kvm [19897]: vcpu0, guest rIP: 0x9124 disabled perfctr wrmsr: 0x187 data 0xe0000011 INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 1 PID: 19951 Comm: syz-executor4 Not tainted 4.15.0-rc3-next-20171214+ #67 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xe9/0x14b lib/dump_stack.c:53 register_lock_class+0x164/0x5d0 kernel/locking/lockdep.c:752 __lock_acquire+0xb4/0x1430 kernel/locking/lockdep.c:3314 lock_acquire+0xbf/0x220 kernel/locking/lockdep.c:3914 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:310 [inline] ipc_lock_object ipc/util.h:171 [inline] sem_lock ipc/sem.c:375 [inline] do_semtimedop+0x9bd/0x1970 ipc/sem.c:1972 SYSC_semtimedop ipc/sem.c:2130 [inline] SyS_semtimedop+0x72/0xa0 ipc/sem.c:2123 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x452a39 RSP: 002b:00007f29eb04bc58 EFLAGS: 00000212 ORIG_RAX: 00000000000000dc RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452a39 RDX: 0000000000000001 RSI: 000000002078c000 RDI: 0000000000000000 RBP: 00000000000003b3 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000204f5ff0 R11: 0000000000000212 R12: 00000000006f3968 R13: 00000000ffffffff R14: 00007f29eb04c6d4 R15: 0000000000000000 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl Disabled LAPIC found during irq injection SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=20025 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61501 sclass=netlink_route_socket pig=20025 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=20025 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=20030 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61501 sclass=netlink_route_socket pig=20032 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=20032 comm=syz-executor7 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl binder: 20074:20075 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 20074:20075 BC_FREE_BUFFER uffffffffffffffff no match binder: 20074:20075 transaction failed 29189/-22, size 56-72 line 2832 binder: 20074:20075 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 20074:20075 BC_FREE_BUFFER uffffffffffffffff no match binder: 20074:20075 transaction failed 29189/-22, size 56-72 line 2832 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 nla_parse: 17 callbacks suppressed netlink: 16 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 16 bytes leftover after parsing attributes in process `syz-executor1'. device syz0 entered promiscuous mode audit: type=1400 audit(1513353345.998:9274): avc: denied { execute } for pid=20115 comm="syz-executor6" path="pipe:[76876]" dev="pipefs" ino=76876 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=fifo_file permissive=1 netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. device gre0 entered promiscuous mode device gre0 entered promiscuous mode QAT: Invalid ioctl QAT: Invalid ioctl sg_write: data in/out 822404280/197 bytes for SCSI command 0x12-- guessing data in; program syz-executor0 not setting count and/or reply_len properly sg_write: data in/out 822404280/197 bytes for SCSI command 0x12-- guessing data in; program syz-executor0 not setting count and/or reply_len properly netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. audit: type=1326 audit(1513353347.222:9275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20426 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0xffff0000 do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app QAT: Stopping all acceleration devices. QAT: Stopping all acceleration devices. audit: type=1326 audit(1513353347.353:9276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20426 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0xffff0000 netlink: 'syz-executor4': attribute type 2 has an invalid length. sctp: [Deprecated]: syz-executor6 (pid 20526) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead netlink: 'syz-executor4': attribute type 2 has an invalid length. sctp: [Deprecated]: syz-executor6 (pid 20580) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead pit: kvm: requested 5866 ns i8254 timer period limited to 500000 ns device gre0 entered promiscuous mode binder: 20849:20858 DecRefs 0 refcount change on invalid ref 2 ret -22 audit: type=1326 audit(1513353348.146:9277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513353348.146:9278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=16 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513353348.146:9279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513353348.147:9280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=41 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513353348.172:9281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513353348.172:9282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513353348.197:9283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=41 