====================================================== WARNING: possible circular locking dependency detected 4.15.0-rc9+ #283 Not tainted ------------------------------------------------------ syz-executor0/4979 is trying to acquire lock: (sk_lock-AF_INET6){+.+.}, at: [<0000000006a175e4>] lock_sock include/net/sock.h:1461 [inline] (sk_lock-AF_INET6){+.+.}, at: [<0000000006a175e4>] do_ipv6_setsockopt.isra.8+0x3c5/0x39d0 net/ipv6/ipv6_sockglue.c:167 but task is already holding lock: (rtnl_mutex){+.+.}, at: [<000000000cfa3392>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:72 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (rtnl_mutex){+.+.}: __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:72 register_netdevice_notifier+0xad/0x860 net/core/dev.c:1590 tee_tg_check+0x1a0/0x280 net/netfilter/xt_TEE.c:106 xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:845 check_target net/ipv6/netfilter/ip6_tables.c:538 [inline] find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:580 translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:749 do_replace net/ipv6/netfilter/ip6_tables.c:1167 [inline] do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1693 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 -> #0 (sk_lock-AF_INET6){+.+.}: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 lock_sock_nested+0xc2/0x110 net/core/sock.c:2770 lock_sock include/net/sock.h:1461 [inline] do_ipv6_setsockopt.isra.8+0x3c5/0x39d0 net/ipv6/ipv6_sockglue.c:167 ipv6_setsockopt+0xd7/0x150 net/ipv6/ipv6_sockglue.c:922 sctp_setsockopt+0x2a0/0x5de0 net/sctp/socket.c:4074 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(rtnl_mutex); lock(sk_lock-AF_INET6); lock(rtnl_mutex); lock(sk_lock-AF_INET6); *** DEADLOCK *** 1 lock held by syz-executor0/4979: #0: (rtnl_mutex){+.+.}, at: [<000000000cfa3392>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:72 stack backtrace: CPU: 0 PID: 4979 Comm: syz-executor0 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_circular_bug.isra.37+0x2cd/0x2dc kernel/locking/lockdep.c:1218 check_prev_add kernel/locking/lockdep.c:1858 [inline] check_prevs_add kernel/locking/lockdep.c:1971 [inline] validate_chain kernel/locking/lockdep.c:2412 [inline] __lock_acquire+0x30a8/0x3e00 kernel/locking/lockdep.c:3426 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3914 lock_sock_nested+0xc2/0x110 net/core/sock.c:2770 lock_sock include/net/sock.h:1461 [inline] do_ipv6_setsockopt.isra.8+0x3c5/0x39d0 net/ipv6/ipv6_sockglue.c:167 ipv6_setsockopt+0xd7/0x150 net/ipv6/ipv6_sockglue.c:922 sctp_setsockopt+0x2a0/0x5de0 net/sctp/socket.c:4074 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007fe27e07fc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 RDX: 000000000000002d RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00000000000004b5 R08: 0000000000000088 R09: 0000000000000000 R10: 000000002041b000 R11: 0000000000000212 R12: 00000000006f6198 R13: 00000000ffffffff R14: 00007fe27e0806d4 R15: 0000000000000000 binder: binder_mmap: 5009 2000c000-2000e000 bad vm_flags failed -1 binder: 5009:5013 Acquire 1 refcount change on invalid ref 2 ret -22 binder: 5009:5013 got reply transaction with no transaction stack binder: 5009:5013 transaction failed 29201/-71, size 64-24 line 2703 binder: binder_mmap: 5009 2000c000-2000e000 bad vm_flags failed -1 binder: undelivered TRANSACTION_ERROR: 29201 TCP: request_sock_TCPv6: Possible SYN flooding on port 20010. Sending cookies. Check SNMP counters. encrypted_key: insufficient parameters specified QAT: Invalid ioctl encrypted_key: insufficient parameters specified syz-executor0 uses obsolete (PF_INET,SOCK_PACKET) device eql entered promiscuous mode QAT: Invalid ioctl QAT: Invalid ioctl FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 0 PID: 5410 Comm: syz-executor1 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node+0x33/0x70 mm/slab.c:3679 kmalloc_node include/linux/slab.h:541 [inline] kvmalloc_node+0x99/0xd0 mm/util.c:397 kvmalloc include/linux/mm.h:541 [inline] xt_alloc_table_info+0x64/0xe0 net/netfilter/x_tables.c:1006 do_replace net/ipv6/netfilter/ip6_tables.c:1156 [inline] do_ip6t_set_ctl+0x29b/0x5f0 net/ipv6/netfilter/ip6_tables.c:1693 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007fae95a9ec58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fae95a9eaa0 RCX: 0000000000453299 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00007fae95a9ea90 R08: 00000000000003c0 R09: 0000000000000000 R10: 0000000020021c40 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007fae95a9ebc8 R14: 00000000004b8096 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 5435 Comm: syz-executor1 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node+0x33/0x70 mm/slab.c:3679 kmalloc_node include/linux/slab.h:541 [inline] kvmalloc_node+0x99/0xd0 mm/util.c:397 kvmalloc include/linux/mm.h:541 [inline] kvmalloc_array include/linux/mm.h:557 [inline] xt_alloc_entry_offsets+0x21/0x30 net/netfilter/x_tables.c:774 translate_table+0x235/0x1690 net/ipv6/netfilter/ip6_tables.c:704 do_replace net/ipv6/netfilter/ip6_tables.c:1167 [inline] do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1693 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007fae95a9ec58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fae95a9eaa0 RCX: 0000000000453299 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00007fae95a9ea90 R08: 00000000000003c0 R09: 0000000000000000 R10: 0000000020021c40 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007fae95a9ebc8 R14: 00000000004b8096 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 5502 Comm: syz-executor4 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node+0x33/0x70 mm/slab.c:3679 kmalloc_node include/linux/slab.h:541 [inline] kvmalloc_node+0x99/0xd0 mm/util.c:397 kvmalloc include/linux/mm.h:541 [inline] xt_alloc_table_info+0x64/0xe0 net/netfilter/x_tables.c:1006 do_replace net/ipv6/netfilter/ip6_tables.c:1156 [inline] do_ip6t_set_ctl+0x29b/0x5f0 net/ipv6/netfilter/ip6_tables.c:1693 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007faa864c4c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007faa864c4aa0 RCX: 0000000000453299 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00007faa864c4a90 R08: 00000000000003c0 R09: 0000000000000000 R10: 0000000020021c40 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007faa864c4bc8 R14: 00000000004b8096 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 5510 Comm: syz-executor4 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node+0x33/0x70 mm/slab.c:3679 kmalloc_node include/linux/slab.h:541 [inline] kvmalloc_node+0x99/0xd0 mm/util.c:397 kvmalloc include/linux/mm.h:541 [inline] kvmalloc_array include/linux/mm.h:557 [inline] xt_alloc_entry_offsets+0x21/0x30 net/netfilter/x_tables.c:774 translate_table+0x235/0x1690 net/ipv6/netfilter/ip6_tables.c:704 do_replace net/ipv6/netfilter/ip6_tables.c:1167 [inline] do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1693 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007faa864c4c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007faa864c4aa0 RCX: 0000000000453299 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00007faa864c4a90 R08: 00000000000003c0 R09: 0000000000000000 R10: 0000000020021c40 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007faa864c4bc8 R14: 00000000004b8096 R15: 0000000000000000 netlink: 'syz-executor5': attribute type 21 has an invalid length. netlink: 'syz-executor5': attribute type 21 has an invalid length. CPU: 1 PID: 5489 Comm: syz-executor1 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3368 [inline] kmem_cache_alloc_trace+0x4b/0x750 mm/slab.c:3608 kmalloc include/linux/slab.h:499 [inline] kzalloc include/linux/slab.h:688 [inline] tee_tg_check+0xed/0x280 net/netfilter/xt_TEE.c:97 xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:845 check_target net/ipv6/netfilter/ip6_tables.c:538 [inline] find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:580 translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:749 