binder: undelivered TRANSACTION_COMPLETE
binder: undelivered TRANSACTION_ERROR: 29189
ion_ioctl: ioctl validate failed

===============================
[ INFO: suspicious RCU usage. ]
4.9.123-g8dd3fc2 #79 Not tainted
-------------------------------
kernel/rcu/tree_plugin.h:678 Illegal synchronize_rcu() in RCU read-side critical section!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 0
3 locks held by syz-executor1/3853:
 #0:  (tasklist_lock){.+.?..}, at: [<ffffffff81148932>] do_wait+0x392/0x950 kernel/exit.c:1558
 #1:  (rcu_read_lock){......}, at: [<ffffffff81cfca10>] INIT_LIST_HEAD include/linux/list.h:28 [inline]
 #1:  (rcu_read_lock){......}, at: [<ffffffff81cfca10>] avc_compute_av+0xb0/0x610 security/selinux/avc.c:975
 #2:  (rcu_callback){......}, at: [<ffffffff81289b8e>] __rcu_reclaim kernel/rcu/rcu.h:108 [inline]
 #2:  (rcu_callback){......}, at: [<ffffffff81289b8e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 #2:  (rcu_callback){......}, at: [<ffffffff81289b8e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 #2:  (rcu_callback){......}, at: [<ffffffff81289b8e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 #2:  (rcu_callback){......}, at: [<ffffffff81289b8e>] rcu_process_callbacks+0x98e/0x12b0 kernel/rcu/tree.c:3037

stack backtrace:
CPU: 1 PID: 3853 Comm: syz-executor1 Not tainted 4.9.123-g8dd3fc2 #79
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db307d60 ffffffff81eb9689 ffff8801d41eb000 0000000000000000
 0000000000000002 ffffffff83c6e380 ffff8801d0315cd8 ffff8801db307d90
 ffffffff81428611 ffff8801d0315b80 ffff8801a49add48 ffff8801a49ad548
Call Trace:
 <IRQ> 
 [<ffffffff81eb9689>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb9689>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81428611>] lockdep_rcu_suspicious.cold.48+0x110/0x141 kernel/locking/lockdep.c:4455
 [<ffffffff81286428>] synchronize_rcu+0x68/0x90 kernel/rcu/tree_plugin.h:675
 [<ffffffff836c4e2a>] __l2tp_session_unhash+0x38a/0x520 net/l2tp/l2tp_core.c:1796
 [<ffffffff836c51b7>] l2tp_tunnel_closeall+0x1f7/0x350 net/l2tp/l2tp_core.c:1364
 [<ffffffff836c5a72>] l2tp_tunnel_destruct+0x2f2/0x590 net/l2tp/l2tp_core.c:1324
 [<ffffffff830280f5>] __sk_destruct+0x55/0x590 net/core/sock.c:1428
 [<ffffffff81289aae>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff81289aae>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 [<ffffffff81289aae>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 [<ffffffff81289aae>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 [<ffffffff81289aae>] rcu_process_callbacks+0x8ae/0x12b0 kernel/rcu/tree.c:3037
 [<ffffffff83a08880>] __do_softirq+0x210/0x940 kernel/softirq.c:288
 [<ffffffff8114d554>] invoke_softirq kernel/softirq.c:368 [inline]
 [<ffffffff8114d554>] irq_exit+0x114/0x150 kernel/softirq.c:409
 [<ffffffff83a07461>] exiting_irq arch/x86/include/asm/apic.h:669 [inline]
 [<ffffffff83a07461>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:962
 [<ffffffff83a035f0>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:648
 <EOI> 
 [<ffffffff81cfbe89>] spin_unlock_irqrestore include/linux/spinlock.h:362 [inline]
 [<ffffffff81cfbe89>] avc_reclaim_node security/selinux/avc.c:543 [inline]
 [<ffffffff81cfbe89>] avc_alloc_node+0x289/0x3d0 security/selinux/avc.c:561
 [<ffffffff81cfcad8>] avc_insert security/selinux/avc.c:672 [inline]
 [<ffffffff81cfcad8>] avc_compute_av+0x178/0x610 security/selinux/avc.c:978
 [<ffffffff81cfebb4>] avc_has_perm_noaudit security/selinux/avc.c:1114 [inline]
 [<ffffffff81cfebb4>] avc_has_perm+0x364/0x4f0 security/selinux/avc.c:1148
 [<ffffffff81d10dac>] task_has_perm+0x1fc/0x330 security/selinux/hooks.c:1615
 [<ffffffff81d10f03>] selinux_task_wait+0x23/0x30 security/selinux/hooks.c:3954
 [<ffffffff81cf7c43>] security_task_wait+0x73/0xb0 security/security.c:1032
 [<ffffffff81145221>] wait_consider_task+0x2a1/0x3620 kernel/exit.c:1377
 [<ffffffff811489c3>] do_wait_thread kernel/exit.c:1490 [inline]
 [<ffffffff811489c3>] do_wait+0x423/0x950 kernel/exit.c:1561
 [<ffffffff811498fb>] SYSC_wait4 kernel/exit.c:1693 [inline]
 [<ffffffff811498fb>] SyS_wait4+0x12b/0x1f0 kernel/exit.c:1658
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff83a01c93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
ODEBUG: object ffff8801db307ce8 is NOT on stack ffff8801a7c90000, but annotated
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3853 at lib/debugobjects.c:303 debug_object_is_on_stack lib/debugobjects.c:303 [inline]
WARNING: CPU: 1 PID: 3853 at lib/debugobjects.c:303 __debug_object_init.cold.10+0x6b/0x2b0 lib/debugobjects.c:329