[ 39.995168] audit: type=1800 audit(1569313935.080:32): pid=7474 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2450 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 45.428042] kauditd_printk_skb: 2 callbacks suppressed [ 45.428055] audit: type=1400 audit(1569313940.600:35): avc: denied { map } for pid=7649 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.12' (ECDSA) to the list of known hosts. [ 52.153732] audit: type=1400 audit(1569313947.320:36): avc: denied { map } for pid=7661 comm="syz-executor434" path="/root/syz-executor434670664" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 52.180699] IPVS: ftp: loaded support on port[0] = 21 [ 52.229764] chnl_net:caif_netlink_parms(): no params data found [ 52.262956] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.269894] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.278259] device bridge_slave_0 entered promiscuous mode [ 52.287076] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.293589] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.300696] device bridge_slave_1 entered promiscuous mode [ 52.316375] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 52.325987] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 52.342870] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 52.350689] team0: Port device team_slave_0 added [ 52.356209] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 52.364095] team0: Port device team_slave_1 added [ 52.369485] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 52.376904] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 52.459314] device hsr_slave_0 entered promiscuous mode [ 52.497621] device hsr_slave_1 entered promiscuous mode [ 52.537857] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 52.545026] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 52.559403] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.566037] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.573166] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.579680] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.611234] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 52.619135] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.627134] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 52.636664] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 52.656006] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.663697] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.672296] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 52.682351] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 52.688708] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.698001] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 52.706523] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.713040] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.723798] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.732389] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.738824] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.759394] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 52.768849] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 52.776998] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 52.785826] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 52.796347] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network executing program [ 52.809280] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 52.815596] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 52.823496] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 52.836615] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 52.848469] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 52.861053] netlink: 80 bytes leftover after parsing attributes in process `syz-executor434'. [ 52.870133] netlink: 48 bytes leftover after parsing attributes in process `syz-executor434'. [ 52.892181] [ 52.893960] ============================= [ 52.898171] WARNING: suspicious RCU usage [ 52.902485] 4.19.75 #0 Not tainted [ 52.906050] ----------------------------- [ 52.910261] include/net/sch_generic.h:419 suspicious rcu_dereference_check() usage! [ 52.918890] [ 52.918890] other info that might help us debug this: [ 52.918890] [ 52.927561] [ 52.927561] rcu_scheduler_active = 2, debug_locks = 1 [ 52.934263] 3 locks held by syz-executor434/7662: [ 52.939161] #0: 00000000ab3841ce (rcu_read_lock_bh){....