[ 31.413484] audit: type=1800 audit(1572949212.371:33): pid=6783 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 31.440204] audit: type=1800 audit(1572949212.371:34): pid=6783 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 [ 32.015161] random: sshd: uninitialized urandom read (32 bytes read) [ 32.352855] audit: type=1400 audit(1572949213.311:35): avc: denied { map } for pid=6957 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 32.402053] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 32.990535] random: sshd: uninitialized urandom read (32 bytes read) [ 33.173228] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.27' (ECDSA) to the list of known hosts. [ 38.791171] random: sshd: uninitialized urandom read (32 bytes read) [ 38.909414] audit: type=1400 audit(1572949219.861:36): avc: denied { map } for pid=6970 comm="syz-executor343" path="/root/syz-executor343342523" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 39.150946] IPVS: ftp: loaded support on port[0] = 21 [ 39.905158] audit: type=1400 audit(1572949220.861:37): avc: denied { create } for pid=6971 comm="syz-executor343" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 39.929430] audit: type=1400 audit(1572949220.861:38): avc: denied { write } for pid=6971 comm="syz-executor343" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 39.953353] audit: type=1400 audit(1572949220.861:39): avc: denied { read } for pid=6971 comm="syz-executor343" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 40.005168] chnl_net:caif_netlink_parms(): no params data found [ 40.033950] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.040812] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.047790] device bridge_slave_0 entered promiscuous mode [ 40.054765] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.061212] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.068109] device bridge_slave_1 entered promiscuous mode [ 40.082654] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 40.091403] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 40.106993] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 40.114319] team0: Port device team_slave_0 added [ 40.119694] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 40.126901] team0: Port device team_slave_1 added [ 40.132112] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 40.139207] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 40.221788] device hsr_slave_0 entered promiscuous mode [ 40.290515] device hsr_slave_1 entered promiscuous mode [ 40.330688] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 40.337545] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 40.350126] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.356693] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.363646] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.369983] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.395904] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 40.402913] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.410979] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 40.418895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.438407] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.455940] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.465765] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 40.471911] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.479683] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.488242] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.494730] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.511597] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.519258] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.525658] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.533170] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 40.541071] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 40.548561] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 40.556600] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 40.564965] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 40.574200] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 40.580279] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 40.592382] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 40.599474] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready executing program [ 40.607277] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 40.619103] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.648009] block nbd0: Receive control failed (result -22) [ 40.656997] block nbd0: shutting down sockets [ 40.662416] [ 40.664036] ============================================ [ 40.669461] WARNING: possible recursive locking detected [ 40.674889] 4.14.151 #0 Not tainted [ 40.678493] -------------------------------------------- [ 40.683933] kworker/u5:1/6981 is trying to acquire lock: [ 40.689359] ("knbd%d-recv"nbd->index){+.