============================= WARNING: suspicious RCU usage 4.15.0+ #217 Not tainted ----------------------------- ./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor6/9067: #0: (rcu_read_lock){....}, at: [<0000000050b54fdb>] __rds_conn_create+0xe46/0x1b50 net/rds/connection.c:218 stack backtrace: CPU: 1 PID: 9067 Comm: syz-executor6 Not tainted 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592 rcu_preempt_sleep_check include/linux/rcupdate.h:301 [inline] ___might_sleep+0x385/0x470 kernel/sched/core.c:6093 __might_sleep+0x95/0x190 kernel/sched/core.c:6081 slab_pre_alloc_hook mm/slab.h:420 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x2a2/0x760 mm/slab.c:3539 rds_tcp_conn_alloc+0xa7/0x4e0 net/rds/tcp.c:296 __rds_conn_create+0x112f/0x1b50 net/rds/connection.c:227 rds_conn_create_outgoing+0x3f/0x50 net/rds/connection.c:309 rds_sendmsg+0xda3/0x2390 net/rds/send.c:1126 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg+0xca/0x110 net/socket.c:640 SYSC_sendto+0x361/0x5c0 net/socket.c:1747 SyS_sendto+0x40/0x50 net/socket.c:1715 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7f26c79 RSP: 002b:00000000f772209c EFLAGS: 00000286 ORIG_RAX: 0000000000000171 RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 0000000020fc2000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002069affb RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 BUG: sleeping function called from invalid context at mm/slab.h:420 in_atomic(): 1, irqs_disabled(): 0, pid: 9067, name: syz-executor6 1 lock held by syz-executor6/9067: #0: (rcu_read_lock){....}, at: [<0000000050b54fdb>] __rds_conn_create+0xe46/0x1b50 net/rds/connection.c:218 CPU: 1 PID: 9067 Comm: syz-executor6 Not tainted 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6128 __might_sleep+0x95/0x190 kernel/sched/core.c:6081 slab_pre_alloc_hook mm/slab.h:420 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x2a2/0x760 mm/slab.c:3539 rds_tcp_conn_alloc+0xa7/0x4e0 net/rds/tcp.c:296 __rds_conn_create+0x112f/0x1b50 net/rds/connection.c:227 rds_conn_create_outgoing+0x3f/0x50 net/rds/connection.c:309 rds_sendmsg+0xda3/0x2390 net/rds/send.c:1126 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg+0xca/0x110 net/socket.c:640 SYSC_sendto+0x361/0x5c0 net/socket.c:1747 SyS_sendto+0x40/0x50 net/socket.c:1715 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7f26c79 RSP: 002b:00000000f772209c EFLAGS: 00000286 ORIG_RAX: 0000000000000171 RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 0000000020fc2000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002069affb RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 syz-executor3 (9089) used greatest stack depth: 13376 bytes left IPv6: NLM_F_REPLACE set, but no existing node found! IPv6: NLM_F_REPLACE set, but no existing node found! FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 9509 Comm: syz-executor5 Tainted: G W 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] __do_kmalloc mm/slab.c:3703 [inline] __kmalloc+0x63/0x760 mm/slab.c:3714 kmalloc include/linux/slab.h:517 [inline] sock_kmalloc+0x112/0x190 net/core/sock.c:1986 af_alg_alloc_areq+0x74/0x2f0 crypto/af_alg.c:1098 _skcipher_recvmsg crypto/algif_skcipher.c:75 [inline] skcipher_recvmsg+0x2bc/0x10e0 crypto/algif_skcipher.c:164 sock_recvmsg_nosec net/socket.c:803 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:810 ___sys_recvmsg+0x2a4/0x640 net/socket.c:2205 __sys_recvmsg+0xe2/0x210 net/socket.c:2250 C_SYSC_recvmsg net/compat.c:751 [inline] compat_SyS_recvmsg+0x2a/0x40 net/compat.c:749 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7ff4c79 RSP: 002b:00000000f77f009c EFLAGS: 00000286 ORIG_RAX: 0000000000000174 RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 0000000020d2b000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 9544 Comm: syz-executor5 Tainted: G W 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] __do_kmalloc mm/slab.c:3703 [inline] __kmalloc+0x63/0x760 mm/slab.c:3714 