===============================
[ INFO: suspicious RCU usage. ]
4.4.174+ #4 Not tainted
-------------------------------
net/ipv6/ip6_fib.c:1465 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 1, debug_locks = 0
4 locks held by syz-executor.5/3125:
 #0:  (((&net->ipv6.ip6_fib_timer))){+.-...}, at: [<ffffffff8125822e>] lockdep_copy_map include/linux/lockdep.h:165 [inline]
 #0:  (((&net->ipv6.ip6_fib_timer))){+.-...}, at: [<ffffffff8125822e>] call_timer_fn+0xde/0x850 kernel/time/timer.c:1175
 #1:  (fib6_gc_lock){+.-...}, at: [<ffffffff825fa33a>] spin_lock_bh include/linux/spinlock.h:307 [inline]
 #1:  (fib6_gc_lock){+.-...}, at: [<ffffffff825fa33a>] fib6_run_gc+0x3a/0x230 net/ipv6/ip6_fib.c:1811
 #2:  (rcu_read_lock){......}, at: [<ffffffff825f1ee0>] __fib6_clean_all+0x0/0x240 net/ipv6/ip6_fib.c:1698
 #3:  (&tb->tb6_lock){++--..}, at: [<ffffffff825f1fc8>] __fib6_clean_all+0xe8/0x240 net/ipv6/ip6_fib.c:1712

stack backtrace:
CPU: 1 PID: 3125 Comm: syz-executor.5 Not tainted 4.4.174+ #4
 0000000000000000 c906c24d521bc2e0 ffff8801db707978 ffffffff81aad1a1
 ffff8801d21f36c0 0000000000000000 0000000000000001 00000000000005b9
 ffff8801bceac740 ffff8801db7079a8 ffffffff813ab7d6 ffff8801db707bc8
Call Trace:
 <IRQ>  [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ>  [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff813ab7d6>] lockdep_rcu_suspicious.cold+0x10a/0x149 kernel/locking/lockdep.c:4305
 [<ffffffff825f9ada>] fib6_del+0x7ea/0xae0 net/ipv6/ip6_fib.c:1465
 [<ffffffff825fa06c>] fib6_clean_node+0x29c/0x500 net/ipv6/ip6_fib.c:1652
 [<ffffffff825f1830>] fib6_walk_continue+0x3e0/0x630 net/ipv6/ip6_fib.c:1578
 [<ffffffff825f1d71>] fib6_walk+0x91/0xe0 net/ipv6/ip6_fib.c:1623
 [<ffffffff825f1ea8>] fib6_clean_tree+0xe8/0x120 net/ipv6/ip6_fib.c:1697
 [<ffffffff825f1fe0>] __fib6_clean_all+0x100/0x240 net/ipv6/ip6_fib.c:1713
 [<ffffffff825fa3af>] fib6_clean_all net/ipv6/ip6_fib.c:1724 [inline]
 [<ffffffff825fa3af>] fib6_run_gc+0xaf/0x230 net/ipv6/ip6_fib.c:1821
 [<ffffffff825fa54d>] fib6_gc_timer_cb+0x1d/0x30 net/ipv6/ip6_fib.c:1836
 [<ffffffff812582dd>] call_timer_fn+0x18d/0x850 kernel/time/timer.c:1185
 [<ffffffff81258ebf>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff81258ebf>] run_timer_softirq+0x51f/0xb70 kernel/time/timer.c:1444
 [<ffffffff8271bb16>] __do_softirq+0x226/0xa3f kernel/softirq.c:273
 [<ffffffff82719cdc>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:956
 <EOI>  [<ffffffff810e1744>] do_softirq.part.0+0x54/0x60 kernel/softirq.c:317
 [<ffffffff810e181c>] do_softirq kernel/softirq.c:309 [inline]
 [<ffffffff810e181c>] __local_bh_enable_ip+0xcc/0xe0 kernel/softirq.c:170
 [<ffffffff8259f8bf>] local_bh_enable include/linux/bottom_half.h:31 [inline]
 [<ffffffff8259f8bf>] rcu_read_unlock_bh include/linux/rcupdate.h:957 [inline]
 [<ffffffff8259f8bf>] ip6_finish_output2+0xa0f/0x1dc0 net/ipv6/ip6_output.c:114
 [<ffffffff825b0203>] ip6_finish_output+0x2f3/0x750 net/ipv6/ip6_output.c:131
 [<ffffffff825b0814>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff825b0814>] ip6_output+0x1b4/0x520 net/ipv6/ip6_output.c:145
 [<ffffffff826bf66c>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff826bf66c>] ip6_local_out+0x9c/0x180 net/ipv6/output_core.c:169
 [<ffffffff825b28c2>] ip6_send_skb+0xa2/0x340 net/ipv6/ip6_output.c:1725
 [<ffffffff82611a3c>] udp_v6_send_skb+0x85c/0xe90 net/ipv6/udp.c:1066
 [<ffffffff826142ed>] udpv6_sendmsg+0x1e3d/0x24f0 net/ipv6/udp.c:1330
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821d9e69>] ___sys_sendmsg+0x369/0x890 net/socket.c:1975
 [<ffffffff821dd2e0>] __sys_sendmmsg+0x130/0x2e0 net/socket.c:2060
 [<ffffffff821dd4c5>] SYSC_sendmmsg net/socket.c:2090 [inline]
 [<ffffffff821dd4c5>] SyS_sendmmsg+0x35/0x60 net/socket.c:2085
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
SELinux:  policydb string length 520 does not match expected length 8
SELinux:  policydb string length 520 does not match expected length 8
audit: type=1400 audit(1552304316.399:2134): avc:  denied  { create } for  pid=3217 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1552304316.439:2135): avc:  denied  { create } for  pid=3220 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1552304316.539:2136): avc:  denied  { create } for  pid=3217 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1552304316.589:2137): avc:  denied  { create } for  pid=3220 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
SELinux:  policydb string length 520 does not match expected length 8
audit: type=1400 audit(1552304317.169:2138): avc:  denied  { create } for  pid=3245 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1552304317.179:2139): avc:  denied  { create } for  pid=3246 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1552304317.199:2140): avc:  denied  { create } for  pid=3246 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
SELinux:  policydb string length 520 does not match expected length 8
audit: type=1400 audit(1552304318.219:2141): avc:  denied  { create } for  pid=3278 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1552304318.929:2142): avc:  denied  { create } for  pid=3295 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
SELinux:  policydb string length 520 does not match expected length 8
audit: type=1400 audit(1552304319.699:2143): avc:  denied  { create } for  pid=3330 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
SELinux:  policydb string length 520 does not match expected length 8
audit_printk_skb: 9 callbacks suppressed
audit: type=1400 audit(1552304321.479:2147): avc:  denied  { create } for  pid=3396 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
SELinux:  policydb string length 520 does not match expected length 8
audit: type=1400 audit(1552304322.219:2148): avc:  denied  { create } for  pid=3423 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0