[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.655687] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 23.980403] random: sshd: uninitialized urandom read (32 bytes read) [ 24.427533] random: sshd: uninitialized urandom read (32 bytes read) [ 24.988884] random: sshd: uninitialized urandom read (32 bytes read) [ 106.344890] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.36' (ECDSA) to the list of known hosts. [ 111.999040] random: sshd: uninitialized urandom read (32 bytes read) 2018/09/10 13:31:23 parsed 1 programs [ 113.315108] random: cc1: uninitialized urandom read (8 bytes read) 2018/09/10 13:31:25 executed programs: 0 [ 114.748948] IPVS: ftp: loaded support on port[0] = 21 [ 114.980379] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.987512] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.995205] device bridge_slave_0 entered promiscuous mode [ 115.013916] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.020356] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.028482] device bridge_slave_1 entered promiscuous mode [ 115.045922] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 115.063902] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 115.112608] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 115.132273] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 115.204605] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 115.212176] team0: Port device team_slave_0 added [ 115.229132] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 115.236807] team0: Port device team_slave_1 added [ 115.254314] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 115.274110] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 115.294625] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 115.313460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 115.449105] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.455574] bridge0: port 2(bridge_slave_1) entered forwarding state [ 115.462563] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.468963] bridge0: port 1(bridge_slave_0) entered forwarding state [ 115.971998] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.023716] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 116.076168] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 116.082858] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 116.091027] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 116.136396] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.456744] hrtimer: interrupt took 25549 ns [ 118.734901] [ 118.736770] ===================================== [ 118.741623] WARNING: bad unlock balance detected! [ 118.746555] 4.19.0-rc2-next-20180904+ #55 Not tainted [ 118.751746] ------------------------------------- [ 118.756589] kworker/u4:1/22 is trying to release lock (&file->mut) at: [ 118.763266] [] ucma_event_handler+0x788/0x1000 [ 118.769401] but there are no more locks to release! [ 118.774407] [ 118.774407] other info that might help us debug this: [ 118.781159] 4 locks held by kworker/u4:1/22: [ 118.785568] #0: 00000000cfd75845 ((wq_completion)"ib_addr"){+.+.}, at: process_one_work+0xb44/0x1aa0 [ 118.794957] #1: 00000000643b7ac2 ((work_completion)(&(&req->work)->work)){+.+.}, at: process_one_work+0xb9b/0x1aa0 [ 118.805724] #2: 000000003614ce59 (&id_priv->handler_mutex){+.+.}, at: addr_handler+0xed/0x430 [ 118.814514] #3: 00000000ceceb470 (&file->mut){+.+.