devpts: called with bogus options =============================== [ INFO: suspicious RCU usage. ] 4.9.205-syzkaller #0 Not tainted ------------------------------- include/linux/inetdevice.h:205 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 0 4 locks held by syz-executor.1/10480: #0: (rcu_read_lock_bh){......}, at: [<00000000f59437f2>] ip_finish_output2+0x20b/0x1280 net/ipv4/ip_output.c:198 #1: (rcu_read_lock_bh){......}, at: [<00000000f0026ba2>] __dev_queue_xmit+0x1d4/0x1bd0 net/core/dev.c:3407 #2: (_xmit_TUNNEL6#2){+.-...}, at: [<000000002a1a43f3>] spin_lock include/linux/spinlock.h:302 [inline] #2: (_xmit_TUNNEL6#2){+.-...}, at: [<000000002a1a43f3>] __netif_tx_lock include/linux/netdevice.h:3573 [inline] #2: (_xmit_TUNNEL6#2){+.-...}, at: [<000000002a1a43f3>] __dev_queue_xmit+0x1116/0x1bd0 net/core/dev.c:3469 #3: (slock-AF_INET){+.-...}, at: [<00000000db379a89>] spin_trylock include/linux/spinlock.h:312 [inline] #3: (slock-AF_INET){+.-...}, at: [<00000000db379a89>] icmp_xmit_lock net/ipv4/icmp.c:220 [inline] #3: (slock-AF_INET){+.-...}, at: [<00000000db379a89>] __icmp_send+0x48b/0x1420 net/ipv4/icmp.c:656 stack backtrace: CPU: 1 PID: 10480 Comm: syz-executor.1 Not tainted 4.9.205-syzkaller #0 ffff8801c9176dd8 ffffffff81b55e6b ffff8801d1242140 0000000000000000 0000000000000002 00000000000000cd ffff8801affeaf80 ffff8801c9176e08 ffffffff81406997 ffff8801d1242198 ffff8801c9176f28 ffff8801cc2c2200 Call Trace: [<00000000a5bb64ff>] __dump_stack lib/dump_stack.c:15 [inline] [<00000000a5bb64ff>] dump_stack+0xcb/0x130 lib/dump_stack.c:56 [<00000000808525ce>] lockdep_rcu_suspicious.cold+0x10a/0x149 kernel/locking/lockdep.c:4458 [<00000000f6da1c21>] __in_dev_get_rcu include/linux/inetdevice.h:205 [inline] [<00000000f6da1c21>] fib_compute_spec_dst+0x6c4/0xcc0 net/ipv4/fib_frontend.c:284 [<0000000055b2e637>] __ip_options_echo+0x4be/0x13e0 net/ipv4/ip_options.c:177 [<000000008a72e101>] __icmp_send+0x648/0x1420 net/ipv4/icmp.c:685 [<0000000000d919fb>] ipv4_send_dest_unreach net/ipv4/route.c:1203 [inline] [<0000000000d919fb>] ipv4_link_failure+0x460/0x850 net/ipv4/route.c:1210 [<00000000cc37495e>] dst_link_failure include/net/dst.h:490 [inline] [<00000000cc37495e>] vti6_xmit net/ipv6/ip6_vti.c:522 [inline] [<00000000cc37495e>] vti6_tnl_xmit+0xb08/0x17f0 net/ipv6/ip6_vti.c:561 [<00000000cd85e243>] __netdev_start_xmit include/linux/netdevice.h:4072 [inline] [<00000000cd85e243>] netdev_start_xmit include/linux/netdevice.h:4081 [inline] [<00000000cd85e243>] xmit_one net/core/dev.c:2977 [inline] [<00000000cd85e243>] dev_hard_start_xmit+0x195/0x8b0 net/core/dev.c:2993 [<00000000e0669c1d>] __dev_queue_xmit+0x11a3/0x1bd0 net/core/dev.c:3473 [<000000009fce85ce>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3506 [<000000001d13611d>] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1368 [<0000000018fb3c54>] dst_neigh_output include/net/dst.h:470 [inline] [<0000000018fb3c54>] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:225 [<00000000adf5a031>] ip_finish_output+0x3c4/0xce0 net/ipv4/ip_output.c:313 [<0000000050ca1569>] NF_HOOK_COND include/linux/netfilter.h:246 [inline] [<0000000050ca1569>] ip_output+0x1ec/0x5b0 net/ipv4/ip_output.c:401 [<00000000c6c91be5>] dst_output include/net/dst.h:507 [inline] [<00000000c6c91be5>] NF_HOOK_THRESH include/linux/netfilter.h:232 [inline] [<00000000c6c91be5>] NF_HOOK include/linux/netfilter.h:255 [inline] [<00000000c6c91be5>] raw_send_hdrinc net/ipv4/raw.c:421 [inline] [<00000000c6c91be5>] raw_sendmsg+0x1c5c/0x23e0 net/ipv4/raw.c:643 [<00000000f874979a>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:766 [<000000002f106774>] sock_sendmsg_nosec net/socket.c:649 [inline] [<000000002f106774>] sock_sendmsg+0xbe/0x110 net/socket.c:659 [<00000000296c2e5d>] sock_write_iter+0x235/0x3d0 net/socket.c:857 [<00000000fe3cae83>] new_sync_write fs/read_write.c:498 [inline] [<00000000fe3cae83>] __vfs_write+0x3c1/0x560 fs/read_write.c:511 [<00000000f0ccda55>] vfs_write+0x185/0x520 fs/read_write.c:559 [<00000000bb8b7a2f>] SYSC_write fs/read_write.c:607 [inline] [<00000000bb8b7a2f>] SyS_write+0x121/0x270 fs/read_write.c:599 [<00000000443ee371>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288 [<00000000b042b4ec>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb devpts: called with bogus options devpts: called with bogus options devpts: called with bogus options audit: type=1400 audit(1575132867.373:2713): avc: denied { prog_load } for pid=10776 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1575132867.443:2714): avc: denied { prog_run } for pid=10776 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 devpts: called with bogus options audit: type=1400 audit(1575132868.843:2715): avc: denied { prog_load } for pid=10843 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1575132868.983:2716): avc: denied { prog_run } for pid=10843 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 devpts: called with bogus options audit: type=1400 audit(1575132869.643:2717): avc: denied { prog_load } for pid=10865 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1575132869.923:2718): avc: denied { prog_run } for pid=10865 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 devpts: called with bogus options audit: type=1400 audit(1575132870.873:2719): avc: denied { prog_load } for pid=10927 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1575132871.223:2720): avc: denied { prog_run } for pid=10927 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 devpts: called with bogus options audit: type=1400 audit(1575132871.753:2721): avc: denied { prog_load } for pid=10976 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1575132871.863:2722): avc: denied { prog_run } for pid=10976 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 devpts: called with bogus options audit: type=1400 audit(1575132872.853:2723): avc: denied { prog_load } for pid=11018 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1575132872.903:2724): avc: denied { create } for pid=11030 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1575132872.903:2725): avc: denied { write } for pid=11030 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1575132872.973:2726): avc: denied { read } for pid=11030 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1575132872.983:2727): avc: denied { create } for pid=11030 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1575132872.993:2728): avc: denied { write } for pid=11030 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 devpts: called with bogus options audit: type=1400 audit(1575132873.483:2729): avc: denied { prog_run } for pid=11018 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1575132873.773:2730): avc: denied { prog_load } for pid=11066 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1575132873.873:2731): avc: denied { prog_run } for pid=11066 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 audit: type=1400 audit(1575132874.153:2732): avc: denied { create } for pid=11082 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 devpts: called with bogus options