[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 79.234989][ T27] audit: type=1800 audit(1582338056.728:25): pid=9390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 79.255126][ T27] audit: type=1800 audit(1582338056.738:26): pid=9390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 79.276311][ T27] audit: type=1800 audit(1582338056.738:27): pid=9390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.36' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 92.453437][ T9548] IPVS: ftp: loaded support on port[0] = 21 [ 92.482336][ T9548] [ 92.484786][ T9548] ====================================================== [ 92.491777][ T9548] WARNING: possible circular locking dependency detected [ 92.498821][ T9548] 5.6.0-rc2-syzkaller #0 Not tainted [ 92.504078][ T9548] ------------------------------------------------------ [ 92.511118][ T9548] syz-executor103/9548 is trying to acquire lock: [ 92.517506][ T9548] ffffe8ffffc48f18 (&l->lock){....}, at: bpf_lru_push_free+0xe5/0x5b0 [ 92.525693][ T9548] [ 92.525693][ T9548] but task is already holding lock: [ 92.533033][ T9548] ffff88809f4e0720 (&htab->buckets[i].lock){....}, at: __htab_map_lookup_and_delete_batch+0x617/0x1540 [ 92.544068][ T9548] [ 92.544068][ T9548] which lock already depends on the new lock. [ 92.544068][ T9548] [ 92.554456][ T9548] [ 92.554456][ T9548] the existing dependency chain (in reverse order) is: [ 92.563448][ T9548] [ 92.563448][ T9548] -> #1 (&htab->buckets[i].lock){....}: [ 92.571232][ T9548] _raw_spin_lock_irqsave+0x95/0xcd [ 92.576949][ T9548] htab_lru_map_delete_node+0xce/0x2f0 [ 92.582910][ T9548] __bpf_lru_list_shrink+0xf9/0x470 [ 92.588614][ T9548] bpf_lru_pop_free+0xa9f/0x1670 [ 92.594079][ T9548] prealloc_lru_pop+0x2c/0xa0 [ 92.599272][ T9548] __htab_lru_percpu_map_update_elem+0x67e/0xa90 [ 92.606100][ T9548] bpf_percpu_hash_update+0x16e/0x210 [ 92.611983][ T9548] bpf_map_update_value.isra.0+0x2d7/0x8e0 [ 92.618291][ T9548] __do_sys_bpf+0x3163/0x41e0 [ 92.623480][ T9548] __x64_sys_bpf+0x73/0xb0 [ 92.628398][ T9548] do_syscall_64+0xfa/0x790 [ 92.633402][ T9548] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 92.639791][ T9548] [ 92.639791][ T9548] -> #0 (&l->lock){....}: [ 92.646288][ T9548] __lock_acquire+0x2596/0x4a00 [ 92.651642][ T9548] lock_acquire+0x190/0x410 [ 92.656657][ T9548] _raw_spin_lock_irqsave+0x95/0xcd [ 92.662361][ T9548] bpf_lru_push_free+0xe5/0x5b0 [ 92.667761][ T9548] __htab_map_lookup_and_delete_batch+0x8d4/0x1540 [ 92.674768][ T9548] htab_lru_percpu_map_lookup_and_delete_batch+0x37/0x40 [ 92.682292][ T9548] bpf_map_do_batch+0x3f5/0x510 [ 92.687739][ T9548] __do_sys_bpf+0x1f7d/0x41e0 [ 92.692916][ T9548] __x64_sys_bpf+0x73/0xb0 [ 92.697843][ T9548] do_syscall_64+0xfa/0x790 [ 92.702848][ T9548] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 92.709233][ T9548] [ 92.709233][ T9548] other info that might help us debug this: [ 92.709233][ T9548] [ 92.719444][ T9548] Possible unsafe locking scenario: [ 92.719444][ T9548] [ 92.726878][ T9548] CPU0 CPU1 [ 92.732228][ T9548] ---- ---- [ 92.737581][ T9548] lock(&htab->buckets[i].lock); [ 92.742588][ T9548] lock(&l->lock); [ 92.748891][ T9548] lock(&htab->buckets[i].lock); [ 92.756418][ T9548] lock(&l->lock); [ 92.760253][ T9548] [ 92.760253][ T9548] *** DEADLOCK *** [ 92.760253][ T9548] [ 92.768421][ T9548] 2 locks held by syz-executor103/9548: [ 92.773991][ T9548] #0: ffffffff89bac240 (rcu_read_lock){....