BUG: using __this_cpu_add() in preemptible [00000000] code: syz-executor4/6504
caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
CPU: 0 PID: 6504 Comm: syz-executor4 Not tainted 4.4.113-g962d1f3 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 bca3b1a29b0ff80d ffff8800bafef800 ffffffff81d028ed
 0000000000000000 ffffffff839fe3a0 ffffffff83cef6a0 ffff8800bb0c0000
 0000000000000003 ffff8800bafef840 ffffffff81d62834 ffffffff810002b8
Call Trace:
 [<ffffffff81d028ed>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d028ed>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81d62834>] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46
 [<ffffffff810002b8>] ? 0xffffffff810002b8
 [<ffffffff81d6289c>] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
 [<ffffffff831289d9>] tcp_try_coalesce+0x249/0x4d0 net/ipv4/tcp_input.c:4278
 [<ffffffff83130b57>] tcp_queue_rcv+0x127/0x720 net/ipv4/tcp_input.c:4485
 [<ffffffff8314842b>] tcp_send_rcvq+0x39b/0x450 net/ipv4/tcp_input.c:4531
 [<ffffffff8311f71f>] tcp_sendmsg+0x1e8f/0x2b10 net/ipv4/tcp.c:1134
 [<ffffffff831d51fc>] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:755
 [<ffffffff82dea20a>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82dea20a>] sock_sendmsg+0xca/0x110 net/socket.c:635
 [<ffffffff82deb158>] SYSC_sendto+0x2c8/0x340 net/socket.c:1665
 [<ffffffff82ded650>] SyS_sendto+0x40/0x50 net/socket.c:1633
 [<ffffffff83771c9f>] entry_SYSCALL_64_fastpath+0x1c/0x98
netlink: 11 bytes leftover after parsing attributes in process `syz-executor1'.
binder: 6552:6555 ioctl 4b37 0 returned -22
audit: type=1400 audit(1517359534.394:11): avc:  denied  { set_context_mgr } for  pid=6552 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
netlink: 11 bytes leftover after parsing attributes in process `syz-executor1'.
keychord: unsupported version 0
keychord: unsupported version 0
mmap: syz-executor7 (6799) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt.
audit: type=1326 audit(1517359536.214:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7071 comm="syz-executor6" exe="/root/syz-executor6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x0
audit: type=1326 audit(1517359536.284:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7071 comm="syz-executor6" exe="/root/syz-executor6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x0
TCP: request_sock_TCPv6: Possible SYN flooding on port 20026. Sending cookies.  Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 20030. Sending cookies.  Check SNMP counters.
audit: type=1400 audit(1517359537.074:14): avc:  denied  { getattr } for  pid=7322 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1517359537.134:15): avc:  denied  { ioctl } for  pid=7322 comm="syz-executor4" path="socket:[14209]" dev="sockfs" ino=14209 ioctlcmd=5473 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
sock: sock_set_timeout: `syz-executor7' (pid 7391) tries to set negative timeout
sock: sock_set_timeout: `syz-executor7' (pid 7391) tries to set negative timeout
netlink: 20 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 20 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 20 bytes leftover after parsing attributes in process `syz-executor3'.
audit: type=1400 audit(1517359538.014:16): avc:  denied  { bind } for  pid=7595 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1517359538.054:17): avc:  denied  { getopt } for  pid=7595 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
binder: 7864:7879 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
binder: 7864:7872 Acquire 1 refcount change on invalid ref 0 ret -22
IPVS: length: 24 != 8
IPVS: length: 24 != 8
netlink: 1192 bytes leftover after parsing attributes in process `syz-executor4'.
netlink: 1192 bytes leftover after parsing attributes in process `syz-executor4'.
netlink: 1192 bytes leftover after parsing attributes in process `syz-executor4'.
