RFLAGS=0x00000202 DR7 = 0x0000000000000400 WARNING: suspicious RCU usage 4.14.215-syzkaller #0 Not tainted ----------------------------- net/tipc/bearer.c:177 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz-executor.1/14715: #0: (cb_lock){++++}, at: [] genl_rcv+0x15/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x112/0x140 net/netlink/genetlink.c:623 stack backtrace: CPU: 0 PID: 14715 Comm: syz-executor.1 Not tainted 4.14.215-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x283 lib/dump_stack.c:58 tipc_bearer_find+0x1ff/0x2f0 net/tipc/bearer.c:177 tipc_nl_compat_link_set+0x40b/0xb90 net/tipc/netlink_compat.c:807 __tipc_nl_compat_doit net/tipc/netlink_compat.c:316 [inline] tipc_nl_compat_doit+0x192/0x5d0 net/tipc/netlink_compat.c:364 tipc_nl_compat_handle net/tipc/netlink_compat.c:1215 [inline] tipc_nl_compat_recv+0xa0b/0xae0 net/tipc/netlink_compat.c:1297 genl_family_rcv_msg+0x572/0xb20 net/netlink/genetlink.c:600 genl_rcv_msg+0xaf/0x140 net/netlink/genetlink.c:625 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2433 genl_rcv+0x24/0x40 net/netlink/genetlink.c:636 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45e219 RSP: 002b:00007f9646f81c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219 RDX: 0000000000000000 RSI: 00000000200003c0 RDI: 0000000000000003 RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007ffee6247f4f R14: 00007f9646f829c0 R15: 000000000119bf8c Sysenter RSP=0000000000000f80 CS:RIP=0050:0000000000002810 CS: sel=0x0030, attr=0x0409b, limit=0x000fffff, base=0x0000000000000000 DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 GDTR: limit=0x000007ff, base=0x0000000000001000 LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 IDTR: limit=0x000001ff, base=0x0000000000003800 TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 EFER = 0x0000000000000001 PAT = 0x0007040600070406 DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 Interruptibility = 00000001 ActivityState = 00000000 *** Host State *** RIP = 0xffffffff81162b9e RSP = 0xffff8880554079b8 CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 FSBase=00007f3527ddc700 GSBase=ffff8880ba400000 TRBase=fffffe0000003000 GDTBase=fffffe0000001000 IDTBase=fffffe0000000000 CR0=0000000080050033 CR3=00000000a9ba4000 CR4=00000000001426f0 Sysenter RSP=fffffe0000003000 CS:RIP=0010:ffffffff87401690 EFER = 0x0000000000000d01 PAT = 0x0407050600070106 *** Control State *** PinBased=0000003f CPUBased=b699edfa SecondaryExec=000000ea EntryControls=0000d1ff ExitControls=002fefff ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 VMEntry: intr_info=80000202 errcode=00000000 ilen=00000000 VMExit: intr_info=00000000 errcode=00000000 ilen=00000003 reason=80000021 qualification=0000000000000003 IDTVectoring: info=00000000 errcode=00000000 TSC Offset = 0xffffff7529694d7a EPT pointer = 0x000000004cf6001e Virtual processor ID = 0x0001 *** Guest State *** CR0: actual=0x0000000000000031, shadow=0x0000000060000011, gh_mask=fffffffffffffff7 CR4: actual=0x0000000000002050, shadow=0x0000000000000020, gh_mask=ffffffffffffe871 CR3 = 0x00000000fffbc000 RSP = 0x0000000000000f80 RIP = 0x0000000000000001 RFLAGS=0x00000202 DR7 = 0x0000000000000400 Sysenter RSP=0000000000000f80 CS:RIP=0050:0000000000002810 CS: sel=0x0030, attr=0x0409b, limit=0x000fffff, base=0x0000000000000000 DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 GDTR: limit=0x000007ff, base=0x0000000000001000 LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 IDTR: limit=0x000001ff, base=0x0000000000003800 TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 EFER = 0x0000000000000001 PAT = 0x0007040600070406 DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 Interruptibility = 00000001 