}, at: ucma_event_handler+0x116/0x1000 [ 118.822849] [ 118.822849] stack backtrace: [ 118.827351] CPU: 1 PID: 22 Comm: kworker/u4:1 Not tainted 4.19.0-rc2-next-20180904+ #55 [ 118.835490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 118.844852] Workqueue: ib_addr process_one_req [ 118.849632] Call Trace: [ 118.852256] dump_stack+0x1c9/0x2b4 [ 118.855890] ? dump_stack_print_info.cold.2+0x52/0x52 [ 118.861082] ? vprintk_func+0x81/0x117 [ 118.864966] ? ucma_event_handler+0x788/0x1000 [ 118.869546] print_unlock_imbalance_bug.cold.49+0xcc/0xd8 [ 118.875080] lock_release+0x76e/0x9f0 [ 118.878896] ? ucma_event_handler+0x788/0x1000 [ 118.883485] ? lock_downgrade+0x8f0/0x8f0 [ 118.887819] ? mark_held_locks+0xc9/0x160 [ 118.891968] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 118.897145] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 118.902336] ? lockdep_hardirqs_on+0x421/0x5c0 [ 118.907014] ? trace_hardirqs_on+0xbd/0x2c0 [ 118.911348] ? kasan_check_read+0x11/0x20 [ 118.915667] ? __wake_up_common_lock+0x1d0/0x330 [ 118.920428] __mutex_unlock_slowpath+0x102/0x8c0 [ 118.925185] ? do_raw_spin_lock+0xc1/0x200 [ 118.929422] ? wait_for_completion+0x8d0/0x8d0 [ 118.934015] ? __wake_up_common_lock+0x1d0/0x330 [ 118.939188] ? __wake_up_common+0x7b0/0x7b0 [ 118.943513] ? ucma_event_handler+0xd4/0x1000 [ 118.948362] ? rcu_read_lock_sched_held+0x108/0x120 [ 118.953382] ? kmem_cache_alloc_trace+0x324/0x730 [ 118.958318] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 118.963429] ? lockdep_hardirqs_on+0x421/0x5c0 [ 118.968030] mutex_unlock+0xd/0x10 [ 118.971574] ucma_event_handler+0x788/0x1000 [ 118.975988] ? ucma_destroy_id+0x550/0x550 [ 118.980239] ? cma_comp_exch+0xab/0xd0 [ 118.984143] addr_handler+0x311/0x430 [ 118.987998] ? cma_work_handler+0x1f0/0x1f0 [ 118.992379] process_one_req+0x1a6/0x940 [ 118.996441] ? addr_resolve+0xc40/0xc40 [ 119.000512] ? graph_lock+0x170/0x170 [ 119.004322] ? lock_acquire+0x1e4/0x4f0 [ 119.008299] ? process_one_work+0xb9b/0x1aa0 [ 119.012718] ? _raw_spin_unlock_irq+0x27/0x70 [ 119.017540] ? __lock_is_held+0xb5/0x140 [ 119.021603] process_one_work+0xc73/0x1aa0 [ 119.025837] ? mark_held_locks+0x160/0x160 [ 119.030074] ? pwq_dec_nr_in_flight+0x4a0/0x4a0 [ 119.034894] ? __switch_to_asm+0x34/0x70 [ 119.038959] ? __switch_to_asm+0x40/0x70 [ 119.043060] ? __switch_to_asm+0x34/0x70 [ 119.047123] ? __switch_to_asm+0x34/0x70 [ 119.051347] ? __switch_to_asm+0x40/0x70 [ 119.055493] ? __switch_to_asm+0x34/0x70 [ 119.059610] ? __switch_to_asm+0x40/0x70 [ 119.063693] ? __switch_to_asm+0x34/0x70 [ 119.067766] ? lockdep_hardirqs_on+0x421/0x5c0 [ 119.073029] ? __sched_text_start+0x8/0x8 [ 119.077237] ? graph_lock+0x170/0x170 [ 119.081213] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 119.085973] ? lock_acquire+0x1e4/0x4f0 [ 119.089959] ? worker_thread+0x3dc/0x13c0 [ 119.094108] ? lock_release+0x9f0/0x9f0 [ 119.098082] ? trace_hardirqs_off+0xb8/0x2b0 [ 119.102551] ? kasan_check_read+0x11/0x20 [ 119.106702] ? worker_thread+0x3dc/0x13c0 [ 119.111013] ? trace_hardirqs_on+0x2c0/0x2c0 [ 119.115461] ? kasan_check_write+0x14/0x20 [ 119.119716] ? do_raw_spin_lock+0xc1/0x200 [ 119.123967] worker_thread+0x189/0x13c0 [ 119.127943] ? __switch_to_asm+0x34/0x70 [ 119.132008] ? process_one_work+0x1aa0/0x1aa0 [ 119.136587] ? graph_lock+0x170/0x170 [ 119.140388] ? graph_lock+0x170/0x170 [ 119.144186] ? find_held_lock+0x36/0x1c0 [ 119.148247] ? find_held_lock+0x36/0x1c0 [ 119.152316] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 119.157418] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 119.162534] ? lockdep_hardirqs_on+0x421/0x5c0 [ 119.167129] ? trace_hardirqs_on+0xbd/0x2c0 [ 119.171449] ? kasan_check_read+0x11/0x20 [ 119.175593] ? __kthread_parkme+0xd7/0x1b0 [ 119.179826] ? kasan_check_write+0x14/0x20 [ 119.184060] ? __kthread_parkme+0x58/0x1b0 [ 119.188297] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 119.193833] ? __kthread_parkme+0x106/0x1b0 [ 119.198382] kthread+0x35a/0x420 [ 119.201757] ? process_one_work+0x1aa0/0x1aa0 [ 119.206265] ? kthread_bind+0x40/0x40 [ 119.210067] ret_from_fork+0x3a/0x50