[ 38.353239][ T26] audit: type=1800 audit(1555648817.573:27): pid=7532 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 38.374840][ T26] audit: type=1800 audit(1555648817.583:28): pid=7532 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 39.182835][ T26] audit: type=1800 audit(1555648818.463:29): pid=7532 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 39.203404][ T26] audit: type=1800 audit(1555648818.463:30): pid=7532 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.209' (ECDSA) to the list of known hosts. 2019/04/19 04:40:27 parsed 1 programs 2019/04/19 04:40:28 executed programs: 0 syzkaller login: [ 49.468243][ T7699] IPVS: ftp: loaded support on port[0] = 21 [ 49.523114][ T7699] chnl_net:caif_netlink_parms(): no params data found [ 49.550404][ T7699] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.558586][ T7699] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.566562][ T7699] device bridge_slave_0 entered promiscuous mode [ 49.574906][ T7699] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.582107][ T7699] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.589699][ T7699] device bridge_slave_1 entered promiscuous mode [ 49.604658][ T7699] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 49.614168][ T7699] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 49.630790][ T7699] team0: Port device team_slave_0 added [ 49.637712][ T7699] team0: Port device team_slave_1 added [ 49.692534][ T7699] device hsr_slave_0 entered promiscuous mode [ 49.730948][ T7699] device hsr_slave_1 entered promiscuous mode [ 49.787728][ T7699] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.794981][ T7699] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.803180][ T7699] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.810347][ T7699] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.840361][ T7699] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.853592][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.864212][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.872558][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.881127][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 49.892227][ T7699] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.902400][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.910894][ T3483] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.918004][ T3483] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.937936][ T7699] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 49.949072][ T7699] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 49.963234][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.972394][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.979429][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.987850][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 49.997713][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 50.006754][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.015298][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.023852][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 50.031405][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 50.045798][ T7699] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.136845][ T7705] [ 50.139212][ T7705] ====================================================== [ 50.146208][ T7705] WARNING: possible circular locking dependency detected [ 50.153312][ T7705] 5.1.0-rc5+ #76 Not tainted [ 50.158023][ T7705] ------------------------------------------------------ [ 50.165159][ T7705] syz-executor.0/7705 is trying to acquire lock: [ 50.171467][ T7705] 00000000826c1133 (&rp->fetch_lock){+.+.}, at: mon_bin_vma_fault+0x73/0x2d0 [ 50.180227][ T7705] [ 50.180227][ T7705] but task is already holding lock: [ 50.187625][ T7705] 000000000dbc8828 (&mm->mmap_sem){++++}, at: __mm_populate+0x270/0x380 [ 50.196148][ T7705] [ 50.196148][ T7705] which lock already depends on the new lock. [ 50.196148][ T7705] [ 50.206540][ T7705] [ 50.206540][ T7705] the existing dependency chain (in reverse order) is: [ 50.215642][ T7705] [ 50.215642][ T7705] -> #1 (&mm->mmap_sem){++++}: [ 50.222795][ T7705] lock_acquire+0x16f/0x3f0 [ 50.227910][ T7705] __might_fault+0x15e/0x1e0 [ 50.233069][ T7705] _copy_to_user+0x30/0x120 [ 50.238085][ T7705] mon_bin_get_event+0x117/0x450 [ 50.243531][ T7705] mon_bin_ioctl+0xacf/0xc80 [ 50.248624][ T7705] do_vfs_ioctl+0xd6e/0x1390 [ 50.253718][ T7705] ksys_ioctl+0xab/0xd0 [ 50.258371][ T7705] __x64_sys_ioctl+0x73/0xb0 [ 50.263471][ T7705] do_syscall_64+0x103/0x610 [ 50.268563][ T7705] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 50.274957][ T7705] [ 50.274957][ T7705] -> #0 (&rp->fetch_lock){+.+.