BUG: using __this_cpu_add() in preemptible [00000000] code: syz-executor6/5544 caller is __this_cpu_preempt_check+0x13/0x20 /syzkaller/managers/android-44-kasan-gce/kernel/lib/smp_processor_id.c:62 CPU: 1 PID: 5544 Comm: syz-executor6 Not tainted 4.4.105-g8a53962 #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 8f760e14a105657a ffff8800b591f828 ffffffff81cc9b0f 0000000000000001 ffffffff839fd4a0 ffff8800b591f868 ffffffff81d28d18 ffffffff83ced1a0 1ffff10016b23f14 ffff8801da757200 ffff8801da757680 Call Trace: [] __dump_stack /syzkaller/managers/android-44-kasan-gce/kernel/lib/dump_stack.c:15 [inline] [] dump_stack+0x8e/0xcf /syzkaller/managers/android-44-kasan-gce/kernel/lib/dump_stack.c:51 [] check_preemption_disabled+0x1b8/0x1f0 /syzkaller/managers/android-44-kasan-gce/kernel/lib/smp_processor_id.c:46 [] __this_cpu_preempt_check+0x13/0x20 /syzkaller/managers/android-44-kasan-gce/kernel/lib/smp_processor_id.c:62 [] tcp_try_coalesce+0x200/0x4b0 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp_input.c:4278 [] tcp_queue_rcv+0xfe/0x720 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp_input.c:4485 [] tcp_send_rcvq+0x391/0x4a0 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp_input.c:4531 [] tcp_sendmsg+0x1d1c/0x36a0 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp.c:1134 [] inet_sendmsg+0x26c/0x430 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/af_inet.c:755 [] sock_sendmsg_nosec /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:625 [inline] [] sock_sendmsg+0xb5/0xf0 /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:635 [] SYSC_sendto+0x267/0x300 /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:1665 [] SyS_sendto+0x9/0x10 /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:1633 [] entry_SYSCALL_64_fastpath+0x16/0x76 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'. IPVS: Creating netns size=2552 id=9 IPVS: Creating netns size=2552 id=10 device gre0 entered promiscuous mode audit: type=1400 audit(1512959143.832:14): avc: denied { create } for pid=5955 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_rdma_socket permissive=1 device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket sg_write: data in/out 262364/161 bytes for SCSI command 0xff-- guessing data in; program syz-executor4 not setting count and/or reply_len properly sg_write: data in/out 262364/161 bytes for SCSI command 0xff-- guessing data in; program syz-executor4 not setting count and/or reply_len properly audit: type=1400 audit(1512959144.962:15): avc: denied { create } for pid=6262 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_scsitransport_socket permissive=1 capability: warning: `syz-executor6' uses 32-bit capabilities (legacy support in use) sd 0:0:1:0: [sg0] tag#13 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK sd 0:0:1:0: [sg0] tag#13 CDB: opcode=0xff (vendor) sd 0:0:1:0: [sg0] tag#13 CDB[00]: ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#13 CDB[10]: 00 00 00 00 10 27 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#13 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#13 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#13 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK sd 0:0:1:0: [sg0] tag#13 CDB: opcode=0xff (vendor) sd 0:0:1:0: [sg0] tag#13 CDB[00]: ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#13 CDB[10]: 00 00 00 00 10 27 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#13 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#13 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket device gre0 entered promiscuous mode sg_write: data in/out 262364/161 bytes for SCSI command 0xff-- guessing data in; program syz-executor3 not setting count and/or reply_len properly kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 6578 Comm: syz-executor3 Not tainted 4.4.105-g8a53962 #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d6010000 task.stack: ffff8801d1f80000 RIP: 0010:[] [] sg_read_oxfer /syzkaller/managers/android-44-kasan-gce/kernel/drivers/scsi/sg.c:1986 [inline] RIP: 0010:[] [] sg_read+0x93e/0x1260 /syzkaller/managers/android-44-kasan-gce/kernel/drivers/scsi/sg.c:531 RSP: 0018:ffff8801d1f87b20 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff8801d54dc730 RCX: 000000000000000c RDX: 0000000000000000 RSI: ffff8801d54dc754 RDI: ffff8801d1bb8170 RBP: ffff8801d1f87c18 R08: 0000000000080000 R09: 0000000000000001 R10: 0000000000000000 R11: 1ffff1003a3f0f2a R12: 0000000000000000 R13: ffff8801d1bb8140 R14: 0000000000000000 R15: 0000000000000077 FS: 00007f027db5c700(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020d11ff0 CR3: 00000001d1e47000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff8801d1f87d80[ 55.429769] nla_parse: 4 callbacks suppressed netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. ffff8801d1bb8158 ffff8801d1f87b78 ffff8801d1bb8168[ 55.451276] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. 000000000000009b ffff8801d1f87b78 0000000020f45fc8 0000000000001000 1ffff1003a3f0f6e 0000000020d06f89 0000000041b58ab3 ffffffff83fa600e Call Trace: [] do_loop_readv_writev+0x11c/0x1e0 /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:680 [] do_readv_writev+0x552/0x660 /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:810 [] vfs_readv+0x5a/0xa0 /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:834 [] SYSC_readv /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:860 [inline] [] SyS_readv+0xd3/0x260 /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:852 [] entry_SYSCALL_64_fastpath+0x16/0x76 Code: 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 a9 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 65 28 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 7d 08 00 00 49 8b 04 24 48 85 c0 0f 84 ee 04 RIP [] sg_read_oxfer /syzkaller/managers/android-44-kasan-gce/kernel/drivers/scsi/sg.c:1986 [inline] RIP [] sg_read+0x93e/0x1260 /syzkaller/managers/android-44-kasan-gce/kernel/drivers/scsi/sg.c:531 RSP ---[ end trace ae3a9ec90796286a ]---