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513353348.198:9284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513353348.198:9285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513353348.198:9286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=20864 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=41 compat=0 ip=0x452a39 code=0x7ffc0000 device lo left promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready SELinux: unrecognized netlink message: protocol=9 nlmsg_type=257 sclass=netlink_audit_socket pig=20893 comm=syz-executor2 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=257 sclass=netlink_audit_socket pig=20893 comm=syz-executor2 binder: 20949:20951 got transaction with invalid parent offset or type binder: 20949:20951 transaction failed 29201/-22, size 72-16 line 3070 binder: BINDER_SET_CONTEXT_MGR already set binder: 20949:20961 ioctl 40046207 0 returned -16 binder_alloc: 20949: binder_alloc_buf, no vma binder: 20949:20951 transaction failed 29189/-3, size 72-16 line 2947 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29201 IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready dccp_v6_rcv: dropped packet with invalid checksum QAT: Invalid ioctl QAT: Invalid ioctl binder: 21050:21051 got reply transaction with bad transaction stack, transaction 159 has target 21050:0 binder: 21050:21051 transaction failed 29201/-71, size 0-0 line 2762 binder: BINDER_SET_CONTEXT_MGR already set QAT: Invalid ioctl binder: 21050:21079 ioctl 40046207 0 returned -16 QAT: Invalid ioctl binder_alloc: 21050: binder_alloc_buf, no vma binder: 21050:21051 transaction failed 29189/-3, size 0-0 line 2947 device gre0 entered promiscuous mode binder: undelivered TRANSACTION_ERROR: 29189 binder: release 21050:21051 transaction 159 out, still active binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29201 binder: send failed reply for transaction 159, target dead QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl binder: 21240:21248 ioctl 40046205 8 returned -22 binder: 21240:21248 ERROR: BC_REGISTER_LOOPER called without request binder: 21248 RLIMIT_NICE not set binder_alloc: 21240: binder_alloc_buf, no vma binder: 21240:21267 transaction failed 29189/-3, size 0-0 line 2947 binder: 21240:21267 got reply transaction with no transaction stack binder: 21240:21267 transaction failed 29201/-71, size 24-8 line 2747 binder: undelivered TRANSACTION_ERROR: 29201 binder: 21240:21248 ioctl 40046205 6 returned -22 binder: 21240:21267 ioctl 40046205 8 returned -22 binder: 21240:21267 unknown command 0 binder: 21240:21267 ioctl c0306201 20008fd0 returned -22 binder_alloc: 21240: binder_alloc_buf, no vma binder: 21240:21248 transaction failed 29189/-3, size 0-0 line 2947 binder: 21240:21248 got reply transaction with no transaction stack binder: 21240:21248 transaction failed 29201/-71, size 24-8 line 2747 binder: undelivered TRANSACTION_ERROR: 29201 print_req_error: 98 callbacks suppressed print_req_error: I/O error, dev loop6, sector 0 print_req_error: I/O error, dev loop6, sector 0 buffer_io_error: 94 callbacks suppressed Buffer I/O error on dev loop6, logical block 0, async page read QAT: Invalid ioctl QAT: Invalid ioctl print_req_error: I/O error, dev loop6, sector 0 Buffer I/O error on dev loop6, logical block 0, async page read QAT: Invalid ioctl QAT: Invalid ioctl print_req_error: I/O error, dev loop6, sector 0 print_req_error: I/O error, dev loop6, sector 0 Buffer I/O error on dev loop6, logical block 0, async page read print_req_error: I/O error, dev loop6, sector 0 Buffer I/O error on dev loop6, logical block 0, async page read print_req_error: I/O error, dev loop6, sector 0 Buffer I/O error on dev loop6, logical block 0, async page read print_req_error: I/O error, dev loop6, sector 0 Buffer I/O error on dev loop6, logical block 0, async page read print_req_error: I/O error, dev loop6, sector 0 Buffer I/O error on dev loop6, logical block 0, async page read print_req_error: I/O error, dev loop6, sector 0 Buffer I/O error on dev loop6, logical block 0, async page read Buffer I/O error on dev loop6, logical block 0, async page read Buffer I/O error on dev loop6, logical block 0, async page read netlink: 'syz-executor0': attribute type 39 has an invalid length. netlink: 'syz-executor0': attribute type 39 has an invalid length. device gre0 entered promiscuous mode device lo entered promiscuous mode device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=21727 comm=syz-executor0 device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device eql entered promiscuous mode device eql entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=21875 comm=syz-executor2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=21875 comm=syz-executor2 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 device gre0 entered promiscuous mode binder: 21992:21993 ioctl c018620b 202dd000 returned -14 RDS: rds_bind could not find a transport for 172.20.4.187, load