============================= WARNING: suspicious RCU usage 4.15.0+ #217 Not tainted ----------------------------- ./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor6/5761: #0: (rcu_read_lock){....}, at: [<000000000f8ed1a5>] __rds_conn_create+0xe46/0x1b50 net/rds/connection.c:218 stack backtrace: CPU: 0 PID: 5761 Comm: syz-executor6 Not tainted 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592 rcu_preempt_sleep_check include/linux/rcupdate.h:301 [inline] ___might_sleep+0x385/0x470 kernel/sched/core.c:6093 __might_sleep+0x95/0x190 kernel/sched/core.c:6081 slab_pre_alloc_hook mm/slab.h:420 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x2a2/0x760 mm/slab.c:3539 rds_tcp_conn_alloc+0xa7/0x4e0 net/rds/tcp.c:296 __rds_conn_create+0x112f/0x1b50 net/rds/connection.c:227 rds_conn_create_outgoing+0x3f/0x50 net/rds/connection.c:309 rds_sendmsg+0xda3/0x2390 net/rds/send.c:1126 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg+0xca/0x110 net/socket.c:640 SYSC_sendto+0x361/0x5c0 net/socket.c:1747 SyS_sendto+0x40/0x50 net/socket.c:1715 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7f8cc79 RSP: 002b:00000000f778809c EFLAGS: 00000286 ORIG_RAX: 0000000000000171 RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000020fc2000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002069affb RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 BUG: sleeping function called from invalid context at mm/slab.h:420 in_atomic(): 1, irqs_disabled(): 0, pid: 5761, name: syz-executor6 1 lock held by syz-executor6/5761: #0: (rcu_read_lock){....}, at: [<000000000f8ed1a5>] __rds_conn_create+0xe46/0x1b50 net/rds/connection.c:218 CPU: 0 PID: 5761 Comm: syz-executor6 Not tainted 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6128 __might_sleep+0x95/0x190 kernel/sched/core.c:6081 slab_pre_alloc_hook mm/slab.h:420 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x2a2/0x760 mm/slab.c:3539 rds_tcp_conn_alloc+0xa7/0x4e0 net/rds/tcp.c:296 __rds_conn_create+0x112f/0x1b50 net/rds/connection.c:227 rds_conn_create_outgoing+0x3f/0x50 net/rds/connection.c:309 rds_sendmsg+0xda3/0x2390 net/rds/send.c:1126 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg+0xca/0x110 net/socket.c:640 SYSC_sendto+0x361/0x5c0 net/socket.c:1747 SyS_sendto+0x40/0x50 net/socket.c:1715 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7f8cc79 RSP: 002b:00000000f778809c EFLAGS: 00000286 ORIG_RAX: 0000000000000171 RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000020fc2000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002069affb RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 binder: 5844:5846 BC_FREE_BUFFER u000000002020e000 no match binder: BINDER_SET_CONTEXT_MGR already set binder: 5844:5846 ioctl 40046207 0 returned -16 binder: 5844:5872 BC_FREE_BUFFER u000000002020e000 no match sock: sock_set_timeout: `syz-executor2' (pid 5886) tries to set negative timeout sock: sock_set_timeout: `syz-executor2' (pid 5886) tries to set negative timeout device syz6 entered promiscuous mode device syz6 left promiscuous mode kauditd_printk_skb: 8 callbacks suppressed audit: type=1400 audit(1518286062.105:35): avc: denied { create } for pid=6107 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1 audit: type=1400 audit(1518286062.110:36): avc: denied { getattr } for pid=6107 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1 syz-executor2 uses obsolete (PF_INET,SOCK_PACKET) device eql entered promiscuous mode device eql entered promiscuous mode netlink: 'syz-executor5': attribute type 1 has an invalid length. netlink: 'syz-executor5': attribute type 1 has an invalid length. audit: type=1400 audit(1518286062.803:37): avc: denied { net_bind_service } for pid=1231 comm="kworker/u5:0" capability=10 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=cap_userns permissive=1 audit: type=1400 audit(1518286063.680:38): avc: denied { map } for pid=6458 comm="syz-executor4" path="/dev/usbmon0" dev="devtmpfs" ino=1150 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usbmon_device_t:s0 tclass=chr_file permissive=1 dccp_close: ABORT with 20 bytes unread do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app audit: type=1400 audit(1518286064.287:39): avc: denied { setgid } for pid=6622 comm="syz-executor6" capability=6 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 binder_alloc: 6606: binder_alloc_buf, no vma binder: 6606:6612 transaction failed 29189/-3, size 0-0 line 2957 Option '3Ø' to dns_resolver key: bad/missing value kernel msg: ebtables bug: please report to author: Wrong len argument audit: type=1326 audit(1518286064.344:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6613 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f31c79 code=0x0 audit: type=1326 audit(1518286064.352:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6606 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fcac79 code=0x7ffc0000 audit: type=1326 audit(1518286064.354:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6613 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f31c79 code=0x0 audit: type=1326 audit(1518286064.353:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6606 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fcac79 code=0x7ffc0000 audit: type=1326 