=============================== [ INFO: suspicious RCU usage. ] 4.9.141+ #1 Not tainted ------------------------------- net/ipv6/ip6_fib.c:1471 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 0 6 locks held by syz-executor.1/2120: #0: (tasklist_lock){.+.+..}, at: [] do_wait+0x392/0x950 kernel/exit.c:1558 #1: (rcu_read_lock){......}, at: [] task_has_perm+0x0/0x330 security/selinux/hooks.c:5822 #2: (((&net->ipv6.ip6_fib_timer))){+.-...}, at: [] lockdep_copy_map include/linux/lockdep.h:165 [inline] #2: (((&net->ipv6.ip6_fib_timer))){+.-...}, at: [] call_timer_fn+0xda/0x6e0 kernel/time/timer.c:1309 #3: (&(&net->ipv6.fib6_gc_lock)->rlock){+.-...}, at: [] spin_lock_bh include/linux/spinlock.h:307 [inline] #3: (&(&net->ipv6.fib6_gc_lock)->rlock){+.-...}, at: [] fib6_run_gc+0xa5/0x2c0 net/ipv6/ip6_fib.c:1816 #4: (rcu_read_lock){......}, at: [] __fib6_clean_all+0x0/0x220 net/ipv6/ip6_fib.c:1703 #5: (&tb->tb6_lock){++--..}, at: [] __fib6_clean_all+0xe0/0x220 net/ipv6/ip6_fib.c:1717 stack backtrace: CPU: 1 PID: 2120 Comm: syz-executor.1 Not tainted 4.9.141+ #1 ffff8801db7078c8 ffffffff81b42e79 ffff8801cfa917c0 0000000000000000 0000000000000002 ffffffff82cc2480 ffffed003b6e0f67 ffff8801db7078f8 ffffffff813fe948 ffff8801d9e09340 ffff8801db707ae8 ffff8801d9e09340 Call Trace: [ 894.281598] [] __dump_stack lib/dump_stack.c:15 [inline] [ 894.281598] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] lockdep_rcu_suspicious.cold.32+0x110/0x141 kernel/locking/lockdep.c:4455 [] fib6_del+0x810/0xb10 net/ipv6/ip6_fib.c:1470 [] fib6_clean_node+0x220/0x4c0 net/ipv6/ip6_fib.c:1657 [] fib6_walk_continue+0x3e5/0x640 net/ipv6/ip6_fib.c:1583 [] fib6_walk+0x91/0xf0 net/ipv6/ip6_fib.c:1628 [] fib6_clean_tree+0xd3/0x110 net/ipv6/ip6_fib.c:1702 [] __fib6_clean_all+0xf9/0x220 net/ipv6/ip6_fib.c:1718 [] fib6_clean_all net/ipv6/ip6_fib.c:1729 [inline] [] fib6_run_gc+0x117/0x2c0 net/ipv6/ip6_fib.c:1826 [] fib6_gc_timer_cb+0x1c/0x20 net/ipv6/ip6_fib.c:1841 [] call_timer_fn+0x163/0x6e0 kernel/time/timer.c:1319 [] expire_timers+0x234/0x580 kernel/time/timer.c:1359 [] __run_timers kernel/time/timer.c:1674 [inline] [] run_timer_softirq+0x208/0x5e0 kernel/time/timer.c:1687 [] __do_softirq+0x20e/0x964 kernel/softirq.c:288 [] invoke_softirq kernel/softirq.c:368 [inline] [] irq_exit+0x11c/0x150 kernel/softirq.c:409 [] exiting_irq arch/x86/include/asm/apic.h:669 [inline] [] smp_apic_timer_interrupt+0x81/0xb0 arch/x86/kernel/apic/apic.c:962 [] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:648 [ 894.542079] [] ? task_has_perm+0xb2/0x330 security/selinux/hooks.c:1612 [] selinux_task_wait+0x23/0x30 security/selinux/hooks.c:3954 [] security_task_wait+0x73/0xb0 security/security.c:1032 [] wait_consider_task+0x2a1/0x3620 kernel/exit.c:1377 [] do_wait_thread kernel/exit.c:1490 [inline] [] do_wait+0x423/0x950 kernel/exit.c:1561 [] SYSC_wait4 kernel/exit.c:1693 [inline] [] SyS_wait4+0x12b/0x1f0 kernel/exit.c:1658 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb audit: type=1400 audit(1554764609.596:42405): avc: denied { setattr } for pid=1065 comm="syz-executor.1" name="comm" dev="proc" ino=113556 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=file permissive=1 audit: type=1400 audit(1554764609.856:42406): avc: denied { getattr } for pid=1121 comm="syz-executor.5" path="socket:[113572]" dev="sockfs" ino=113572 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1118 comm=syz-executor.0 audit: type=1400 audit(1554764609.936:42407): avc: denied { ioctl } for pid=1121 comm="syz-executor.5" path="socket:[113572]" dev="sockfs" ino=113572 ioctlcmd=0x8935 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1554764611.436:42408): avc: denied { prog_load } for pid=1161 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1168 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1232 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1293 comm=syz-executor.0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1328 comm=syz-executor.0 ip6_tunnel: 6tnl0 xmit: Local address not yet configured! SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1375 comm=syz-executor.0 SELinux: policydb string SE does not match my string SE Linux SELinux: policydb string SE does not match my string SE Linux SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1423 comm=syz-executor.0 SELinux: policydb string SE does not match my string SE Linux SELinux: policydb string SE does not match my string SE Linux SELinux: policydb string SE does not match my string SE Linux SELinux: policydb string SE does not match my string SE Linux SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1462 comm=syz-executor.0 SELinux: policydb string SE does not match my string SE Linux SELinux: policydb string SE does not match my string SE Linux SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1500 comm=syz-executor.0 SELinux: policydb string SE does not match my string SE Linux SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1531 comm=syz-executor.0