============================= WARNING: suspicious RCU usage 4.18.0+ #79 Not tainted ----------------------------- kernel/bpf/core.c:1582 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz-executor4/27910: #0: 000000007b97507a (&ctx->mutex){+.+.}, at: perf_event_ctx_lock_nested+0x375/0x600 kernel/events/core.c:1276 #1: 00000000225ab5bc (bpf_event_mutex){+.+.}, at: perf_event_query_prog_array+0x1c6/0x380 kernel/trace/bpf_trace.c:1062 stack backtrace: CPU: 0 PID: 27910 Comm: syz-executor4 Not tainted 4.18.0+ #79 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 lockdep_rcu_suspicious+0x14a/0x153 kernel/locking/lockdep.c:4562 bpf_prog_array_copy_core+0x2d9/0x360 kernel/bpf/core.c:1582 bpf_prog_array_copy_info+0x9a/0x110 kernel/bpf/core.c:1720 perf_event_query_prog_array+0x22e/0x380 kernel/trace/bpf_trace.c:1063 _perf_ioctl+0x986/0x1600 kernel/events/core.c:5079 perf_ioctl+0x59/0x80 kernel/events/core.c:5110 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x1de/0x1720 fs/ioctl.c:684 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701 __do_sys_ioctl fs/ioctl.c:708 [inline] __se_sys_ioctl fs/ioctl.c:706 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457089 Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fdde77c8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fdde77c96d4 RCX: 0000000000457089 RDX: 0000000020000240 RSI: 00000000c008240a RDI: 0000000000000004 RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000004cf478 R14: 00000000004bead0 R15: 0000000000000000 netlink: 3290 bytes leftover after parsing attributes in process `syz-executor2'. IPVS: ftp: loaded support on port[0] = 21 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves netlink: 3290 bytes leftover after parsing attributes in process `syz-executor2'. bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready bond0: Enslaving bond_slave_0 as an active interface with an up link bond0: Enslaving bond_slave_1 as an active interface with an up link IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready team0: Port device team_slave_0 added IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 8021q: adding VLAN 0 to HW filter on device team0 syz-executor3 invoked oom-killer: gfp_mask=0x6000c0(GFP_KERNEL), nodemask=(null), order=0, oom_score_adj=0 syz-executor3 cpuset=syz3 mems_allowed=0 CPU: 0 PID: 27926 Comm: syz-executor3 Not tainted 4.18.0+ #79 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 dump_header+0x27b/0xf64 mm/oom_kill.c:432 oom_kill_process.cold.25+0x10/0x10bc mm/oom_kill.c:867 out_of_memory+0xa8a/0x14d0 mm/oom_kill.c:1081 mem_cgroup_out_of_memory+0x15e/0x210 mm/memcontrol.c:1212 mem_cgroup_oom_synchronize+0x713/0x940 mm/memcontrol.c:1557 pagefault_out_of_memory+0xc8/0x197 mm/oom_kill.c:1107 mm_fault_error+0x1de/0x380 arch/x86/mm/fault.c:1022 __do_page_fault+0xd25/0xe50 arch/x86/mm/fault.c:1422 do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1469 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1161 RIP: 0033:0x46fe5d Code: 54 55 53 48 81 ec 28 21 00 00 8b 8f c0 00 00 00 85 c9 0f 85 4d 01 00 00 c7 87 c0 00 00 00 ff ff ff ff 48 8d 84 24 20 01 00 00 <48> 89 bc 24 00 01 00 00 48 89 fb 41 bd 00 00 00 00 c7 84 24 e0 00 RSP: 002b:00007ffd1a750130 EFLAGS: 00010246 RAX: 00007ffd1a750250 RBX: 000000000070af00 RCX: 00000000ffffffff RDX: 00007ffd1a752800 RSI: 00000000004bcb98 RDI: 000000000070af00 RBP: 00007ffd1a7527d0 R08: 0000000000a44bd0 R09: 00000000004bcb98 R10: 0000000001dfd940 R11: 0000000000000297 