./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2443547741 <...> no interfaces have a carrier forked to background, child pid 3187 [ 26.523086][ T3188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.534544][ T3188] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.74' (ECDSA) to the list of known hosts. execve("./syz-executor2443547741", ["./syz-executor2443547741"], 0x7ffd20875da0 /* 10 vars */) = 0 brk(NULL) = 0x555556c81000 brk(0x555556c81c40) = 0x555556c81c40 arch_prctl(ARCH_SET_FS, 0x555556c81300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2443547741", 4096) = 28 brk(0x555556ca2c40) = 0x555556ca2c40 brk(0x555556ca3000) = 0x555556ca3000 mprotect(0x7f8cd1234000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c815d0) = 3609 ./strace-static-x86_64: Process 3609 attached [pid 3609] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3609] setsid() = 1 [pid 3609] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3609] unshare(CLONE_NEWNS) = 0 [pid 3609] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3609] unshare(CLONE_NEWIPC) = 0 [pid 3609] unshare(CLONE_NEWCGROUP) = 0 [pid 3609] unshare(CLONE_NEWUTS) = 0 [pid 3609] unshare(CLONE_SYSVSEM) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "16777216", 8) = 8 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "536870912", 9) = 9 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "8192", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3609] close(3) = 0 [pid 3609] getpid() = 1 [pid 3609] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<work)){+.+.}-{0:0}, at: __flush_work+0xdd/0xae0 [ 51.689040][ T3609] [ 51.689040][ T3609] but task is already holding lock: [ 51.696382][ T3609] ffff888026939930 (sk_lock-AF_INET){+.+.}-{0:0}, at: kcm_ioctl+0x396/0x1180 [ 51.705178][ T3609] [ 51.705178][ T3609] which lock already depends on the new lock. [ 51.705178][ T3609] [ 51.715568][ T3609] [ 51.715568][ T3609] the existing dependency chain (in reverse order) is: [ 51.724559][ T3609] [ 51.724559][ T3609] -> #1 (sk_lock-AF_INET){+.+.}-{0:0}: [ 51.732179][ T3609] lock_sock_nested+0x36/0xf0 [ 51.737368][ T3609] strp_work+0x40/0x130 [ 51.742049][ T3609] process_one_work+0x991/0x1610 [ 51.747498][ T3609] worker_thread+0x665/0x1080 [ 51.752680][ T3609] kthread+0x2e4/0x3a0 [ 51.757254][ T3609] ret_from_fork+0x1f/0x30 [ 51.762181][ T3609] [ 51.762181][ T3609] -> #0 ((work_completion)(&strp->work)){+.+.}-{0:0}: [ 51.771115][ T3609] __lock_acquire+0x2a43/0x56d0 [ 51.776470][ T3609] lock_acquire+0x1ab/0x570 [ 51.781480][ T3609] __flush_work+0x105/0xae0 [ 51.786488][ T3609] __cancel_work_timer+0x3f9/0x570 [ 51.792108][ T3609] strp_done+0x64/0xf0 [ 51.796687][ T3609] kcm_ioctl+0x913/0x1180 [ 51.801525][ T3609] sock_do_ioctl+0xcc/0x230 [ 51.806534][ T3609] sock_ioctl+0x2f1/0x640 [ 51.811370][ T3609] __x64_sys_ioctl+0x193/0x200 [ 51.816635][ T3609] do_syscall_64+0x35/0xb0 [ 51.821570][ T3609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 51.827977][ T3609] [ 51.827977][ T3609] other info that might help us debug this: [ 