[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 55.683273][ T26] audit: type=1800 audit(1569098055.464:25): pid=8486 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 55.705340][ T26] audit: type=1800 audit(1569098055.464:26): pid=8486 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 55.742421][ T26] audit: type=1800 audit(1569098055.474:27): pid=8486 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.57' (ECDSA) to the list of known hosts. syzkaller login: [ 66.909407][ T8642] IPVS: ftp: loaded support on port[0] = 21 [ 66.965803][ T8642] chnl_net:caif_netlink_parms(): no params data found [ 66.994561][ T8642] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.002317][ T8642] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.010070][ T8642] device bridge_slave_0 entered promiscuous mode [ 67.018487][ T8642] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.025775][ T8642] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.033605][ T8642] device bridge_slave_1 entered promiscuous mode [ 67.051924][ T8642] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.062773][ T8642] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.080606][ T8642] team0: Port device team_slave_0 added [ 67.087930][ T8642] team0: Port device team_slave_1 added [ 67.142903][ T8642] device hsr_slave_0 entered promiscuous mode [ 67.210578][ T8642] device hsr_slave_1 entered promiscuous mode [ 67.298996][ T8642] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.306350][ T8642] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.314309][ T8642] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.321497][ T8642] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.354533][ T8642] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.367596][ T2820] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 67.387598][ T2820] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.396777][ T2820] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.405146][ T2820] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 67.416734][ T8642] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.426979][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.435823][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.442983][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.462172][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.471216][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.478286][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.487608][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.496863][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.507042][ T2820] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.519662][ T2860] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 67.530900][ T8642] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.543353][ T8642] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.551777][ T2820] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready executing program [ 67.569239][ T8642] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.606358][ T8642] netlink: 80 bytes leftover after parsing attributes in process `syz-executor541'. [ 67.616663][ T8642] netlink: 48 bytes leftover after parsing attributes in process `syz-executor541'. [ 67.628254][ T8642] [ 67.630891][ T8642] ============================= [ 67.635744][ T8642] WARNING: suspicious RCU usage [ 67.640773][ T8642] 5.3.0+ #0 Not tainted [ 67.644929][ T8642] ----------------------------- [ 67.650862][ T8642] include/net/sch_generic.h:492 suspicious rcu_dereference_check() usage! [ 67.659359][ T8642] [ 67.659359][ T8642] other info that might help us debug this: [ 67.659359][ T8642] [ 67.669662][ T8642] [ 67.669662][ T8642] rcu_scheduler_active = 2, debug_locks = 1 [ 67.677769][ T8642] 3 locks held by syz-executor541/8642: [ 67.683519][ T8642] #0: ffffffff88fab240 (rcu_read_lock_bh){....}, at: ip_finish_output2+0x2dc/0x2570 [ 67.693038][ T8642] #1: ffffffff88fab240 (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x20a/0x36f0 [ 67.702453][ T8642] #2: ffff88808ed06b00 (&(&sch->q.lock)->rlock){+...