[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 18.685534] random: sshd: uninitialized urandom read (32 bytes read, 31 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.292089] random: sshd: uninitialized urandom read (32 bytes read, 35 bits of entropy available) [ 21.463366] random: sshd: uninitialized urandom read (32 bytes read, 35 bits of entropy available) [ 22.517653] random: sshd: uninitialized urandom read (32 bytes read, 127 bits of entropy available) [ 22.605735] random: nonblocking pool is initialized Warning: Permanently added '10.128.10.11' (ECDSA) to the list of known hosts. 2018/04/23 08:52:56 parsed 1 programs 2018/04/23 08:52:56 executed programs: 0 [ 28.641553] IPVS: Creating netns size=2552 id=1 [ 28.700779] IPVS: Creating netns size=2552 id=2 [ 28.751980] IPVS: Creating netns size=2552 id=3 [ 28.807725] IPVS: Creating netns size=2552 id=4 [ 28.915239] IPVS: Creating netns size=2552 id=5 [ 29.014412] IPVS: Creating netns size=2552 id=6 [ 29.107390] IPVS: Creating netns size=2552 id=7 [ 29.243035] IPVS: Creating netns size=2552 id=8 [ 29.430976] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.512967] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.672999] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.722452] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.832284] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 29.841624] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.890689] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.922252] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.114362] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.139216] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.155573] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.197368] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.208103] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.215899] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 30.276911] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 30.285769] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.329605] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.512984] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 30.586133] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.606275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.624341] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.645835] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.657376] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.674251] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.685351] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 30.697685] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.707396] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 30.716334] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.727562] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.741913] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 30.752878] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.763223] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 30.774401] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.803624] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.812627] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 30.848896] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.935924] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.944185] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.054270] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.075478] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.115385] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.125591] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.135038] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.178102] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.196326] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.207499] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.271358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.281822] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.310362] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.361376] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.370675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.392076] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.411471] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.498950] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.514453] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.565391] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.587408] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.609758] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.642090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.674713] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.716539] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.771730] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.832421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.873675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 