=============================== [ INFO: suspicious RCU usage. ] 4.9.202+ #0 Not tainted ------------------------------- include/linux/radix-tree.h:199 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 0 2 locks held by syz-executor.4/19545: #0: (&sb->s_type->i_mutex_key#10){+.+.+.}, at: [<000000009666191a>] inode_lock include/linux/fs.h:771 [inline] #0: (&sb->s_type->i_mutex_key#10){+.+.+.}, at: [<000000009666191a>] shmem_add_seals+0x166/0x1020 mm/shmem.c:2610 #1: (&(&mapping->tree_lock)->rlock){..-...}, at: [<00000000cbf289db>] spin_lock_irq include/linux/spinlock.h:332 [inline] #1: (&(&mapping->tree_lock)->rlock){..-...}, at: [<00000000cbf289db>] shmem_tag_pins mm/shmem.c:2465 [inline] #1: (&(&mapping->tree_lock)->rlock){..-...}, at: [<00000000cbf289db>] shmem_wait_for_pins mm/shmem.c:2506 [inline] #1: (&(&mapping->tree_lock)->rlock){..-...}, at: [<00000000cbf289db>] shmem_add_seals+0x342/0x1020 mm/shmem.c:2622 stack backtrace: CPU: 1 PID: 19545 Comm: syz-executor.4 Not tainted 4.9.202+ #0 ffff8801d6167ca0 ffffffff81b55d2b ffff8801d4317468 0000000000000000 0000000000000002 00000000000000c7 ffff8801c4858000 ffff8801d6167cd0 ffffffff81406867 ffffea0006f18d80 dffffc0000000000 ffff8801d6167d78 Call Trace: [<000000005590ed0a>] __dump_stack lib/dump_stack.c:15 [inline] [<000000005590ed0a>] dump_stack+0xcb/0x130 lib/dump_stack.c:56 [<00000000ece8dd47>] lockdep_rcu_suspicious.cold+0x10a/0x149 kernel/locking/lockdep.c:4458 [<00000000cd239386>] radix_tree_deref_slot include/linux/radix-tree.h:199 [inline] [<00000000cd239386>] shmem_tag_pins mm/shmem.c:2467 [inline] [<00000000cd239386>] shmem_wait_for_pins mm/shmem.c:2506 [inline] [<00000000cd239386>] shmem_add_seals+0xa44/0x1020 mm/shmem.c:2622 [<00000000c916a045>] shmem_fcntl+0xf7/0x130 mm/shmem.c:2657 [<000000005c96981e>] do_fcntl fs/fcntl.c:340 [inline] [<000000005c96981e>] SYSC_fcntl fs/fcntl.c:376 [inline] [<000000005c96981e>] SyS_fcntl+0x1d5/0xb50 fs/fcntl.c:361 [<00000000835fcfb2>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288 [<0000000065077d3b>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb audit: type=1400 audit(2000000498.840:884): avc: denied { create } for pid=19557 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(2000000498.970:885): avc: denied { write } for pid=19557 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(2000000499.250:886): avc: denied { read } for pid=19557 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(2000000499.310:887): avc: denied { prog_load } for pid=19569 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(2000000499.360:888): avc: denied { prog_load } for pid=19569 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(2000000499.520:889): avc: denied { create } for pid=19557 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(2000000499.520:890): avc: denied { write } for pid=19557 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(2000000499.930:891): avc: denied { set_context_mgr } for pid=19598 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 audit: type=1400 audit(2000000500.000:892): avc: denied { create } for pid=19592 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(2000000500.000:893): avc: denied { write } for pid=19592 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 binder: 19598:19598 ioctl c0306201 0 returned -14 netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 80 bytes leftover after parsing attributes in process `syz-executor.5'. audit_printk_skb: 18 callbacks suppressed audit: type=1400 audit(2000000505.970:900): avc: denied { map_create } for pid=19880 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 netlink: 80 bytes leftover after parsing attributes in process `syz-executor.5'. EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock audit: type=1400 audit(2000000506.660:901): avc: denied { create } for pid=19914 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(2000000506.670:902): avc: denied { write } for pid=19914 comm="syz-executor.3" path="socket:[33724]" dev="sockfs" ino=33724 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(2000000506.680:903): avc: denied { write } for pid=19914 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=128, mo=a802401c, mo2=0002] System zones: 0-7 EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue audit: type=1400 audit(2000000507.550:904): avc: denied { create } for pid=19939 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(2000000507.550:905): avc: denied { write } for pid=19939 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1