do_replace net/ipv6/netfilter/ip6_tables.c:1167 [inline] do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1693 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007fae95a9ec58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fae95a9eaa0 RCX: 0000000000453299 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00007fae95a9ea90 R08: 00000000000003c0 R09: 0000000000000000 R10: 0000000020021c40 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007fae95a9ebc8 R14: 00000000004b8096 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 5537 Comm: syz-executor4 Not tainted 4.15.0-rc9+ #283 QAT: Invalid ioctl Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 QAT: Invalid ioctl Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3368 [inline] kmem_cache_alloc_trace+0x4b/0x750 mm/slab.c:3608 kmalloc include/linux/slab.h:499 [inline] kzalloc include/linux/slab.h:688 [inline] tee_tg_check+0xed/0x280 net/netfilter/xt_TEE.c:97 xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:845 check_target net/ipv6/netfilter/ip6_tables.c:538 [inline] find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:580 translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:749 do_replace net/ipv6/netfilter/ip6_tables.c:1167 [inline] do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1693 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007faa864c4c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007faa864c4aa0 RCX: 0000000000453299 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00007faa864c4a90 R08: 00000000000003c0 R09: 0000000000000000 R10: 0000000020021c40 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007faa864c4bc8 R14: 00000000004b8096 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 5587 Comm: syz-executor4 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 kmalloc_node include/linux/slab.h:537 [inline] kzalloc_node include/linux/slab.h:699 [inline] __get_vm_area_node+0xae/0x340 mm/vmalloc.c:1402 __vmalloc_node_range+0xa3/0x650 mm/vmalloc.c:1754 __vmalloc_node mm/vmalloc.c:1804 [inline] __vmalloc_node_flags mm/vmalloc.c:1818 [inline] vzalloc+0x45/0x50 mm/vmalloc.c:1857 __do_replace+0xc2/0xab0 net/ipv6/netfilter/ip6_tables.c:1080 do_replace net/ipv6/netfilter/ip6_tables.c:1171 [inline] do_ip6t_set_ctl+0x40f/0x5f0 net/ipv6/netfilter/ip6_tables.c:1693 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007faa864c4c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007faa864c4aa0 RCX: 0000000000453299 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00007faa864c4a90 R08: 00000000000003c0 R09: 0000000000000000 R10: 0000000020021c40 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007faa864c4bc8 R14: 00000000004b8096 R15: 0000000000000000 syz-executor4: vmalloc: allocation failure: 64 bytes, mode:0x14080c0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) syz-executor4 cpuset=/ mems_allowed=0 CPU: 0 PID: 5587 Comm: syz-executor4 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 warn_alloc+0x19a/0x2b0 mm/page_alloc.c:3299 __vmalloc_node_range+0x4f0/0x650 mm/vmalloc.c:1775 __vmalloc_node mm/vmalloc.c:1804 [inline] __vmalloc_node_flags mm/vmalloc.c:1818 [inline] vzalloc+0x45/0x50 mm/vmalloc.c:1857 __do_replace+0xc2/0xab0 net/ipv6/netfilter/ip6_tables.c:1080 do_replace net/ipv6/netfilter/ip6_tables.c:1171 [inline] do_ip6t_set_ctl+0x40f/0x5f0 net/ipv6/netfilter/ip6_tables.c:1693 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0x115/0x150 net/ipv6/ipv6_sockglue.c:928 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1452 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007faa864c4c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007faa864c4aa0 RCX: 0000000000453299 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000013 RBP: 00007faa864c4a90 R08: 00000000000003c0 R09: 0000000000000000 R10: 0000000020021c40 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007faa864c4bc8 R14: 00000000004b8096 R15: 0000000000000000 Mem-Info: active_anon:85626 inactive_anon:63 isolated_anon:0 