BUG: using __this_cpu_add() in preemptible [00000000] code: syz-executor5/16577 caller is __this_cpu_preempt_check+0x13/0x20 /syzkaller/managers/android-44-kasan-gce/kernel/lib/smp_processor_id.c:62 CPU: 0 PID: 16577 Comm: syz-executor5 Not tainted 4.4.105-g36205b7 #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 6dc8f9c38bf79952 ffff8800b4567828 ffffffff81cc9b4f 0000000000000000 ffffffff839fd4a0 ffff8800b4567868 ffffffff81d28d58 ffffffff83ced1a0 1ffff100168acf14 ffff8801d4ba9200 ffff8801d4ba9440 Call Trace: [<ffffffff81cc9b4f>] __dump_stack /syzkaller/managers/android-44-kasan-gce/kernel/lib/dump_stack.c:15 [inline] [<ffffffff81cc9b4f>] dump_stack+0x8e/0xcf /syzkaller/managers/android-44-kasan-gce/kernel/lib/dump_stack.c:51 [<ffffffff81d28d58>] check_preemption_disabled+0x1b8/0x1f0 /syzkaller/managers/android-44-kasan-gce/kernel/lib/smp_processor_id.c:46 [<ffffffff81d28dc3>] __this_cpu_preempt_check+0x13/0x20 /syzkaller/managers/android-44-kasan-gce/kernel/lib/smp_processor_id.c:62 [<ffffffff830dc180>] tcp_try_coalesce+0x200/0x4b0 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp_input.c:4278 [<ffffffff830e5c6e>] tcp_queue_rcv+0xfe/0x720 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp_input.c:4485 [<ffffffff830ffed1>] tcp_send_rcvq+0x391/0x4a0 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp_input.c:4531 [<ffffffff830d20cc>] tcp_sendmsg+0x1d1c/0x36a0 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp.c:1134 [<ffffffff8319024c>] inet_sendmsg+0x26c/0x430 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/af_inet.c:755 [<ffffffff82d94005>] sock_sendmsg_nosec /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:625 [inline] [<ffffffff82d94005>] sock_sendmsg+0xb5/0xf0 /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:635 [<ffffffff82d94e47>] SYSC_sendto+0x267/0x300 /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:1665 [<ffffffff82d97179>] SyS_sendto+0x9/0x10 /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:1633 [<ffffffff8374ab36>] entry_SYSCALL_64_fastpath+0x16/0x76 BUG: using __this_cpu_add() in preemptible [00000000] code: syz-executor5/16577 caller is __this_cpu_preempt_check+0x13/0x20 /syzkaller/managers/android-44-kasan-gce/kernel/lib/smp_processor_id.c:62 CPU: 0 PID: 16577 Comm: syz-executor5 Not tainted 4.4.105-g36205b7 #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 6dc8f9c38bf79952 ffff8800b4567828 ffffffff81cc9b4f 0000000000000000 ffffffff839fd4a0 ffff8800b4567868 ffffffff81d28d58 ffffffff83ced1a0 1ffff100168acf14 ffff8800b9091680 ffff8800b90918c0 Call Trace: [<ffffffff81cc9b4f>] __dump_stack /syzkaller/managers/android-44-kasan-gce/kernel/lib/dump_stack.c:15 [inline] [<ffffffff81cc9b4f>] dump_stack+0x8e/0xcf /syzkaller/managers/android-44-kasan-gce/kernel/lib/dump_stack.c:51 [<ffffffff81d28d58>] check_preemption_disabled+0x1b8/0x1f0 /syzkaller/managers/android-44-kasan-gce/kernel/lib/smp_processor_id.c:46 [<ffffffff81d28dc3>] __this_cpu_preempt_check+0x13/0x20 /syzkaller/managers/android-44-kasan-gce/kernel/lib/smp_processor_id.c:62 [<ffffffff830dc180>] tcp_try_coalesce+0x200/0x4b0 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp_input.c:4278 [<ffffffff830e5c6e>] tcp_queue_rcv+0xfe/0x720 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp_input.c:4485 [<ffffffff830ffed1>] tcp_send_rcvq+0x391/0x4a0 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp_input.c:4531 [<ffffffff830d20cc>] tcp_sendmsg+0x1d1c/0x36a0 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/tcp.c:1134 [<ffffffff8319024c>] inet_sendmsg+0x26c/0x430 /syzkaller/managers/android-44-kasan-gce/kernel/net/ipv4/af_inet.c:755 [<ffffffff82d94005>] sock_sendmsg_nosec /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:625 [inline] [<ffffffff82d94005>] sock_sendmsg+0xb5/0xf0 /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:635 [<ffffffff82d94e47>] SYSC_sendto+0x267/0x300 /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:1665 [<ffffffff82d97179>] SyS_sendto+0x9/0x10 /syzkaller/managers/android-44-kasan-gce/kernel/net/socket.c:1633 [<ffffffff8374ab36>] entry_SYSCALL_64_fastpath+0x16/0x76 binder: 16647:16651 ioctl 40046205 2 returned -22 binder: 16647:16651 ioctl c0086420 20ee6000 returned -22 binder: 16647:16651 ERROR: BC_REGISTER_LOOPER called without request binder: undelivered TRANSACTION_COMPLETE binder: 16647:16651 ioctl 40046205 e69c returned -22 binder: 16647:16651 ioctl 40046205 2 returned -22 binder: 16647:16689 ioctl c0086420 20ee6000 returned -22 binder: 16647:16669 ERROR: BC_REGISTER_LOOPER called without request binder: BINDER_SET_CONTEXT_MGR already set binder: 16647:16651 ioctl 40046207 0 returned -16 binder_alloc: 16647: binder_alloc_buf, no vma binder: 16647:16669 ioctl 40046205 e69c returned -22 binder: 16647:16689 transaction failed 29189/-3, size 0-0 line 3131 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered transaction 264, process died. netlink: 3 bytes leftover after parsing attributes in process `syz-executor6'. binder: 16783:16784 got reply transaction with no transaction stack netlink: 3 bytes leftover after parsing attributes in process `syz-executor6'. binder: 16783:16784 transaction failed 29201/-71, size 32-8 line 2924 binder: 16783:16784 ioctl 404c534a 2000bfb4 returned -22 netlink: 3 bytes leftover after parsing attributes in process `syz-executor6'. binder: 16783:16784 IncRefs 0 refcount change on invalid ref 1 ret -22 binder: 16783:16784 BC_DEAD_BINDER_DONE 0000000000000002 not found netlink: 3 bytes leftover after parsing attributes in process `syz-executor6'. binder_alloc: binder_alloc_mmap_handler: 16783 20004000-20008000 already mapped failed -16 binder: 16783:16801 ioctl c0306201 20007000 returned -14 binder: 16817:16820 got reply transaction with no transaction stack binder: 16817:16820 transaction failed 29201/-71, size 32-8 line 2924 binder: 16783:16801 got reply transaction with no transaction stack binder: 16783:16801 transaction failed 29201/-71, size 56-32 line 2924 binder: 16783:16784 got reply transaction with no transaction stack binder: 16783:16784 transaction failed 29201/-71, size 32-8 line 2924 binder: 16817:16820 ioctl 404c534a 2000b000 returned -22 binder: 16832:16835 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 16832:16835 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: BINDER_SET_CONTEXT_MGR already set binder: 16817:16831 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 16783:16801 ioctl 404c534a 2000bfb4 returned -22 binder: 16783:16801 IncRefs 0 refcount change on invalid ref 1 ret -22 binder: 16783:16801 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 16783:16847 ioctl c0306201 20007000 returned -14 binder: 16783:16829 got reply transaction with no transaction stack binder: 16783:16829 transaction failed 29201/-71, size 56-32 line 2924 binder: 16783:16784 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder: 16817:16820 got reply transaction with no transaction stack binder: 16817:16820 transaction failed 29201/-71, size 32-8 line 2924 binder: BINDER_SET_CONTEXT_MGR already set binder: 16817:16820 ioctl 40046207 0 returned -16 binder: 16817:16820 ioctl 404c534a 2000b000 returned -22 binder: 16817:16831 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 16832:16845 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: 16832:16865 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 16832:16906 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 16832:16916 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: undelivered TRANSACTION_ERROR: 29201 binder: 16961:16966 got reply transaction with no transaction stack binder: 16961:16984 ioctl 404c534a 2000b000 returned -22 binder: 16961:16966 