[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 22.251063] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. [ 22.712801] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) [ 23.137373] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.177724] random: nonblocking pool is initialized Warning: Permanently added '10.128.10.20' (ECDSA) to the list of known hosts. 2018/05/04 17:28:11 parsed 1 programs 2018/05/04 17:28:11 executed programs: 0 [ 30.412928] IPVS: Creating netns size=2552 id=1 [ 30.495796] IPVS: Creating netns size=2552 id=2 [ 30.549498] IPVS: Creating netns size=2552 id=3 [ 30.631520] IPVS: Creating netns size=2552 id=4 [ 30.713791] IPVS: Creating netns size=2552 id=5 [ 30.863085] IPVS: Creating netns size=2552 id=6 [ 31.044658] IPVS: Creating netns size=2552 id=7 [ 31.271604] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 31.286273] IPVS: Creating netns size=2552 id=8 [ 31.375981] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 31.383882] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 31.473405] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 31.766496] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 31.782893] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 31.803094] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.846804] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 31.882456] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.890456] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 31.898769] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.981487] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 32.225761] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 32.275919] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 32.289872] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 32.322522] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 32.381451] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 32.417130] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 32.433973] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 32.461803] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 32.527906] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 32.590623] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 32.667698] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.754084] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 32.762258] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.772942] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.786272] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 32.819371] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 32.828352] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 32.870505] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 32.879236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.933379] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 32.972570] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.992552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 33.008999] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 33.029338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 33.055701] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 33.067507] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 33.077684] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 33.095521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 33.121914] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 33.178363] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 33.187622] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 33.311465] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 33.416592] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 33.468042] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 33.521270] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 33.599974] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 33.617770] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 33.676360] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 33.688667] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 33.696456] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 33.744743] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 33.809196] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 33.850784] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 33.872023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 33.925030] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 33.958310] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 33.981756] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 34.007677] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 