[ 42.921528] audit: type=1800 audit(1581666000.687:30): pid=7963 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2490 res=0 Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 47.539685] kauditd_printk_skb: 4 callbacks suppressed [ 47.539707] audit: type=1400 audit(1581666005.327:35): avc: denied { map } for pid=8137 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.213' (ECDSA) to the list of known hosts. executing program [ 54.423434] audit: type=1400 audit(1581666012.207:36): avc: denied { map } for pid=8149 comm="syz-executor582" path="/root/syz-executor582176415" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 executing program executing program [ 59.434335] ------------[ cut here ]------------ [ 59.440655] ODEBUG: free active (active state 0) object type: timer_list hint: rfcomm_dlc_timeout+0x0/0x80 [ 59.451475] WARNING: CPU: 1 PID: 8152 at lib/debugobjects.c:325 debug_print_object+0x168/0x250 [ 59.460771] Kernel panic - not syncing: panic_on_warn set ... [ 59.460771] [ 59.468122] CPU: 1 PID: 8152 Comm: syz-executor582 Not tainted 4.19.103-syzkaller #0 [ 59.476004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.485343] Call Trace: [ 59.487940] dump_stack+0x197/0x210 [ 59.491753] panic+0x26a/0x50e [ 59.494961] ? __warn_printk+0xf3/0xf3 [ 59.498894] ? debug_print_object+0x168/0x250 [ 59.503377] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 59.509168] ? __warn.cold+0x5/0x53 [ 59.513506] ? __warn+0xe8/0x1d0 [ 59.516865] ? debug_print_object+0x168/0x250 [ 59.521385] __warn.cold+0x20/0x53 [ 59.524918] ? trace_hardirqs_off+0x62/0x220 [ 59.529381] ? debug_print_object+0x168/0x250 [ 59.533868] report_bug+0x263/0x2b0 [ 59.537480] do_error_trap+0x204/0x360 [ 59.541352] ? math_error+0x340/0x340 [ 59.545137] ? wake_up_klogd+0x99/0xd0 [ 59.549020] ? vprintk_emit+0x1ce/0x6d0 [ 59.553831] ? error_entry+0x7c/0xe0 [ 59.557538] ? trace_hardirqs_off_caller+0x65/0x220 [ 59.562557] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 59.567761] do_invalid_op+0x1b/0x20 [ 59.571494] invalid_op+0x14/0x20 [ 59.575113] RIP: 0010:debug_print_object+0x168/0x250 [ 59.580205] Code: dd e0 09 eb 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b5 00 00 00 48 8b 14 dd e0 09 eb 87 48 c7 c7 20 ff ea 87 e8 56 9b d4 fd <0f> 0b 83 05 4b 69 63 06 01 48 83 c4 20 5b 41 5c 41 5d 41 5e 5d c3 [ 59.599791] RSP: 0018:ffff8880880478b8 EFLAGS: 00010082 [ 59.605154] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 59.612428] RDX: 0000000000000000 RSI: ffffffff8155a136 RDI: ffffed1011008f09 [ 59.619893] RBP: ffff8880880478f8 R08: ffff8880a79fa540 R09: ffffed1015d23ee3 [ 59.627159] R10: ffffed1015d23ee2 R11: ffff8880ae91f717 R12: 0000000000000001 [ 59.634421] R13: ffffffff88fa05a0 R14: ffffffff815b1920 R15: ffff88808f0d07e8 [ 59.641707] ? __internal_add_timer+0x1f0/0x1f0 [ 59.646542] ? vprintk_func+0x86/0x189 [ 59.650439] ? debug_print_object+0x168/0x250 [ 59.654929] debug_check_no_obj_freed+0x29f/0x464 [ 59.659767] kfree+0xbd/0x220 [ 59.663103] rfcomm_dlc_free+0x20/0x30 [ 59.667022] rfcomm_dev_ioctl+0x1988/0x1c90 [ 59.671467] ? mark_held_locks+0xb1/0x100 [ 59.675621] ? lock_sock_nested+0xe2/0x120 [ 59.679864] ? rfcomm_tty_install+0x1a0/0x1a0 [ 59.684848] ? lock_sock_nested+0x9a/0x120 [ 59.689084] ? trace_hardirqs_on+0x67/0x220 [ 59.693396] ? __local_bh_enable_ip+0x15a/0x270 [ 59.698056] rfcomm_sock_ioctl+0x90/0xb0 [ 59.702117] sock_do_ioctl+0xd8/0x2f0 [ 59.705922] ? compat_ifr_data_ioctl+0x160/0x160 [ 59.711020] ? __lock_acquire+0x6ee/0x49c0 [ 59.715242] ? rcu_read_lock_sched_held+0x110/0x130 [ 59.720257] ? kmem_cache_alloc+0x32a/0x700 [ 59.724581] sock_ioctl+0x325/0x610 [ 59.728296] ? dlci_ioctl_set+0x40/0x40 [ 59.732260] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 59.737798] ? __might_sleep+0x95/0x190 [ 59.741772] ? find_held_lock+0x35/0x130 [ 59.745818] ? dlci_ioctl_set+0x40/0x40 [ 59.750052] do_vfs_ioctl+0xd5f/0x1380 [ 59.753929] ? selinux_file_ioctl+0x46c/0x5d0 [ 59.758410] ? selinux_file_ioctl+0x125/0x5d0 [ 59.762897] ? ioctl_preallocate+0x210/0x210 [ 59.767298] ? selinux_file_mprotect+0x620/0x620 [ 59.772044] ? __sanitizer_cov_trace_const_cmp4+0x1b/0x20 [ 59.778255] ? __fd_install+0x200/0x640 [ 59.782222] ? fd_install+0x4d/0x60 [ 59.785857] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 59.791408] ? security_file_ioctl+0x8d/0xc0 [ 59.795990] ksys_ioctl+0xab/0xd0 [ 59.799533] __x64_sys_ioctl+0x73/0xb0 [ 59.803424] do_syscall_64+0xfd/0x620 [ 59.807581] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 59.812762] RIP: 0033:0x4412c9 [ 59.816451] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 59.836148] RSP: 002b:00007ffd3257ff88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 59.844042] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004412c9 [ 59.851302] RDX: 0000000020000100 RSI: 00000000400452c8 RDI: 0000000000000005 [ 59.858568] RBP: 000000000000e810 R08: 00000000004002c8 R09: 00000000004002c8 [ 59.865924] R10: 00000000004002c8 R11: 0000000000000246 R12: 00000000004020f0 [ 59.873292] R13: 0000000000402180 R14: 0000000000000000 R15: 0000000000000000 [ 59.880576] [ 59.880580] ====================================================== [ 59.880583] WARNING: possible circular locking dependency detected [ 59.880586] 4.19.103-syzkaller #0 Not tainted [ 59.880589] ------------------------------------------------------ [ 59.880592] syz-executor582/8152 is trying to acquire lock: [ 59.880594] 00000000352b9bc2 ((console_sem).lock){-.-.}, at: down_trylock+0x13/0x70 [ 59.880602] [ 59.880605] but task is already holding lock: [ 59.880607] 00000000035a3359 (&obj_hash[i].lock){-.-.