transaction failed 29201/-71, size 32-8 line 2924 binder: 16961:16966 BC_DEAD_BINDER_DONE 0000000000000002 not found binder_alloc: binder_alloc_mmap_handler: 16961 20004000-20008000 already mapped failed -16 binder: 16961:16984 ioctl c0306201 20007000 returned -14 binder: send failed reply for transaction 277 to 16961:17005 binder: 16961:16966 ioctl c0306201 2000afd0 returned -14 binder: 16961:16966 ioctl c018620b 2000cff1 returned -14 binder: 16961:16966 ioctl c018620b 20001fe8 returned -14 binder: 16961:16966 ioctl c0306201 20006fd0 returned -14 binder: 16961:16966 got reply transaction with no transaction stack binder: 16961:16966 transaction failed 29201/-71, size 32-8 line 2924 binder: BINDER_SET_CONTEXT_MGR already set binder: 16961:17005 ioctl 40046207 0 returned -16 binder: 16961:16984 ioctl 404c534a 2000b000 returned -22 binder: 16961:17053 BC_DEAD_BINDER_DONE 0000000000000002 not found binder_alloc: binder_alloc_mmap_handler: 16961 20004000-20008000 already mapped failed -16 binder: 16961:16966 ioctl c0306201 20007000 returned -14 binder_alloc: 16961: binder_alloc_buf, no vma binder: 16961:16966 transaction failed 29189/-3, size 0-0 line 3131 binder: 16961:17005 ioctl c018620b 20001fe8 returned -14 binder: 16961:17053 ioctl c0306201 20006fd0 returned -14 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29201 device gre0 entered promiscuous mode IPVS: Creating netns size=2552 id=12 binder: 17365:17368 ioctl 40046205 2 returned -22 binder: 17365:17368 ERROR: BC_REGISTER_LOOPER called without request binder: undelivered TRANSACTION_COMPLETE binder: 17365:17368 ioctl 40046205 e69c returned -22 binder: undelivered transaction 281, process died. binder: 17365:17368 ioctl 40046205 2 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 17365:17382 ERROR: BC_REGISTER_LOOPER called without request binder: 17365:17368 ioctl 40046207 0 returned -16 binder_alloc: 17365: binder_alloc_buf, no vma binder: 17365:17384 transaction failed 29189/-3, size 0-0 line 3131 binder: undelivered TRANSACTION_ERROR: 29189 binder: 17365:17382 ioctl 40046205 e69c returned -22 nla_parse: 8 callbacks suppressed netlink: 72 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 72 bytes leftover after parsing attributes in process `syz-executor0'. binder: 17500:17502 got reply transaction with no transaction stack binder: 17500:17502 transaction failed 29201/-71, size 32-8 line 2924 binder: 17500:17502 ioctl 404c534a 2000b000 returned -22 binder: 17500:17502 BC_DEAD_BINDER_DONE 0000000000000002 not found audit: type=1326 audit(1513044959.051:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=17490 comm="syz-executor0" exe="/root/syz-executor0" sig=9 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x0 binder_alloc: binder_alloc_mmap_handler: 17500 20004000-20008000 already mapped failed -16 binder: 17500:17538 ioctl c0306201 20007000 returned -14 binder: send failed reply for transaction 285 to 17500:17518 device gre0 entered promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. binder: 17500:17518 ioctl c018620b 20001fe8 returned -14 binder: 17500:17502 ioctl c0306201 2000afd0 returned -14 netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29201 binder: 17500:17518 ioctl c0306201 20006fd0 returned -14 binder: 17500:17518 got reply transaction with no transaction stack binder: 17500:17518 transaction failed 29201/-71, size 32-8 line 2924 binder: BINDER_SET_CONTEXT_MGR already set binder: 17500:17538 ioctl 40046207 0 returned -16 netlink: 1 bytes leftover after parsing attributes in process `syz-executor4'. binder: 17500:17502 ioctl 404c534a 2000b000 returned -22 binder: 17500:17518 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 17500:17502 ioctl c0306201 20007000 returned -14 binder_alloc: 17500: binder_alloc_buf, no vma binder: 17500:17502 transaction failed 