=============================== [ INFO: suspicious RCU usage. ] 4.4.172+ #13 Not tainted ------------------------------- net/ipv6/ip6_fib.c:1465 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 4 locks held by syz-executor5/10863: #0: (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 #1: (fib6_gc_lock){+.-...}, at: [] spin_trylock_bh include/linux/spinlock.h:367 [inline] #1: (fib6_gc_lock){+.-...}, at: [] fib6_run_gc+0x18c/0x230 net/ipv6/ip6_fib.c:1812 #2: (rcu_read_lock){......}, at: [] __fib6_clean_all+0x0/0x240 net/ipv6/ip6_fib.c:1698 #3: (&tb->tb6_lock){++--..}, at: [] __fib6_clean_all+0xe8/0x240 net/ipv6/ip6_fib.c:1712 stack backtrace: CPU: 1 PID: 10863 Comm: syz-executor5 Not tainted 4.4.172+ #13 0000000000000000 cb33be2d9ae72e0e ffff8800b9c9f670 ffffffff81aacde1 ffff8800b5fdf180 0000000000000000 0000000000000001 00000000000005b9 ffff8800aa39c740 ffff8800b9c9f6a0 ffffffff813ab5d0 ffff8800b9c9f8c0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] lockdep_rcu_suspicious.cold+0x10a/0x149 kernel/locking/lockdep.c:4305 [] fib6_del+0x7ea/0xae0 net/ipv6/ip6_fib.c:1465 [] fib6_clean_node+0x29c/0x500 net/ipv6/ip6_fib.c:1652 [] fib6_walk_continue+0x3e0/0x630 net/ipv6/ip6_fib.c:1578 [] fib6_walk+0x91/0xe0 net/ipv6/ip6_fib.c:1623 [] fib6_clean_tree+0xe8/0x120 net/ipv6/ip6_fib.c:1697 [] __fib6_clean_all+0x100/0x240 net/ipv6/ip6_fib.c:1713 [] fib6_clean_all net/ipv6/ip6_fib.c:1724 [inline] [] fib6_run_gc+0xaf/0x230 net/ipv6/ip6_fib.c:1821 [] ndisc_netdev_event+0x98/0x360 net/ipv6/ndisc.c:1690 [] notifier_call_chain+0xb9/0x1e0 kernel/notifier.c:93 [] __raw_notifier_call_chain kernel/notifier.c:394 [inline] [] raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401 [] call_netdevice_notifiers_info+0x56/0x70 net/core/dev.c:1643 [] call_netdevice_notifiers+0x70/0xa0 net/core/dev.c:1659 [] dev_ifsioc+0x55b/0x790 net/core/dev_ioctl.c:273 [] dev_ioctl+0x1c9/0xc90 net/core/dev_ioctl.c:533 [] sock_do_ioctl+0x99/0xb0 net/socket.c:903 [] sock_ioctl+0x24c/0x3d0 net/socket.c:982 [] vfs_ioctl fs/ioctl.c:43 [inline] [] file_ioctl fs/ioctl.c:470 [inline] [] do_vfs_ioctl+0x6e7/0xfa0 fs/ioctl.c:605 [] SYSC_ioctl fs/ioctl.c:622 [inline] [] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613 [] entry_SYSCALL_64_fastpath+0x1e/0x9a audit: type=1400 audit(1548847017.175:368): avc: denied { set_context_mgr } for pid=10878 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 10878:10886 transaction failed 29189/-22, size 0-0 line 3014 binder: 10878:10882 ioctl 40046207 0 returned -13 binder: 10878:10888 BC_FREE_BUFFER u0000000020ffa000 no match binder_alloc: binder_alloc_mmap_handler: 10878 20001000-20004000 already mapped failed -16 audit: type=1400 audit(1548847017.375:369): avc: denied { set_context_mgr } for pid=10878 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 10878:10888 BC_FREE_BUFFER u0000000020ffa000 no match binder: 10878:10886 transaction failed 29189/-22, size 0-0 line 3014 binder: undelivered TRANSACTION_ERROR: 29189 binder: 10878:10882 ioctl 40046207 0 returned -13 binder: undelivered TRANSACTION_ERROR: 29189 audit: type=1400 audit(1548847018.055:370): avc: denied { set_context_mgr } for pid=10894 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 10894:10895 ioctl 40046207 0 returned -13 binder: 10894:10902 transaction failed 29189/-22, size 0-0 line 3014 binder: 10894:10902 BC_FREE_BUFFER u0000000020ffa000 no match binder: undelivered TRANSACTION_ERROR: 29189 audit: type=1400 audit(1548847019.355:371): avc: denied { set_context_mgr } for pid=10917 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 10917:10932 transaction failed 29189/-22, size 0-0 line 3014 binder: 10917:10920 ioctl 40046207 0 returned -13 binder: 10917:10940 BC_FREE_BUFFER u0000000020ffa000 no match binder: undelivered TRANSACTION_ERROR: 29189 audit: type=1400 audit(1548847019.615:372): avc: denied { set_context_mgr } for pid=10942 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 10942:10951 BC_FREE_BUFFER u0000000020ffa000 no match binder: 10942:10948 transaction failed 29189/-22, size 0-0 line 3014 binder: 10942:10944 ioctl 40046207 0 returned -13 binder: undelivered TRANSACTION_ERROR: 29189 audit: type=1400 audit(1548847019.935:373): avc: denied { set_context_mgr } for pid=10956 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 10956:10961 transaction failed 29189/-22, size 0-0 line 3014 binder: 10956:10958 ioctl 40046207 0 returned -13 binder: undelivered TRANSACTION_ERROR: 29189 audit: type=1400 audit(1548847020.915:374): avc: denied { set_context_mgr } for pid=10976 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 10976:10990 ioctl 40046207 0 returned -13 audit: type=1400 audit(1548847021.275:375): avc: denied { set_context_mgr } for pid=11010 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 11010:11012 ioctl 40046207 0 returned -13 audit: type=1400 audit(1548847021.595:376): avc: denied { set_context_mgr } for pid=11021 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 11021:11023 ioctl 40046207 0 returned -13 audit: type=1400 audit(1548847022.465:377): avc: denied { set_context_mgr } for pid=11037 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 binder: 11037:11044 ioctl 40046207 0 returned -13 audit: type=1400 audit(1548847023.165:378): avc: denied { set_context_mgr } for pid=11056 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=0 audit: type=1400 audit(1548847023.245:379): avc: denied { create } for pid=11059 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 binder: 11056:11058 ioctl 40046207 0 returned -13 audit: type=1400 audit(1548847023.975:380): avc: denied { create } for pid=11059 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0