+.}, at: [] flush_workqueue+0xda/0x1400 [ 40.698447] [ 40.698447] but task is already holding lock: [ 40.704483] ("knbd%d-recv"nbd->index){+.+.}, at: [] process_one_work+0x76e/0x1600 [ 40.713757] [ 40.713757] other info that might help us debug this: [ 40.720414] Possible unsafe locking scenario: [ 40.720414] [ 40.726447] CPU0 [ 40.729020] ---- [ 40.731580] lock("knbd%d-recv"nbd->index); [ 40.735980] lock("knbd%d-recv"nbd->index); [ 40.740537] [ 40.740537] *** DEADLOCK *** [ 40.740537] [ 40.746572] May be due to missing lock nesting notation [ 40.746572] [ 40.753836] 3 locks held by kworker/u5:1/6981: [ 40.758411] #0: ("knbd%d-recv"nbd->index){+.+.}, at: [] process_one_work+0x76e/0x1600 [ 40.768120] #1: ((&args->work)){+.+.}, at: [] process_one_work+0x7ab/0x1600 [ 40.777031] #2: (&nbd->config_lock){+.+.}, at: [] refcount_dec_and_mutex_lock+0x49/0x6c [ 40.786892] [ 40.786892] stack backtrace: [ 40.791368] CPU: 0 PID: 6981 Comm: kworker/u5:1 Not tainted 4.14.151 #0 [ 40.798093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.807433] Workqueue: knbd0-recv recv_work [ 40.811729] Call Trace: [ 40.814298] dump_stack+0x138/0x197 [ 40.817906] __lock_acquire.cold+0x2bf/0x8dc [ 40.822295] ? trace_hardirqs_on+0x10/0x10 [ 40.826506] ? __lock_is_held+0xb6/0x140 [ 40.830566] lock_acquire+0x16f/0x430 [ 40.834345] ? flush_workqueue+0xda/0x1400 [ 40.838557] flush_workqueue+0x109/0x1400 [ 40.842681] ? flush_workqueue+0xda/0x1400 [ 40.846892] ? drain_workqueue+0x27/0x3e0 [ 40.851015] ? lock_downgrade+0x740/0x740 [ 40.855137] ? flush_work+0x730/0x730 [ 40.858914] drain_workqueue+0x177/0x3e0 [ 40.862967] ? drain_workqueue+0x177/0x3e0 [ 40.867203] ? mark_held_locks+0xb1/0x100 [ 40.871328] ? kfree+0x183/0x270 [ 40.874687] destroy_workqueue+0x21/0x620 [ 40.878826] ? trace_hardirqs_on+0xd/0x10 [ 40.882950] nbd_config_put+0x43c/0x7a0 [ 40.886899] recv_work+0x18d/0x1f0 [ 40.890441] process_one_work+0x863/0x1600 [ 40.894652] ? pwq_dec_nr_in_flight+0x2e0/0x2e0 [ 40.899296] worker_thread+0x5d9/0x1050 [ 40.903249] kthread+0x319/0x430 [ 40.906608] ? process_one_work+0x1600/0x1600 [ 40.911080] ? kthread_create_on_node+0xd0/0xd0 [ 40.915725] ret_from_fork+0x24/0x30 [ 40.972248] kobject: 'batman_adv' (ffff88808df04280): kobject_uevent_env [ 40.979103] kobject: 'batman_adv' (ffff88808df04280): kobject_uevent_env: filter function caused the event to drop! [ 40.989735] kobject: 'batman_adv' (ffff88808df04280): kobject_cleanup, parent (null) [ 40.998524] kobject: 'batman_adv' (ffff88808df04280): calling ktype release [ 41.005826] kobject: (ffff88808df04280): dynamic_kobj_release [ 41.012106] kobject: 'batman_adv': free name [ 41.016643] kobject: 'rx-0' (ffff88809ad0ce50): kobject_cleanup, parent ffff8880a1295048 [ 41.024883] kobject: 'rx-0' (ffff88809ad0ce50): auto cleanup 'remove' event [ 41.032184] kobject: 'rx-0' (ffff88809ad0ce50): kobject_uevent_env [ 41.038510] kobject: 'rx-0' (ffff88809ad0ce50): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/rx-0' [ 41.049044] kobject: 'rx-0' (ffff88809ad0ce50): auto cleanup kobject_del [ 41.055934] kobject: 'rx-0' (ffff88809ad0ce50): calling ktype release [ 41.062539] kobject: 'rx-0': free name [ 41.066461] kobject: 'tx-0' (ffff8880917c5058): kobject_cleanup, parent ffff8880a1295048 [ 41.075914] kobject: 'tx-0' (ffff8880917c5058): auto cleanup 'remove' event [ 41.083257] kobject: 'tx-0' (ffff8880917c5058): kobject_uevent_env [ 41.089579] kobject: 'tx-0' (ffff8880917c5058): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/tx-0' [ 41.100107] kobject: 'tx-0' (ffff8880917c5058): auto cleanup kobject_del [ 41.106958] kobject: 'tx-0' (ffff8880917c5058): calling ktype release [ 41.113651] kobject: 'tx-0': free name [ 41.117542] kobject: 'queues' (ffff8880a1295048): kobject_cleanup, parent (null) [ 41.126001] kobject: 'queues' (ffff8880a1295048): calling ktype release [ 41.132766] kobject: 'queues' (ffff8880a1295048): kset_release [ 41.138900] kobject: 'queues': free name [ 41.143355] kobject: 'syz_tun' (ffff8880a9490a70): kobject_uevent_env [ 41.149948] kobject: 'syz_tun' (ffff8880a9490a70): fill_kobj_path: path = '/devices/virtual/net/syz_tun' [ 41.160085] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [