============================= WARNING: suspicious RCU usage CPU: 0 PID: 19226 Comm: syz-executor.5 Not tainted 4.14.216-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 4.14.216-syzkaller #0 Not tainted ----------------------------- fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] kmem_cache_alloc+0x28e/0x3c0 mm/slab.c:3550 kmem_cache_zalloc include/linux/slab.h:651 [inline] __kernfs_new_node+0x6f/0x470 fs/kernfs/dir.c:632 kernfs_new_node+0x7b/0xe0 fs/kernfs/dir.c:677 __kernfs_create_file+0x3d/0x320 fs/kernfs/file.c:989 sysfs_add_file_mode_ns+0x1e1/0x450 fs/sysfs/file.c:307 create_files fs/sysfs/group.c:64 [inline] internal_create_group+0x22b/0x710 fs/sysfs/group.c:134 loop_sysfs_init drivers/block/loop.c:821 [inline] loop_set_fd drivers/block/loop.c:946 [inline] lo_ioctl+0x1137/0x1cd0 drivers/block/loop.c:1417 __blkdev_driver_ioctl block/ioctl.c:297 [inline] blkdev_ioctl+0x540/0x1830 block/ioctl.c:594 net/tipc/bearer.c:177 suspicious rcu_dereference_protected() usage! block_ioctl+0xd9/0x120 fs/block_dev.c:1893 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 other info that might help us debug this: entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45e087 RSP: 002b:00007f2b80084a18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045e087 RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 RBP: 0000000000000000 R08: 00007f2b80084ac8 R09: 0000000000000000 R10: 00007f2b80084acc R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000004 R14: 0000000000000004 R15: 00000000200002d0 ntfs: (device loop5): parse_options(): The errors option requires an argument. rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz-executor.4/19232: #0: (cb_lock){++++}, at: [] genl_rcv+0x15/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x112/0x140 net/netlink/genetlink.c:623 stack backtrace: CPU: 1 PID: 19232 Comm: syz-executor.4 Not tainted 4.14.216-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 tipc_bearer_find+0x1ff/0x2f0 net/tipc/bearer.c:177 tipc_nl_compat_link_set+0x40b/0xb90 net/tipc/netlink_compat.c:807 __tipc_nl_compat_doit net/tipc/netlink_compat.c:316 [inline] tipc_nl_compat_doit+0x192/0x5d0 net/tipc/netlink_compat.c:364 tipc_nl_compat_handle net/tipc/netlink_compat.c:1215 [inline] tipc_nl_compat_recv+0xa0b/0xae0 net/tipc/netlink_compat.c:1297 genl_family_rcv_msg+0x572/0xb20 net/netlink/genetlink.c:600 genl_rcv_msg+0xaf/0x140 net/netlink/genetlink.c:625 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2433 genl_rcv+0x24/0x40 net/netlink/genetlink.c:636 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x62e/0xb80 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45e219 RSP: 002b:00007f338a114c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219 RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000007 RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007ffeb04a856f R14: 00007f338a1159c0 R15: 000000000119bf8c ntfs: (device loop5): parse_options(): Unrecognized mount option errors/ {ZWj>w\3r} PA)V1. ntfs: (device loop5): parse_options(): Unrecognized mount option errors/ {ZWj>w\3r} PA)V1. ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. ntfs: (device loop5): parse_options(): Unrecognized mount option ./file0. squashfs: SQUASHFS error: Can't find a SQUASHFS superblock on loop3 ntfs: (device loop5): parse_options(): The errors option requires an argument. ntfs: (device loop5): parse_options(): The errors option requires an argument. squashfs: SQUASHFS error: Can't find a SQUASHFS superblock on loop3 ntfs: (device loop5): parse_options(): The errors option requires an argument. ntfs: (device loop5): parse_options(): Unrecognized mount option disable_eparse. SQUASHFS error: squashfs_read_data failed to read block 0x0 squashfs: SQUASHFS error: unable to read squashfs_super_block netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. MTD: Attempt to mount non-MTD device "/dev/loop5" netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. romfs: VFS: Can't find a romfs filesystem on dev loop5. netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. NILFS (loop1): couldn't find nilfs on the device kauditd_printk_skb: 18 callbacks suppressed audit: type=1804 audit(1611209558.642:20): pid=19766 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir815431819/syzkaller.bGUFSk/343/bus" dev="sda1" ino=15954 res=1 audit: type=1804 audit(1611209558.722:21): pid=19832 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir815431819/syzkaller.bGUFSk/343/bus" dev="sda1" ino=15954 res=1 audit: type=1804 audit(1611209558.732:22): pid=19832 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir815431819/syzkaller.bGUFSk/343/bus" dev="sda1" ino=15954 res=1 ntfs: (device loop5): parse_options(): Unrecognized mount option umaskYa. ntfs: (device loop5): parse_options(): Unrecognized mount option disable_sZ p?x?dnHars. ntfs: (device loop5): parse_options(): Unrecognized mount option umaskYa. ntfs: (device loop5): parse_options(): Unrecognized mount option disable_sZ p?x?dnHars. ntfs: (device loop5): parse_options(): Unrecognized mount option disabla_sparsy8|"q. syz-executor.2 uses obsolete (PF_INET,SOCK_PACKET) ntfs: (device loop5): parse_options(): Unrecognized mount option disabla_sparsy8|"q. ntfs: (device loop5): parse_options(): Unrecognized mount option . vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(7) vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) vhci_hcd: connection closed vhci_hcd: stop threads vhci_hcd: connection closed vhci_hcd: release socket vhci_hcd: disconnect device vhci_hcd: stop threads vhci_hcd: release socket vhci_hcd: disconnect device vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(3) vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(5) vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) vhci_hcd: connection closed vhci_hcd: connection closed vhci_hcd: stop threads vhci_hcd: release socket vhci_hcd: disconnect device vhci_hcd: stop threads vhci_hcd: release socket vhci_hcd: disconnect device nla_parse: 2 callbacks suppressed netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'.