}, at: debug_check_no_obj_freed+0xbe/0x464 [ 59.880615] [ 59.880618] which lock already depends on the new lock. [ 59.880619] [ 59.880621] [ 59.880624] the existing dependency chain (in reverse order) is: [ 59.880625] [ 59.880626] -> #5 (&obj_hash[i].lock){-.-.}: [ 59.880635] _raw_spin_lock_irqsave+0x95/0xcd [ 59.880637] debug_object_activate+0x131/0x4e0 [ 59.880640] enqueue_hrtimer+0x2a/0x3f0 [ 59.880642] hrtimer_start_range_ns+0x5fb/0xc70 [ 59.880645] schedule_hrtimeout_range_clock+0x1a0/0x380 [ 59.880648] schedule_hrtimeout+0x25/0x30 [ 59.880650] wait_task_inactive+0x4a2/0x630 [ 59.880653] __kthread_bind_mask+0x24/0xb0 [ 59.880655] kthread_bind_mask+0x23/0x30 [ 59.880658] init_rescuer.part.0+0xfc/0x190 [ 59.880660] workqueue_init+0x51a/0x808 [ 59.880663] kernel_init_freeable+0x2c0/0x5c8 [ 59.880665] kernel_init+0x12/0x1c6 [ 59.880667] ret_from_fork+0x24/0x30 [ 59.880668] [ 59.880670] -> #4 (hrtimer_bases.lock){-.-.}: [ 59.880678] _raw_spin_lock_irqsave+0x95/0xcd [ 59.880681] lock_hrtimer_base.isra.0+0x75/0x130 [ 59.880683] hrtimer_start_range_ns+0xff/0xc70 [ 59.880686] enqueue_task_rt+0x998/0xe70 [ 59.880689] __sched_setscheduler.constprop.0+0xd1a/0x22f0 [ 59.880691] _sched_setscheduler+0x105/0x1a0 [ 59.880694] sched_setscheduler+0xe/0x10 [ 59.880696] watchdog_dev_init+0xe0/0x1b2 [ 59.880698] watchdog_init+0x17/0x181 [ 59.880701] do_one_initcall+0x107/0x78c [ 59.880703] kernel_init_freeable+0x4d4/0x5c8 [ 59.880705] kernel_init+0x12/0x1c6 [ 59.880708] ret_from_fork+0x24/0x30 [ 59.880709] [ 59.880710] -> #3 (&rt_b->rt_runtime_lock){-...}: [ 59.880718] _raw_spin_lock+0x2f/0x40 [ 59.880721] rq_online_rt+0xb4/0x390 [ 59.880723] set_rq_online.part.0+0xe4/0x140 [ 59.880726] sched_cpu_activate+0x17f/0x270 [ 59.880728] cpuhp_invoke_callback+0x201/0x1af0 [ 59.880731] cpuhp_thread_fun+0x453/0x850 [ 59.880733] smpboot_thread_fn+0x6a3/0xa30 [ 59.880735] kthread+0x354/0x420 [ 59.880738] ret_from_fork+0x24/0x30 [ 59.880739] [ 59.880740] -> #2 (&rq->lock){-.-.}: [ 59.880748] _raw_spin_lock+0x2f/0x40 [ 59.880750] task_fork_fair+0x6a/0x520 [ 59.880752] sched_fork+0x3af/0x900 [ 59.880755] copy_process.part.0+0x187d/0x7a60 [ 59.880757] _do_fork+0x257/0xfd0 [ 59.880760] kernel_thread+0x34/0x40 [ 59.880762] rest_init+0x24/0x222 [ 59.880764] start_kernel+0x7ec/0x825 [ 59.880767] x86_64_start_reservations+0x29/0x2b [ 59.880769] x86_64_start_kernel+0x77/0x7b [ 59.880772] secondary_startup_64+0xa4/0xb0 [ 59.880773] [ 59.880774] -> #1 (&p->pi_lock){-.-.}: [ 59.880783] _raw_spin_lock_irqsave+0x95/0xcd [ 59.880785] try_to_wake_up+0x94/0xf50 [ 59.880787] wake_up_process+0x10/0x20 [ 59.880789] __up.isra.0+0x136/0x1a0 [ 59.880791] up+0x9c/0xe0 [ 59.880794] __up_console_sem+0xb7/0x1c0 [ 59.880798] console_unlock+0x6c7/0x10d0 [ 59.880801] vprintk_emit+0x280/0x6d0 [ 59.880803] vprintk_default+0x28/0x30 [ 59.880805] vprintk_func+0x7e/0x189 [ 59.880807] printk+0xba/0xed [ 59.880810] kauditd_hold_skb.cold+0x3f/0x4e [ 59.880812] kauditd_send_queue+0x12d/0x170 [ 59.880815] kauditd_thread+0x71c/0xa50 [ 59.880817] kthread+0x354/0x420 [ 59.880819] ret_from_fork+0x24/0x30 [ 59.880820] [ 59.880821] -> #0 ((console_sem).lock){-.