Warning: Permanently added '10.128.0.205' (ECDSA) to the list of known hosts. 2023/04/30 10:26:12 ignoring optional flag "sandboxArg"="0" 2023/04/30 10:26:13 parsed 1 programs [ 76.709427][ T5004] cgroup: Unknown subsys name 'net' [ 76.895567][ T5004] cgroup: Unknown subsys name 'rlimit' 2023/04/30 10:26:13 executed programs: 0 [ 77.019544][ T4999] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4999 'syz-execprog' [ 77.102087][ T5013] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.110158][ T5013] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.118022][ T5013] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.126426][ T5013] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.133993][ T5013] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 77.141870][ T5013] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.287499][ T5012] chnl_net:caif_netlink_parms(): no params data found [ 77.342439][ T5012] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.350206][ T5012] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.357863][ T5012] bridge_slave_0: entered allmulticast mode [ 77.364750][ T5012] bridge_slave_0: entered promiscuous mode [ 77.374479][ T5012] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.382040][ T5012] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.389648][ T5012] bridge_slave_1: entered allmulticast mode [ 77.396902][ T5012] bridge_slave_1: entered promiscuous mode [ 77.421642][ T5012] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.434233][ T5012] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.461822][ T5012] team0: Port device team_slave_0 added [ 77.469785][ T5012] team0: Port device team_slave_1 added [ 77.493109][ T5012] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.500269][ T5012] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.526256][ T5012] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.539338][ T5012] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.546431][ T5012] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.572573][ T5012] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.609708][ T5012] hsr_slave_0: entered promiscuous mode [ 77.616167][ T5012] hsr_slave_1: entered promiscuous mode [ 77.728422][ T5012] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 77.739302][ T5012] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 77.750104][ T5012] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 77.759675][ T5012] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 77.785220][ T5012] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.792467][ T5012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.800679][ T5012] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.807820][ T5012] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.868186][ T5012] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.882726][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 77.893919][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.903636][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.912287][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 77.927016][ T5012] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.938738][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.950400][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.957558][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.971652][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.980316][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.987441][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.008262][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 78.029116][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 78.037918][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 78.046676][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 78.054958][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 78.066920][ T5012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 78.222098][ T5012] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.230694][ T758] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 78.238581][ T758] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 78.260199][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 78.270270][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 78.292291][ T5012] veth0_vlan: entered promiscuous mode [ 78.299172][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 78.308289][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 