[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 95.861224][ T27] audit: type=1800 audit(1582072230.961:25): pid=9683 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 95.881151][ T27] audit: type=1800 audit(1582072230.971:26): pid=9683 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 95.934788][ T27] audit: type=1800 audit(1582072230.971:27): pid=9683 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.54' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 107.133962][ T9837] IPVS: ftp: loaded support on port[0] = 21 [ 107.161912][ T9837] [ 107.164375][ T9837] ====================================================== [ 107.171377][ T9837] WARNING: possible circular locking dependency detected [ 107.178386][ T9837] 5.6.0-rc1-syzkaller #0 Not tainted [ 107.183759][ T9837] ------------------------------------------------------ [ 107.190763][ T9837] syz-executor925/9837 is trying to acquire lock: [ 107.197156][ T9837] ffffe8ffffc48c58 (&l->lock){....}, at: bpf_lru_push_free+0xe5/0x5b0 [ 107.205299][ T9837] [ 107.205299][ T9837] but task is already holding lock: [ 107.212653][ T9837] ffff8880a0661920 (&htab->buckets[i].lock){....}, at: __htab_map_lookup_and_delete_batch+0x617/0x1540 [ 107.223834][ T9837] [ 107.223834][ T9837] which lock already depends on the new lock. [ 107.223834][ T9837] [ 107.234223][ T9837] [ 107.234223][ T9837] the existing dependency chain (in reverse order) is: [ 107.243247][ T9837] [ 107.243247][ T9837] -> #1 (&htab->buckets[i].lock){....}: [ 107.250999][ T9837] _raw_spin_lock_irqsave+0x95/0xcd [ 107.256820][ T9837] htab_lru_map_delete_node+0xce/0x2f0 [ 107.262783][ T9837] __bpf_lru_list_shrink+0xf9/0x470 [ 107.268561][ T9837] bpf_lru_pop_free+0xa9f/0x1670 [ 107.274215][ T9837] prealloc_lru_pop+0x2c/0xa0 [ 107.279445][ T9837] __htab_lru_percpu_map_update_elem+0x67e/0xa90 [ 107.286290][ T9837] bpf_percpu_hash_update+0x16e/0x210 [ 107.292181][ T9837] bpf_map_update_value.isra.0+0x2d7/0x8e0 [ 107.298545][ T9837] __do_sys_bpf+0x3163/0x41e0 [ 107.303734][ T9837] __x64_sys_bpf+0x73/0xb0 [ 107.308665][ T9837] do_syscall_64+0xfa/0x790 [ 107.313686][ T9837] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 107.320707][ T9837] [ 107.320707][ T9837] -> #0 (&l->lock){....}: [ 107.327215][ T9837] __lock_acquire+0x2596/0x4a00 [ 107.332569][ T9837] lock_acquire+0x190/0x410 [ 107.337587][ T9837] _raw_spin_lock_irqsave+0x95/0xcd [ 107.343361][ T9837] bpf_lru_push_free+0xe5/0x5b0 [ 107.348717][ T9837] __htab_map_lookup_and_delete_batch+0x8d4/0x1540 [ 107.355731][ T9837] htab_lru_percpu_map_lookup_and_delete_batch+0x37/0x40 [ 107.363332][ T9837] bpf_map_do_batch+0x3f5/0x510 [ 107.368873][ T9837] __do_sys_bpf+0x1f7d/0x41e0 [ 107.374185][ T9837] __x64_sys_bpf+0x73/0xb0 [ 107.379113][ T9837] do_syscall_64+0xfa/0x790 [ 107.384128][ T9837] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 107.390524][ T9837] [ 107.390524][ T9837] other info that might help us debug this: [ 107.390524][ T9837] [ 107.400754][ T9837] Possible unsafe locking scenario: [ 107.400754][ T9837] [ 107.408195][ T9837] CPU0 CPU1 [ 107.413546][ T9837] ---- ---- [ 107.419039][ T9837] lock(&htab->buckets[i].lock); [ 107.424075][ T9837] lock(&l->lock); [ 107.430648][ T9837] lock(&htab->buckets[i].lock); [ 107.438393][ T9837] lock(&l->lock); [ 107.442224][ T9837] [ 107.442224][ T9837] *** DEADLOCK *** [ 107.442224][ T9837] [ 107.450373][ T9837] 2 locks held by syz-executor925/9837: [ 107.455951][ T9837] #0: ffffffff89bac240 (rcu_read_lock){....