29189/-3, size 0-0 line 3131 binder: 17500:17502 ioctl c018620b 20001fe8 returned -14 binder: 17500:17502 ioctl c0306201 20006fd0 returned -14 binder: undelivered TRANSACTION_ERROR: 29189 device gre0 entered promiscuous mode TCP: request_sock_TCP: Possible SYN flooding on port 20030. Sending cookies. Check SNMP counters. binder: 17699:17702 ioctl 40046205 2 returned -22 netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. binder: 17699:17702 ioctl c0086420 20ee6000 returned -22 binder: 17699:17702 ERROR: BC_REGISTER_LOOPER called without request netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. binder: undelivered TRANSACTION_COMPLETE binder: 17699:17702 ioctl 40046205 2 returned -22 binder: 17699:17714 ioctl c0086420 20ee6000 returned -22 binder: 17699:17714 ERROR: BC_REGISTER_LOOPER called without request binder: BINDER_SET_CONTEXT_MGR already set binder: 17699:17702 ioctl 40046207 0 returned -16 netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. binder_alloc: 17699: binder_alloc_buf, no vma binder: 17699:17733 transaction failed 29189/-3, size 0-0 line 3131 binder: undelivered TRANSACTION_ERROR: 29189 binder: 17676:17728 tried to acquire reference to desc 0, got 1 instead binder: undelivered transaction 291, process died. sg_write: data in/out 262364/161 bytes for SCSI command 0xff-- guessing data in; program syz-executor4 not setting count and/or reply_len properly binder: 17676:17718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 17676:17692 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 17723 Comm: syz-executor4 Not tainted 4.4.105-g36205b7 #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d4b3c740 task.stack: ffff8801d6148000 RIP: 0010:[<ffffffff82566c5e>] [<ffffffff82566c5e>] sg_read_oxfer /syzkaller/managers/android-44-kasan-gce/kernel/drivers/scsi/sg.c:1986 [inline] RIP: 0010:[<ffffffff82566c5e>] [<ffffffff82566c5e>] sg_read+0x93e/0x1260 /syzkaller/managers/android-44-kasan-gce/kernel/drivers/scsi/sg.c:531 RSP: 0018:ffff8801d614fb20 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff8800b8bd2b80 RCX: 000000000000000c RDX: 0000000000000000 RSI: ffff8800b8bd2ba4 RDI: ffff8801d2578170 RBP: ffff8801d614fc18 R08: 0000000000080000 R09: 0000000000000001 R10: 0000000000000000 R11: 1ffff1003ac29f2a R12: 0000000000000000 R13: ffff8801d2578140 R14: 0000000000000000 R15: 0000000000000077 FS: 00007f18cca9e700(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000208e6f65 CR3: 00000001d3141000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff8801d614fd80 ffff8801d2578158 ffff8801d614fb78 ffff8801d2578168 000000000000009b ffff8801d614fb78 0000000020f45fc8 0000000000001000 1ffff1003ac29f6e 00000000208e6f89 0000000041b58ab3 ffffffff83fa6036 Call Trace: [<ffffffff814f759c>] do_loop_readv_writev+0x11c/0x1e0 /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:680 [<ffffffff814f96f2>] do_readv_writev+0x552/0x660 /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:810 [<ffffffff814f985a>] vfs_readv+0x5a/0xa0 /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:834 [<ffffffff814fbd33>] SYSC_readv /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:860 [inline] [<ffffffff814fbd33>] SyS_readv+0xd3/0x260 /syzkaller/managers/android-44-kasan-gce/kernel/fs/read_write.c:852 [<ffffffff8374ab36>] entry_SYSCALL_64_fastpath+0x16/0x76 Code: 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 a9 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 65 28 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 7d 08 00 00 49 8b 04 24 48 85 c0 0f 84 ee 04 RIP [<ffffffff82566c5e>] sg_read_oxfer /syzkaller/managers/android-44-kasan-gce/kernel/drivers/scsi/sg.c:1986 [inline] RIP [<ffffffff82566c5e>] sg_read+0x93e/0x1260 /syzkaller/managers/android-44-kasan-gce/kernel/drivers/scsi/sg.c:531 RSP <ffff8801d614fb20> ---[ end trace d3be01cca29d0540 ]---