78.318355][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 78.327082][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 78.338789][ T5012] veth1_vlan: entered promiscuous mode [ 78.359443][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 78.368063][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 78.379497][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 78.388852][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 78.401772][ T5012] veth0_macvtap: entered promiscuous mode [ 78.411083][ T5012] veth1_macvtap: entered promiscuous mode [ 78.427796][ T5012] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.436929][ T758] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 78.445783][ T758] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 78.454145][ T758] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 78.463887][ T758] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 78.475751][ T5012] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.487462][ T5012] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.496684][ T5012] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.505929][ T5012] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.514657][ T5012] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.526171][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 78.534884][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 78.610778][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.630975][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.642092][ T5023] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 78.650577][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.658768][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.667972][ T5023] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 79.176038][ T5013] Bluetooth: hci0: command 0x0409 tx timeout [ 80.528709][ T10] [ 80.531102][ T10] ====================================================== [ 80.538142][ T10] WARNING: possible circular locking dependency detected [ 80.545177][ T10] 6.3.0-next-20230428-syzkaller #0 Not tainted [ 80.551333][ T10] ------------------------------------------------------ [ 80.558347][ T10] kworker/u4:0/10 is trying to acquire lock: [ 80.564325][ T10] ffff88807d3a34b0 (&rs->rs_recv_lock){....}-{2:2}, at: rds_wake_sk_sleep+0x23/0xe0 [ 80.573777][ T10] [ 80.573777][ T10] but task is already holding lock: [ 80.581151][ T10] ffff88807bb0c900 (&rm->m_rs_lock){....}-{2:2}, at: rds_send_remove_from_sock+0x340/0x9e0 [ 80.591202][ T10] [ 80.591202][ T10] which lock already depends on the new lock. [ 80.591202][ T10] [ 80.601617][ T10] [ 80.601617][ T10] the existing dependency chain (in reverse order) is: [ 80.610682][ T10] [ 80.610682][ T10] -> #1 (&rm->m_rs_lock){....}-{2:2}: [ 80.618261][ T10] _raw_spin_lock_irqsave+0x3d/0x60 [ 80.624006][ T10] rds_message_put+0x1dd/0xc30 [ 80.629322][ T10] rds_inc_put+0x13e/0x1a0 [ 80.634290][ T10] rds_clear_recv_queue+0x14b/0x350 [ 80.640036][ T10] rds_release+0xd8/0x3c0 [ 80.644907][ T10] __sock_release+0xcd/0x290 [ 80.650039][ T10] sock_close+0x1c/0x20 [ 80.654839][ T10] __fput+0x27c/0xa90 [ 80.659368][ T10] task_work_run+0x16f/0x270 [ 80.664499][ T10] exit_to_user_mode_prepare+0x210/0x240 [ 80.670674][ T10] syscall_exit_to_user_mode+0x1d/0x50 [ 80.676687][ T10] do_syscall_64+0x46/0xb0 [ 80.681663][ T10] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 80.688099][ T10] [ 80.688099][ T10] -> #0 (&rs->rs_recv_lock){....}-{2:2}: [ 80.695945][ T10] __lock_acquire+0x2f21/0x5df0 [ 80.701349][ T10] lock_acquire.part.0+0x11c/0x370 [ 80.707012][ T10] _raw_read_lock_irqsave+0x49/0x90 [ 80.712754][ T10] rds_wake_sk_sleep+0x23/0xe0 [ 80.718066][ T10] rds_send_remove_from_sock+0xb9/0x9e0 [ 80.724161][ T10] rds_send_path_drop_acked+0x2f3/0x3d0 [ 80.730260][ T10] rds_tcp_write_space+0x1b5/0x6d0 [ 80.735922][ T10] tcp_check_space+0x11b/0x810 [ 80.741228][ T10] tcp_rcv_established+0x8be/0x1f90 [ 80.746972][ T10] tcp_v4_do_rcv+0x65a/0x9c0 [ 80.752112][ T10] __release_sock+0x133/0x3b0 [ 80.757326][ T10] release_sock+0x58/0x1b0 [ 80.762365][ T10] rds_send_xmit+0xafc/0x2580 [ 80.767586][ T10] rds_send_worker+0x96/0x2e0 [ 80.772813][ T10] process_one_work+0x99a/0x15e0 [ 80.778304][ T10] worker_thread+0x67d/0x10c0 [ 80.783539][ T10] kthread+0x344/0x440 [ 80.788243][ T10] ret_from_fork+0x1f/0x30 [ 80.793209][ T10] [ 80.793209][ T10] other info that might help us debug this: [ 80.793209][ T10] [ 80.803960][ T10] Possible unsafe locking scenario: [ 80.803960][ T10] [ 80.811414][ T10] CPU0 CPU1 [ 80.816789][ T10] ---- ---- [ 80.822161][ T10] lock(&rm->m_rs_lock); [ 80.826507][ T10] lock(&rs->rs_recv_lock); [ 80.833648][ T10] lock(&rm->m_rs_lock); [ 80.840507][ T10] rlock(&rs->rs_recv_lock); [ 80.845194][ T10] [ 80.845194][ T10] *** DEADLOCK *** [ 80.845194][ T10] [ 80.853341][ T10] 5 locks held by kworker/u4:0/10: [ 80.858463][ T10] #0: ffff88814a8ba138 ((wq_completion)krdsd){+.