kmalloc include/linux/slab.h:517 [inline] sock_kmalloc+0x112/0x190 net/core/sock.c:1986 _skcipher_recvmsg crypto/algif_skcipher.c:103 [inline] skcipher_recvmsg+0x419/0x10e0 crypto/algif_skcipher.c:164 sock_recvmsg_nosec net/socket.c:803 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:810 ___sys_recvmsg+0x2a4/0x640 net/socket.c:2205 __sys_recvmsg+0xe2/0x210 net/socket.c:2250 C_SYSC_recvmsg net/compat.c:751 [inline] compat_SyS_recvmsg+0x2a/0x40 net/compat.c:749 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7ff4c79 RSP: 002b:00000000f77f009c EFLAGS: 00000286 ORIG_RAX: 0000000000000174 RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 0000000020d2b000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 netlink: 12 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 12 bytes leftover after parsing attributes in process `syz-executor4'. validate_nla: 35 callbacks suppressed netlink: 'syz-executor0': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 1 has an invalid length. netlink: 'syz-executor0': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 26 has an invalid length. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 9743 Comm: syz-executor2 Tainted: G W 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 dccp_close: ABORT with 1 bytes unread should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] __do_kmalloc mm/slab.c:3703 [inline] __kmalloc+0x63/0x760 mm/slab.c:3714 kmalloc include/linux/slab.h:517 [inline] sock_kmalloc+0x112/0x190 net/core/sock.c:1986 af_alg_alloc_areq+0x74/0x2f0 crypto/af_alg.c:1098 _skcipher_recvmsg crypto/algif_skcipher.c:75 [inline] skcipher_recvmsg+0x2bc/0x10e0 crypto/algif_skcipher.c:164 sock_recvmsg_nosec net/socket.c:803 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:810 ___sys_recvmsg+0x2a4/0x640 net/socket.c:2205 __sys_recvmsg+0xe2/0x210 net/socket.c:2250 C_SYSC_recvmsg net/compat.c:751 [inline] compat_SyS_recvmsg+0x2a/0x40 net/compat.c:749 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7f10c79 RSP: 002b:00000000f770c09c EFLAGS: 00000286 ORIG_RAX: 0000000000000174 RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 0000000020d2b000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 netlink: 'syz-executor4': attribute type 26 has an invalid length. netlink: 'syz-executor4': attribute type 1 has an invalid length. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 9796 Comm: syz-executor2 Tainted: G W 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 netlink: 'syz-executor4': attribute type 1 has an invalid length. should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] __do_kmalloc mm/slab.c:3703 [inline] __kmalloc+0x63/0x760 mm/slab.c:3714 kmalloc include/linux/slab.h:517 [inline] sock_kmalloc+0x112/0x190 net/core/sock.c:1986 _skcipher_recvmsg crypto/algif_skcipher.c:103 [inline] skcipher_recvmsg+0x419/0x10e0 crypto/algif_skcipher.c:164 sock_recvmsg_nosec net/socket.c:803 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:810 ___sys_recvmsg+0x2a4/0x640 net/socket.c:2205 __sys_recvmsg+0xe2/0x210 net/socket.c:2250 C_SYSC_recvmsg net/compat.c:751 [inline] compat_SyS_recvmsg+0x2a/0x40 net/compat.c:749 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7f10c79 RSP: 002b:00000000f770c09c EFLAGS: 00000286 ORIG_RAX: 0000000000000174 RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 0000000020d2b000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 netlink: 'syz-executor4': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 1 has an invalid length. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 9820 Comm: syz-executor2 Tainted: G W 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] __do_kmalloc mm/slab.c:3703 [inline] __kmalloc+0x63/0x760 mm/slab.c:3714 kmalloc include/linux/slab.h:517 [inline] blkcipher_next_slow crypto/blkcipher.c:163 [inline] blkcipher_walk_next+0xd72/0x13d0 crypto/blkcipher.c:254 blkcipher_walk_done+0x518/0xde0 crypto/blkcipher.c:132 __glue_ecb_crypt_128bit arch/x86/crypto/glue_helper.c:75 [inline] glue_ecb_crypt_128bit+0x3ca/0x5c0 arch/x86/crypto/glue_helper.c:89 ecb_decrypt+0x34/0x40 arch/x86/crypto/serpent_avx2_glue.c:148 skcipher_crypt_blkcipher crypto/skcipher.c:623 [inline] skcipher_decrypt_blkcipher+0x213/0x310 crypto/skcipher.c:641 crypto_skcipher_decrypt include/crypto/skcipher.h:464 [inline] _skcipher_recvmsg crypto/algif_skcipher.c:143 [inline] skcipher_recvmsg+0x8e6/0x10e0 crypto/algif_skcipher.c:164 sock_recvmsg_nosec net/socket.c:803 [inline] sock_recvmsg+0xc9/0x110 net/socket.c:810 ___sys_recvmsg+0x2a4/0x640 net/socket.c:2205 __sys_recvmsg+0xe2/0x210 net/socket.c:2250 C_SYSC_recvmsg net/compat.c:751 [inline] compat_SyS_recvmsg+0x2a/0x40 net/compat.c:749 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7f10c79 RSP: 002b:00000000f770c09c EFLAGS: 00000286 ORIG_RAX: 0000000000000174 RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 0000000020d2b000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=10062 comm=syz-executor6 audit: type=1400 audit(1518275006.500:54): avc: denied { create } for pid=10199 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 audit: type=1400 audit(1518275006.500:55): avc: denied { write } for pid=10199 comm="syz-executor4" path="socket:[26384]" dev="sockfs" ino=26384 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1539 sclass=netlink_route_socket pig=10236 comm=syz-executor0 netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. binder: BINDER_SET_CONTEXT_MGR already set binder: 10267:10281 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_COMPLETE binder: undelivered transaction 19, process died. mmap: syz-executor1 (10421) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt. binder: 10565 RLIMIT_NICE not set binder: 10565 RLIMIT_NICE not set binder: BINDER_SET_CONTEXT_MGR already set binder: 10549:10579 ioctl 40046207 0 returned -16 binder_alloc: 10549: binder_alloc_buf, no vma binder: 10549:10584 transaction failed 29189/-3, size 0-0 line 2957 binder: undelivered TRANSACTION_ERROR: 29189 binder: release 10549:10565 transaction 21 in, still active binder: send failed reply for transaction 21 to 10549:10579 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 validate_nla: 79 callbacks suppressed netlink: 'syz-executor4': attribute type 1 has an invalid length. netlink: 'syz-executor0': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 1 has an invalid length. ion_ioctl: ioctl validate failed netlink: 'syz-executor4': attribute type 1 has an invalid length. netlink: 'syz-executor0': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 1 has an invalid length. netlink: 'syz-executor0': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 1 has an invalid length. audit: type=1400 audit(1518275009.106:56): avc: denied { map } for pid=10794 comm="syz-executor3" path="socket:[27997]" dev="sockfs" ino=27997 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1 netlink: 'syz-executor0': attribute type 1 has an invalid length. netlink: 'syz-executor4': attribute type 1 has an invalid length. QAT: Invalid ioctl QAT: Invalid ioctl binder: BINDER_SET_CONTEXT_MGR already set binder: 10856:10861 ioctl 40046207 0 returned -16 binder_alloc: 10856: binder_alloc_buf, no vma binder: 10856:10880 transaction failed 29189/-3, size 40-8 line 2957 binder: undelivered TRANSACTION_ERROR: 29189 binder: release 10856:10861 transaction 24 out, still active binder: unexpected work type, 4, not freed binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 24, target dead audit: type=1326 audit(1518275009.578:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=10902 comm="syz-executor3" exe="/root/syz-executor3" sig=9 arch=40000003 syscall=240 compat=1 ip=0xf7fc4c79 code=0x0 audit: type=1326 audit(1518275009.667:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=10902 comm="syz-executor3" exe="/root/syz-executor3" sig=9 arch=40000003 syscall=240 compat=1 ip=0xf7fc4c79 code=0x0