ActivityState = 00000000 *** Host State *** RIP = 0xffffffff81162b9e RSP = 0xffff888050cb79b8 CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 FSBase=00007f3527ddc700 GSBase=ffff8880ba400000 TRBase=fffffe0000003000 GDTBase=fffffe0000001000 IDTBase=fffffe0000000000 CR0=0000000080050033 CR3=000000005143a000 CR4=00000000001426f0 Sysenter RSP=fffffe0000003000 CS:RIP=0010:ffffffff87401690 EFER = 0x0000000000000d01 PAT = 0x0407050600070106 *** Control State *** PinBased=0000003f CPUBased=b699edfa SecondaryExec=000000ea EntryControls=0000d1ff ExitControls=002fefff ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 VMEntry: intr_info=80000202 errcode=00000000 ilen=00000000 VMExit: intr_info=00000000 errcode=00000000 ilen=00000003 reason=80000021 qualification=0000000000000003 IDTVectoring: info=00000000 errcode=00000000 TSC Offset = 0xffffff74ea9e92a8 EPT pointer = 0x00000000aa68201e Virtual processor ID = 0x0001 overlay: failed to look up (file1) for ino (-13) audit: type=1800 audit(1610886882.973:11): pid=14750 uid=0 auid=0 ses=4 op="collect_data" cause="failed(directio)" comm="syz-executor.3" name="bus" dev="sda1" ino=15793 res=0 audit: type=1804 audit(1610886882.983:12): pid=14750 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.3" name="/root/syzkaller-testdir779497878/syzkaller.fZfAmH/105/bus" dev="sda1" ino=15793 res=1 audit: type=1804 audit(1610886883.003:13): pid=14750 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.3" name="/root/syzkaller-testdir779497878/syzkaller.fZfAmH/105/bus" dev="sda1" ino=15793 res=1 raw_sendmsg: syz-executor.3 forgot to set AF_INET. Fix it! audit: type=1804 audit(1610886883.714:14): pid=14750 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.3" name="/root/syzkaller-testdir779497878/syzkaller.fZfAmH/105/bus" dev="sda1" ino=15793 res=1 audit: type=1804 audit(1610886883.714:15): pid=14756 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.3" name="/root/syzkaller-testdir779497878/syzkaller.fZfAmH/105/bus" dev="sda1" ino=15793 res=1 audit: type=1804 audit(1610886883.714:16): pid=14750 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.3" name="/root/syzkaller-testdir779497878/syzkaller.fZfAmH/105/bus" dev="sda1" ino=15793 res=1 BTRFS info (device loop0): metadata ratio 0 BTRFS info (device loop0): disk space caching is enabled BTRFS info (device loop0): has skinny extents attempt to access beyond end of device loop0: rw=4096, want=2064, limit=267 BTRFS error (device loop0): failed to read chunk root BTRFS error (device loop0): open_ctree failed BTRFS info (device loop0): metadata ratio 0 BTRFS info (device loop0): disk space caching is enabled BTRFS info (device loop0): has skinny extents BTRFS error (device loop0): open_ctree failed F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock attempt to access beyond end of device loop1: rw=12288, want=8200, limit=128 F2FS-fs (loop1): invalid crc value attempt to access beyond end of device loop1: rw=12288, want=12296, limit=128 F2FS-fs (loop1): invalid crc value F2FS-fs (loop1): Failed to get valid F2FS checkpoint F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock attempt to access beyond end of device loop1: rw=12288, want=8200, limit=128 F2FS-fs (loop1): invalid crc value attempt to access beyond end of device loop1: rw=12288, want=12296, limit=128 F2FS-fs (loop1): invalid crc value F2FS-fs (loop1): Failed to get valid F2FS checkpoint attempt to access beyond end of device loop1: rw=12288, want=8200, limit=128 attempt to access beyond end of device loop1: rw=12288, want=12296, limit=128 attempt to access beyond end of device loop1: rw=12288, want=8200, limit=128 attempt to access beyond end of device loop1: rw=12288, want=12296, limit=128