============================= WARNING: suspicious RCU usage 4.14.0-rc5-next-20171018+ #36 Not tainted ----------------------------- ./include/linux/inetdevice.h:231 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor6/2477: #0: (rcu_read_lock){....}, at: [] inet_rtm_getroute+0xaa0/0x2d70 net/ipv4/route.c:2738 stack backtrace: CPU: 0 PID: 2477 Comm: syz-executor6 Not tainted 4.14.0-rc5-next-20171018+ #36 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4662 __in_dev_get_rtnl include/linux/inetdevice.h:231 [inline] fib_dump_info+0x1136/0x13d0 net/ipv4/fib_semantics.c:1368 inet_rtm_getroute+0xf97/0x2d70 net/ipv4/route.c:2785 rtnetlink_rcv_msg+0x51c/0x1020 net/core/rtnetlink.c:4334 netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2409 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4358 netlink_unicast_kernel net/netlink/af_netlink.c:1273 [inline] netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1299 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1862 sock_sendmsg_nosec net/socket.c:632 [inline] sock_sendmsg+0xca/0x110 net/socket.c:642 sock_write_iter+0x31a/0x5d0 net/socket.c:911 call_write_iter include/linux/fs.h:1770 [inline] new_sync_write fs/read_write.c:468 [inline] __vfs_write+0x684/0x970 fs/read_write.c:481 vfs_write+0x189/0x510 fs/read_write.c:543 SYSC_write fs/read_write.c:588 [inline] SyS_write+0xef/0x220 fs/read_write.c:580 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x452719 RSP: 002b:00007f13dc922be8 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452719 RDX: 0000000000000025 RSI: 00000000209f2000 RDI: 0000000000000015 RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f6698 R13: 00000000ffffffff R14: 00007f13dc9236d4 R15: 0000000000000000 device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=2516 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=2529 comm=syz-executor5 TCP: request_sock_TCP: Possible SYN flooding on port 20005. Sending cookies. Check SNMP counters. mmap: syz-executor4 (2626): VmData 13844480 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl sctp: [Deprecated]: syz-executor1 (pid 2694) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead device syz5 entered promiscuous mode sctp: [Deprecated]: syz-executor1 (pid 2707) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead device syz5 left promiscuous mode device syz5 entered promiscuous mode QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'. QAT: Invalid ioctl netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'. QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl netlink: 2 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 2 bytes leftover after parsing attributes in process `syz-executor7'. QAT: Invalid ioctl irq bypass consumer (token ffff8801d87e0c80) registration fails: -16 QAT: Invalid ioctl device lo entered promiscuous mode device lo left promiscuous mode rpcbind: RPC call returned error 22 rpcbind: RPC call returned error 22 rpcbind: RPC call returned error 22 audit: type=1326 audit(1508539114.492:3100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3172 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452719 code=0xffff0000 netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. audit: type=1326 audit(1508539114.595:3101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3172 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452719 code=0xffff0000 RDS: rds_bind could not find a transport for 172.20.0.187, load rds_tcp or rds_rdma? RDS: rds_bind could not find a transport for 172.20.0.187, load rds_tcp or rds_rdma? SELinux: unrecognized netlink message: protocol=4 nlmsg_type=1545 sclass=netlink_tcpdiag_socket pig=3274 comm=syz-executor2 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=1545 sclass=netlink_tcpdiag_socket pig=3281 comm=syz-executor2 audit: type=1326 audit(1508539115.797:3102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452719 code=0x7ffc0000 audit: type=1326 audit(1508539115.820:3103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=68 compat=0 ip=0x452719 code=0x7ffc0000 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl audit: type=1326 audit(1508539115.820:3104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452719 code=0x7ffc0000 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl audit: type=1326 audit(1508539115.820:3105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452719 code=0x7ffc0000 audit: type=1326 audit(1508539115.823:3106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=55 