=============================== [ INFO: suspicious RCU usage. ] 4.9.141+ #1 Not tainted ------------------------------- net/ipv6/ip6_fib.c:1471 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 0 5 locks held by syz-executor.3/2116: #0: (rcu_read_lock){......}, at: [] INIT_LIST_HEAD include/linux/list.h:28 [inline] #0: (rcu_read_lock){......}, at: [] avc_compute_av+0xb0/0x610 security/selinux/avc.c:973 #1: (((&net->ipv6.ip6_fib_timer))){+.-...}, at: [] lockdep_copy_map include/linux/lockdep.h:165 [inline] #1: (((&net->ipv6.ip6_fib_timer))){+.-...}, at: [] call_timer_fn+0xda/0x6e0 kernel/time/timer.c:1309 #2: (&(&net->ipv6.fib6_gc_lock)->rlock){+.-...}, at: [] spin_lock_bh include/linux/spinlock.h:307 [inline] #2: (&(&net->ipv6.fib6_gc_lock)->rlock){+.-...}, at: [] fib6_run_gc+0xa5/0x2c0 net/ipv6/ip6_fib.c:1816 #3: (rcu_read_lock){......}, at: [] __fib6_clean_all+0x0/0x220 net/ipv6/ip6_fib.c:1703 #4: (&tb->tb6_lock){++--..}, at: [] __fib6_clean_all+0xe0/0x220 net/ipv6/ip6_fib.c:1717 stack backtrace: CPU: 0 PID: 2116 Comm: syz-executor.3 Not tainted 4.9.141+ #1 ffff8801db6078c8 ffffffff81b42e79 ffff8801d786af80 0000000000000000 0000000000000002 ffffffff82cc2480 ffffed003b6c0f67 ffff8801db6078f8 ffffffff813fe948 ffff8801d7823dc0 ffff8801db607ae8 ffff8801d7823dc0 Call Trace: [ 1688.893818] [] __dump_stack lib/dump_stack.c:15 [inline] [ 1688.893818] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] lockdep_rcu_suspicious.cold.32+0x110/0x141 kernel/locking/lockdep.c:4455 [] fib6_del+0x810/0xb10 net/ipv6/ip6_fib.c:1470 [] fib6_clean_node+0x220/0x4c0 net/ipv6/ip6_fib.c:1657 [] fib6_walk_continue+0x3e5/0x640 net/ipv6/ip6_fib.c:1583 [] fib6_walk+0x91/0xf0 net/ipv6/ip6_fib.c:1628 [] fib6_clean_tree+0xd3/0x110 net/ipv6/ip6_fib.c:1702 [] __fib6_clean_all+0xf9/0x220 net/ipv6/ip6_fib.c:1718 [] fib6_clean_all net/ipv6/ip6_fib.c:1729 [inline] [] fib6_run_gc+0x117/0x2c0 net/ipv6/ip6_fib.c:1826 [] fib6_gc_timer_cb+0x1c/0x20 net/ipv6/ip6_fib.c:1841 [] call_timer_fn+0x163/0x6e0 kernel/time/timer.c:1319 [] expire_timers+0x234/0x580 kernel/time/timer.c:1359 [] __run_timers kernel/time/timer.c:1674 [inline] [] run_timer_softirq+0x208/0x5e0 kernel/time/timer.c:1687 [] __do_softirq+0x20e/0x964 kernel/softirq.c:288 [] invoke_softirq kernel/softirq.c:368 [inline] [] irq_exit+0x11c/0x150 kernel/softirq.c:409 [] exiting_irq arch/x86/include/asm/apic.h:669 [inline] [] smp_apic_timer_interrupt+0x81/0xb0 arch/x86/kernel/apic/apic.c:962 [] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:648 [ 1689.154537] [] ? arch_local_irq_restore arch/x86/include/asm/paravirt.h:768 [inline] [ 1689.154537] [] ? __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:162 [inline] [ 1689.154537] [] ? _raw_spin_unlock_irqrestore+0x5f/0x70 kernel/locking/spinlock.c:191 [] spin_unlock_irqrestore include/linux/spinlock.h:362 [inline] [] avc_reclaim_node security/selinux/avc.c:541 [inline] [] avc_alloc_node+0x31c/0x3c0 security/selinux/avc.c:559 [] avc_insert security/selinux/avc.c:670 [inline] [] avc_compute_av+0x178/0x610 security/selinux/avc.c:976 [] avc_has_perm_noaudit+0x29d/0x2f0 security/selinux/avc.c:1112 [] selinux_inode_permission+0x32d/0x4b0 security/selinux/hooks.c:3038 [] security_inode_permission+0xb9/0x100 security/security.c:611 [] __inode_permission2+0x93/0x2d0 fs/namei.c:435 [] inode_permission2+0x2f/0x110 fs/namei.c:485 [] may_lookup fs/namei.c:1689 [inline] [] link_path_walk+0x936/0x1230 fs/namei.c:2064 [] path_mountpoint+0x66/0x6c0 fs/namei.c:2696 [] filename_mountpoint.part.19+0x15b/0x310 fs/namei.c:2717 [] filename_mountpoint fs/namei.c:2714 [inline] [] user_path_mountpoint_at+0x49/0x70 fs/namei.c:2747 [] SYSC_umount fs/namespace.c:1722 [inline] [] SyS_umount+0x13d/0xcf0 