51.827977][ T3609] [ 51.838193][ T3609] Possible unsafe locking scenario: [ 51.838193][ T3609] [ 51.845630][ T3609] CPU0 CPU1 [ 51.850979][ T3609] ---- ---- [ 51.856331][ T3609] lock(sk_lock-AF_INET); [ 51.860735][ T3609] lock((work_completion)(&strp->work)); [ 51.868959][ T3609] lock(sk_lock-AF_INET); [ 51.875887][ T3609] lock((work_completion)(&strp->work)); [ 51.881597][ T3609] [ 51.881597][ T3609] *** DEADLOCK *** [ 51.881597][ T3609] [ 51.889724][ T3609] 1 lock held by syz-executor244/3609: [ 51.895166][ T3609] #0: ffff888026939930 (sk_lock-AF_INET){+.+.}-{0:0}, at: kcm_ioctl+0x396/0x1180 [ 51.904380][ T3609] [ 51.904380][ T3609] stack backtrace: [ 51.910251][ T3609] CPU: 0 PID: 3609 Comm: syz-executor244 Not tainted 6.0.0-rc1-next-20220819-syzkaller #0 [ 51.920124][ T3609] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1521 [ 51.929473][ T3609] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 3609, name: syz-executor244 [ 51.938910][ T3609] preempt_count: 0, expected: 0 [ 51.943746][ T3609] RCU nest depth: 0, expected: 0 [ 51.948664][ T3609] INFO: lockdep is turned off. [ 51.953410][ T3609] irq event stamp: 186633 [ 51.957721][ T3609] hardirqs last enabled at (186633): [] __cancel_work_timer+0x408/0x570 [ 51.967692][ T3609] hardirqs last disabled at (186632): [] try_to_grab_pending+0xbd/0xd0 [ 51.977486][ T3609] softirqs last enabled at (186628): [] kcm_ioctl+0x8fe/0x1180 [ 51.986669][ T3609] softirqs last disabled at (186626): [] kcm_ioctl+0x8bf/0x1180 [ 51.995851][ T3609] CPU: 0 PID: 3609 Comm: syz-executor244 Not tainted 6.0.0-rc1-next-20220819-syzkaller #0 [ 52.005748][ T3609] syz-executor244[3609] cmdline: ./syz-executor2443547741 [ 52.012834][ T3609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 52.022870][ T3609] Call Trace: [ 52.026133][ T3609] [ 52.029048][ T3609] dump_stack_lvl+0xcd/0x134 [ 52.033694][ T3609] __might_resched.cold+0x222/0x26b [ 52.038890][ T3609] down_read_killable+0x75/0x490 [ 52.043826][ T3609] ? down_read+0x450/0x450 [ 52.048235][ T3609] ? _prb_read_valid+0x5f6/0x710 [ 52.053168][ T3609] __access_remote_vm+0xac/0x6f0 [ 52.058121][ T3609] ? rcu_read_lock_sched_held+0xd/0x70 [ 52.063582][ T3609] ? lock_release+0x560/0x780 [ 52.068248][ T3609] ? follow_phys+0x2c0/0x2c0 [ 52.072835][ T3609] ? do_raw_spin_lock+0x120/0x2a0 [ 52.077852][ T3609] ? rwlock_bug.part.0+0x90/0x90 [ 52.082773][ T3609] ? lock_release+0x560/0x780 [ 52.087444][ T3609] ? __up_console_sem+0x47/0xc0 [ 52.092295][ T3609] get_mm_cmdline.part.0+0x217/0x620 [ 52.097593][ T3609] ? dname_to_vma_addr.isra.0+0x360/0x360 [ 52.103323][ T3609] ? _raw_spin_unlock_irqrestore+0x3d/0x70 [ 52.109119][ T3609] get_task_cmdline_kernel+0x1d9/0x220 [ 52.114580][ T3609] dump_stack_print_cmdline.part.0+0x82/0x150 [ 52.120640][ T3609] ? _atomic_dec_and_lock_irqsave+0x150/0x150 [ 52.126713][ T3609] ? dump_stack_print_info+0xc6/0x190 [ 52.132079][ T3609] dump_stack_print_info+0x185/0x190 [ 52.137362][ T3609] dump_stack_lvl+0xc1/0x134 [ 52.141947][ T3609] check_noncircular+0x25f/0x2e0 [ 52.146884][ T3609] ? register_lock_class+0xbe/0x1120 [ 52.152154][ T3609] ? print_circular_bug+0x1e0/0x1e0 [ 52.157345][ T3609] ? save_trace+0x43/0xa00 [ 52.161747][ T3609] __lock_acquire+0x2a43/0x56d0 [ 52.166592][ T3609] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 52.172561][ T3609] ? unwind_next_frame+0xfa9/0x1cc0 [ 52.177767][ T3609] lock_acquire+0x1ab/0x570 [ 52.182614][ T3609] ? __flush_work+0xdd/0xae0 [ 52.187216][ T3609] ? lock_release+0x780/0x780 [ 52.191877][ T3609] ? __flush_work+0x874/0xae0 [ 52.196541][ T3609] ? lock_downgrade+0x6e0/0x6e0 [ 52.201383][ T3609] __flush_work+0x105/0xae0 [ 52.205870][ T3609] ? __flush_work+0xdd/0xae0 [ 52.210447][ T3609] ? lock_chain_count+0x20/0x20 [ 52.215282][ T3609] ? queue_delayed_work_on+0x120/0x120 [ 52.220727][ T3609] ? __lock_acquire+0x166e/0x56d0 [ 52.225736][ T3609] ? del_timer+0xc5/0x110 [ 52.230051][ T3609] ? mark_held_locks+0x9f/0xe0 [ 52.234797][ T3609] ? __cancel_work_timer+0x408/0x570 [ 52.240079][ T3609] __cancel_work_timer+0x3f9/0x570 [ 52.245186][ T3609] ? cancel_delayed_work+0x20/0x20 [ 52.250292][ T3609] ? kcm_ioctl+0x8fe/0x1180 [ 52.254790][ T3609] ? mark_held_locks+0x9f/0xe0 [ 52.259546][ T3609] ? __local_bh_enable_ip+0xa0/0x120 [ 52.264826][ T3609] strp_done+0x64/0xf0 [ 52.268900][ T3609] kcm_ioctl+0x913/0x1180 [ 52.273233][ T3609] ? tomoyo_path_number_perm+0x24e/0x590 [ 52.278857][ T3609] ? kcm_done_work+0x20/0x20 [ 52.283436][ T3609] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 52.289236][ T3609] sock_do_ioctl+0xcc/0x230 [ 52.293726][ T3609] ? get_user_ifreq+0x250/0x250 [ 52.298566][ T3609] ? vfs_fileattr_set+0xbe0/0xbe0 [ 52.303579][ T3609] sock_ioctl+0x2f1/0x640 [ 52.307918][ T3609] ? br_ioctl_call+0xa0/0xa0 [ 52.312504][ T3609] ? lock_downgrade+0x6e0/0x6e0 [ 52.317349][ T3609] ? _raw_spin_unlock_irq+0x1f/0x40 [ 52.322541][ T3609] ? bpf_lsm_file_ioctl+0x5/0x10 [ 52.327462][ T3609] ? br_ioctl_call+0xa0/0xa0 [ 52.332040][ T3609] __x64_sys_ioctl+0x193/0x200 [ 52.336789][ T3609] do_syscall_64+0x35/0xb0 [ 52.341206][ T3609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 52.347091][ T3609] RIP: 0033:0x7f8cd11bfaf9 [ 52.351501][ T3609] Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 52.371088][ T3609] RSP: 002b:00007fff00d82a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 52.379484][ T3609] RAX: ffffffffffffffda RBX: 00007fff00d82a98 RCX: 00007f8cd11bfaf9 [ 52.387453][ T3609] RDX: 0000000020000180 RSI: 00000000000089e0 RDI: 0000000000000005 [ 52.395415][ T3609] RBP: 0000000000000003 R08: bb1414ac00000000 R09: bb1414ac00000000 [ 52.403369][ T3609] R10: bb1414ac00000000 R11: 0000000000000246 R12: 00007fff00d82aa0 [ 52.411319][ T3609] R13: 00007fff00d82a94 R14: 0000000000000003 R15: 0000000000000000 [ 52.419280][ T3609] [ 52.422302][ T3609] syz-executor244[3609] cmdline: ./syz-executor2443547741 [ 52.429390][ T3609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 52.439442][ T3609] Call Trace: [ 52.442703][ T3609] [ 52.445619][ T3609] dump_stack_lvl+0xcd/0x134 [ 52.450204][ T3609] check_noncircular+0x25f/0x2e0 [ 