active_file:3516 inactive_file:8323 isolated_file:0 unevictable:0 dirty:109 writeback:0 unstable:0 slab_reclaimable:6737 slab_unreclaimable:91524 mapped:24132 shmem:70 pagetables:695 bounce:0 free:1405667 free_pcp:506 free_cma:0 Node 0 active_anon:342504kB inactive_anon:252kB active_file:14064kB inactive_file:33292kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:96528kB dirty:436kB writeback:0kB shmem:280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 137216kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2868 6378 6378 Node 0 DMA32 free:2939228kB min:30320kB low:37900kB high:45480kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2940052kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:824kB local_pcp:660kB free_cma:0kB lowmem_reserve[]: 0 0 3510 3510 Node 0 Normal free:2667532kB min:37096kB low:46368kB high:55640kB active_anon:342504kB inactive_anon:252kB active_file:14064kB inactive_file:33292kB unevictable:0kB writepending:436kB present:4718592kB managed:3594340kB mlocked:0kB kernel_stack:3808kB pagetables:2780kB bounce:0kB free_pcp:1192kB local_pcp:648kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB Node 0 DMA32: 5*4kB (UM) 3*8kB (UM) 5*16kB (UM) 3*32kB (UM) 2*64kB (M) 2*128kB (M) 3*256kB (UM) 4*512kB (UM) 3*1024kB (UM) 2*2048kB (UM) 715*4096kB (M) = 2939228kB Node 0 Normal: 734*4kB (UME) 231*8kB (UME) 1258*16kB (UME) 418*32kB (UME) 36*64kB (UME) 6*128kB (ME) 5*256kB (UME) 5*512kB (UM) 1*1024kB (M) 4*2048kB (ME) 640*4096kB (M) = 2675856kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 11895 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 328404 pages reserved device syz5 entered promiscuous mode QAT: Invalid ioctl QAT: Invalid ioctl kauditd_printk_skb: 70 callbacks suppressed audit: type=1400 audit(1517134814.176:110): avc: denied { prog_run } for pid=5706 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 xt_l2tp: missing protocol rule (udp|l2tpip) xt_l2tp: missing protocol rule (udp|l2tpip) Cannot find add_set index 511 as target audit: type=1400 audit(1517134814.737:111): avc: denied { read } for pid=5879 comm="syz-executor7" path="socket:[15634]" dev="sockfs" ino=15634 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1517134815.231:112): avc: denied { set_context_mgr } for pid=6086 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: BINDER_SET_CONTEXT_MGR already set binder: 6086:6090 ioctl 40046207 0 returned -16 audit: type=1400 audit(1517134815.274:113): avc: denied { getattr } for pid=6081 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 QAT: Invalid ioctl mmap: syz-executor3 (6184) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt. QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl audit: type=1326 audit(1517134815.922:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6334 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 audit: type=1326 audit(1517134815.923:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6334 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 audit: type=1326 audit(1517134815.952:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6334 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=298 compat=0 ip=0x453299 code=0x7ffc0000 audit: type=1326 audit(1517134815.977:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6334 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 audit: type=1326 audit(1517134815.977:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6334 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 audit: type=1326 audit(1517134816.002:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6334 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=158 compat=0 ip=0x453299 code=0x7ffc0000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 6391 Comm: syz-executor7 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node+0x56/0x760 mm/slab.c:3632 __alloc_skb+0xf1/0x780 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:983 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1147 [inline] netlink_sendmsg+0xa86/0xe60 net/netlink/af_netlink.c:1839 sock_sendmsg_nosec net/socket.c:638 [inline] sock_sendmsg+0xca/0x110 net/socket.c:648 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2028 __sys_sendmsg+0xe5/0x210 net/socket.c:2062 SYSC_sendmsg net/socket.c:2073 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2069 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007f5bdd26ec58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f5bdd26eaa0 RCX: 0000000000453299 RDX: 0000000000000000 RSI: 0000000020008000 RDI: 0000000000000013 RBP: 00007f5bdd26ea90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007f5bdd26ebc8 R14: 00000000004b8096 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 6415 Comm: syz-executor7 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node_track_caller+0x33/0x70 mm/slab.c:3686 __kmalloc_reserve.isra.39+0x41/0xd0 net/core/skbuff.c:137 __alloc_skb+0x13b/0x780 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:983 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1147 [inline] netlink_sendmsg+0xa86/0xe60 net/netlink/af_netlink.c:1839 sock_sendmsg_nosec net/socket.c:638 [inline] sock_sendmsg+0xca/0x110 net/socket.c:648 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2028 __sys_sendmsg+0xe5/0x210 net/socket.c:2062 SYSC_sendmsg net/socket.c:2073 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2069 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007f5bdd26ec58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f5bdd26eaa0 RCX: 0000000000453299 RDX: 0000000000000000 RSI: 0000000020008000 RDI: 0000000000000013 RBP: 00007f5bdd26ea90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007f5bdd26ebc8 R14: 00000000004b8096 R15: 0000000000000000 QAT: Invalid ioctl ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table ion_mmap: failure mapping buffer to userspace ion_mmap: failure mapping buffer to userspace ip6_tables: ip6tables: counters copy to user failed while replacing table QAT: Invalid ioctl QAT: Invalid ioctl ip6_tables: ip6tables: counters copy to user failed while replacing table ion_mmap: failure mapping buffer to userspace ip6_tables: ip6tables: counters copy to user failed while replacing table QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 6902 Comm: syz-executor3 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3368 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3542 ptlock_alloc+0x24/0x70 mm/memory.c:4692 ptlock_init include/linux/mm.h:1790 [inline] pgtable_page_ctor include/linux/mm.h:1824 [inline] pte_alloc_one+0x59/0x100 arch/x86/mm/pgtable.c:32 __pte_alloc+0x2a/0x310 mm/memory.c:648 do_anonymous_page mm/memory.c:3105 [inline] handle_pte_fault mm/memory.c:3941 [inline] __handle_mm_fault+0x2d06/0x3ce0 mm/memory.c:4067 handle_mm_fault+0x334/0x8d0 mm/memory.c:4104 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1430 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1505 page_fault+0x2c/0x60 arch/x86/entry/entry_64.S:1260 RIP: 0010:__put_user_8+0x1c/0x25 arch/x86/lib/putuser.S:81 RSP: 0018:ffff8801ce077ef8 EFLAGS: 00010287 RAX: 00007f49080c3700 RBX: 00007fffffffeff9 RCX: 0000000020fb2fff RDX: 0000000000000034 RSI: ffffc90002348000 RDI: 0000000000000282 RBP: ffff8801ce077f20 R08: 0000000000000000 R09: 1ffff10039c0efbc R10: ffff8801ce077da8 R11: ffff8801d07c4e08 R12: 00007f49080c3700 R13: 0000000020fb2fff R14: 00007f49080c36d4 R15: ffffffffffffffff SYSC_arch_prctl arch/x86/kernel/process_64.c:683 [inline] SyS_arch_prctl+0x25/0x50 arch/x86/kernel/process_64.c:679 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x453299 RSP: 002b:00007f49080c2c58 EFLAGS: 00000212 ORIG_RAX: 000000000000009e RAX: ffffffffffffffda RBX: 00007f49080c2aa0 RCX: 0000000000453299 RDX: 0000000000000000 RSI: 0000000020fb2fff RDI: 0000000000001003 RBP: 00007f49080c2a90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b8096 R13: 00007f49080c2bc8 R14: 00000000004b8096 R15: 0000000000000000 ip6_tables: ip6tables: counters copy to user failed while replacing table