audit(1518286064.354:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6606 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=40000003 syscall=246 compat=1 ip=0xf7fcac79 code=0x7ffc0000 Option '3Ø' to dns_resolver key: bad/missing value binder_alloc: 6606: binder_alloc_buf, no vma binder: 6606:6655 transaction failed 29189/-3, size 0-0 line 2957 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 device eql entered promiscuous mode binder: 6716 invalid dec weak, ref 14 desc 0 s 1 w 0 binder_alloc: binder_alloc_mmap_handler: 6716 20000000-20002000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 6716:6728 ioctl 40046207 0 returned -16 binder_alloc: 6716: binder_alloc_buf, no vma binder: 6716 invalid dec weak, ref 16 desc 0 s 1 w 0 binder: 6716:6734 transaction failed 29189/-3, size 40-8 line 2957 binder: undelivered TRANSACTION_ERROR: 29189 binder: release 6716:6721 transaction 11 out, still active binder: unexpected work type, 4, not freed binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 11, target dead mmap: syz-executor4 (6823): VmData 1597440 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 device eql entered promiscuous mode capability: warning: `syz-executor3' uses deprecated v2 capabilities in a way that may be insecure SELinux: unrecognized netlink message: protocol=9 nlmsg_type=770 sclass=netlink_audit_socket pig=6956 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=770 sclass=netlink_audit_socket pig=6971 comm=syz-executor7 binder: BINDER_SET_CONTEXT_MGR already set binder: 7054:7080 ioctl 40046207 0 returned -16 binder: 7119:7120 got new transaction with bad transaction stack, transaction 19 has target 7119:0 binder: 7119:7120 transaction failed 29201/-71, size 0-0 line 2869 PF_BRIDGE: br_mdb_parse() with non-bridge binder_alloc: binder_alloc_mmap_handler: 7119 20000000-20002000 already mapped failed -16 PF_BRIDGE: br_mdb_parse() with non-bridge binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 7119: binder_alloc_buf, no vma binder: 7119:7120 ioctl 40046207 0 returned -16 binder: 7119:7138 transaction failed 29189/-3, size 40-8 line 2957 binder: undelivered TRANSACTION_ERROR: 29189 binder: release 7119:7120 transaction 19 out, still active binder: send failed reply for transaction 19, target dead Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable kauditd_printk_skb: 25 callbacks suppressed audit: type=1400 audit(1518286067.351:70): avc: denied { map } for pid=7270 comm="syz-executor2" path="/dev/snd/pcmC0D0p" dev="devtmpfs" ino=9156 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file permissive=1 x_tables: ip_tables: osf match: only valid for protocol 6 x_tables: ip_tables: osf match: only valid for protocol 6 SELinux: failed to load policy audit: type=1400 audit(1518286067.817:71): avc: denied { map } for pid=7371 comm="syz-executor4" path="/dev/autofs" dev="devtmpfs" ino=1108 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:autofs_device_t:s0 tclass=chr_file permissive=1 dccp_invalid_packet: P.Data Offset(4) too small dccp_invalid_packet: P.Data Offset(4) too small binder: 7463:7467 tried to acquire reference to desc 0, got 1 instead IPv4: Oversized IP packet from 127.0.0.1 IPv4: Oversized IP packet from 127.0.0.1 bridge: RTM_NEWNEIGH with invalid state 0x0 bridge: RTM_NEWNEIGH with invalid state 0x0 sock: sock_set_timeout: `syz-executor6' (pid 7658) tries to set negative timeout sock: sock_set_timeout: `syz-executor6' (pid 7669) tries to set negative timeout audit: type=1400 audit(1518286069.054:72): avc: denied { getopt } for pid=7678 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1518286069.054:73): avc: denied { read } for pid=7678 comm="syz-executor0" path="socket:[20546]" dev="sockfs" ino=20546 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 BUG: sleeping function called from invalid context at mm/slab.h:420 in_atomic(): 1, irqs_disabled(): 0, pid: 7706, name: syz-executor6 1 lock held by syz-executor6/7706: #0: (rcu_read_lock){....}, at: [<000000000f8ed1a5>] __rds_conn_create+0xe46/0x1b50 net/rds/connection.c:218 CPU: 0 PID: 7706 Comm: syz-executor6 Tainted: G W 4.15.0+ #217 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: IPv4: Oversized IP packet from 127.0.0.1 __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6128 __might_sleep+0x95/0x190 kernel/sched/core.c:6081 slab_pre_alloc_hook mm/slab.h:420 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc_trace+0x299/0x740 mm/slab.c:3605 kmalloc include/linux/slab.h:512 [inline] kzalloc include/linux/slab.h:701 [inline] rds_loop_conn_alloc+0xc8/0x380 net/rds/loop.c:126 __rds_conn_create+0x112f/0x1b50 net/rds/connection.c:227 rds_conn_create_outgoing+0x3f/0x50 net/rds/connection.c:309 rds_sendmsg+0xda3/0x2390 net/rds/send.c:1126 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg+0xca/0x110 net/socket.c:640 SYSC_sendto+0x361/0x5c0 net/socket.c:1747 SyS_sendto+0x40/0x50 net/socket.c:1715 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ee/0xfa1 arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7f8cc79 RSP: 002b:00000000f778809c EFLAGS: 00000286 ORIG_RAX: 0000000000000171 RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000020218000 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000020062000 RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000