52.455126][ T3609] ? register_lock_class+0xbe/0x1120 [ 52.460407][ T3609] ? print_circular_bug+0x1e0/0x1e0 [ 52.465597][ T3609] ? save_trace+0x43/0xa00 [ 52.469997][ T3609] __lock_acquire+0x2a43/0x56d0 [ 52.474837][ T3609] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 52.480801][ T3609] ? unwind_next_frame+0xfa9/0x1cc0 [ 52.485994][ T3609] lock_acquire+0x1ab/0x570 [ 52.490489][ T3609] ? __flush_work+0xdd/0xae0 [ 52.495069][ T3609] ? lock_release+0x780/0x780 [ 52.499730][ T3609] ? __flush_work+0x874/0xae0 [ 52.504394][ T3609] ? lock_downgrade+0x6e0/0x6e0 [ 52.509233][ T3609] __flush_work+0x105/0xae0 [ 52.513726][ T3609] ? __flush_work+0xdd/0xae0 [ 52.518302][ T3609] ? lock_chain_count+0x20/0x20 [ 52.523135][ T3609] ? queue_delayed_work_on+0x120/0x120 [ 52.528581][ T3609] ? __lock_acquire+0x166e/0x56d0 [ 52.533593][ T3609] ? del_timer+0xc5/0x110 [ 52.537912][ T3609] ? mark_held_locks+0x9f/0xe0 [ 52.542660][ T3609] ? __cancel_work_timer+0x408/0x570 [ 52.547948][ T3609] __cancel_work_timer+0x3f9/0x570 [ 52.553049][ T3609] ? cancel_delayed_work+0x20/0x20 [ 52.558149][ T3609] ? kcm_ioctl+0x8fe/0x1180 [ 52.562639][ T3609] ? mark_held_locks+0x9f/0xe0 [ 52.567386][ T3609] ? __local_bh_enable_ip+0xa0/0x120 [ 52.572655][ T3609] strp_done+0x64/0xf0 [ 52.576710][ T3609] kcm_ioctl+0x913/0x1180 [ 52.581028][ T3609] ? tomoyo_path_number_perm+0x24e/0x590 [ 52.586671][ T3609] ? kcm_done_work+0x20/0x20 [ 52.591267][ T3609] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 52.597078][ T3609] sock_do_ioctl+0xcc/0x230 [ 52.601578][ T3609] ? get_user_ifreq+0x250/0x250 [ 52.606426][ T3609] ? vfs_fileattr_set+0xbe0/0xbe0 [ 52.611438][ T3609] sock_ioctl+0x2f1/0x640 [ 52.615765][ T3609] ? br_ioctl_call+0xa0/0xa0 [ 52.620340][ T3609] ? lock_downgrade+0x6e0/0x6e0 [ 52.625177][ T3609] ? _raw_spin_unlock_irq+0x1f/0x40 [ 52.630371][ T3609] ? bpf_lsm_file_ioctl+0x5/0x10 [ 52.635293][ T3609] ? br_ioctl_call+0xa0/0xa0 [ 52.639890][ T3609] __x64_sys_ioctl+0x193/0x200 [ 52.644652][ T3609] do_syscall_64+0x35/0xb0 [ 52.649054][ T3609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 52.654933][ T3609] RIP: 0033:0x7f8cd11bfaf9 [ 52.659331][ T3609] Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 52.678920][ T3609] RSP: 002b:00007fff00d82a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 52.687314][ T3609] RAX: ffffffffffffffda RBX: 00007fff00d82a98 RCX: 00007f8cd11bfaf9 [ 52.695266][ T3609] RDX: 0000000020000180 RSI: 00000000000089e0 RDI: 0000000000000005 [ 52.703217][ T3609] RBP: 0000000000000003 R08: bb1414ac00000000 R09: bb1414ac00000000 [ 52.711182][ T3609] R10: bb1414ac00000000 R11: 0000000000000246 R12: 00007fff00d82aa0 [pid 3609] ioctl(5, SIOCPROTOPRIVATE, 0x20000180) = -1 EALREADY (Operation already in progress) [pid 3609] exit_group(1) = ? [ 52.719146][ T3609] R13: 00007fff00d82a94 R14: 0000000000000003 R15: 0000000000000000 [ 52.727105][ T3609] [pid 3609] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3609, si_uid=0, si_status=1, si_utime=0, si_stime=194} --- exit_group(0) = ? +++ exited with 0 +++