-.}: [ 59.880829] lock_acquire+0x16f/0x3f0 [ 59.880832] _raw_spin_lock_irqsave+0x95/0xcd [ 59.880834] down_trylock+0x13/0x70 [ 59.880837] __down_trylock_console_sem+0xa8/0x210 [ 59.880839] console_trylock+0x15/0xa0 [ 59.880842] vprintk_emit+0x267/0x6d0 [ 59.880844] vprintk_default+0x28/0x30 [ 59.880846] vprintk_func+0x7e/0x189 [ 59.880848] printk+0xba/0xed [ 59.880850] __warn_printk+0x9b/0xf3 [ 59.880853] debug_print_object+0x168/0x250 [ 59.880856] debug_check_no_obj_freed+0x29f/0x464 [ 59.880858] kfree+0xbd/0x220 [ 59.880860] rfcomm_dlc_free+0x20/0x30 [ 59.880863] rfcomm_dev_ioctl+0x1988/0x1c90 [ 59.880865] rfcomm_sock_ioctl+0x90/0xb0 [ 59.880867] sock_do_ioctl+0xd8/0x2f0 [ 59.880869] sock_ioctl+0x325/0x610 [ 59.880872] do_vfs_ioctl+0xd5f/0x1380 [ 59.880874] ksys_ioctl+0xab/0xd0 [ 59.880876] __x64_sys_ioctl+0x73/0xb0 [ 59.880879] do_syscall_64+0xfd/0x620 [ 59.880881] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 59.880883] [ 59.880885] other info that might help us debug this: [ 59.880887] [ 59.880888] Chain exists of: [ 59.880890] (console_sem).lock --> hrtimer_bases.lock --> &obj_hash[i].lock [ 59.880900] [ 59.880902] Possible unsafe locking scenario: [ 59.880904] [ 59.880906] CPU0 CPU1 [ 59.880908] ---- ---- [ 59.880910] lock(&obj_hash[i].lock); [ 59.880915] lock(hrtimer_bases.lock); [ 59.880921] lock(&obj_hash[i].lock); [ 59.880925] lock((console_sem).lock); [ 59.880930] [ 59.880932] *** DEADLOCK *** [ 59.880933] [ 59.880935] 3 locks held by syz-executor582/8152: [ 59.880937] #0: 00000000c8388c7c (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}, at: rfcomm_sock_ioctl+0x82/0xb0 [ 59.880947] #1: 00000000280d06c8 (rfcomm_ioctl_mutex){+.+.}, at: rfcomm_dev_ioctl+0x923/0x1c90 [ 59.880957] #2: 00000000035a3359 (&obj_hash[i].lock){-.-.}, at: debug_check_no_obj_freed+0xbe/0x464 [ 59.880967] [ 59.880969] stack backtrace: [ 59.880972] CPU: 1 PID: 8152 Comm: syz-executor582 Not tainted 4.19.103-syzkaller #0 [ 59.880977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.880979] Call Trace: [ 59.880981] dump_stack+0x197/0x210 [ 59.880984] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 59.880986] __lock_acquire+0x2e19/0x49c0 [ 59.880988] ? mark_held_locks+0x100/0x100 [ 59.880991] ? kvm_clock_read+0x18/0x30 [ 59.880993] ? kvm_sched_clock_read+0x9/0x20 [ 59.880995] lock_acquire+0x16f/0x3f0 [ 59.880998] ? down_trylock+0x13/0x70 [ 59.881000] _raw_spin_lock_irqsave+0x95/0xcd [ 59.881002] ? down_trylock+0x13/0x70 [ 59.881005] ? vprintk_emit+0x267/0x6d0 [ 59.881007] down_trylock+0x13/0x70 [ 59.881009] ? vprintk_emit+0x267/0x6d0 [ 59.881012] __down_trylock_console_sem+0xa8/0x210 [ 59.881014] console_trylock+0x15/0xa0 [ 59.881016] vprintk_emit+0x267/0x6d0 [ 59.881019] ? __internal_add_timer+0x1f0/0x1f0 [ 59.881021] vprintk_default+0x28/0x30 [ 59.881023] vprintk_func+0x7e/0x189 [ 59.881025] printk+0xba/0xed [ 59.881028] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 59.881030] ? __warn_printk+0x8f/0xf3 [ 59.881033] ? rfcomm_dlc_link+0x170/0x170 [ 59.881035] __warn_printk+0x9b/0xf3 [ 59.881037] ? add_taint.cold+0x16/0x16 [ 59.881039] ? skb_dequeue+0x12e/0x180 [ 59.881042] ? rfcomm_dlc_link+0x170/0x170 [ 59.881044] debug_print_object+0x168/0x250 [ 59.881047] debug_check_no_obj_freed+0x29f/0x464 [ 59.881049] kfree+0xbd/0x220 [ 59.881051] rfcomm_dlc_free+0x20/0x30 [ 59.881054] rfcomm_dev_ioctl+0x1988/0x1c90 [ 59.881056] ? mark_held_locks+0xb1/0x100 [ 59.881058] ? lock_sock_nested+0xe2/0x120 [ 59.881061] ? rfcomm_tty_install+0x1a0/0x1a0 [ 59.881063] ? lock_sock_nested+0x9a/0x120 [ 59.881066] ? trace_hardirqs_on+0x67/0x220 [ 59.881068] ? __local_bh_enable_ip+0x15a/0x270 [ 59.881071] rfcomm_sock_ioctl+0x90/0xb0 [ 59.881073] sock_do_ioctl+0xd8/0x2f0 [ 59.881075] ? compat_ifr_data_ioctl+0x160/0x160 [ 59.881078] ? __lock_acquire+0x6ee/0x49c0 [ 59.881081] ? rcu_read_lock_sched_held+0x110/0x130 [ 59.881083] ? kmem_cache_alloc+0x32a/0x700 [ 59.881085] sock_ioctl+0x325/0x610 [ 59.881088] ? dlci_ioctl_set+0x40/0x40 [ 59.881090] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 59.881093] ? __might_sleep+0x95/0x190 [ 59.881095] ? find_held_lock+0x35/0x130 [ 59.881098] ? dlci_ioctl_set+0x40/0x40 [ 59.881100] do_vfs_ioctl+0xd5f/0x1380 [ 59.881102] ? selinux_file_ioctl+0x46c/0x5d0 [ 59.881105] ? selinux_file_ioctl+0x125/0x5d0 [ 59.881107] ? ioctl_preallocate+0x210/0x210 [ 59.881110] ? selinux_file_mprotect+0x620/0x620 [ 59.881113] ? __sanitizer_cov_trace_const_cmp4+0x1b/0x20 [ 59.881115] ? __fd_install+0x200/0x640 [ 59.881117] ? fd_install+0x4d/0x60 [ 59.881121] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 59.881123] ? security_file_ioctl+0x8d/0xc0 [ 59.881125] ksys_ioctl+0xab/0xd0 [ 59.881127] __x64_sys_ioctl+0x73/0xb0 [ 59.881130] do_syscall_64+0xfd/0x620 [ 59.881133] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 59.881135] RIP: 0033:0x4412c9 [ 59.881143] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 59.881146] RSP: 002b:00007ffd3257ff88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 59.881152] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004412c9 [ 59.881156] RDX: 0000000020000100 RSI: 00000000400452c8 RDI: 0000000000000005 [ 59.881159] RBP: 000000000000e810 R08: 00000000004002c8 R09: 00000000004002c8 [ 59.881163] R10: 00000000004002c8 R11: 0000000000000246 R12: 00000000004020f0 [ 59.881166] R13: 0000000000402180 R14: 0000000000000000 R15: 0000000000000000 [ 59.882498] Kernel Offset: disabled [ 60.853960] Rebooting in 86400 seconds..