}, at: __htab_map_lookup_and_delete_batch+0x54b/0x1540 [ 92.785617][ T9548] #1: ffff88809f4e0720 (&htab->buckets[i].lock){....}, at: __htab_map_lookup_and_delete_batch+0x617/0x1540 [ 92.797088][ T9548] [ 92.797088][ T9548] stack backtrace: [ 92.802977][ T9548] CPU: 0 PID: 9548 Comm: syz-executor103 Not tainted 5.6.0-rc2-syzkaller #0 [ 92.811683][ T9548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 92.821762][ T9548] Call Trace: [ 92.825139][ T9548] dump_stack+0x197/0x210 [ 92.829449][ T9548] print_circular_bug.isra.0.cold+0x163/0x172 [ 92.835496][ T9548] check_noncircular+0x32e/0x3e0 [ 92.840411][ T9548] ? print_circular_bug.isra.0+0x230/0x230 [ 92.846210][ T9548] ? alloc_list_entry+0xc0/0xc0 [ 92.851040][ T9548] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 92.857272][ T9548] ? find_first_zero_bit+0x9a/0xc0 [ 92.862369][ T9548] __lock_acquire+0x2596/0x4a00 [ 92.867205][ T9548] ? mark_held_locks+0xf0/0xf0 [ 92.871953][ T9548] lock_acquire+0x190/0x410 [ 92.876456][ T9548] ? bpf_lru_push_free+0xe5/0x5b0 [ 92.881514][ T9548] _raw_spin_lock_irqsave+0x95/0xcd [ 92.886711][ T9548] ? bpf_lru_push_free+0xe5/0x5b0 [ 92.891728][ T9548] bpf_lru_push_free+0xe5/0x5b0 [ 92.896561][ T9548] __htab_map_lookup_and_delete_batch+0x8d4/0x1540 [ 92.903115][ T9548] ? __kasan_check_read+0x11/0x20 [ 92.908135][ T9548] ? htab_percpu_map_seq_show_elem+0x490/0x490 [ 92.914270][ T9548] ? htab_percpu_map_lookup_batch+0x40/0x40 [ 92.920142][ T9548] htab_lru_percpu_map_lookup_and_delete_batch+0x37/0x40 [ 92.927144][ T9548] bpf_map_do_batch+0x3f5/0x510 [ 92.931997][ T9548] __do_sys_bpf+0x1f7d/0x41e0 [ 92.936675][ T9548] ? find_held_lock+0x35/0x130 [ 92.941480][ T9548] ? bpf_prog_load+0x1820/0x1820 [ 92.946528][ T9548] ? lock_downgrade+0x920/0x920 [ 92.951380][ T9548] ? handle_mm_fault+0x292/0xa50 [ 92.956759][ T9548] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 92.962221][ T9548] ? do_syscall_64+0x26/0x790 [ 92.967269][ T9548] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 92.973492][ T9548] ? do_syscall_64+0x26/0x790 [ 92.978453][ T9548] __x64_sys_bpf+0x73/0xb0 [ 92.982872][ T9548] do_syscall_64+0xfa/0x790 [ 92.987372][ T9548] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 92.993255][ T9548] RIP: 0033:0x440bf9 [ 92.997131][ T9548] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 93.016734][ T9548] RSP: 002b:00007ffcd0f094d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 93.025126][ T9548] RAX: ffffffffffffffda RBX: 00000000004a2390 RCX: 0000000000440bf9 [ 93.033088][ T9548] RDX: 0000000000000038 RSI: 0000000020000100 RDI: 0000000000000019 [ 93.041082][ T9548] RBP: 00000000006cb018 R08: 0000254c20080522 R09: 0000254c20080522 [ 93.049042][ T9548] R10: 0000254c20080522 R11: 0000000000000246 R12: 00000000