fs/namespace.c:1706 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. SELinux: duplicate or incompatible mount options SELinux: duplicate or incompatible mount options input: syz0 as /devices/virtual/input/input179 input: syz0 as /devices/virtual/input/input180 audit_printk_skb: 1824 callbacks suppressed audit: type=1400 audit(1554942739.380:74303): avc: denied { net_admin } for pid=2114 comm="syz-executor.4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942739.390:74304): avc: denied { net_admin } for pid=24670 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942739.390:74305): avc: denied { net_admin } for pid=24670 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942739.400:74306): avc: denied { net_admin } for pid=24670 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942739.400:74307): avc: denied { net_admin } for pid=24670 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942739.450:74308): avc: denied { net_admin } for pid=24670 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942739.450:74309): avc: denied { net_admin } for pid=24670 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942739.450:74310): avc: denied { net_admin } for pid=24670 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942739.450:74311): avc: denied { net_admin } for pid=24670 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942739.450:74312): avc: denied { net_admin } for pid=24670 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 input: syz0 as /devices/virtual/input/input181 input: syz0 as /devices/virtual/input/input182 input: syz0 as /devices/virtual/input/input183 binder: 7538:7539 got reply transaction with no transaction stack binder: 7538:7539 transaction failed 29201/-71, size 32-8 line 2921 binder: BINDER_SET_CONTEXT_MGR already set binder: 7538:7539 ioctl 40046207 0 returned -16 binder: 7538:7539 got transaction with invalid offset (0, min 0 max 24) or object. binder: 7538:7539 transaction failed 29201/-22, size 24-8 line 3199 binder: undelivered TRANSACTION_ERROR: 29201 binder: 7538:7539 got reply transaction with no transaction stack binder: 7538:7539 transaction failed 29201/-71, size 32-8 line 2921 input: syz0 as /devices/virtual/input/input184 input: syz0 as /devices/virtual/input/input185 audit_printk_skb: 1740 callbacks suppressed audit: type=1400 audit(1554942744.400:74893): avc: denied { net_admin } for pid=2115 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942744.440:74894): avc: denied { net_admin } for pid=2115 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942744.510:74895): avc: denied { net_admin } for pid=2115 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942744.560:74896): avc: denied { net_admin } for pid=2115 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942744.580:74897): avc: denied { net_admin } for pid=2115 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942744.620:74898): avc: denied { dac_override } for pid=7544 comm="syz-executor.2" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942744.650:74899): avc: denied { net_admin } for pid=2115 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1554942744.670:74900): avc: denied { create } for pid=7544 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1554942744.680:74901): avc: denied { write } for pid=7544 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1554942744.680:74902): avc: denied { sys_admin } for pid=7544 comm="syz-executor.2" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 input: syz0 as /devices/virtual/input/input186 input: syz0 as /devices/virtual/input/input187 input: syz0 as /devices/virtual/input/input188 input: syz0 as /devices/virtual/input/input189