}, at: __dev_queue_xmit+0x14b0/0x36f0 [ 67.712507][ T8642] [ 67.712507][ T8642] stack backtrace: [ 67.718389][ T8642] CPU: 0 PID: 8642 Comm: syz-executor541 Not tainted 5.3.0+ #0 [ 67.725930][ T8642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.735981][ T8642] Call Trace: [ 67.739265][ T8642] dump_stack+0x172/0x1f0 [ 67.743665][ T8642] lockdep_rcu_suspicious+0x153/0x15d [ 67.749065][ T8642] netem_enqueue+0x1cfb/0x2d80 [ 67.753850][ T8642] ? lock_acquire+0x190/0x410 [ 67.758621][ T8642] ? __dev_queue_xmit+0x14b0/0x36f0 [ 67.763825][ T8642] __dev_queue_xmit+0x157e/0x36f0 [ 67.768842][ T8642] ? __kasan_check_read+0x11/0x20 [ 67.773864][ T8642] ? netdev_core_pick_tx+0x2f0/0x2f0 [ 67.779153][ T8642] ? match_held_lock+0x4e0/0x510 [ 67.784086][ T8642] ? __ip_finish_output+0x5fc/0xb90 [ 67.789282][ T8642] ? lock_downgrade+0x920/0x920 [ 67.794294][ T8642] ? ip_finish_output2+0x13e2/0x2570 [ 67.799573][ T8642] ? __ip_finish_output+0x5fc/0xb90 [ 67.804784][ T8642] ? ip_finish_output2+0x13e2/0x2570 [ 67.810072][ T8642] dev_queue_xmit+0x18/0x20 [ 67.814568][ T8642] ? dev_queue_xmit+0x18/0x20 [ 67.819344][ T8642] ip_finish_output2+0x1726/0x2570 [ 67.824458][ T8642] ? nf_ct_deliver_cached_events+0x23d/0x6e0 [ 67.830691][ T8642] ? ip_frag_next+0x910/0x910 [ 67.835595][ T8642] ? ip_mc_output+0xb31/0xf40 [ 67.840427][ T8642] __ip_finish_output+0x5fc/0xb90 [ 67.845479][ T8642] ? __ip_finish_output+0x5fc/0xb90 [ 67.850685][ T8642] ? audit_tag_tree+0x910/0xef0 [ 67.855539][ T8642] ip_finish_output+0x38/0x1f0 [ 67.860299][ T8642] ip_mc_output+0x292/0xf40 [ 67.864799][ T8642] ? __ip_queue_xmit+0x1be0/0x1be0 [ 67.869896][ T8642] ? __ip_finish_output+0xb90/0xb90 [ 67.875098][ T8642] ? ip_make_skb+0x1b1/0x2c0 [ 67.879689][ T8642] ? ip_reply_glue_bits+0xc0/0xc0 [ 67.884706][ T8642] ip_local_out+0xbb/0x190 [ 67.889109][ T8642] ip_send_skb+0x42/0xf0 [ 67.893337][ T8642] udp_send_skb.isra.0+0x6b2/0x1160 [ 67.898522][ T8642] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 67.904758][ T8642] udp_sendmsg+0x1e96/0x2820 [ 67.909351][ T8642] ? ip_reply_glue_bits+0xc0/0xc0 [ 67.914396][ T8642] ? udp_unicast_rcv_skb.isra.0+0x360/0x360 [ 67.920288][ T8642] ? find_held_lock+0x35/0x130 [ 67.925152][ T8642] ? __might_fault+0x12b/0x1e0 [ 67.929912][ T8642] ? ___might_sleep+0x163/0x280 [ 67.934755][ T8642] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 67.940382][ T8642] ? aa_sk_perm+0x288/0x880 [ 67.944882][ T8642] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 67.950426][ T8642] inet_sendmsg+0x9e/0xe0 [ 67.954864][ T8642] ? inet_sendmsg+0x9e/0xe0 [ 67.959436][ T8642] ? inet_send_prepare+0x4f0/0x4f0 [ 67.964585][ T8642] sock_sendmsg+0xd7/0x130 [ 67.968988][ T8642] ___sys_sendmsg+0x3e2/0x920 [ 67.973661][ T8642] ? copy_msghdr_from_user+0x440/0x440 [ 67.979105][ T8642] ? __kasan_check_read+0x11/0x20 [ 67.985252][ T8642] ? __kasan_check_read+0x11/0x20 [ 67.990282][ T8642] ? __lock_acquire+0x1703/0x4e70 [ 67.995337][ T8642] ? mark_held_locks+0xf0/0xf0 [ 68.000126][ T8642] ? __might_fault+0x12b/0x1e0 [ 68.004987][ T8642] ? find_held_lock+0x35/0x130 [ 68.009759][ T8642] ? __might_fault+0x12b/0x1e0 [ 68.014549][ T8642] ? lock_downgrade+0x920/0x920 [ 68.019450][ T8642] ? ___might_sleep+0x163/0x280 [ 68.024431][ T8642] __sys_sendmmsg+0x1bf/0x4d0 [ 68.029177][ T8642] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 68.034480][ T8642] ? release_sock+0x156/0x1c0 [ 68.039159][ T8642] ? __sys_connect+0x12d/0x330 [ 68.043920][ T8642] ? __ia32_sys_accept+0xb0/0xb0 [ 68.048925][ T8642] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 68.055179][ T8642] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 68.060655][ T8642] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 68.066195][ T8642] ? do_syscall_64+0x26/0x760 [ 68.070975][ T8642] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 68.077247][ T8642] ? do_syscall_64+0x26/0x760 [ 68.081930][ T8642] __x64_sys_sendmmsg+0x9d/0x100 [ 68.086977][ T8642] do_syscall_64+0xfa/0x760 [ 68.091552][ T8642] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 68.097430][ T8642] RIP: 0033:0x441b59 [ 68.101323][ T8642] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 68.121221][ T8642] RSP: 002b:00007ffd17a4c4b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 68.130236][ T8642] RAX: ffffffffffffffda RBX: 0000315f6576616c RCX: 0000000000441b59 [ 68.138332][ T8642] RDX: 04000000000001a8 RSI: 0000000020007fc0 RDI: 0000000000000005 [ 68.146428][ T8642] RBP: 735f656764697262 R08: 0000000001bbbbbb R09: 0000000001bbbbbb [ 68.154567][ T8642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.162718][ T8642] R13: 00000000004030f0 R14: 0000000000000000 R15: 0000000000000000