============================= WARNING: suspicious RCU usage 4.16.0-rc2+ #328 Not tainted ----------------------------- ./include/net/inet_sock.h:136 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor3/9077: #0: (sk_lock-AF_INET6){+.+.}, at: [<00000000bd7f1799>] lock_sock include/net/sock.h:1463 [inline] #0: (sk_lock-AF_INET6){+.+.}, at: [<00000000bd7f1799>] inet6_bind+0x359/0x1460 net/ipv6/af_inet6.c:310 stack backtrace: CPU: 1 PID: 9077 Comm: syz-executor3 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592 ireq_opt_deref include/net/inet_sock.h:135 [inline] inet_csk_route_req+0x824/0xca0 net/ipv4/inet_connection_sock.c:543 dccp_v4_send_response+0xa7/0x650 net/dccp/ipv4.c:485 dccp_v4_conn_request+0x9ee/0x11b0 net/dccp/ipv4.c:633 dccp_v6_conn_request+0xd30/0x1410 net/dccp/ipv6.c:317 dccp_rcv_state_process+0x574/0x1620 net/dccp/input.c:612 dccp_v4_do_rcv+0xf1/0x160 net/dccp/ipv4.c:682 dccp_v6_do_rcv+0x86a/0xa70 net/dccp/ipv6.c:578 sk_backlog_rcv include/net/sock.h:908 [inline] __release_sock+0x124/0x360 net/core/sock.c:2271 release_sock+0xa4/0x2a0 net/core/sock.c:2786 inet6_bind+0x3ab/0x1460 net/ipv6/af_inet6.c:414 SYSC_bind+0x1c3/0x410 net/socket.c:1474 SyS_bind+0x24/0x30 net/socket.c:1460 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007f2aa4ab9c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 00007f2aa4aba6d4 RCX: 0000000000453de9 RDX: 000000000000001c RSI: 0000000020000000 RDI: 0000000000000013 RBP: 000000000072bf58 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000026 R14: 00000000006f0430 R15: 0000000000000001 ============================= WARNING: suspicious RCU usage 4.16.0-rc2+ #328 Not tainted ----------------------------- ./include/net/inet_sock.h:136 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor3/9077: #0: (sk_lock-AF_INET6){+.+.}, at: [<00000000bd7f1799>] lock_sock include/net/sock.h:1463 [inline] #0: (sk_lock-AF_INET6){+.+.}, at: [<00000000bd7f1799>] inet6_bind+0x359/0x1460 net/ipv6/af_inet6.c:310 stack backtrace: CPU: 1 PID: 9077 Comm: syz-executor3 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592 ireq_opt_deref include/net/inet_sock.h:135 [inline] dccp_v4_send_response+0x4b6/0x650 net/dccp/ipv4.c:496 dccp_v4_conn_request+0x9ee/0x11b0 net/dccp/ipv4.c:633 dccp_v6_conn_request+0xd30/0x1410 net/dccp/ipv6.c:317 dccp_rcv_state_process+0x574/0x1620 net/dccp/input.c:612 dccp_v4_do_rcv+0xf1/0x160 net/dccp/ipv4.c:682 dccp_v6_do_rcv+0x86a/0xa70 net/dccp/ipv6.c:578 sk_backlog_rcv include/net/sock.h:908 [inline] __release_sock+0x124/0x360 net/core/sock.c:2271 release_sock+0xa4/0x2a0 net/core/sock.c:2786 inet6_bind+0x3ab/0x1460 net/ipv6/af_inet6.c:414 SYSC_bind+0x1c3/0x410 net/socket.c:1474 SyS_bind+0x24/0x30 net/socket.c:1460 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007f2aa4ab9c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 00007f2aa4aba6d4 RCX: 0000000000453de9 RDX: 000000000000001c RSI: 0000000020000000 RDI: 0000000000000013 RBP: 000000000072bf58 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000026 R14: 00000000006f0430 R15: 0000000000000001 dccp_close: ABORT with 65423 bytes unread xt_hashlimit: overflow, try lower: 0/0 xt_hashlimit: overflow, try lower: 0/0 device eql entered promiscuous mode xt_connbytes: Forcing CT accounting to be enabled DRBG: could not allocate digest TFM handle: hmac(sha512) DRBG: could not allocate digest TFM handle: hmac(sha512) kauditd_printk_skb: 990 callbacks suppressed audit: type=1400 audit(1519571857.358:3911): avc: denied { dac_read_search } for pid=9545 comm="syz-executor7" capability=2 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571857.360:3912): avc: denied { net_admin } for pid=4288 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571857.421:3913): avc: denied { net_admin } for pid=4287 comm="syz-executor6" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571857.424:3914): avc: denied { net_admin } for pid=4285 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571857.425:3915): avc: denied { net_admin } for pid=4285 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571857.430:3916): avc: denied { net_admin } for pid=4279 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571857.430:3917): avc: denied { net_admin } for pid=4279 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571857.435:3918): avc: denied { net_admin } for pid=4294 comm="syz-executor2" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571857.435:3919): avc: denied { net_admin } for pid=4294 comm="syz-executor2" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571857.437:3920): avc: denied { net_admin } for pid=4294 comm="syz-executor2" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 irq bypass consumer (token 00000000e99a13aa) registration fails: -16 x_tables: ip_tables: ah match: only valid for protocol 51 binder: BINDER_SET_CONTEXT_MGR already set binder: 9806:9823 ioctl 40046207 0 returned -16 netlink: 46 bytes leftover after parsing attributes in process `syz-executor4'. xt_connbytes: Forcing CT accounting to be enabled device eql entered promiscuous mode netlink: 46 bytes leftover after parsing attributes in process `syz-executor4'. device eql entered promiscuous mode *** Guest State *** CR0: actual=0x0000000000000020, shadow=0x0000000000000000, gh_mask=fffffffffffffff7 CR4: actual=0x0000000000002050, shadow=0x0000000000000020, gh_mask=ffffffffffffe871 CR3 = 0x00000000fffbc000 RSP = 0x0000000000000000 RIP = 0x0000000000008000 RFLAGS=0x00010002 DR7 = 0x0000000000000400 Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 CS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 DS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 SS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 ES: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 FS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 GS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 GDTR: limit=0x00000000, base=0x0000000000000000 LDTR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 IDTR: limit=0x00000000, base=0x0000000000000000 TR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 EFER = 0x0000000000000000 PAT = 0x0007040600070406 DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 Interruptibility = 00000008 ActivityState = 00000000 *** Host State *** RIP = 0xffffffff811cd945 RSP = 0xffff8801d37d73b8 CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 FSBase=00007f2aa4ab9700 GSBase=ffff8801db200000 TRBase=fffffe0000003000 GDTBase=fffffe0000001000 IDTBase=fffffe0000000000 CR0=0000000080050033 CR3=00000001d26dc004 CR4=00000000001626f0 Sysenter RSP=fffffe0000002200 CS:RIP=0010:ffffffff85e01e70 EFER = 0x0000000000000d01 PAT = 0x0000000000000000 *** Control State *** PinBased=0000003f CPUBased=b599edfa SecondaryExec=000000c2 EntryControls=0000d1ff ExitControls=0023efff ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 VMEntry: intr_info=80000306 errcode=00000000 ilen=00000000 VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 reason=80000021 qualification=0000000000000000 IDTVectoring: info=00000000 errcode=00000000 TSC Offset = 0xffffffcef24a1331 EPT pointer = 0x00000001b662401e sg_write: data in/out 47805/8 bytes for SCSI command 0x0-- guessing data in; program syz-executor7 not setting count and/or reply_len properly mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains QAT: Invalid ioctl syz-executor4 (10229) used greatest stack depth: 14032 bytes left can: request_module (can-proto-0) failed. kvm: emulating exchange as write binder: 10422:10436 tried to acquire reference to desc 0, got 1 instead kauditd_printk_skb: 1011 callbacks suppressed audit: type=1400 audit(1519571862.361:4932): avc: denied { net_raw } for pid=10476 comm="syz-executor7" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571862.366:4933): avc: denied { net_raw } for pid=10476 comm="syz-executor7" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 sit: non-ECT from 0.0.0.0 with TOS=0x2 audit: type=1400 audit(1519571862.371:4934): avc: denied { dac_override } for pid=10475 comm="syz-executor4" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571862.422:4935): avc: denied { dac_override } for pid=10475 comm="syz-executor4" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 sit: non-ECT from 0.0.0.0 with TOS=0x2 audit: type=1400 audit(1519571862.473:4936): avc: denied { net_admin } for pid=4282 comm="syz-executor4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571862.485:4937): avc: denied { net_admin } for pid=4282 comm="syz-executor4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571862.494:4938): avc: denied { net_admin } for pid=4294 comm="syz-executor2" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519571862.499:4939): avc: denied { map_create } for pid=10477 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1519571862.500:4940): avc: denied { map_read map_write } for pid=10477 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1519571862.500:4941): avc: denied { net_admin } for pid=4285 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 netlink: 28 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 28 bytes leftover after parsing attributes in process `syz-executor2'. bridge0: port 1(gretap0) entered blocking state bridge0: port 1(gretap0) entered disabled state device gretap0 entered promiscuous mode bridge0: port 1(gretap0) entered blocking state bridge0: port 1(gretap0) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl