Starting OpenBSD Secure Shell server... [ OK ] Started Daily apt download activities. [ OK ] Started Daily apt upgrade and clean activities. [ OK ] Reached target Timers. Starting Permit User Sessions... [ OK ] Started System Logging Service. [ OK ] Started Permit User Sessions. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.249' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 57.115543][ C0] [ 57.117988][ C0] ======================================================== [ 57.125187][ C0] WARNING: possible irq lock inversion dependency detected [ 57.132362][ C0] 5.6.0-syzkaller #0 Not tainted [ 57.137269][ C0] -------------------------------------------------------- [ 57.144437][ C0] swapper/0/0 just changed the state of lock: [ 57.150488][ C0] ffff8880944a3cd8 (&ctx->ctx_lock){..-.}-{2:2}, at: free_ioctx_users+0x2b/0x450 [ 57.159580][ C0] but this lock took another, SOFTIRQ-unsafe lock in the past: [ 57.167109][ C0] (&pid->wait_pidfd){+.+.}-{2:2} [ 57.167116][ C0] [ 57.167116][ C0] [ 57.167116][ C0] and interrupts could create inverse lock ordering between them. [ 57.167116][ C0] [ 57.186409][ C0] [ 57.186409][ C0] other info that might help us debug this: [ 57.194468][ C0] Possible interrupt unsafe locking scenario: [ 57.194468][ C0] [ 57.202765][ C0] CPU0 CPU1 [ 57.208107][ C0] ---- ---- [ 57.213445][ C0] lock(&pid->wait_pidfd); [ 57.217922][ C0] local_irq_disable(); [ 57.224659][ C0] lock(&ctx->ctx_lock); [ 57.231493][ C0] lock(&pid->wait_pidfd); [ 57.238502][ C0] [ 57.241931][ C0] lock(&ctx->ctx_lock); [ 57.246418][ C0] [ 57.246418][ C0] *** DEADLOCK *** [ 57.246418][ C0] [ 57.254538][ C0] 2 locks held by swapper/0/0: [ 57.259273][ C0] #0: ffffffff899bbaa0 (rcu_callback){....}-{0:0}, at: rcu_core+0x520/0x1370 [ 57.268113][ C0] #1: ffffffff899bbbc0 (rcu_read_lock){....}-{1:2}, at: percpu_ref_switch_to_atomic_rcu+0x209/0x540 [ 57.278937][ C0] [ 57.278937][ C0] the shortest dependencies between 2nd lock and 1st lock: [ 57.288287][ C0] -> (&pid->wait_pidfd){+.+.}-{2:2} { [ 57.293738][ C0] HARDIRQ-ON-W at: [ 57.297793][ C0] lock_acquire+0x1f2/0x8f0 [ 57.304096][ C0] _raw_spin_lock+0x2a/0x40 [ 57.310399][ C0] proc_pid_make_inode+0x1f9/0x3c0 [ 57.317308][ C0] proc_pid_instantiate+0x51/0x150 [ 57.324214][ C0] proc_pid_lookup+0x1da/0x340 [ 57.330776][ C0] proc_root_lookup+0x20/0x60 [ 57.337249][ C0] __lookup_slow+0x256/0x490 [ 57.343636][ C0] walk_component+0x418/0x6a0 [ 57.350123][ C0] link_path_walk.part.0+0x4f1/0xb50 [ 57.357203][ C0] path_openat+0x25a/0x27d0 [ 57.363500][ C0] do_filp_open+0x192/0x260 [ 57.369800][ C0] do_sys_openat2+0x585/0x7d0 [ 57.376286][ C0] do_sys_open+0xc3/0x140 [ 57.382435][ C0] do_syscall_64+0xf6/0x7d0 [ 57.388757][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 57.396443][ C0] SOFTIRQ-ON-W at: [ 57.400492][ C0] lock_acquire+0x1f2/0x8f0 [ 57.406806][ C0] _raw_spin_lock+0x2a/0x40 [ 57.413107][ C0] proc_pid_make_inode+0x1f9/0x3c0 [ 57.420016][ C0] proc_pid_instantiate+0x51/0x150 [ 57.426924][ C0] proc_pid_lookup+0x1da/0x340 [ 57.433482][ C0] proc_root_lookup+0x20/0x60 [ 57.439957][ C0] __lookup_slow+0x256/0x490 [ 57.446584][ C0] walk_component+0x418/0x6a0 [ 57.453099][ C0] link_path_walk.part.0+0x4f1/0xb50 [ 57.460210][ C0] path_openat+0x25a/0x27d0 [ 57.466534][ C0] do_filp_open+0x192/0x260 [ 57.472866][ C0] do_sys_openat2+0x585/0x7d0 [ 57.479366][ C0] do_sys_open+0xc3/0x140 [ 57.485606][ C0] do_syscall_64+0xf6/0x7d0 [ 57.492042][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 57.499752][ C0] INITIAL USE at: [ 57.503734][ C0] lock_acquire+0x1f2/0x8f0 [ 57.509973][ C0] _raw_spin_lock_irqsave+0x8c/0xbf [ 57.516883][ C0] __wake_up_common_lock+0xb4/0x130 [ 57.523805][ C0] do_notify_parent+0x19e/0xe60 [ 57.530374][ C0] do_exit+0x238f/0x2dd0 [ 57.536328][ C0] call_usermodehelper_exec_async+0x507/0x710 [ 57.544102][ C0] ret_from_fork+0x24/0x30 [ 57.550241][ C0] } [ 57.552836][ C0] ... key at: [] __key.53827+0x0/0x40 [ 57.560359][ C0] ... acquired at: [ 57.564284][ C0] _raw_spin_lock+0x2a/0x40 [ 57.568942][ C0] io_submit_one+0xc1b/0x2ec0 [ 57.573802][ C0] __ia32_compat_sys_io_submit+0x1bf/0x530 [ 57.579781][ C0] do_fast_syscall_32+0x270/0xe90 [ 57.584957][ C0] entry_SYSENTER_compat+0x70/0x7f [ 57.590213][ C0] [ 57.592532][ C0] -> (&ctx->ctx_lock){..-.}-{2:2} { [ 57.597715][ C0] IN-SOFTIRQ-W at: [ 57.601677][ C0] lock_acquire+0x1f2/0x8f0 [ 57.607808][ C0] _raw_spin_lock_irq+0x5b/0x80 [ 57.614301][ C0] free_ioctx_users+0x2b/0x450 [ 57.620689][ C0] percpu_ref_switch_to_atomic_rcu+0x494/0x540 [ 57.628475][ C0] rcu_core+0x59f/0x1370 [ 57.634339][ C0] __do_softirq+0x26c/0x9f7 [ 57.640466][ C0] irq_exit+0x192/0x1d0 [ 57.646273][ C0] smp_apic_timer_interrupt+0x19e/0x600 [ 57.653460][ C0] apic_timer_interrupt+0xf/0x20 [ 57.660041][ C0] native_safe_halt+0xe/0x10 [ 57.666310][ C0] default_idle+0x49/0x350 [ 57.672358][ C0] do_idle+0x393/0x690 [ 57.678055][ C0] cpu_startup_entry+0x14/0x20 [ 57.684448][ C0] start_kernel+0x867/0x8a1 [ 57.690592][ C0] secondary_startup_64+0xa4/0xb0 [ 57.697247][ C0] INITIAL USE at: [ 57.701134][ C0] lock_acquire+0x1f2/0x8f0 [ 57.707187][ C0] _raw_spin_lock_irq+0x5b/0x80 [ 57.713591][ C0] io_submit_one+0xbd6/0x2ec0 [ 57.719820][ C0] __ia32_compat_sys_io_submit+0x1bf/0x530 [ 57.727185][ C0] do_fast_syscall_32+0x270/0xe90 [ 57.733761][ C0] entry_SYSENTER_compat+0x70/0x7f [ 57.740464][ C0] } [ 57.742997][ C0] ... key at: [] __key.55303+0x0/0x40 [ 57.750537][ C0] ... acquired at: [ 57.754342][ C0] mark_lock+0x624/0xf10 [ 57.758736][ C0] __lock_acquire+0x1d28/0x4e00 [ 57.763737][ C0] lock_acquire+0x1f2/0x8f0 [ 57.768396][ C0] _raw_spin_lock_irq+0x5b/0x80 [ 57.773426][ C0] free_ioctx_users+0x2b/0x450 [ 57.778359][ C0] percpu_ref_switch_to_atomic_rcu+0x494/0x540 [ 57.784670][ C0] rcu_core+0x59f/0x1370 [ 57.789071][ C0] __do_softirq+0x26c/0x9f7 [ 57.793723][ C0] irq_exit+0x192/0x1d0 [ 57.798028][ C0] smp_apic_timer_interrupt+0x19e/0x600 [ 57.803717][ C0] apic_timer_interrupt+0xf/0x20 [ 57.808813][ C0] native_safe_halt+0xe/0x10 [ 57.813549][ C0] default_idle+0x49/0x350 [ 57.818110][ C0] do_idle+0x393/0x690 [ 57.822325][ C0] cpu_startup_entry+0x14/0x20 [ 57.827237][ C0] start_kernel+0x867/0x8a1 [ 57.831889][ C0] secondary_startup_64+0xa4/0xb0 [ 57.837056][ C0] [ 57.839376][ C0] [ 57.839376][ C0] stack backtrace: [ 57.845251][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-syzkaller #0 [ 57.852762][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.862790][ C0] Call Trace: [ 57.866050][ C0] [ 57.868988][ C0] dump_stack+0x188/0x20d [ 57.873315][ C0] check_usage_forwards.cold+0x20/0x29 [ 57.878773][ C0] ? check_usage_backwards+0x4e0/0x4e0 [ 57.884227][ C0] ? stack_trace_consume_entry+0x160/0x160 [ 57.890023][ C0] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 57.896591][ C0] ? save_trace+0x42/0x9f0 [ 57.901000][ C0] mark_lock+0x624/0xf10 [ 57.905225][ C0] ? check_usage_backwards+0x4e0/0x4e0 [ 57.910665][ C0] ? print_usage_bug+0x240/0x240 [ 57.915577][ C0] ? print_usage_bug+0x240/0x240 [ 57.920486][ C0] ? mark_lock+0x12b/0xf10 [ 57.924875][ C0] __lock_acquire+0x1d28/0x4e00 [ 57.929711][ C0] ? mark_held_locks+0xe0/0xe0 [ 57.934463][ C0] ? __wake_up_common_lock+0xde/0x130 [ 57.939871][ C0] lock_acquire+0x1f2/0x8f0 [ 57.944410][ C0] ? free_ioctx_users+0x2b/0x450 [ 57.949352][ C0] ? lock_release+0x800/0x800 [ 57.954005][ C0] ? lock_acquire+0x1f2/0x8f0 [ 57.958708][ C0] ? percpu_ref_switch_to_atomic_rcu+0x209/0x540 [ 57.965030][ C0] ? lock_release+0x800/0x800 [ 57.969733][ C0] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 57.975580][ C0] _raw_spin_lock_irq+0x5b/0x80 [ 57.980473][ C0] ? free_ioctx_users+0x2b/0x450 [ 57.985393][ C0] free_ioctx_users+0x2b/0x450 [ 57.990245][ C0] percpu_ref_switch_to_atomic_rcu+0x494/0x540 [ 57.996430][ C0] rcu_core+0x59f/0x1370 [ 58.000704][ C0] ? __rcu_read_unlock+0x700/0x700 [ 58.005796][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 58.011317][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 58.017319][ C0] ? run_rebalance_domains+0x202/0x2c0 [ 58.022755][ C0] __do_softirq+0x26c/0x9f7 [ 58.027237][ C0] irq_exit+0x192/0x1d0 [ 58.031367][ C0] smp_apic_timer_interrupt+0x19e/0x600 [ 58.036896][ C0] apic_timer_interrupt+0xf/0x20 [ 58.041806][ C0] [ 58.044720][ C0] RIP: 0010:native_safe_halt+0xe/0x10 [ 58.050084][ C0] Code: cc cc cc cc cc cc cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d d4 f2 59 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d c4 f2 59 00 fb f4 cc 41 56 41 55 41 54 55 53 e8 33 77 92 f9 e8 fe b2 ca fb 0f 1f [ 58.069758][ C0] RSP: 0018:ffffffff89807d98 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 [ 58.078159][ C0] RAX: 1ffffffff132925f RBX: ffffffff898864c0 RCX: 0000000000000000 [ 58.086123][ C0] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffffffff89886d84 [ 58.094157][ C0] RBP: dffffc0000000000 R08: ffffffff898864c0 R09: 0000000000000000 [ 58.102104][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff1310c98 [ 58.110062][ C0] R13: 0000000000000000 R14: ffffffff8a88e980 R15: 0000000000000000 [ 58.118027][ C0] default_idle+0x49/0x350 [ 58.122421][ C0] do_idle+0x393/0x690 [ 58.126466][ C0] ? rcu_read_lock_held+0x9c/0xb0 [ 58.131489][ C0] ? arch_cpu_idle_exit+0x70/0x70 [ 58.136508][ C0] ? schedule+0xe7/0x2a0 [ 58.140745][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 58.146973][ C0] cpu_startup_entry+0x14/0x20 [ 58.151797][ C0] start_kernel+0x867/0x8a1 [ 58.156363][ C0] ? mem_encrypt_init+0x5/0x5 [ 58.161012][ C0] ? x86_family+0x3d/0x50 [ 58.165315][ C0] ? load_ucode_bsp+0x23d/0x27d [ 58.170139][ C0] secondary_startup_64+0xa4/0xb0