}, at: __htab_map_lookup_and_delete_batch+0x54b/0x1540 [ 107.466622][ T9837] #1: ffff8880a0661920 (&htab->buckets[i].lock){....}, at: __htab_map_lookup_and_delete_batch+0x617/0x1540 [ 107.478216][ T9837] [ 107.478216][ T9837] stack backtrace: [ 107.484099][ T9837] CPU: 0 PID: 9837 Comm: syz-executor925 Not tainted 5.6.0-rc1-syzkaller #0 [ 107.492804][ T9837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 107.502854][ T9837] Call Trace: [ 107.506222][ T9837] dump_stack+0x197/0x210 [ 107.511170][ T9837] print_circular_bug.isra.0.cold+0x163/0x172 [ 107.517671][ T9837] check_noncircular+0x32e/0x3e0 [ 107.522601][ T9837] ? print_circular_bug.isra.0+0x230/0x230 [ 107.528486][ T9837] ? alloc_list_entry+0xc0/0xc0 [ 107.533364][ T9837] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 107.539613][ T9837] ? find_first_zero_bit+0x9a/0xc0 [ 107.544759][ T9837] __lock_acquire+0x2596/0x4a00 [ 107.549750][ T9837] ? mark_held_locks+0xf0/0xf0 [ 107.554497][ T9837] lock_acquire+0x190/0x410 [ 107.558999][ T9837] ? bpf_lru_push_free+0xe5/0x5b0 [ 107.564020][ T9837] _raw_spin_lock_irqsave+0x95/0xcd [ 107.569217][ T9837] ? bpf_lru_push_free+0xe5/0x5b0 [ 107.574233][ T9837] bpf_lru_push_free+0xe5/0x5b0 [ 107.579080][ T9837] __htab_map_lookup_and_delete_batch+0x8d4/0x1540 [ 107.585572][ T9837] ? __kasan_check_read+0x11/0x20 [ 107.590730][ T9837] ? htab_percpu_map_seq_show_elem+0x490/0x490 [ 107.596936][ T9837] ? htab_percpu_map_lookup_batch+0x40/0x40 [ 107.603018][ T9837] htab_lru_percpu_map_lookup_and_delete_batch+0x37/0x40 [ 107.610258][ T9837] bpf_map_do_batch+0x3f5/0x510 [ 107.615510][ T9837] __do_sys_bpf+0x1f7d/0x41e0 [ 107.620182][ T9837] ? find_held_lock+0x35/0x130 [ 107.624937][ T9837] ? bpf_prog_load+0x1820/0x1820 [ 107.629927][ T9837] ? lock_downgrade+0x920/0x920 [ 107.634854][ T9837] ? handle_mm_fault+0x292/0xa50 [ 107.639790][ T9837] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 107.645416][ T9837] ? do_syscall_64+0x26/0x790 [ 107.650082][ T9837] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 107.656279][ T9837] ? do_syscall_64+0x26/0x790 [ 107.660993][ T9837] __x64_sys_bpf+0x73/0xb0 [ 107.665403][ T9837] do_syscall_64+0xfa/0x790 [ 107.669936][ T9837] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 107.675882][ T9837] RIP: 0033:0x440c09 [ 107.679766][ T9837] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 107.699554][ T9837] RSP: 002b:00007ffcbb99cd68 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 107.707954][ T9837] RAX: ffffffffffffffda RBX: 00000000004a2390 RCX: 0000000000440c09 [ 107.716466][ T9837] RDX: 0000000000000038 RSI: 0000000020000100 RDI: 0000000000000019 [ 107.727492][ T9837] RBP: 00000000006cb018 R08: 0000000120080522 R09: 0000000120080522 [ 107.735562][ T9837] R10: 0000000120080522 R11: 0000000000000246 R12: 0000000000402110 [ 107.743512][ T9837] R13: 00000000004021a0 R14: 0000000000000000 R15: 0000000000000000