[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.44' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 60.196632][ T6864] IPVS: ftp: loaded support on port[0] = 21 [ 60.236877][ T6864] IPVS: ftp: loaded support on port[0] = 21 [ 60.280120][ T258] tipc: TX() has been purged, node left! [ 61.557956][ T6864] [ 61.560295][ T6864] ====================================================== [ 61.567285][ T6864] WARNING: possible circular locking dependency detected [ 61.574311][ T6864] 5.9.0-rc3-next-20200903-syzkaller #0 Not tainted [ 61.580961][ T6864] ------------------------------------------------------ [ 61.587960][ T6864] syz-executor985/6864 is trying to acquire lock: [ 61.594349][ T6864] ffffffff8a87d730 (pernet_ops_rwsem){++++}-{3:3}, at: unregister_netdevice_notifier+0x1e/0x170 [ 61.604753][ T6864] [ 61.604753][ T6864] but task is already holding lock: [ 61.612110][ T6864] ffff888085909c90 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: __sock_release+0x86/0x280 [ 61.622204][ T6864] [ 61.622204][ T6864] which lock already depends on the new lock. [ 61.622204][ T6864] [ 61.632583][ T6864] [ 61.632583][ T6864] the existing dependency chain (in reverse order) is: [ 61.641570][ T6864] [ 61.641570][ T6864] -> #3 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}: [ 61.650243][ T6864] down_write+0x8d/0x150 [ 61.654987][ T6864] __sock_release+0x86/0x280 [ 61.660188][ T6864] sock_close+0x18/0x20 [ 61.664847][ T6864] __fput+0x285/0x920 [ 61.669368][ T6864] delayed_fput+0x56/0x70 [ 61.674195][ T6864] process_one_work+0x94c/0x1670 [ 61.679631][ T6864] worker_thread+0x64c/0x1120 [ 61.684805][ T6864] kthread+0x3b5/0x4a0 [ 61.689408][ T6864] ret_from_fork+0x1f/0x30 [ 61.694318][ T6864] [ 61.694318][ T6864] -> #2 ((delayed_fput_work).work){+.+.}-{0:0}: [ 61.702718][ T6864] process_one_work+0x8bb/0x1670 [ 61.708175][ T6864] worker_thread+0x64c/0x1120 [ 61.713351][ T6864] kthread+0x3b5/0x4a0 [ 61.717915][ T6864] ret_from_fork+0x1f/0x30 [ 61.722862][ T6864] [ 61.722862][ T6864] -> #1 ((wq_completion)events){+.+.}-{0:0}: [ 61.731014][ T6864] flush_workqueue+0x110/0x13e0 [ 61.736375][ T6864] tipc_exit_net+0x47/0x2a0 [ 61.741380][ T6864] ops_exit_list+0xb0/0x160 [ 61.746385][ T6864] cleanup_net+0x4ea/0xb10 [ 61.751306][ T6864] process_one_work+0x94c/0x1670 [ 61.756855][ T6864] worker_thread+0x64c/0x1120 [ 61.762234][ T6864] kthread+0x3b5/0x4a0 [ 61.766811][ T6864] ret_from_fork+0x1f/0x30 [ 61.771722][ T6864] [ 61.771722][ T6864] -> #0 (pernet_ops_rwsem){++++}-{3:3}: [ 61.779449][ T6864] __lock_acquire+0x29bb/0x5570 [ 61.784815][ T6864] lock_acquire+0x1f3/0xae0 [ 61.789826][ T6864] down_write+0x8d/0x150 [ 61.794565][ T6864] unregister_netdevice_notifier+0x1e/0x170 [ 61.801002][ T6864] raw_release+0x58/0x890 [ 61.805823][ T6864] __sock_release+0xcd/0x280 [ 61.810905][ T6864] sock_close+0x18/0x20 [ 61.815574][ T6864] __fput+0x285/0x920 [ 61.820052][ T6864] task_work_run+0xdd/0x190 [ 61.825048][ T6864] do_exit+0xb7d/0x29f0 [ 61.829703][ T6864] do_group_exit+0x125/0x310 [ 61.834788][ T6864] __x64_sys_exit_group+0x3a/0x50 [ 61.840317][ T6864] do_syscall_64+0x2d/0x70 [ 61.845250][ T6864] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 61.851716][ T6864] [ 61.851716][ T6864] other info that might help us debug this: [ 61.851716][ T6864] [ 61.863132][ T6864] Chain exists of: [ 61.863132][ T6864] pernet_ops_rwsem --> (delayed_fput_work).work --> &sb->s_type->i_mutex_key#12 [ 61.863132][ T6864] [ 61.878146][ T6864] Possible unsafe locking scenario: [ 61.878146][ T6864] [ 61.885569][ T6864] CPU0 CPU1 [ 61.890906][ T6864] ---- ---- [ 61.896243][ T6864] lock(&sb->s_type->i_mutex_key#12); [ 61.902110][ T6864] lock((delayed_fput_work).work); [ 61.909798][ T6864] lock(&sb->s_type->i_mutex_key#12); [ 61.917747][ T6864] lock(pernet_ops_rwsem); [ 61.922238][ T6864] [ 61.922238][ T6864] *** DEADLOCK *** [ 61.922238][ T6864] [ 61.930359][ T6864] 1 lock held by syz-executor985/6864: [ 61.935787][ T6864] #0: ffff888085909c90 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: __sock_release+0x86/0x280 [ 61.946272][ T6864] [ 61.946272][ T6864] stack backtrace: [ 61.952139][ T6864] CPU: 0 PID: 6864 Comm: syz-executor985 Not tainted 5.9.0-rc3-next-20200903-syzkaller #0 [ 61.961998][ T6864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.972636][ T6864] Call Trace: [ 61.975905][ T6864] dump_stack+0x198/0x1fd [ 61.980210][ T6864] check_noncircular+0x324/0x3e0 [ 61.985138][ T6864] ? print_circular_bug+0x3a0/0x3a0 [ 61.990328][ T6864] ? is_bpf_text_address+0xa9/0x160 [ 61.995518][ T6864] ? lock_repin_lock+0x460/0x460 [ 62.000428][ T6864] ? mark_lock+0xbc/0x1710 [ 62.004819][ T6864] __lock_acquire+0x29bb/0x5570 [ 62.009735][ T6864] ? lockdep_hardirqs_on_prepare+0x530/0x530 [ 62.015710][ T6864] lock_acquire+0x1f3/0xae0 [ 62.020191][ T6864] ? unregister_netdevice_notifier+0x1e/0x170 [ 62.026232][ T6864] ? lock_release+0x8f0/0x8f0 [ 62.030887][ T6864] ? lock_is_held_type+0xbb/0xf0 [ 62.035855][ T6864] down_write+0x8d/0x150 [ 62.040079][ T6864] ? unregister_netdevice_notifier+0x1e/0x170 [ 62.046181][ T6864] ? down_write_killable+0x170/0x170 [ 62.051441][ T6864] ? lock_is_held_type+0xbb/0xf0 [ 62.056375][ T6864] unregister_netdevice_notifier+0x1e/0x170 [ 62.062267][ T6864] raw_release+0x58/0x890 [ 62.066632][ T6864] ? fcntl_setlk+0xf60/0xf60 [ 62.071287][ T6864] __sock_release+0xcd/0x280 [ 62.075865][ T6864] sock_close+0x18/0x20 [ 62.080006][ T6864] __fput+0x285/0x920 [ 62.083971][ T6864] ? __sock_release+0x280/0x280 [ 62.089002][ T6864] task_work_run+0xdd/0x190 [ 62.093489][ T6864] do_exit+0xb7d/0x29f0 [ 62.097619][ T6864] ? mm_update_next_owner+0x7a0/0x7a0 [ 62.102967][ T6864] ? vmacache_update+0xce/0x140 [ 62.107847][ T6864] ? lock_is_held_type+0xbb/0xf0 [ 62.112888][ T6864] do_group_exit+0x125/0x310 [ 62.117461][ T6864] __x64_sys_exit_group+0x3a/0x50 [ 62.122478][ T6864] do_syscall_64+0x2d/0x70 [ 62.126880][ T6864] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 62.132748][ T6864] RIP: 0033:0x43f9b8 [ 62.136638][ T6864] Code: Bad RIP value. [ 62.140677][ T6864] RSP: 002b:00007ffe08a46098 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 62.149071][ T6864] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000043f9b8 [ 62.157025][ T6864] RDX: 0000000000000