[ 81.873877][ T27] audit: type=1800 audit(1582073547.164:26): pid=9983 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 83.130660][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 83.130671][ T27] audit: type=1800 audit(1582073548.444:29): pid=9983 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 83.157819][ T27] audit: type=1800 audit(1582073548.444:30): pid=9983 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.42' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 90.745375][T10137] IPVS: ftp: loaded support on port[0] = 21 [ 90.775916][T10137] [ 90.778419][T10137] ====================================================== [ 90.785538][T10137] WARNING: possible circular locking dependency detected [ 90.792980][T10137] 5.6.0-rc1-syzkaller #0 Not tainted [ 90.798267][T10137] ------------------------------------------------------ [ 90.805281][T10137] syz-executor389/10137 is trying to acquire lock: [ 90.811780][T10137] ffffe8ffffc4a658 (&l->lock){....}, at: bpf_lru_push_free+0xe5/0x5b0 [ 90.819938][T10137] [ 90.819938][T10137] but task is already holding lock: [ 90.827368][T10137] ffff88809fad0a20 (&htab->buckets[i].lock){....}, at: __htab_map_lookup_and_delete_batch+0x617/0x1540 [ 90.838887][T10137] [ 90.838887][T10137] which lock already depends on the new lock. [ 90.838887][T10137] [ 90.850049][T10137] [ 90.850049][T10137] the existing dependency chain (in reverse order) is: [ 90.859212][T10137] [ 90.859212][T10137] -> #1 (&htab->buckets[i].lock){....}: [ 90.867110][T10137] _raw_spin_lock_irqsave+0x95/0xcd [ 90.872842][T10137] htab_lru_map_delete_node+0xce/0x2f0 [ 90.878832][T10137] __bpf_lru_list_shrink+0xf9/0x470 [ 90.884658][T10137] bpf_lru_pop_free+0xa9f/0x1670 [ 90.890113][T10137] prealloc_lru_pop+0x2c/0xa0 [ 90.895308][T10137] __htab_lru_percpu_map_update_elem+0x67e/0xa90 [ 90.902151][T10137] bpf_percpu_hash_update+0x16e/0x210 [ 90.908170][T10137] bpf_map_update_value.isra.0+0x2d7/0x8e0 [ 90.915373][T10137] __do_sys_bpf+0x3163/0x41e0 [ 90.920745][T10137] __x64_sys_bpf+0x73/0xb0 [ 90.925676][T10137] do_syscall_64+0xfa/0x790 [ 90.930934][T10137] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 90.937334][T10137] [ 90.937334][T10137] -> #0 (&l->lock){....}: [ 90.943844][T10137] __lock_acquire+0x2596/0x4a00 [ 90.949632][T10137] lock_acquire+0x190/0x410 [ 90.954884][T10137] _raw_spin_lock_irqsave+0x95/0xcd [ 90.960614][T10137] bpf_lru_push_free+0xe5/0x5b0 [ 90.967114][T10137] __htab_map_lookup_and_delete_batch+0x8d4/0x1540 [ 90.974836][T10137] htab_lru_percpu_map_lookup_and_delete_batch+0x37/0x40 [ 90.982450][T10137] bpf_map_do_batch+0x3f5/0x510 [ 90.987827][T10137] __do_sys_bpf+0x1f7d/0x41e0 [ 90.993128][T10137] __x64_sys_bpf+0x73/0xb0 [ 90.998280][T10137] do_syscall_64+0xfa/0x790 [ 91.003380][T10137] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 91.009908][T10137] [ 91.009908][T10137] other info that might help us debug this: [ 91.009908][T10137] [ 91.020131][T10137] Possible unsafe locking scenario: [ 91.020131][T10137] [ 91.027790][T10137] CPU0 CPU1 [ 91.033152][T10137] ---- ---- [ 91.038749][T10137] lock(&htab->buckets[i].lock); [ 91.043869][T10137] lock(&l->lock); [ 91.050737][T10137] lock(&htab->buckets[i].lock); [ 91.058496][T10137] lock(&l->lock); [ 91.062294][T10137] [ 91.062294][T10137] *** DEADLOCK *** [ 91.062294][T10137] [ 91.070822][T10137] 2 locks held by syz-executor389/10137: [ 91.077087][T10137] #0: ffffffff89bac240 (rcu_read_lock){....}, at: __htab_map_lookup_and_delete_batch+0x54b/0x1540 [ 91.087938][T10137] #1: ffff88809fad0a20 (&htab->buckets[i].lock){....}, at: __htab_map_lookup_and_delete_batch+0x617/0x1540 [ 91.099621][T10137] [ 91.099621][T10137] stack backtrace: [ 91.106063][T10137] CPU: 0 PID: 10137 Comm: syz-executor389 Not tainted 5.6.0-rc1-syzkaller #0 [ 91.115174][T10137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.125471][T10137] Call Trace: [ 91.128760][T10137] dump_stack+0x197/0x210 [ 91.133086][T10137] print_circular_bug.isra.0.cold+0x163/0x172 [ 91.139165][T10137] check_noncircular+0x32e/0x3e0 [ 91.144101][T10137] ? print_circular_bug.isra.0+0x230/0x230 [ 91.149900][T10137] ? alloc_list_entry+0xc0/0xc0 [ 91.154754][T10137] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 91.161095][T10137] ? find_first_zero_bit+0x9a/0xc0 [ 91.166390][T10137] __lock_acquire+0x2596/0x4a00 [ 91.171238][T10137] ? mark_held_locks+0xf0/0xf0 [ 91.176089][T10137] lock_acquire+0x190/0x410 [ 91.180726][T10137] ? bpf_lru_push_free+0xe5/0x5b0 [ 91.186011][T10137] _raw_spin_lock_irqsave+0x95/0xcd [ 91.191230][T10137] ? bpf_lru_push_free+0xe5/0x5b0 [ 91.196570][T10137] bpf_lru_push_free+0xe5/0x5b0 [ 91.201416][T10137] __htab_map_lookup_and_delete_batch+0x8d4/0x1540 [ 91.207915][T10137] ? __kasan_check_read+0x11/0x20 [ 91.212983][T10137] ? htab_percpu_map_seq_show_elem+0x490/0x490 [ 91.220257][T10137] ? htab_percpu_map_lookup_batch+0x40/0x40 [ 91.226160][T10137] htab_lru_percpu_map_lookup_and_delete_batch+0x37/0x40 [ 91.233527][T10137] bpf_map_do_batch+0x3f5/0x510 [ 91.238597][T10137] __do_sys_bpf+0x1f7d/0x41e0 [ 91.243446][T10137] ? find_held_lock+0x35/0x130 [ 91.248367][T10137] ? bpf_prog_load+0x1820/0x1820 [ 91.253308][T10137] ? lock_downgrade+0x920/0x920 [ 91.258307][T10137] ? handle_mm_fault+0x292/0xa50 [ 91.263252][T10137] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 91.268857][T10137] ? do_syscall_64+0x26/0x790 [ 91.273626][T10137] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 91.280114][T10137] ? do_syscall_64+0x26/0x790 [ 91.284802][T10137] __x64_sys_bpf+0x73/0xb0 [ 91.289256][T10137] do_syscall_64+0xfa/0x790 [ 91.293963][T10137] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 91.299926][T10137] RIP: 0033:0x440c09 [ 91.304000][T10137] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 91.323707][T10137] RSP: 002b:00007ffdd86c5d18 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 91.332123][T10137] RAX: ffffffffffffffda RBX: 00000000004a2390 RCX: 0000000000440c09 [ 91.340204][T10137] RDX: 0000000000000038 RSI: 0000000020000100 RDI: 0000000000000019 [ 91.348173][T10137] RBP: 00000000006cb018 R08: 0000000120080522 R09: 0000000120080522 [ 91.356246][T10137] R10: 0000000120080522 R11: 0000000000000246 R12: 0000000000402110 [ 91.364226][T10137] R13: 00000000004021a0 R14: 0000000000000000 R15: 0000000000000000