+.}-{0:0}, at: process_one_work+0x883/0x15e0 [ 80.868787][ T10] #1: ffffc900000f7db0 ((work_completion)(&(&cp->cp_send_w)->work)){+.+.}-{0:0}, at: process_one_work+0x8b7/0x15e0 [ 80.881014][ T10] #2: ffff88807e748d70 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sock_set_cork+0x1a/0xa0 [ 80.890932][ T10] #3: ffff88807e748ff8 (k-clock-AF_INET){++.-}-{2:2}, at: rds_tcp_write_space+0x29/0x6d0 [ 80.900937][ T10] #4: ffff88807bb0c900 (&rm->m_rs_lock){....}-{2:2}, at: rds_send_remove_from_sock+0x340/0x9e0 [ 80.911434][ T10] [ 80.911434][ T10] stack backtrace: [ 80.917332][ T10] CPU: 0 PID: 10 Comm: kworker/u4:0 Not tainted 6.3.0-next-20230428-syzkaller #0 [ 80.926457][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 80.936524][ T10] Workqueue: krdsd rds_send_worker [ 80.941690][ T10] Call Trace: [ 80.944986][ T10] [ 80.947948][ T10] dump_stack_lvl+0xd9/0x150 [ 80.952580][ T10] check_noncircular+0x25f/0x2e0 [ 80.957556][ T10] ? register_lock_class+0xbe/0x1120 [ 80.962890][ T10] ? print_circular_bug+0x730/0x730 [ 80.968129][ T10] ? register_lock_class+0xbe/0x1120 [ 80.973446][ T10] ? rds_message_put+0x7dc/0xc30 [ 80.978410][ T10] ? is_dynamic_key.part.0+0x1f0/0x1f0 [ 80.983921][ T10] ? process_one_work+0x99a/0x15e0 [ 80.989068][ T10] ? worker_thread+0x67d/0x10c0 [ 80.993948][ T10] ? kthread+0x344/0x440 [ 80.998214][ T10] ? ret_from_fork+0x1f/0x30 [ 81.002838][ T10] __lock_acquire+0x2f21/0x5df0 [ 81.007732][ T10] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 81.013764][ T10] ? mark_held_locks+0x9f/0xe0 [ 81.018578][ T10] lock_acquire.part.0+0x11c/0x370 [ 81.023751][ T10] ? rds_wake_sk_sleep+0x23/0xe0 [ 81.028738][ T10] ? lock_sync+0x190/0x190 [ 81.033199][ T10] ? rcu_is_watching+0x12/0xb0 [ 81.038425][ T10] ? trace_lock_acquire+0x12d/0x180 [ 81.043662][ T10] ? rds_wake_sk_sleep+0x23/0xe0 [ 81.048624][ T10] ? lock_acquire+0x32/0xc0 [ 81.053165][ T10] ? rds_wake_sk_sleep+0x23/0xe0 [ 81.058130][ T10] _raw_read_lock_irqsave+0x49/0x90 [ 81.063352][ T10] ? rds_wake_sk_sleep+0x23/0xe0 [ 81.068310][ T10] rds_wake_sk_sleep+0x23/0xe0 [ 81.073117][ T10] rds_send_remove_from_sock+0xb9/0x9e0 [ 81.078739][ T10] rds_send_path_drop_acked+0x2f3/0x3d0 [ 81.084331][ T10] ? rds_tcp_recv_exit+0x20/0x20 [ 81.089347][ T10] ? rds_send_remove_from_sock+0x9e0/0x9e0 [ 81.095202][ T10] ? lock_acquire+0x32/0xc0 [ 81.099740][ T10] ? rds_tcp_write_space+0x29/0x6d0 [ 81.104978][ T10] ? sk_stream_wait_close+0x3e0/0x3e0 [ 81.110404][ T10] rds_tcp_write_space+0x1b5/0x6d0 [ 81.115540][ T10] ? ktime_get+0x38e/0x470 [ 81.119989][ T10] tcp_check_space+0x11b/0x810 [ 81.124777][ T10] tcp_rcv_established+0x8be/0x1f90 [ 81.129999][ T10] ? __release_sock+0xd4/0x3b0 [ 81.134778][ T10] ? tcp_check_space+0x810/0x810 [ 81.139741][ T10] tcp_v4_do_rcv+0x65a/0x9c0 [ 81.144376][ T10] __release_sock+0x133/0x3b0 [ 81.149082][ T10] ? release_sock+0x1f/0x1b0 [ 81.153719][ T10] release_sock+0x58/0x1b0 [ 81.158158][ T10] ? rds_tcp_xmit_path_prepare+0xa0/0xa0 [ 81.163838][ T10] rds_send_xmit+0xafc/0x2580 [ 81.168574][ T10] ? rds_send_mprds_hash+0x450/0x450 [ 81.173914][ T10] rds_send_worker+0x96/0x2e0 [ 81.178630][ T10] process_one_work+0x99a/0x15e0 [ 81.183627][ T10] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 81.189034][ T10] ? rcu_is_watching+0x12/0xb0 [ 81.193820][ T10] ? spin_bug+0x1c0/0x1c0 [ 81.198167][ T10] ? lock_acquire+0x32/0xc0 [ 81.202698][ T10] ? worker_thread+0x16d/0x10c0 [ 81.207586][ T10] worker_thread+0x67d/0x10c0 [ 81.212308][ T10] ? process_one_work+0x15e0/0x15e0 [ 81.217539][ T10] kthread+0x344/0x440 [ 81.221639][ T10] ? kthread_complete_and_exit+0x40/0x40 [ 81.227305][ T10] ret_from_fork+0x1f/0x30 [ 81.231774][ T10] [ 81.255096][ T4407] Bluetooth: hci0: command 0x041b tx timeout 2023/04/30 10:26:18 executed programs: 56 [ 83.336445][ T5013] Bluetooth: hci0: command 0x040f tx timeout [ 85.415228][ T5013] Bluetooth: hci0: command 0x0419 tx timeout 2023/04/30 10:26:23 executed programs: 200