}, at: ip_finish_output2+0x2b0/0x1730 [ 52.948017] #1: 00000000ab3841ce (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x214/0x2fe0 [ 52.957047] #2: 000000001f9ccf2b (&qdisc_tx_lock){+...}, at: __dev_queue_xmit+0x147c/0x2fe0 [ 52.965726] [ 52.965726] stack backtrace: [ 52.970274] CPU: 0 PID: 7662 Comm: syz-executor434 Not tainted 4.19.75 #0 [ 52.977313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.986672] Call Trace: [ 52.989394] dump_stack+0x172/0x1f0 [ 52.993169] lockdep_rcu_suspicious+0x153/0x15d [ 52.998407] netem_enqueue+0x1ada/0x28f0 [ 53.002472] ? lock_acquire+0x16f/0x3f0 [ 53.006463] ? kasan_check_write+0x14/0x20 [ 53.010974] ? do_raw_spin_lock+0xc8/0x240 [ 53.015713] __dev_queue_xmit+0x153d/0x2fe0 [ 53.020139] ? mark_held_locks+0x100/0x100 [ 53.025223] ? netdev_pick_tx+0x300/0x300 [ 53.029562] ? ip_finish_output+0x737/0xce0 [ 53.033909] ? find_held_lock+0x35/0x130 [ 53.038162] ? ip_finish_output+0x737/0xce0 [ 53.042535] ? ip_finish_output2+0x1295/0x1730 [ 53.047117] ? ip_finish_output+0x737/0xce0 [ 53.051437] ? ip_finish_output2+0x1295/0x1730 [ 53.056030] dev_queue_xmit+0x18/0x20 [ 53.059845] ? dev_queue_xmit+0x18/0x20 [ 53.063817] ip_finish_output2+0x1041/0x1730 [ 53.068438] ? ip_copy_metadata+0xce0/0xce0 [ 53.072791] ip_finish_output+0x737/0xce0 [ 53.076969] ? ip_finish_output+0x737/0xce0 [ 53.081307] ip_mc_output+0x298/0xf50 [ 53.085127] ? __ip_queue_xmit+0x1bc0/0x1bc0 [ 53.089545] ? ip_fragment.constprop.0+0x240/0x240 [ 53.094522] ? ip_make_skb+0x1b1/0x2c0 [ 53.098414] ? ip_reply_glue_bits+0xc0/0xc0 [ 53.102740] ip_local_out+0xbb/0x190 [ 53.106499] ip_send_skb+0x42/0xf0 [ 53.110050] udp_send_skb.isra.0+0x6bb/0x11d0 [ 53.114552] udp_sendmsg+0x1e04/0x25e0 [ 53.118448] ? ip_reply_glue_bits+0xc0/0xc0 [ 53.122771] ? udp_push_pending_frames+0xf0/0xf0 [ 53.127526] ? __might_fault+0x12b/0x1e0 [ 53.131590] ? find_held_lock+0x35/0x130 [ 53.135662] ? sock_has_perm+0x209/0x2a0 [ 53.139773] ? selinux_secmark_relabel_packet+0xe0/0xe0 [ 53.145147] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 53.150686] ? copy_msghdr_from_user+0x2d0/0x430 [ 53.155556] ? _raw_spin_unlock_bh+0x31/0x40 [ 53.160619] inet_sendmsg+0x141/0x5d0 [ 53.164432] ? inet_sendmsg+0x141/0x5d0 [ 53.168416] ? ipip_gro_receive+0x100/0x100 [ 53.172752] sock_sendmsg+0xd7/0x130 [ 53.176670] ___sys_sendmsg+0x3e2/0x920 [ 53.180662] ? copy_msghdr_from_user+0x430/0x430 [ 53.185435] ? mark_held_locks+0x100/0x100 [ 53.189677] ? ip4_datagram_release_cb+0x259/0xb90 [ 53.194610] ? find_held_lock+0x35/0x130 [ 53.198674] ? ip4_datagram_release_cb+0x259/0xb90 [ 53.203667] ? __might_fault+0x12b/0x1e0 [ 53.207727] ? find_held_lock+0x35/0x130 [ 53.211958] ? __might_fault+0x12b/0x1e0 [ 53.216055] __sys_sendmmsg+0x1bf/0x4e0 [ 53.220067] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 53.224396] ? release_sock+0x156/0x1c0 [ 53.228425] ? __sys_connect+0x12d/0x330 [ 53.233572] ? __ia32_sys_accept+0xb0/0xb0 [ 53.237810] ? __sys_setsockopt+0x1a4/0x280 [ 53.242136] ? kernel_accept+0x310/0x310 [ 53.246195] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 53.250967] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 53.255887] ? do_syscall_64+0x26/0x620 [ 53.259914] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 53.265325] ? do_syscall_64+0x26/0x620 [ 53.269324] __x64_sys_sendmmsg+0x9d/0x100 [ 53.273578] do_syscall_64+0xfd/0x620 [ 53.277631] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 53.282905] RIP: 0033:0x4423a9 [ 53.286143] Code: 43 02 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 53.305048] RSP: 002b:00007ffff4cf17f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 53.312799] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004423a9 [ 53.320100] RDX: 04000000000001a8 RSI: 0000000020007fc0 RDI: 0000000000000005 [ 53.327368] RBP: 00007ffff4cf1820 R08: 0000000000000400 R09: 0000000000000400 [ 53.335255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.342613] R13: 00000000004038e0 R14: 0000000000000000 R15: 0000000000000000