===============================
[ INFO: suspicious RCU usage. ]
4.4.174+ #4 Not tainted
-------------------------------
net/ipv6/ip6_fib.c:1465 suspicious rcu_dereference_protected() usage!
audit: type=1400 audit(1554684305.259:39): avc:  denied  { getopt } for  pid=4585 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1
audit: type=1400 audit(1554684305.259:40): avc:  denied  { write } for  pid=4585 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1
netlink: 5 bytes leftover after parsing attributes in process `syz-executor.5'.

other info that might help us debug this:


rcu_scheduler_active = 1, debug_locks = 0
6 locks held by syz-executor.4/4547:
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814b0528>] pipe_lock_nested fs/pipe.c:65 [inline]
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814b0528>] pipe_lock fs/pipe.c:73 [inline]
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814b0528>] pipe_wait+0x1b8/0x1e0 fs/pipe.c:121
 #1:  (&mm->mmap_sem){++++++}, at: [<ffffffff810aa991>] __do_page_fault+0x1d1/0x7f0 arch/x86/mm/fault.c:1182
 #2:  (((&net->ipv6.ip6_fib_timer))){+.-...}, at: [<ffffffff8125822e>] lockdep_copy_map include/linux/lockdep.h:165 [inline]
 #2:  (((&net->ipv6.ip6_fib_timer))){+.-...}, at: [<ffffffff8125822e>] call_timer_fn+0xde/0x850 kernel/time/timer.c:1175
 #3:  (fib6_gc_lock){+.-...}, at: [<ffffffff825fa33a>] spin_lock_bh include/linux/spinlock.h:307 [inline]
 #3:  (fib6_gc_lock){+.-...}, at: [<ffffffff825fa33a>] fib6_run_gc+0x3a/0x230 net/ipv6/ip6_fib.c:1811
 #4:  (rcu_read_lock){......}, at: [<ffffffff825f1ee0>] __fib6_clean_all+0x0/0x240 net/ipv6/ip6_fib.c:1698
 #5:  (&tb->tb6_lock){++--..}, at: [<ffffffff825f1fc8>] __fib6_clean_all+0xe8/0x240 net/ipv6/ip6_fib.c:1712

stack backtrace:
CPU: 1 PID: 4547 Comm: syz-executor.4 Not tainted 4.4.174+ #4
 0000000000000000 fbc613343e7625a1 ffff8801db707940 ffffffff81aad1a1
 ffff8800b923ec40 0000000000000000 0000000000000001 00000000000005b9
 ffff8801d2278000 ffff8801db707970 ffffffff813ab7d6 ffff8801db707b90
Call Trace:
 <IRQ>  [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ>  [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff813ab7d6>] lockdep_rcu_suspicious.cold+0x10a/0x149 kernel/locking/lockdep.c:4305
 [<ffffffff825f9ada>] fib6_del+0x7ea/0xae0 net/ipv6/ip6_fib.c:1465
 [<ffffffff825fa06c>] fib6_clean_node+0x29c/0x500 net/ipv6/ip6_fib.c:1652
 [<ffffffff825f1830>] fib6_walk_continue+0x3e0/0x630 net/ipv6/ip6_fib.c:1578
 [<ffffffff825f1d71>] fib6_walk+0x91/0xe0 net/ipv6/ip6_fib.c:1623
 [<ffffffff825f1ea8>] fib6_clean_tree+0xe8/0x120 net/ipv6/ip6_fib.c:1697
 [<ffffffff825f1fe0>] __fib6_clean_all+0x100/0x240 net/ipv6/ip6_fib.c:1713
 [<ffffffff825fa3af>] fib6_clean_all net/ipv6/ip6_fib.c:1724 [inline]
 [<ffffffff825fa3af>] fib6_run_gc+0xaf/0x230 net/ipv6/ip6_fib.c:1821
 [<ffffffff825fa54d>] fib6_gc_timer_cb+0x1d/0x30 net/ipv6/ip6_fib.c:1836
 [<ffffffff812582dd>] call_timer_fn+0x18d/0x850 kernel/time/timer.c:1185
 [<ffffffff81258ebf>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff81258ebf>] run_timer_softirq+0x51f/0xb70 kernel/time/timer.c:1444
 [<ffffffff8271bb16>] __do_softirq+0x226/0xa3f kernel/softirq.c:273
 [<ffffffff810e1a8a>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff810e1a8a>] irq_exit+0x10a/0x150 kernel/softirq.c:391
 [<ffffffff8271b24e>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
 [<ffffffff8271b24e>] smp_apic_timer_interrupt+0x7e/0xb0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff8271a59d>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:768
 <EOI>  [<ffffffff813d03ad>] ? __read_once_size include/linux/compiler.h:218 [inline]
 <EOI>  [<ffffffff813d03ad>] ? atomic_read arch/x86/include/asm/atomic.h:26 [inline]
 <EOI>  [<ffffffff813d03ad>] ? static_key_count include/linux/jump_label.h:172 [inline]
 <EOI>  [<ffffffff813d03ad>] ? static_key_false include/linux/jump_label.h:182 [inline]
 <EOI>  [<ffffffff813d03ad>] ? trace_mm_page_alloc include/trace/events/kmem.h:217 [inline]
 <EOI>  [<ffffffff813d03ad>] ? __alloc_pages_nodemask+0x2ad/0x14b0 mm/page_alloc.c:3319
 [<ffffffff81430352>] __alloc_pages include/linux/gfp.h:415 [inline]
 [<ffffffff81430352>] __alloc_pages_node include/linux/gfp.h:428 [inline]
 [<ffffffff81430352>] alloc_pages_node include/linux/gfp.h:442 [inline]
 [<ffffffff81430352>] alloc_zeroed_user_highpage_movable include/linux/highmem.h:183 [inline]
 [<ffffffff81430352>] wp_page_copy.isra.0+0x812/0xc70 mm/memory.c:2163
 [<ffffffff81433bda>] do_wp_page+0x23a/0x1340 mm/memory.c:2441
 [<ffffffff8143b2e4>] handle_pte_fault mm/memory.c:3362 [inline]
 [<ffffffff8143b2e4>] __handle_mm_fault mm/memory.c:3474 [inline]
 [<ffffffff8143b2e4>] handle_mm_fault+0x1614/0x3140 mm/memory.c:3503
 [<ffffffff810aaa4e>] __do_page_fault+0x28e/0x7f0 arch/x86/mm/fault.c:1243
 [<ffffffff810ab008>] do_page_fault+0x28/0x30 arch/x86/mm/fault.c:1306
 [<ffffffff82719e35>] page_fault+0x25/0x30 arch/x86/entry/entry_64.S:1064
 [<ffffffff81532fb0>] pipe_to_user+0xb0/0x160 fs/splice.c:1545
 [<ffffffff81533b6e>] splice_from_pipe_feed fs/splice.c:776 [inline]
 [<ffffffff81533b6e>] __splice_from_pipe+0x37e/0x7a0 fs/splice.c:901
 [<ffffffff8153414d>] vmsplice_to_user+0x1bd/0x1e0 fs/splice.c:1580
 [<ffffffff81536e34>] SYSC_vmsplice fs/splice.c:1661 [inline]
 [<ffffffff81536e34>] SyS_vmsplice+0x114/0x140 fs/splice.c:1644
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
netlink: 5 bytes leftover after parsing attributes in process `syz-executor.5'.
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26159 sclass=netlink_route_socket
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26159 sclass=netlink_route_socket