===============================
[ INFO: suspicious RCU usage. ]
4.9.205-syzkaller #0 Not tainted
-------------------------------
include/linux/inetdevice.h:205 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 0
4 locks held by syz-executor.2/12359:
 #0:  (rcu_read_lock_bh){......}, at: [<00000000d38a9c5a>] ip_finish_output2+0x20b/0x1280 net/ipv4/ip_output.c:198
 #1:  (rcu_read_lock_bh){......}, at: [<00000000996a54c7>] __dev_queue_xmit+0x1d4/0x1bd0 net/core/dev.c:3407
 #2:  (_xmit_TUNNEL6#2){+.-...}, at: [<0000000033ff127d>] spin_lock include/linux/spinlock.h:302 [inline]
 #2:  (_xmit_TUNNEL6#2){+.-...}, at: [<0000000033ff127d>] __netif_tx_lock include/linux/netdevice.h:3573 [inline]
 #2:  (_xmit_TUNNEL6#2){+.-...}, at: [<0000000033ff127d>] __dev_queue_xmit+0x1116/0x1bd0 net/core/dev.c:3469
 #3:  (slock-AF_INET){+.-...}, at: [<00000000306c1068>] spin_trylock include/linux/spinlock.h:312 [inline]
 #3:  (slock-AF_INET){+.-...}, at: [<00000000306c1068>] icmp_xmit_lock net/ipv4/icmp.c:220 [inline]
 #3:  (slock-AF_INET){+.-...}, at: [<00000000306c1068>] __icmp_send+0x48b/0x1420 net/ipv4/icmp.c:656

stack backtrace:
CPU: 1 PID: 12359 Comm: syz-executor.2 Not tainted 4.9.205-syzkaller #0
 ffff8801b9206dd8 ffffffff81b55e6b ffff8801c97af000 0000000000000000
 0000000000000002 00000000000000cd ffff8801c8bd0000 ffff8801b9206e08
 ffffffff81406997 ffff8801c97af058 ffff8801b9206f28 ffff8801d5d6c400
Call Trace:
 [<0000000096ec06fe>] __dump_stack lib/dump_stack.c:15 [inline]
 [<0000000096ec06fe>] dump_stack+0xcb/0x130 lib/dump_stack.c:56
 [<00000000d9a0c345>] lockdep_rcu_suspicious.cold+0x10a/0x149 kernel/locking/lockdep.c:4458
 [<000000006c8e86c6>] __in_dev_get_rcu include/linux/inetdevice.h:205 [inline]
 [<000000006c8e86c6>] fib_compute_spec_dst+0x6c4/0xcc0 net/ipv4/fib_frontend.c:284
 [<000000005e70dc35>] __ip_options_echo+0x4be/0x13e0 net/ipv4/ip_options.c:177
 [<000000002635dd03>] __icmp_send+0x648/0x1420 net/ipv4/icmp.c:685
 [<00000000ab3ba5c0>] ipv4_send_dest_unreach net/ipv4/route.c:1203 [inline]
 [<00000000ab3ba5c0>] ipv4_link_failure+0x460/0x850 net/ipv4/route.c:1210
 [<00000000d7f05f28>] dst_link_failure include/net/dst.h:490 [inline]
 [<00000000d7f05f28>] vti6_xmit net/ipv6/ip6_vti.c:522 [inline]
 [<00000000d7f05f28>] vti6_tnl_xmit+0xb08/0x17f0 net/ipv6/ip6_vti.c:561
 [<0000000033d6afe8>] __netdev_start_xmit include/linux/netdevice.h:4072 [inline]
 [<0000000033d6afe8>] netdev_start_xmit include/linux/netdevice.h:4081 [inline]
 [<0000000033d6afe8>] xmit_one net/core/dev.c:2977 [inline]
 [<0000000033d6afe8>] dev_hard_start_xmit+0x195/0x8b0 net/core/dev.c:2993
 [<000000004d98be7e>] __dev_queue_xmit+0x11a3/0x1bd0 net/core/dev.c:3473
 [<0000000055dfc670>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3506
 [<00000000579a5332>] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1368
 [<00000000ca23b308>] dst_neigh_output include/net/dst.h:470 [inline]
 [<00000000ca23b308>] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:225
 [<00000000fe005775>] ip_finish_output+0x3c4/0xce0 net/ipv4/ip_output.c:313
 [<0000000054dd4431>] NF_HOOK_COND include/linux/netfilter.h:246 [inline]
 [<0000000054dd4431>] ip_output+0x1ec/0x5b0 net/ipv4/ip_output.c:401
 [<000000001c7c5760>] dst_output include/net/dst.h:507 [inline]
 [<000000001c7c5760>] NF_HOOK_THRESH include/linux/netfilter.h:232 [inline]
 [<000000001c7c5760>] NF_HOOK include/linux/netfilter.h:255 [inline]
 [<000000001c7c5760>] raw_send_hdrinc net/ipv4/raw.c:421 [inline]
 [<000000001c7c5760>] raw_sendmsg+0x1c5c/0x23e0 net/ipv4/raw.c:643
 [<00000000f09a85bb>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:766
 [<00000000cabba92f>] sock_sendmsg_nosec net/socket.c:649 [inline]
 [<00000000cabba92f>] sock_sendmsg+0xbe/0x110 net/socket.c:659
 [<00000000d9893bc9>] sock_write_iter+0x235/0x3d0 net/socket.c:857
 [<0000000010f5a051>] new_sync_write fs/read_write.c:498 [inline]
 [<0000000010f5a051>] __vfs_write+0x3c1/0x560 fs/read_write.c:511
 [<000000009a37aaf9>] vfs_write+0x185/0x520 fs/read_write.c:559
 [<00000000c1a4738b>] SYSC_write fs/read_write.c:607 [inline]
 [<00000000c1a4738b>] SyS_write+0x121/0x270 fs/read_write.c:599
 [<0000000025ca0e0f>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
 [<000000004ae8cc80>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
syz-executor.4 uses obsolete (PF_INET,SOCK_PACKET)
syz-executor.3 (12348) used greatest stack depth: 22968 bytes left
syz-executor.5 (12427) used greatest stack depth: 22928 bytes left