compat=0 ip=0x452719 code=0x7ffc0000 audit: type=1326 audit(1508539115.823:3107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452719 code=0x7ffc0000 audit: type=1326 audit(1508539115.823:3108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452719 code=0x7ffc0000 audit: type=1326 audit(1508539115.823:3109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=108 compat=0 ip=0x452719 code=0x7ffc0000 audit: type=1326 audit(1508539115.824:3110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452719 code=0x7ffc0000 audit: type=1326 audit(1508539115.824:3111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=3409 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452719 code=0x7ffc0000 netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 6 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 6 bytes leftover after parsing attributes in process `syz-executor6'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=3636 comm=syz-executor6 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl netlink: 5 bytes leftover after parsing attributes in process `syz-executor6'. sock: sock_set_timeout: `syz-executor7' (pid 3707) tries to set negative timeout sock: sock_set_timeout: `syz-executor7' (pid 3707) tries to set negative timeout SELinux: unrecognized netlink message: protocol=6 nlmsg_type=3131 sclass=netlink_xfrm_socket pig=3735 comm=syz-executor6 SELinux: unrecognized netlink message: protocol=6 nlmsg_type=3131 sclass=netlink_xfrm_socket pig=3735 comm=syz-executor6 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=44980 sclass=netlink_route_socket pig=3759 comm=syz-executor2 do_dccp_getsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app SELinux: unrecognized netlink message: protocol=0 nlmsg_type=44980 sclass=netlink_route_socket pig=3759 comm=syz-executor2 do_dccp_getsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app dccp_v6_rcv: dropped packet with invalid checksum dccp_v6_rcv: dropped packet with invalid checksum usercopy: kernel memory overwrite attempt detected to ffff8801c5bab314 (kvm_vcpu) (1320 bytes) ------------[ cut here ]------------ device eql entered promiscuous mode kernel BUG at mm/usercopy.c:84! usercopy: kernel memory overwrite attempt detected to ffff8801c75bb3d4 (kvm_vcpu) (1320 bytes) ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:84! invalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 3824 Comm: syz-executor7 Not tainted 4.14.0-rc5-next-20171018+ #36 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801bfe184c0 task.stack: ffff8801cd280000 RIP: 0010:report_usercopy mm/usercopy.c:76 [inline] RIP: 0010:__check_object_size+0x3a2/0x4f0 mm/usercopy.c:276 RSP: 0018:ffff8801cd287148 EFLAGS: 00010286 RAX: 000000000000005e RBX: ffffffff8511a0e0 RCX: 0000000000000000 RDX: 000000000000005e RSI: ffffc90002549000 RDI: ffffed0039a50e1d RBP: ffff8801cd287238 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8511a0a0 R13: ffff8801c75bb3d4 R14: 0000000000000528 R15: ffffea00071d6e00 FS: 00007fe8b9961700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe8b995eff8 CR3: 00000001c8225000 CR4: 00000000001426e0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: check_object_size include/linux/thread_info.h:111 [inline] check_copy_size include/linux/thread_info.h:142 [inline] copy_from_user include/linux/uaccess.h:145 [inline] kvm_vcpu_ioctl_set_cpuid2+0x75/0x1a0 arch/x86/kvm/cpuid.c:245 kvm_arch_vcpu_ioctl+0x1718/0x4710 arch/x86/kvm/x86.c:3521 kvm_vcpu_ioctl+0x240/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2703 vfs_ioctl fs/ioctl.c:45 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685 SYSC_ioctl fs/ioctl.c:700 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x4525a7 RSP: 002b:00007fe8b995f008 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fe8b995f7a0 RCX: 00000000004525a7 RDX: 00007fe8b995f7a0 RSI: 000000004008ae90 RDI: 000000000000001f RBP: 0000000000000082 R08: 0000000000000001 R09: 0000000000000040 R10: ffffffffffffffff R11: 0000000000000217 R12: 00000000fec00000 R13: 000000002097d000 R14: 00007fe8b99616d4 R15: 0000000000000002 Code: 48 0f 44 da e8 70 f0 c3 ff 48 8b 85 28 ff ff ff 4d 89 f1 4c 89 e9 4c 89 e2 48 89 de 48 c7 c7 a0 a1 11 85 49 89 c0 e8 c3 fb ad ff <0f> 0b 48 c7 c0 60 9f 11 85 eb 96 48 c7 c0 a0 9f 11 85 eb 8d 48 RIP: report_usercopy mm/usercopy.c:76 [inline] RSP: ffff8801cd287148 RIP: __check_object_size+0x3a2/0x4f0 mm/usercopy.c:276 RSP: ffff8801cd287148 ---[ end trace 6255fbff1bf0fb5e ]---