34.032769] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.086728] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.097722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 34.127127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 36.320795] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 36.330699] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 36.447223] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 36.477009] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 36.546749] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.575748] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.656074] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.743376] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.045213] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 37.167702] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 37.225525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.378617] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 37.446994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.563980] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 37.652207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.765743] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.230018] [ 38.231685] ====================================================== [ 38.237987] [ INFO: possible circular locking dependency detected ] [ 38.244378] 4.4.131-g4fca5a0 #32 Not tainted [ 38.248770] ------------------------------------------------------- [ 38.255163] syz-executor1/5830 is trying to acquire lock: [ 38.260682] (&(&q->lock)->rlock){+.-...}, at: [] ip_defrag+0x318/0x3fe0 [ 38.269590] [ 38.269590] but task is already holding lock: [ 38.275548] (_xmit_NETROM){+.-...}, at: [] sch_direct_xmit+0x23c/0x6e0 [ 38.284378] [ 38.284378] which lock already depends on the new lock. [ 38.284378] [ 38.292683] [ 38.292683] the existing dependency chain (in reverse order) is: [ 38.300291] -> #1 (_xmit_NETROM){+.-...}: [ 38.305104] [] lock_acquire+0x15e/0x450 [ 38.311372] [] _raw_spin_lock_irqsave+0x4e/0x70 [ 38.318337] [] depot_save_stack+0x211/0x610 [ 38.324952] [] save_stack+0xa9/0xd0 [ 38.330867] [] kasan_kmalloc+0xc7/0xe0 [ 38.337050] [] kasan_slab_alloc+0x12/0x20 [ 38.343486] [] kmem_cache_alloc+0xbe/0x2a0 [ 38.350029] [] inet_getpeer.part.5+0xeac/0x15a0 [ 38.356994] [] inet_getpeer+0x55b/0x6f0 [ 38.363266] [] icmp6_send+0x17c5/0x1b80 [ 38.369540] [] icmpv6_param_prob+0x29/0x40 [ 38.376069] [] ipv6_frag_rcv+0x3f94/0x4fd0 [ 38.382598] [] ip6_input_finish+0x32e/0x1550 [ 38.389298] [] ip6_input+0xf6/0x200 [ 38.395217] [] ip6_rcv_finish+0x13d/0x640 [ 38.401658] [] ipv6_rcv+0x10cb/0x1cd0 [ 38.407749] [] __netif_receive_skb_core+0x12d6/0x2940 [ 38.415236] [] __netif_receive_skb+0x5b/0x1b0 [ 38.422023] [] process_backlog+0x216/0x6a0 [ 38.428551] [] net_rx_action+0x3a2/0xdb0 [ 38.434904] [] __do_softirq+0x22c/0xa1a [ 38.441170] [] do_softirq_own_stack+0x1c/0x30 [ 38.447955] [] do_softirq.part.16+0x54/0x60 [ 38.454565] [] do_softirq+0x19/0x20 [ 38.460485] [] netif_rx_ni+0xec/0x3a0 [ 38.466592] [] tun_get_user+0xbe7/0x2410 [ 38.472946] [] tun_chr_write_iter+0xd5/0x190 [ 38.479732] [] do_iter_readv_writev+0x13c/0x1e0 [ 38.486688] [] compat_do_readv_writev+0x2e2/0x6e0 [ 38.493826] [] compat_writev+0xe1/0x150 [ 38.500091] [] compat_SyS_writev+0xd8/0x1c0 [ 38.506702] [] do_fast_syscall_32+0x326/0x8b0 [ 38.513493] [] sysenter_flags_fixed+0xd/0x17 [ 38.520198] -> #0 (&(&q->lock)->rlock){+.-...}: [ 38.525538] [] __lock_acquire+0x3902/0x5270 [ 38.532150] [] lock_acquire+0x15e/0x450 [ 38.538588] [] _raw_spin_lock+0x36/0x50 [ 38.544857] [] ip_defrag+0x318/0x3fe0 [ 38.550949] [] ip_check_defrag+0x3c8/0x7e0 [ 38.557474] [] packet_rcv_fanout+0x52a/0x5e0 [ 38.564228] [] dev_hard_start_xmit+0x644/0x11c0 [ 38.571190] [] sch_direct_xmit+0x2c1/0x6e0 [ 38.577716] [] __dev_queue_xmit+0xef3/0x1c80 [ 38.584414] [] dev_queue_xmit+0x17/0x20 [ 38.590680] [] neigh_resolve_output+0x637/0x790 [ 38.597637] [] ip_finish_output2+0x6ab/0x1110 [ 38.604421] [] ip_do_fragment+0x198b/0x2150 [ 38.611036] [] ip_fragment.constprop.50+0x143/0x200 [ 38.618347] [] ip_finish_output+0x6c4/0xbc0 [ 38.624964] [] ip_mc_output+0x233/0x980 [ 38.631229] [] ip_local_out+0x9b/0x180 [ 38.637405] [] ip_send_skb+0x3c/0xc0 [ 38.643417] [] udp_send_skb+0x5c3/0xc60 [ 38.649688] [] udp_sendmsg+0x16ce/0x1bb0 [ 38.656039] [] inet_sendmsg+0x203/0x4d0 [ 38.662302] [] sock_sendmsg+0xcc/0x110 [ 38.668483] [] SYSC_sendto+0x21c/0x370 [ 38.674662] [] SyS_sendto+0x40/0x50 [ 38.680578] [] do_fast_syscall_32+0x326/0x8b0 [ 38.687368] [] sysenter_flags_fixed+0xd/0x17 [ 38.694071] [ 38.694071] other info that might help us debug this: [ 38.694071] [ 38.702202] Possible unsafe locking scenario: [ 38.702202] [ 38.708249] CPU0 CPU1 [ 38.712903] ---- ---- [ 38.717553] lock(_xmit_NETROM); [ 38.721241] lock(&(&q->lock)->rlock); [ 38.727976] lock(_xmit_NETROM); [ 38.734274] lock(&(&q->lock)->rlock); [ 38.738484] [ 38.738484] *** DEADLOCK *** [ 38.738484] [ 38.744529] 4 locks held by syz-executor1/5830: [ 38.749182] #0: (rcu_read_lock_bh){......