INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.17' (ECDSA) to the list of known hosts. 2018/04/24 06:11:55 parsed 1 programs 2018/04/24 06:11:55 executed programs: 0 syzkaller login: [ 37.047899] IPVS: ftp: loaded support on port[0] = 21 [ 37.239521] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.245990] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.253325] device bridge_slave_0 entered promiscuous mode [ 37.269211] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.275607] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.282642] device bridge_slave_1 entered promiscuous mode [ 37.297254] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 37.313045] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 37.351295] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 37.368083] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 37.426171] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 37.433400] team0: Port device team_slave_0 added [ 37.447648] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 37.454771] team0: Port device team_slave_1 added [ 37.469481] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 37.485288] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 37.502690] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 37.518495] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 37.626150] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.632590] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.639423] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.645784] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.035059] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 38.041168] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.083495] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.125380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.132684] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 38.166607] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 38.172709] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.182272] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 38.410315] [ 38.412027] ============================= [ 38.416195] WARNING: suspicious RCU usage [ 38.420357] 4.17.0-rc1+ #16 Not tainted [ 38.424342] ----------------------------- [ 38.428508] net/ipv6/route.c:1550 suspicious rcu_dereference_protected() usage! [ 38.435978] [ 38.435978] other info that might help us debug this: [ 38.435978] [ 38.444136] [ 38.444136] rcu_scheduler_active = 2, debug_locks = 1 [ 38.450825] 3 locks held by syz-executor0/4757: [ 38.455513] #0: 00000000a61192eb (rcu_read_lock_bh){....}, at: ip6_finish_output2+0x253/0x2800 [ 38.464471] #1: 00000000a61192eb (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x30f/0x34c0 [ 38.473206] #2: 0000000098dbd501 (rcu_read_lock){....}, at: ip6_link_failure+0xfe/0x790 [ 38.481477] [ 38.481477] stack backtrace: [ 38.485982] CPU: 0 PID: 4757 Comm: syz-executor0 Not tainted 4.17.0-rc1+ #16 [ 38.493147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.502477] Call Trace: [ 38.505044] dump_stack+0x1b9/0x294 [ 38.508652] ? dump_stack_print_info.cold.2+0x52/0x52 [ 38.513822] ? print_lock+0xd1/0xd6 [ 38.517429] ? vprintk_func+0x81/0xe7 [ 38.521212] lockdep_rcu_suspicious+0x14a/0x153 [ 38.525863] rt6_remove_exception_rt+0x416/0x4d0 [ 38.530600] ? __rt6_find_exception_spinlock+0x330/0x330 [ 38.536029] ? kasan_check_read+0x11/0x20 [ 38.540168] ? rcu_is_watching+0x85/0x140 [ 38.544309] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 