rds_tcp or rds_rdma? RDS: rds_bind could not find a transport for 172.20.4.187, load rds_tcp or rds_rdma? binder: 21992:22003 got reply transaction with bad transaction stack, transaction 169 has target 21992:0 binder: 21992:22003 transaction failed 29201/-71, size 0-0 line 2762 binder: BINDER_SET_CONTEXT_MGR already set binder: 21992:22009 ioctl 40046207 0 returned -16 binder_alloc: 21992: binder_alloc_buf, no vma binder: 21992:22003 transaction failed 29189/-3, size 0-0 line 2947 binder: undelivered TRANSACTION_ERROR: 29189 binder: release 21992:22003 transaction 169 out, still active binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29201 binder: send failed reply for transaction 169, target dead device gre0 entered promiscuous mode device lo left promiscuous mode binder: 22251:22252 DecRefs 0 refcount change on invalid ref 3 ret -22 binder: 22251:22252 BC_INCREFS_DONE u0000000000000000 no match binder: 22252 RLIMIT_NICE not set binder: 22252 RLIMIT_NICE not set binder: 22252 RLIMIT_NICE not set binder: send failed reply for transaction 173 to 22251:22264 binder: 22251:22252 ioctl c0306201 2000efd0 returned -14 binder: 22251:22264 DecRefs 0 refcount change on invalid ref 3 ret -22 binder: 22251:22264 BC_INCREFS_DONE u0000000000000000 node 172 cookie mismatch 0000000000000002 != 0000000000000000 binder: 22264 RLIMIT_NICE not set binder: BINDER_SET_CONTEXT_MGR already set binder: 22251:22252 ioctl 40046207 0 returned -16 binder_alloc: 22251: binder_alloc_buf, no vma binder: 22251:22274 transaction failed 29189/-3, size 0-0 line 2947 binder: undelivered TRANSACTION_ERROR: 29189 device gre0 entered promiscuous mode device gre0 entered promiscuous mode netlink: 'syz-executor1': attribute type 2 has an invalid length. netlink: 'syz-executor1': attribute type 2 has an invalid length. Option '§Öç#\®¼' to dns_resolver key: bad/missing value Option '§Öç#\®¼' to dns_resolver key: bad/missing value nla_parse: 29 callbacks suppressed netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. device gre0 entered promiscuous mode netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'. QAT: Invalid ioctl RDS: rds_bind could not find a transport for 172.20.7.187, load rds_tcp or rds_rdma? QAT: Invalid ioctl device gre0 entered promiscuous mode RDS: rds_bind could not find a transport for 172.20.7.187, load rds_tcp or rds_rdma? QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8 sclass=netlink_xfrm_socket pig=22902 comm=syz-executor5 netlink: 9 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 9 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=9 nlmsg_type=28 sclass=netlink_audit_socket pig=23066 comm=syz-executor6 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=28 sclass=netlink_audit_socket pig=23066 comm=syz-executor6 device gre0 entered promiscuous mode netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'. do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app kauditd_printk_skb: 521 callbacks suppressed audit: type=1326 audit(1513353354.429:9808): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23293 comm="syz-executor1" exe="/root/syz-executor1" sig=9 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x0 audit: type=1326 audit(1513353354.519:9809): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23293 comm="syz-executor1" exe="/root/syz-executor1" sig=9 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pig=23337 comm=syz-executor3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pig=23337 comm=syz-executor3 QAT: Invalid ioctl QAT: Invalid ioctl binder: 23402:23404 ioctl 40046205 0 returned -22 binder: 23402:23404 ERROR: BC_REGISTER_LOOPER called without request QAT: Invalid ioctl QAT: Invalid ioctl binder: 23404 RLIMIT_NICE not set binder: 23404 RLIMIT_NICE not set binder: release 23402:23404 transaction 176 in, still active SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5 sclass=netlink_route_socket pig=23416 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23416 comm=syz-executor0 QAT: Invalid ioctl binder: send failed reply for transaction 176 to 23402:23411 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: 23402:23404 ioctl 40046205 0 returned -22 device lo entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready binder: 23402:23411 ERROR: BC_REGISTER_LOOPER called without request binder: 23411 RLIMIT_NICE not set device lo left promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5 sclass=netlink_route_socket pig=23424 comm=syz-executor0 device lo entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready device lo left promiscuous mode binder: release 23402:23433 transaction 178 out, still active binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 178, target dead netlink: 'syz-executor5': attribute type 10 has an invalid length. netlink: 'syz-executor5': attribute type 10 has an invalid length. device gre0 entered promiscuous mode