}, at: [] ip_finish_output2+0x212/0x1110 [ 38.759177] #1: (rcu_read_lock_bh){......}, at: [] __dev_queue_xmit+0x1d7/0x1c80 [ 38.769082] #2: (_xmit_NETROM){+.-...}, at: [] sch_direct_xmit+0x23c/0x6e0 [ 38.778563] #3: (rcu_read_lock){......}, at: [] dev_hard_start_xmit+0xa8/0x11c0 [ 38.788485] [ 38.788485] stack backtrace: [ 38.792976] CPU: 1 PID: 5830 Comm: syz-executor1 Not tainted 4.4.131-g4fca5a0 #32 [ 38.800581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.809926] 0000000000000000 0b034cd7be2a882b ffff8800ba3aecc8 ffffffff81e0e06d [ 38.817978] ffffffff853ed8e0 ffffffff853eba80 ffffffff853ed8e0 ffff8800ab6da150 [ 38.826007] ffff8800ab6d9800 ffff8800ba3aed10 ffffffff8140e3eb 0000000000000003 [ 38.834028] Call Trace: [ 38.836606] [] dump_stack+0xc1/0x124 [ 38.841962] [] print_circular_bug.cold.50+0x1bd/0x27d [ 38.848799] [] __lock_acquire+0x3902/0x5270 [ 38.854768] [] ? debug_check_no_locks_freed+0x210/0x210 [ 38.861782] [] ? trace_hardirqs_on_caller+0x266/0x590 [ 38.868617] [] lock_acquire+0x15e/0x450 [ 38.874234] [] ? ip_defrag+0x318/0x3fe0 [ 38.879856] [] ? inet_frag_find+0x22e/0x9c0 [ 38.885820] [] _raw_spin_lock+0x36/0x50 [ 38.891443] [] ? ip_defrag+0x318/0x3fe0 [ 38.897063] [] ip_defrag+0x318/0x3fe0 [ 38.902508] [] ? debug_check_no_locks_freed+0x210/0x210 [ 38.909514] [] ? memcpy+0x45/0x50 [ 38.914609] [] ? ip_expire+0x770/0x770 [ 38.920140] [] ip_check_defrag+0x3c8/0x7e0 [ 38.926016] [] ? ip_defrag+0x3fe0/0x3fe0 [ 38.931723] [] packet_rcv_fanout+0x52a/0x5e0 [ 38.937755] [] ? packet_bind+0x190/0x190 [ 38.943438] [] dev_hard_start_xmit+0x644/0x11c0 [ 38.949732] [] ? dev_hard_start_xmit+0xa8/0x11c0 [ 38.956108] [] sch_direct_xmit+0x2c1/0x6e0 [ 38.961963] [] ? dev_watchdog+0x7f0/0x7f0 [ 38.967737] [] __dev_queue_xmit+0xef3/0x1c80 [ 38.973775] [] ? __dev_queue_xmit+0x1d7/0x1c80 [ 38.979986] [] ? debug_check_no_locks_freed+0x210/0x210 [ 38.986969] [] ? netdev_pick_tx+0x2c0/0x2c0 [ 38.992915] [] ? memcpy+0x45/0x50 [ 38.997989] [] dev_queue_xmit+0x17/0x20 [ 39.003585] [] neigh_resolve_output+0x637/0x790 [ 39.009882] [] ? ip_finish_output2+0x6ab/0x1110 [ 39.016170] [] ip_finish_output2+0x6ab/0x1110 [ 39.022288] [] ? ip_finish_output2+0x212/0x1110 [ 39.028585] [] ? nf_ct_deliver_cached_events+0x335/0x560 [ 39.035657] [] ? nf_ct_deliver_cached_events+0x83/0x560 [ 39.042643] [] ? ip_copy_metadata+0x700/0x700 [ 39.048765] [] ? ip_options_fragment+0x1ac/0x280 [ 39.055141] [] ip_do_fragment+0x198b/0x2150 [ 39.061174] [] ? ip_copy_metadata+0x700/0x700 [ 39.067293] [] ip_fragment.constprop.50+0x143/0x200 [ 39.073932] [] ip_finish_output+0x6c4/0xbc0 [ 39.079876] [] ip_mc_output+0x233/0x980 [ 39.085479] [] ? ip_queue_xmit+0x1ab0/0x1ab0 [ 39.091515] [] ? ip_make_skb+0x116/0x210 [ 39.097219] [] ? ip_fragment.constprop.50+0x200/0x200 [ 39.104038] [] ? ip_flush_pending_frames+0x30/0x30 [ 39.110596] [] ip_local_out+0x9b/0x180 [ 39.116105] [] ip_send_skb+0x3c/0xc0 [ 39.121465] [] udp_send_skb+0x5c3/0xc60 [ 39.127060] [] udp_sendmsg+0x16ce/0x1bb0 [ 39.132745] [] ? ip_reply_glue_bits+0xc0/0xc0 [ 39.138862] [] ? udp4_lib_lookup+0x60/0x60 [ 39.144719] [] ? ip4_datagram_connect+0x50/0x50 [ 39.151011] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 39.157299] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 39.163589] [] ? _raw_spin_unlock_bh+0x30/0x40 [ 39.169800] [] ? release_sock+0x3b6/0x500 [ 39.175568] [] ? udp_v4_get_port+0x139/0x180 [ 39.181597] [] inet_sendmsg+0x203/0x4d0 [ 39.187206] [] ? inet_sendmsg+0x73/0x4d0 [ 39.192887] [] ? inet_recvmsg+0x4c0/0x4c0 [ 39.198668] [] sock_sendmsg+0xcc/0x110 [ 39.204181] [] SYSC_sendto+0x21c/0x370 [ 39.209698] [] ? SYSC_connect+0x300/0x300 [ 39.215469] [] ? sock_has_perm+0x29f/0x400 [ 39.221323] [] ? selinux_file_send_sigiotask+0x310/0x310 [ 39.228395] [] ? compat_sock_setsockopt.constprop.6+0xad/0x4c0 [ 39.235992] [] ? compat_SyS_futex+0x1e1/0x2f0 [ 39.242115] [] ? compat_SyS_get_robust_list+0x310/0x310 [ 39.249099] [] ? compat_SyS_setsockopt+0x18d/0x2a0 [ 39.255649] [] ? SyS_socket+0x121/0x1b0 [ 39.261250] [] ? scm_detach_fds_compat+0x3b0/0x3b0 [ 39.267799] [] SyS_sendto+0x40/0x50 [ 39.273060] [] ? SyS_getpeername+0x30/0x30 [ 39.278917] [] do_fast_syscall_32+0x326/0x8b0 2018/05/04 17:28:20 executed programs: 8 [ 39.285035] [] sysenter_flags_fixed+0xd/0x17 2018/05/04 17:28:25 executed programs: 290