netlink: 'syz-executor.3': attribute type 5 has an invalid length. ============================= WARNING: suspicious RCU usage 4.19.84 #0 Not tainted ----------------------------- include/linux/radix-tree.h:241 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz-executor.0/26370: #0: 00000000442a1879 (&sb->s_type->i_mutex_key#12){+.+.}, at: inode_lock include/linux/fs.h:747 [inline] #0: 00000000442a1879 (&sb->s_type->i_mutex_key#12){+.+.}, at: memfd_add_seals mm/memfd.c:199 [inline] #0: 00000000442a1879 (&sb->s_type->i_mutex_key#12){+.+.}, at: memfd_fcntl+0x235/0x1750 mm/memfd.c:249 #1: 00000000b9810522 (&(&(&mapping->i_pages)->xa_lock)->rlock){-.-.}, at: spin_lock_irq include/linux/spinlock.h:354 [inline] #1: 00000000b9810522 (&(&(&mapping->i_pages)->xa_lock)->rlock){-.-.}, at: memfd_tag_pins mm/memfd.c:42 [inline] #1: 00000000b9810522 (&(&(&mapping->i_pages)->xa_lock)->rlock){-.-.}, at: memfd_wait_for_pins mm/memfd.c:83 [inline] #1: 00000000b9810522 (&(&(&mapping->i_pages)->xa_lock)->rlock){-.-.}, at: memfd_add_seals mm/memfd.c:217 [inline] #1: 00000000b9810522 (&(&(&mapping->i_pages)->xa_lock)->rlock){-.-.}, at: memfd_fcntl+0x4bc/0x1750 mm/memfd.c:249 stack backtrace: CPU: 0 PID: 26370 Comm: syz-executor.0 Not tainted 4.19.84 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:4539 radix_tree_deref_slot include/linux/radix-tree.h:241 [inline] radix_tree_deref_slot include/linux/radix-tree.h:239 [inline] memfd_tag_pins mm/memfd.c:44 [inline] memfd_wait_for_pins mm/memfd.c:83 [inline] memfd_add_seals mm/memfd.c:217 [inline] memfd_fcntl+0xfdf/0x1750 mm/memfd.c:249 do_fcntl+0x200/0x1020 fs/fcntl.c:421 __do_sys_fcntl fs/fcntl.c:463 [inline] __se_sys_fcntl fs/fcntl.c:448 [inline] __x64_sys_fcntl+0x16d/0x1e0 fs/fcntl.c:448 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45a639 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f22685c7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a639 RDX: 0000000000000008 RSI: 0000000000000409 RDI: 0000000000000004 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22685c86d4 R13: 00000000004c1068 R14: 00000000004d3c60 R15: 00000000ffffffff netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. audit: type=1804 audit(1574228467.993:391): pid=26374 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/142/bus" dev="sda1" ino=16579 res=1 audit: type=1804 audit(1574228468.113:392): pid=26386 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/143/bus" dev="sda1" ino=16819 res=1 audit: type=1804 audit(1574228468.263:393): pid=26392 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/144/bus" dev="sda1" ino=16819 res=1 audit: type=1804 audit(1574228468.503:394): pid=26395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/145/bus" dev="sda1" ino=16770 res=1 audit: type=1804 audit(1574228468.713:395): pid=26401 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/146/bus" dev="sda1" ino=16770 res=1 netlink: 'syz-executor.3': attribute type 5 has an invalid length. audit: type=1804 audit(1574228469.293:396): pid=26406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/147/bus" dev="sda1" ino=16834 res=1 netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. audit: type=1804 audit(1574228469.453:397): pid=26425 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/148/bus" dev="sda1" ino=17026 res=1 audit: type=1804 audit(1574228469.623:398): pid=26432 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/149/bus" dev="sda1" ino=17234 res=1 audit: type=1804 audit(1574228469.743:399): pid=26436 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/150/bus" dev="sda1" ino=17234 res=1 audit: type=1804 audit(1574228469.933:400): pid=26439 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/151/bus" dev="sda1" ino=17234 res=1 netlink: 'syz-executor.3': attribute type 5 has an invalid length. netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 'syz-executor.3': attribute type 5 has an invalid length. audit: type=1804 audit(1574228470.763:401): pid=26451 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/152/bus" dev="sda1" ino=17201 res=1 netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. audit: type=1804 audit(1574228471.133:402): pid=26574 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/153/bus" dev="sda1" ino=17201 res=1 netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 'syz-executor.3': attribute type 5 has an invalid length. netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 'syz-executor.3': attribute type 5 has an invalid length. netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 'syz-executor.3': attribute type 5 has an invalid length. netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. audit: type=1804 audit(1574228472.213:403): pid=26590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/154/bus" dev="sda1" ino=17441 res=1 netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 'syz-executor.3': attribute type 5 has an invalid length. netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. hid-generic 0000:0000:0000.0001: item fetching failed at offset 0/1 UHID_CREATE from different security context by process 250 (syz-executor.0), this is not allowed. hid-generic: probe of 0000:0000:0000.0001 failed with error -22 hid-generic 0000:0000:0000.0002: item fetching failed at offset 0/1 hid-generic: probe of 0000:0000:0000.0002 failed with error -22 netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 'syz-executor.3': attribute type 5 has an invalid length. netlink: 'syz-executor.3': attribute type 5 has an invalid length. netlink: 'syz-executor.3': attribute type 5 has an invalid length. netlink: 'syz-executor.3': attribute type 5 has an invalid length. nla_parse: 7 callbacks suppressed netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 46 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 46 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. kauditd_printk_skb: 6 callbacks suppressed audit: type=1804 audit(1574228475.743:410): pid=26710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969615442/syzkaller.LpyYm2/96/bus" dev="sda1" ino=17560 res=1 audit: type=1804 audit(1574228475.963:411): pid=26714 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/167/bus" dev="sda1" ino=17544 res=1 netlink: 'syz-executor.3': attribute type 5 has an invalid length. netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 46 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 46 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 'syz-executor.3': attribute type 5 has an invalid length. audit: type=1804 audit(1574228476.763:412): pid=26723 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/168/bus" dev="sda1" ino=17557 res=1 netlink: 100 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. audit: type=1804 audit(1574228476.963:413): pid=26737 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/169/bus" dev="sda1" ino=17542 res=1 audit: type=1804 audit(1574228477.263:414): pid=26746 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/170/bus" dev="sda1" ino=16647 res=1 audit: type=1804 audit(1574228477.423:415): pid=26752 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir219335935/syzkaller.E79wwx/171/bus" dev="sda1" ino=17297 res=1