38.549477] ? ip6_neigh_lookup+0x899/0xcb0 [ 38.553779] ip6_link_failure+0x484/0x790 [ 38.557915] ? rt6_do_update_pmtu+0x730/0x730 [ 38.562400] ? refcount_inc_not_zero+0x2d0/0x2d0 [ 38.567138] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 38.572666] ? __ipv6_addr_type+0x219/0x32f [ 38.576969] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 38.582486] ? ip6_tnl_get_cap+0x16e/0x190 [ 38.586699] ? check_usage+0x2bc/0x770 [ 38.590566] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 38.596080] ? ip6_tnl_xmit_ctl+0x104/0x450 [ 38.600382] ? rt6_do_update_pmtu+0x730/0x730 [ 38.604857] ip6_tnl_xmit+0x49a/0x34b0 [ 38.608724] ? check_usage_forwards+0x3a0/0x3a0 [ 38.613369] ? __bfs+0xa8/0x790 [ 38.616635] ? ip6ip6_err+0x730/0x730 [ 38.620418] ? __lock_acquire+0x7f5/0x5140 [ 38.624630] ? graph_lock+0x170/0x170 [ 38.628414] ? kasan_check_read+0x11/0x20 [ 38.632538] ? __lock_acquire+0x28fb/0x5140 [ 38.636839] ? print_usage_bug+0xc0/0xc0 [ 38.640880] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 38.645877] ? map_id_range_down+0x1e6/0x410 [ 38.650266] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 38.655784] ? iptunnel_handle_offloads+0x3c2/0x710 [ 38.660782] ? iptunnel_metadata_reply+0x380/0x380 [ 38.665695] ip6_tnl_start_xmit+0x8fc/0x2290 [ 38.670082] ? ip6_tnl_start_xmit+0x8fc/0x2290 [ 38.674646] ? ip6_tnl_xmit+0x34b0/0x34b0 [ 38.678776] ? debug_check_no_locks_freed+0x310/0x310 [ 38.683943] ? __lock_acquire+0x7f5/0x5140 [ 38.688156] ? debug_check_no_locks_freed+0x310/0x310 [ 38.693327] ? debug_check_no_locks_freed+0x310/0x310 [ 38.698495] ? graph_lock+0x170/0x170 [ 38.702275] ? graph_lock+0x170/0x170 [ 38.706052] ? graph_lock+0x170/0x170 [ 38.709830] ? __lock_acquire+0x7f5/0x5140 [ 38.714053] dev_hard_start_xmit+0x264/0xc10 [ 38.718447] ? validate_xmit_skb_list+0x120/0x120 [ 38.723269] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 38.728788] ? netif_skb_features+0x696/0xb40 [ 38.733264] ? validate_xmit_xfrm+0x1ef/0xdc0 [ 38.737738] ? lock_acquire+0x1dc/0x520 [ 38.741693] ? validate_xmit_skb+0x704/0xd90 [ 38.746083] ? netif_skb_features+0xb40/0xb40 [ 38.750564] __dev_queue_xmit+0x2724/0x34c0 [ 38.754865] ? find_held_lock+0x36/0x1c0 [ 38.758913] ? netdev_pick_tx+0x2d0/0x2d0 [ 38.763040] ? match_held_lock+0x860/0x8b0 [ 38.767265] ? lock_downgrade+0x8e0/0x8e0 [ 38.771391] ? lock_release+0xa10/0xa10 [ 38.775347] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 38.780864] ? __local_bh_enable_ip+0x161/0x230 [ 38.785514] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 38.790509] ? __neigh_create+0x1447/0x2050 [ 38.794810] ? trace_hardirqs_on+0xd/0x10 [ 38.798937] ? __local_bh_enable_ip+0x161/0x230 [ 38.803590] ? _raw_write_unlock_bh+0x30/0x40 [ 38.808081] ? __neigh_create+0xd2c/0x2050 [ 38.812301] ? debug_check_no_locks_freed+0x310/0x310 [ 38.817471] ? neigh_hash_alloc+0x1e0/0x1e0 [ 38.821781] ? kasan_unpoison_shadow+0x35/0x50 [ 38.826340] ? kasan_kmalloc+0xc4/0xe0 [ 38.830207] ? __local_bh_enable_ip+0x161/0x230 [ 38.834863] ? ip6t_do_table+0xd6c/0x1cd0 [ 38.838994] ? lock_acquire+0x1dc/0x520 [ 38.842946] ? ip6_finish_output2+0x253/0x2800 [ 38.847509] ? kasan_check_read+0x11/0x20 [ 38.851654] ? rcu_is_watching+0x85/0x140 [ 38.855782] ? rcu_pm_notify+0xc0/0xc0 [ 38.859650] dev_queue_xmit+0x17/0x20 [ 38.863427] ? dev_queue_xmit+0x17/0x20 [ 38.867395] neigh_direct_output+0x15/0x20 [ 38.871609] ip6_finish_output2+0xc93/0x2800 [ 38.875997] ? find_held_lock+0x36/0x1c0 [ 38.880036] ? ip6_flush_pending_frames+0xc0/0xc0 [ 38.884870] ? lock_downgrade+0x8e0/0x8e0 [ 38.889004] ? kasan_check_read+0x11/0x20 [ 38.893131] ? rcu_is_watching+0x85/0x140 [ 38.897257] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 38.902432] ? ip6_mtu+0x159/0x510 [ 38.905966] ? ip6_dst_ifdown+0x4c0/0x4c0 [ 38.910111] ? kasan_check_read+0x11/0x20 [ 38.914235] ? rcu_is_watching+0x85/0x140 [ 38.918372] ip6_finish_output+0x5fe/0xbc0 [ 38.922593] ? ip6_finish_output+0x5fe/0xbc0 [ 38.926983] ip6_output+0x227/0x9b0 [ 38.930591] ? ip6_finish_output+0xbc0/0xbc0 [ 38.934981] ? kasan_check_read+0x11/0x20 [ 38.939107] ? rcu_is_watching+0x85/0x140 [ 38.943235] ? ip6_fragment+0x3910/0x3910 [ 38.947362] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 38.952356] ? nf_hook_slow+0x11e/0x1c0 [ 38.956327] rawv6_sendmsg+0x2674/0x4590 [ 38.960374] ? rawv6_getsockopt+0x140/0x140 [ 38.964672] ? graph_lock+0x170/0x170 [ 38.968457] ? find_get_entries_tag+0x10a0/0x10a0 [ 38.973279] ? graph_lock+0x170/0x170 [ 38.977060] ? find_held_lock+0x36/0x1c0 [ 38.981113] ? lock_release+0xa10/0xa10 [ 38.985068] ? __check_object_size+0x95/0x5d9 [ 38.989546] ? rawv6_recvmsg+0xe80/0xe80 [ 38.993588] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 38.999110] ? _copy_from_user+0xdf/0x150 [ 39.003243] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 39.008238] ? rw_copy_check_uvector+0x2d3/0x3a0 [ 39.012986] inet_sendmsg+0x19f/0x690 [ 39.016763] ? rawv6_getsockopt+0x140/0x140 [ 39.021063] ? inet_sendmsg+0x19f/0x690 [ 39.025017] ? copy_msghdr_from_user+0x3bc/0x560 [ 39.029750] ? ipip_gro_receive+0x100/0x100 [ 39.034049] ? move_addr_to_kernel.part.18+0x100/0x100 [ 39.039308] ? do_raw_spin_unlock+0x9e/0x2e0 [ 39.043699] ? security_socket_sendmsg+0x94/0xc0 [ 39.048436] ? ipip_gro_receive+0x100/0x100 [ 39.052740] sock_sendmsg+0xd5/0x120 [ 39.056432] ___sys_sendmsg+0x805/0x940 [ 39.060387] ? __handle_mm_fault+0x93a/0x4310 [ 39.064861] ? copy_msghdr_from_user+0x560/0x560 [ 39.069597] ? vm_insert_mixed_mkwrite+0x40/0x40 [ 39.074330] ? graph_lock+0x170/0x170 [ 39.078112] ? __local_bh_enable_ip+0x161/0x230 [ 39.082760] ? find_held_lock+0x36/0x1c0 [ 39.086805] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.092322] ? __fget_light+0x2ef/0x430 [ 39.096278] ? fget_raw+0x20/0x20 [ 39.099708] ? find_held_lock+0x36/0x1c0 [ 39.103753] ? lock_downgrade+0x8e0/0x8e0 [ 39.107877] ? handle_mm_fault+0x8c0/0xc70 [ 39.112095] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 39.117611] ? sockfd_lookup_light+0xc5/0x160 [ 39.122088] __sys_sendmsg+0x115/0x270 [ 39.125959] ? __ia32_sys_shutdown+0x80/0x80 [ 39.130350] ? __x64_sys_futex+0x477/0x680 [ 39.134571] __x64_sys_sendmsg+0x78/0xb0 [ 39.138620] do_syscall_64+0x1b1/0x800 [ 39.142485] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 39.147324] ? syscall_return_slowpath+0x5c0/0x5c0 [ 39.152234] ? syscall_return_slowpath+0x30f/0x5c0 [ 39.157160] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 39.162504] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.167336] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.172503] RIP: 0033:0x455389 [ 39.175667] RSP: 002b:00007ffcc085b9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 39.183361] RAX: ffffffffffffffda RBX: 0000000000cec914 RCX: 0000000000455389 [ 39.190629] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003 [ 39.197875] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 39.205122] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 39.212368] R1