./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2980337150 <...> DUID 00:04:a1:84:1b:e0:48:24:35:f8:15:f9:55:b5:79:ea:e6:3e forked to background, child pid 3190 [ 24.654134][ T3191] 8021q: adding VLAN 0 to HW filter on device bond0 [ 24.667564][ T3191] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.121' (ECDSA) to the list of known hosts. execve("./syz-executor2980337150", ["./syz-executor2980337150"], 0x7ffceea34960 /* 10 vars */) = 0 brk(NULL) = 0x555555f67000 brk(0x555555f67c40) = 0x555555f67c40 arch_prctl(ARCH_SET_FS, 0x555555f67300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2980337150", 4096) = 28 brk(0x555555f88c40) = 0x555555f88c40 brk(0x555555f89000) = 0x555555f89000 mprotect(0x7f289b65e000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 chmod("/dev/raw-gadget", 0666) = 0 getpid() = 3611 mkdir("./syzkaller.HTK3oh", 0700) = 0 chmod("./syzkaller.HTK3oh", 0777) = 0 chdir("./syzkaller.HTK3oh") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3612 attached , child_tidptr=0x555555f675d0) = 3612 [pid 3612] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3612] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3612] setsid() = 1 [pid 3612] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3612] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3612] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3612] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3612] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3612] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3612] unshare(CLONE_NEWNS) = 0 [pid 3612] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3612] unshare(CLONE_NEWIPC) = 0 [pid 3612] unshare(CLONE_NEWCGROUP) = 0 [pid 3612] unshare(CLONE_NEWUTS) = 0 [pid 3612] unshare(CLONE_SYSVSEM) = 0 [pid 3612] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3612] write(3, "16777216", 8) = 8 [pid 3612] close(3) = 0 [pid 3612] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3612] write(3, "536870912", 9) = 9 [pid 3612] close(3) = 0 [pid 3612] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3612] write(3, "1024", 4) = 4 [pid 3612] close(3) = 0 [pid 3612] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3612] write(3, "8192", 4) = 4 [pid 3612] close(3) = 0 [pid 3612] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3612] write(3, "1024", 4) = 4 [pid 3612] close(3) = 0 [pid 3612] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3612] write(3, "1024", 4) = 4 [pid 3612] close(3) = 0 [pid 3612] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3612] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3612] close(3) = 0 [pid 3612] getpid() = 1 [pid 3612] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< HARDIRQ-unsafe lock order detected [ 41.844194][ T3612] 5.19.0-rc3-syzkaller-00043-g3abc3ae553c7 #0 Not tainted [ 41.844201][ T3612] ----------------------------------------------------- [ 41.844206][ T3612] syz-executor298/3612 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 41.844224][ T3612] ffffffff8c80a058 (tasklist_lock){.+.+}-{2:2}, at: send_sigio+0xbe/0x300 [ 41.844286][ T3612] [ 41.844286][ T3612] and this task is already holding: [ 41.844290][ T3612] ffff888021360130 (&f->f_owner.lock){....}-{2:2}, at: send_sigio+0x2f/0x300 [ 41.844324][ T3612] which would create a new lock dependency: [ 41.844328][ T3612] (&f->f_owner.lock){....}-{2:2} -> (tasklist_lock){.+.+}-{2:2} [ 41.844359][ T3612] [ 41.844359][ T3612] but this new dependency connects a HARDIRQ-irq-safe lock: [ 41.844365][ T3612] (&timer->lock){-...}-{2:2} [ 41.844378][ T3612] [pid 3612] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3612, si_uid=0, si_status=1, si_utime=0, si_stime=9} --- exit_group(0) = ? +++ exited with 0 +++ [ 41.84437