}: [ 50.282066][ T7705] __lock_acquire+0x239c/0x3fb0 [ 50.287502][ T7705] lock_acquire+0x16f/0x3f0 [ 50.292511][ T7705] __mutex_lock+0xf7/0x1310 [ 50.297558][ T7705] mutex_lock_nested+0x16/0x20 [ 50.302833][ T7705] mon_bin_vma_fault+0x73/0x2d0 [ 50.315242][ T7705] __do_fault+0x116/0x4e0 [ 50.320099][ T7705] __handle_mm_fault+0xf6c/0x3ec0 [ 50.325630][ T7705] handle_mm_fault+0x43f/0xb30 [ 50.330893][ T7705] __get_user_pages+0x7b6/0x1a40 [ 50.336437][ T7705] populate_vma_page_range+0x20d/0x2a0 [ 50.342467][ T7705] __mm_populate+0x204/0x380 [ 50.347675][ T7705] vm_mmap_pgoff+0x213/0x230 [ 50.353006][ T7705] ksys_mmap_pgoff+0x4aa/0x630 [ 50.358308][ T7705] __x64_sys_mmap+0xe9/0x1b0 [ 50.363409][ T7705] do_syscall_64+0x103/0x610 [ 50.368504][ T7705] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 50.374930][ T7705] [ 50.374930][ T7705] other info that might help us debug this: [ 50.374930][ T7705] [ 50.385486][ T7705] Possible unsafe locking scenario: [ 50.385486][ T7705] [ 50.393057][ T7705] CPU0 CPU1 [ 50.398442][ T7705] ---- ---- [ 50.403795][ T7705] lock(&mm->mmap_sem); [ 50.408018][ T7705] lock(&rp->fetch_lock); [ 50.414940][ T7705] lock(&mm->mmap_sem); [ 50.421677][ T7705] lock(&rp->fetch_lock); [ 50.426073][ T7705] [ 50.426073][ T7705] *** DEADLOCK *** [ 50.426073][ T7705] [ 50.434408][ T7705] 1 lock held by syz-executor.0/7705: [ 50.439798][ T7705] #0: 000000000dbc8828 (&mm->mmap_sem){++++}, at: __mm_populate+0x270/0x380 [ 50.448555][ T7705] [ 50.448555][ T7705] stack backtrace: [ 50.454517][ T7705] CPU: 0 PID: 7705 Comm: syz-executor.0 Not tainted 5.1.0-rc5+ #76 [ 50.462395][ T7705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.472437][ T7705] Call Trace: [ 50.475727][ T7705] dump_stack+0x172/0x1f0 [ 50.480148][ T7705] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 50.486206][ T7705] check_prev_add.constprop.0+0xf11/0x23c0 [ 50.491999][ T7705] ? check_usage+0x570/0x570 [ 50.496726][ T7705] ? depot_save_stack+0x1de/0x460 [ 50.501779][ T7705] ? graph_lock+0x7b/0x200 [ 50.506182][ T7705] ? __lockdep_reset_lock+0x450/0x450 [ 50.511536][ T7705] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 50.517782][ T7705] __lock_acquire+0x239c/0x3fb0 [ 50.522630][ T7705] ? depot_save_stack+0x1de/0x460 [ 50.527755][ T7705] ? mark_held_locks+0xf0/0xf0 [ 50.532513][ T7705] ? __do_fault+0x2b9/0x4e0 [ 50.537016][ T7705] lock_acquire+0x16f/0x3f0 [ 50.541539][ T7705] ? mon_bin_vma_fault+0x73/0x2d0 [ 50.546592][ T7705] ? mon_bin_vma_fault+0x73/0x2d0 [ 50.551603][ T7705] __mutex_lock+0xf7/0x1310 [ 50.556092][ T7705] ? mon_bin_vma_fault+0x73/0x2d0 [ 50.561105][ T7705] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 50.566724][ T7705] ? mon_bin_vma_fault+0x73/0x2d0 [ 50.571739][ T7705] ? mutex_trylock+0x1e0/0x1e0 [ 50.576501][ T7705] ? ptlock_alloc+0x20/0x70 [ 50.580981][ T7705] ? rcu_read_lock_sched_held+0x110/0x130 [ 50.586790][ T7705] ? kmem_cache_alloc+0x32e/0x6f0 [ 50.591795][ T7705] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 50.598013][ T7705] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 50.604345][ T7705] mutex_lock_nested+0x16/0x20 [ 50.609094][ T7705] ? mutex_lock_nested+0x16/0x20 [ 50.614013][ T7705] mon_bin_vma_fault+0x73/0x2d0 [ 50.618844][ T7705] __do_fault+0x116/0x4e0 [ 50.623151][ T7705] ? mem_cgroup_try_charge_delay+0x6c/0xa0 [ 50.628949][ T7705] __handle_mm_fault+0xf6c/0x3ec0 [ 50.634006][ T7705] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 50.639540][ T7705] ? find_held_lock+0x35/0x130 [ 50.644431][ T7705] ? handle_mm_fault+0x322/0xb30 [ 50.649358][ T7705] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 50.655583][ T7705] ? kasan_check_read+0x11/0x20 [ 50.660430][ T7705] handle_mm_fault+0x43f/0xb30 [ 50.665189][ T7705] __get_user_pages+0x7b6/0x1a40 [ 50.670117][ T7705] ? follow_page_mask+0x19a0/0x19a0 [ 50.675299][ T7705] ? vma_set_page_prot+0x18c/0x240 [ 50.680400][ T7705] ? memset+0x32/0x40 [ 50.684368][ T7705] populate_vma_page_range+0x20d/0x2a0 [ 50.690017][ T7705] __mm_populate+0x204/0x380 [ 50.694599][ T7705] ? populate_vma_page_range+0x2a0/0x2a0 [ 50.700221][ T7705] vm_mmap_pgoff+0x213/0x230 [ 50.704984][ T7705] ? vma_is_stack_for_current+0xd0/0xd0 [ 50.710629][ T7705] ? ksys_dup3+0x3e0/0x3e0 [ 50.715070][ T7705] ? _copy_to_user+0xc9/0x120 [ 50.719878][ T7705] ksys_mmap_pgoff+0x4aa/0x630 [ 50.724630][ T7705] ? find_mergeable_anon_vma+0x2e0/0x2e0 [ 50.730687][ T7705] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 50.736138][ T7705] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 50.741747][ T7705] ? do_syscall_64+0x26/0x610 [ 50.746424][ T7705] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 50.752529][ T7705] __x64_sys_mmap+0xe9/0x1b0 [ 50.757399][ T7705] do_syscall_64+0x103/0x610 [ 50.761980][ T7705] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 50.767858][ T7705] RIP: 0033:0x458c29 [ 50.771801][ T7705] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 50.791573][ T7705] RSP: 002b:00007f77d9affc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 50.800197][ T7705] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458c29 [ 50.808156][ T7705] RDX: 0000000000000002 RSI: 0000000000400000 RDI: 0000000020a19000 [ 50.816113][ T7705] RBP: 000000000073bf00 R08: 0000000000000003 R09: 0000000000000000 [ 50.824343][ T7705] R10: 0000000000008012 R11: 0000000000000246 R12: 00007f77d9b006d4 [ 50.832298][ T7705] R13: 00000000004c4b5a R14: 00000000004d8780 R15: 00000000ffffffff