33.904480] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 34.000444] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 34.139339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.182975] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 34.213043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.256853] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 34.303669] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 34.398484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.443866] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.468246] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.595954] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 34.743600] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 34.800019] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 34.814351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.942892] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.971395] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.714616] [ 35.716281] ====================================================== [ 35.722582] [ INFO: possible circular locking dependency detected ] [ 35.728977] 4.4.125-g38f41ec #21 Not tainted [ 35.733372] ------------------------------------------------------- [ 35.739762] syz-executor4/5770 is trying to acquire lock: [ 35.745280] (&(&q->lock)->rlock){+.-...}, at: [] ip_defrag+0x31d/0x3eb0 [ 35.754192] [ 35.754192] but task is already holding lock: [ 35.760145] (_xmit_NETROM){+.-...}, at: [] sch_direct_xmit+0x23c/0x760 [ 35.768978] [ 35.768978] which lock already depends on the new lock. [ 35.768978] [ 35.777366] [ 35.777366] the existing dependency chain (in reverse order) is: [ 35.784971] -> #1 (_xmit_NETROM){+.-...}: [ 35.789794] [] lock_acquire+0x15e/0x460 [ 35.796053] [] _raw_spin_lock_irqsave+0x4e/0x70 [ 35.803098] [] depot_save_stack+0x276/0x640 [ 35.809712] [] save_stack+0xa3/0xd0 [ 35.815638] [] kasan_kmalloc+0xad/0xe0 [ 35.821811] [] kasan_slab_alloc+0x12/0x20 [ 35.828243] [] kmem_cache_alloc+0xba/0x290 [ 35.834855] [] inet_getpeer.part.3+0xec8/0x1560 [ 35.841819] [] inet_getpeer+0x572/0x700 [ 35.848080] [] icmp6_send+0x1787/0x1b70 [ 35.854346] [] icmpv6_param_prob+0x29/0x40 [ 35.860880] [] ipv6_frag_rcv+0x4010/0x5020 [ 35.867414] [] ip6_input_finish+0x329/0x1540 [ 35.874110] [] ip6_input+0x106/0x200 [ 35.881499] [] ip6_rcv_finish+0x138/0x630 [ 35.887940] [] ipv6_rcv+0x1055/0x1e60 [ 35.894025] [] __netif_receive_skb_core+0xa59/0x28f0 [ 35.901419] [] __netif_receive_skb+0x5b/0x1c0 [ 35.908206] [] process_backlog+0x213/0x690 [ 35.914728] [] net_rx_action+0x373/0xe70 [ 35.921079] [] __do_softirq+0x227/0xa38 [ 35.927343] [] do_softirq_own_stack+0x1c/0x30 [ 35.934125] [] do_softirq.part.17+0x54/0x60 [ 35.940730] [] do_softirq+0x19/0x20 [ 35.946640] [] netif_rx_ni+0x166/0x3a0 [ 35.952835] [] tun_get_user+0xc74/0x2340 [ 35.959185] [] tun_chr_write_iter+0xd5/0x190 [ 35.965874] [] do_iter_readv_writev+0x138/0x1e0 [ 35.972840] [] compat_do_readv_writev+0x2d4/0x6e0 [ 35.979964] [] compat_writev+0xdc/0x150 [ 35.986226] [] compat_SyS_writev+0xd8/0x1b0 [ 35.992830] [] do_fast_syscall_32+0x321/0x8a0 [ 35.999612] [] sysenter_flags_fixed+0xd/0x17 [ 36.006311] -> #0 (&(&q->lock)->rlock){+.-...}: [ 36.011643] [] __lock_acquire+0x371f/0x4b50 [ 36.018254] [] lock_acquire+0x15e/0x460 [ 36.024512] [] _raw_spin_lock+0x36/0x50 [ 36.030774] [] ip_defrag+0x31d/0x3eb0 [ 36.036856] [] ip_check_defrag+0x383/0x770 [ 36.043377] [] packet_rcv_fanout+0x192/0x620 [ 36.050069] [] dev_hard_start_xmit+0x62b/0x1220 [ 36.057049] [] sch_direct_xmit+0x2c1/0x760 [ 36.063575] [] __dev_queue_xmit+0x148e/0x1cc0 [ 36.070357] [] dev_queue_xmit+0x17/0x20 [ 36.076791] [] neigh_resolve_output+0x469/0x770 [ 36.083743] [] ip_finish_output2+0x6f4/0x10b0 [ 36.090530] [] ip_do_fragment+0xcbf/0x2120 [ 36.097133] [] ip_fragment.constprop.49+0x145/0x200 [ 36.104437] [] ip_finish_output+0x50b/0xb00 [ 36.111046] [] ip_mc_output+0x237/0x980 [ 36.117329] [] ip_local_out+0x95/0x170 [ 36.123513] [] ip_send_skb+0x3c/0xc0 [ 36.129521] [] udp_send_skb+0x66c/0xcd0 [ 36.135782] [] udp_sendmsg+0x981/0x1c30 [ 36.142045] [] inet_sendmsg+0x2bc/0x4c0 [ 36.148300] [] sock_sendmsg+0xca/0x110 [ 36.154480] [] SYSC_sendto+0x2c8/0x340 [ 36.160627] [] SyS_sendto+0x40/0x50 [ 36.166512] [] do_fast_syscall_32+0x321/0x8a0 [ 36.173267] [] sysenter_flags_fixed+0xd/0x17 [ 36.180288] [ 36.180288] other info that might help us debug this: [ 36.180288] [ 36.188397] Possible unsafe locking scenario: [ 36.188397] [ 36.194428] CPU0 CPU1 [ 36.199075] ---- ---- [ 36.203714] lock(_xmit_NETROM); [ 36.207373] lock(&(&q->lock)->rlock); [ 36.214063] lock(_xmit_NETROM); [ 36.220235] lock(&(&q->lock)->rlock); [ 36.224405] [ 36.224405] *** DEADLOCK *** [ 36.224405] [ 36.230434] 4 locks held by syz-executor4/5770: [ 36.235069] #0: (rcu_read_lock_bh){......}, at: [] ip_finish_output2+0x203/0x10b0 [ 36.245006] #1: (rcu_read_lock_bh){......}, at: [] __dev_queue_xmit+0x1d5/0x1cc0 [ 36.254850] #2: (_xmit_NETROM){+.-...}, at: [] sch_direct_xmit+0x23c/0x760 [ 36.264181] #3: (rcu_read_lock){......}, at: [] dev_hard_start_xmit+0xa6/0x1220 [ 36.273919] [ 36.273919] stack backtrace: [ 36.278387] CPU: 0 PID: 5770 Comm: syz-executor4 Not tainted 4.4.125-g38f41ec #21 [ 36.285975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.295299] 0000000000000000 37f724ec4b85a5dd ffff8801c7a16cc8 ffffffff81d067bd [ 36.303272] ffffffff851c02b0 ffffffff851c02b0 ffffffff851bee70 ffff8801d91fe980 [ 36.311247] ffff8801d91fe000 ffff8801c7a16d10 ffffffff81234081 ffff8801d91fe980 [ 36.319228] Call Trace: [ 36.321790] [] dump_stack+0xc1/0x124 [ 36.327129] [] print_circular_bug+0x271/0x310 [ 36.333246] [] __lock_acquire+0x371f/0x4b50 [ 36.339192] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 36.346186] [] ? trace_hardirqs_on_caller+0x266/0x590 [ 36.352996] [] lock_acquire+0x15e/0x460 [ 36.358590] [] ? ip_defrag+0x31d/0x3eb0 [ 36.364184] [] ? _raw_spin_unlock+0x2c/0x50 [ 36.370211] [] ? inet_frag_find+0x25d/0x9c0 [ 36.376156] [] _raw_spin_lock+0x36/0x50 [ 36.381755] [] ? ip_defrag+0x31d/0x3eb0 [ 36.387348] [] ip_defrag+0x31d/0x3eb0 [ 36.392769] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 36.399749] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 36.406730] [] ? ip_expire+0x770/0x770 [ 36.412235] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 36.419219] [] ip_check_defrag+0x383/0x770 [ 36.425078] [] ? ip_defrag+0x3eb0/0x3eb0 [ 36.430766] [] ? kvm_clock_read+0x23/0x40 [ 36.436536] [] packet_rcv_fanout+0x192/0x620 [ 36.442564] [] ? packet_setsockopt+0x2270/0x2270 [ 36.448940] [] dev_hard_start_xmit+0x62b/0x1220 [ 36.455230] [] ? dev_hard_start_xmit+0xa6/0x1220 [ 36.461605] [] sch_direct_xmit+0x2c1/0x760 [ 36.467462] [] ? dev_deactivate_queue.constprop.34+0x150/0x150 [ 36.475062] [] __dev_queue_xmit+0x148e/0x1cc0 [ 36.481183] [] ? __dev_queue_xmit+0x1d5/0x1cc0 [ 36.487482] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 36.494467] [] ? netdev_pick_tx+0x310/0x310 [ 36.500411] [] ? memcpy+0x45/0x50 [ 36.505491] [] dev_queue_xmit+0x17/0x20 [ 36.511088] [] neigh_resolve_output+0x469/0x770 [ 36.517384] [] ? ip_finish_output2+0x6f4/0x10b0 [ 36.523673] [] ? eth_mac_addr+0x1a0/0x1a0 [ 36.529440] [] ip_finish_output2+0x6f4/0x10b0 [ 36.535554] [] ? ip_finish_output2+0x203/0x10b0 [ 36.541843] [] ? nf_ct_deliver_cached_events+0x293/0x5f0 [ 36.548927] [] ? nf_ct_deliver_cached_events+0x89/0x5f0 [ 36.555926] [] ? nf_ct_expect_register_notifier+0x110/0x110 [ 36.563255] [] ? dst_output+0x150/0x150 [ 36.568854] [] ? ip_options_fragment+0x1b2/0x2a0 [ 36.575322] [] ip_do_fragment+0xcbf/0x2120 [ 36.581176] [] ? dst_output+0x150/0x150 [ 36.586771] [] ip_fragment.constprop.49+0x145/0x200 [ 36.593407] [] ip_finish_output+0x50b/0xb00 [ 36.599356] [] ip_mc_output+0x237/0x980 [ 36.604949] [] ? ip_queue_xmit+0x16c0/0x16c0 [ 36.610977] [] ? ip_fragment.constprop.49+0x200/0x200 [ 36.617788] [] ? ip_flush_pending_frames+0x30/0x30 [ 36.624336] [] ip_local_out+0x95/0x170 [ 36.629849] [] ip_send_skb+0x3c/0xc0 [ 36.635186] [] udp_send_skb+0x66c/0xcd0 [ 36.640779] [] udp_sendmsg+0x981/0x1c30 [ 36.646374] [] ? ip_reply_glue_bits+0xc0/0xc0 [ 36.652488] [] ? udp_seq_next+0x80/0x80 [ 36.658086] [] ? sock_has_perm+0x1c1/0x400 [ 36.663939] [] ? sock_has_perm+0x29f/0x400 [ 36.669966] [] ? sock_has_perm+0x9f/0x400 [ 36.675736] [] ? inet_sendmsg+0x201/0x4c0 [ 36.681505] [] inet_sendmsg+0x2bc/0x4c0 [ 36.687098] [] ? inet_sendmsg+0x73/0x4c0 [ 36.692778] [] ? inet_recvmsg+0x4c0/0x4c0 [ 36.698548] [] sock_sendmsg+0xca/0x110 [ 36.704055] [] SYSC_sendto+0x2c8/0x340 [ 36.709566] [] ? SYSC_connect+0x310/0x310 [ 36.715334] [] ? ip4_datagram_connect+0x3a/0x50 [ 36.721623] [] ? inet_dgram_connect+0x172/0x1f0 [ 36.727916] [] ? SYSC_connect+0x212/0x310 [ 36.733685] [] ? compat_SyS_futex+0x1f9/0x2a0 [ 36.739800] [] ? fd_install+0x4d/0x60 [ 36.745223] [] ? compat_SyS_get_robust_list+0x300/0x300 [ 36.752205] [] ? SyS_socket+0x121/0x1b0 [ 36.757800] [] ? move_addr_to_kernel+0x50/0x50 [ 36.764005] [] SyS_sendto+0x40/0x50 2018/04/23 08:53:04 executed programs: 8 [ 36.769254] [] ? SyS_getpeername+0x30/0x30 [ 36.775109] [] do_fast_syscall_32+0x321/0x8a0 [ 36.781227] [] sysenter_flags_fixed+0xd/0x17 2018/04/23 08:53:09 executed programs: 107