sock: sock_set_timeout: `syz-executor0' (pid 8285) tries to set negative timeout
binder: 8398:8410 transaction failed 29189/-22, size 0-0 line 3005
binder: undelivered TRANSACTION_ERROR: 29189
binder: 8398:8410 transaction failed 29189/-22, size 0-0 line 3005
binder: undelivered TRANSACTION_ERROR: 29189
BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor0/8913
caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
CPU: 1 PID: 8913 Comm: syz-executor0 Not tainted 4.4.113-g962d1f3 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 b600cc373de63cf3 ffff8800b18cf480 ffffffff81d028ed
 0000000000000001 ffffffff839fe3a0 ffffffff83d0b8a0 ffff8801c312c740
 0000000000000003 ffff8800b18cf4c0 ffffffff81d62834 ffff8800b18cf4d8
Call Trace:
 [<ffffffff81d028ed>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d028ed>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81d62834>] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46
 [<ffffffff81d6289c>] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
 [<ffffffff832e03e8>] ipcomp_alloc_tfms net/xfrm/xfrm_ipcomp.c:286 [inline]
 [<ffffffff832e03e8>] ipcomp_init_state+0x188/0x980 net/xfrm/xfrm_ipcomp.c:363
 [<ffffffff83248640>] ipcomp4_init_state+0xb0/0x7d0 net/ipv4/ipcomp.c:137
 [<ffffffff832bed57>] __xfrm_init_state+0x3e7/0xb30 net/xfrm/xfrm_state.c:2058
 [<ffffffff832ddbd6>] xfrm_state_construct net/xfrm/xfrm_user.c:590 [inline]
 [<ffffffff832ddbd6>] xfrm_add_sa+0x1916/0x2e40 net/xfrm/xfrm_user.c:636
 [<ffffffff832ce13c>] xfrm_user_rcv_msg+0x41c/0x6b0 net/xfrm/xfrm_user.c:2525
 [<ffffffff82f88b1e>] netlink_rcv_skb+0x13e/0x370 net/netlink/af_netlink.c:2349
 [<ffffffff832ca66f>] xfrm_netlink_rcv+0x6f/0x90 net/xfrm/xfrm_user.c:2533
 [<ffffffff82f876a2>] netlink_unicast_kernel net/netlink/af_netlink.c:1267 [inline]
 [<ffffffff82f876a2>] netlink_unicast+0x522/0x760 net/netlink/af_netlink.c:1293
 [<ffffffff82f881c8>] netlink_sendmsg+0x8e8/0xc50 net/netlink/af_netlink.c:1847
 [<ffffffff82dea20a>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82dea20a>] sock_sendmsg+0xca/0x110 net/socket.c:635
 [<ffffffff82debde1>] ___sys_sendmsg+0x6c1/0x7c0 net/socket.c:1962
 [<ffffffff82dede33>] __sys_sendmsg+0xd3/0x190 net/socket.c:1996
 [<ffffffff82dedf1d>] SYSC_sendmsg net/socket.c:2007 [inline]
 [<ffffffff82dedf1d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2003
 [<ffffffff83771c9f>] entry_SYSCALL_64_fastpath+0x1c/0x98
BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor0/8947
caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
CPU: 1 PID: 8947 Comm: syz-executor0 Not tainted 4.4.113-g962d1f3 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 ad064f4d170e2a3e ffff8801c37df480 ffffffff81d028ed
 0000000000000001 ffffffff839fe3a0 ffffffff83d0b8a0 ffff8801c318df00
 0000000000000003 ffff8801c37df4c0 ffffffff81d62834 ffff8801c37df4d8
Call Trace:
 [<ffffffff81d028ed>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d028ed>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81d62834>] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46
 [<ffffffff81d6289c>] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
 [<ffffffff832e03e8>] ipcomp_alloc_tfms net/xfrm/xfrm_ipcomp.c:286 [inline]
 [<ffffffff832e03e8>] ipcomp_init_state+0x188/0x980 net/xfrm/xfrm_ipcomp.c:363
 [<ffffffff83248640>] ipcomp4_init_state+0xb0/0x7d0 net/ipv4/ipcomp.c:137
 [<ffffffff832bed57>] __xfrm_init_state+0x3e7/0xb30 net/xfrm/xfrm_state.c:2058
 [<ffffffff832ddbd6>] xfrm_state_construct net/xfrm/xfrm_user.c:590 [inline]
 [<ffffffff832ddbd6>] xfrm_add_sa+0x1916/0x2e40 net/xfrm/xfrm_user.c:636
 [<ffffffff832ce13c>] xfrm_user_rcv_msg+0x41c/0x6b0 net/xfrm/xfrm_user.c:2525
 [<ffffffff82f88b1e>] netlink_rcv_skb+0x13e/0x370 net/netlink/af_netlink.c:2349
 [<ffffffff832ca66f>] xfrm_netlink_rcv+0x6f/0x90 net/xfrm/xfrm_user.c:2533
 [<ffffffff82f876a2>] netlink_unicast_kernel net/netlink/af_netlink.c:1267 [inline]
 [<ffffffff82f876a2>] netlink_unicast+0x522/0x760 net/netlink/af_netlink.c:1293
 [<ffffffff82f881c8>] netlink_sendmsg+0x8e8/0xc50 net/netlink/af_netlink.c:1847
 [<ffffffff82dea20a>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82dea20a>] sock_sendmsg+0xca/0x110 net/socket.c:635
 [<ffffffff82debde1>] ___sys_sendmsg+0x6c1/0x7c0 net/socket.c:1962
 [<ffffffff82dede33>] __sys_sendmsg+0xd3/0x190 net/socket.c:1996
 [<ffffffff82dedf1d>] SYSC_sendmsg net/socket.c:2007 [inline]
 [<ffffffff82dedf1d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2003
 [<ffffffff83771c9f>] entry_SYSCALL_64_fastpath+0x1c/0x98