_setsockopt.isra.8+0x50a/0x39d0 net/ipv6/ipv6_sockglue.c:898 ipv6_setsockopt+0xd7/0x130 net/ipv6/ipv6_sockglue.c:922 dccp_setsockopt+0x85/0xd0 net/dccp/proto.c:576 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2975 SYSC_setsockopt net/socket.c:1849 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1828 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453e69 RSP: 002b:00007f52d8fbec68 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007f52d8fbf6d4 RCX: 0000000000453e69 RDX: 0000000000000037 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 000000000072bea0 R08: 0000000000000028 R09: 0000000000000000 R10: 00000000200000c0 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000523 R14: 00000000006f7be8 R15: 0000000000000000 kauditd_printk_skb: 1913 callbacks suppressed audit: type=1400 audit(1520747321.494:154364): avc: denied { net_admin } for pid=4196 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747321.496:154365): avc: denied { net_admin } for pid=4196 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747321.498:154366): avc: denied { net_admin } for pid=4196 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747321.500:154367): avc: denied { net_admin } for pid=4205 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747321.502:154368): avc: denied { net_admin } for pid=4205 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747321.509:154369): avc: denied { net_admin } for pid=4205 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747321.511:154370): avc: denied { net_admin } for pid=4205 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747321.512:154371): avc: denied { net_admin } for pid=4205 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747321.514:154372): avc: denied { net_admin } for pid=4206 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747321.516:154373): avc: denied { net_admin } for pid=4206 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 kauditd_printk_skb: 3500 callbacks suppressed audit: type=1400 audit(1520747326.503:156077): avc: denied { net_admin } for pid=29908 comm="syz-executor1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747326.509:156078): avc: denied { net_admin } for pid=5657 comm="syz-executor6" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747326.511:156079): avc: denied { net_admin } for pid=5657 comm="syz-executor6" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747326.513:156080): avc: denied { net_admin } for pid=4206 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747326.520:156081): avc: denied { net_admin } for pid=29912 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747326.523:156082): avc: denied { net_admin } for pid=5657 comm="syz-executor6" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747326.526:156083): avc: denied { net_admin } for pid=4206 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747326.528:156084): avc: denied { net_admin } for pid=5657 comm="syz-executor6" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747326.535:156085): avc: denied { net_admin } for pid=4206 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1520747326.537:156086): avc: denied { net_admin } for pid=5657 comm="syz-executor6" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 device gretap0 entered promiscuous mode