R12: 00000000004bcb98 R13: 00007ffd1a752800 R14: 0000000000000000 R15: 0000000000000000 Task in /syz3 killed as a result of limit of /syz3 memory: usage 20kB, limit 0kB, failcnt 5577 memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /syz3: cache:184KB rss:12KB rss_huge:0KB shmem:0KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:0KB inactive_file:0KB active_file:0KB unevictable:0KB [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [27926] 0 27926 17553 8387 114688 0 0 syz-executor3 Memory cgroup out of memory: Kill process 27926 (syz-executor3) score 8415000 or sacrifice child Killed process 27926 (syz-executor3) total-vm:70212kB, anon-rss:60kB, file-rss:33488kB, shmem-rss:0kB device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed IPVS: ftp: loaded support on port[0] = 21 bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready bond0: Enslaving bond_slave_0 as an active interface with an up link bond0: Enslaving bond_slave_1 as an active interface with an up link IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready team0: Port device team_slave_0 added IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 8021q: adding VLAN 0 to HW filter on device team0 syz-executor3 invoked oom-killer: gfp_mask=0x6000c0(GFP_KERNEL), nodemask=(null), order=0, oom_score_adj=0 syz-executor3 cpuset=syz3 mems_allowed=0 CPU: 0 PID: 28286 Comm: syz-executor3 Not tainted 4.18.0+ #79 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 dump_header+0x27b/0xf64 mm/oom_kill.c:432 oom_kill_process.cold.25+0x10/0x10bc mm/oom_kill.c:867 out_of_memory+0xa8a/0x14d0 mm/oom_kill.c:1081 mem_cgroup_out_of_memory+0x15e/0x210 mm/memcontrol.c:1212 mem_cgroup_oom_synchronize+0x713/0x940 mm/memcontrol.c:1557 pagefault_out_of_memory+0xc8/0x197 mm/oom_kill.c:1107 mm_fault_error+0x1de/0x380 arch/x86/mm/fault.c:1022 __do_page_fault+0xd25/0xe50 arch/x86/mm/fault.c:1422 do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1469 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1161 RIP: 0033:0x46fe5d Code: 54 55 53 48 81 ec 28 21 00 00 8b 8f c0 00 00 00 85 c9 0f 85 4d 01 00 00 c7 87 c0 00 00 00 ff ff ff ff 48 8d 84 24 20 01 00 00 <48> 89 bc 24 00 01 00 00 48 89 fb 41 bd 00 00 00 00 c7 84 24 e0 00 RSP: 002b:00007ffe1ffd4450 EFLAGS: 00010246 RAX: 00007ffe1ffd4570 RBX: 000000000070af00 RCX: 00000000ffffffff RDX: 00007ffe1ffd6b20 RSI: 00000000004bcb98 RDI: 000000000070af00 RBP: 00007ffe1ffd6af0 R08: 0000000000a44bd0 R09: 00000000004bcb98 R10: 00000000022a7940 R11: 0000000000000297 R12: 00000000004bcb98 R13: 00007ffe1ffd6b20 R14: 0000000000000000 R15: 0000000000000000 Task in /syz3 killed as a result of limit of /syz3 memory: usage 20kB, limit 0kB, failcnt 5621 memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /syz3: cache:184KB rss:12KB rss_huge:0KB shmem:0KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:0KB inactive_file:0KB active_file:0KB unevictable:0KB [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [28286] 0 28286 17553 8388 118784 0 0 syz-executor3 Memory cgroup out of memory: Kill process 28286 (syz-executor3) score 8417000 or sacrifice child Killed process 28286 (syz-executor3) total-vm:70212kB, anon-rss:64kB, file-rss:33488kB, shmem-rss:0kB oom_reaper: reaped process 28286 (syz-executor3), now anon-rss:0kB, file-rss:32768kB, shmem-rss:0kB device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state IPVS: ftp: loaded support on port[0] = 21 team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves