[ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.42' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 69.637973][ T27] audit: type=1400 audit(1597007820.835:8): avc: denied { execmem } for pid=6847 comm="syz-executor880" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 69.655168][ T6847] [ 69.660948][ T6847] ============================================ [ 69.667066][ T6847] WARNING: possible recursive locking detected [ 69.673216][ T6847] 5.8.0-syzkaller #0 Not tainted [ 69.678151][ T6847] -------------------------------------------- [ 69.684271][ T6847] syz-executor880/6847 is trying to acquire lock: [ 69.690648][ T6847] ffff8880a19214d8 (&ctx->completion_lock){....}-{2:2}, at: io_queue_linked_timeout+0x4c/0x200 [ 69.700960][ T6847] [ 69.700960][ T6847] but task is already holding lock: [ 69.708305][ T6847] ffff8880a19214d8 (&ctx->completion_lock){....}-{2:2}, at: io_cqring_overflow_flush+0x814/0xaa0 [ 69.718778][ T6847] [ 69.718778][ T6847] other info that might help us debug this: [ 69.726806][ T6847] Possible unsafe locking scenario: [ 69.726806][ T6847] [ 69.734224][ T6847] CPU0 [ 69.737472][ T6847] ---- [ 69.740756][ T6847] lock(&ctx->completion_lock); [ 69.745659][ T6847] lock(&ctx->completion_lock); [ 69.750562][ T6847] [ 69.750562][ T6847] *** DEADLOCK *** [ 69.750562][ T6847] [ 69.758693][ T6847] May be due to missing lock nesting notation [ 69.758693][ T6847] [ 69.766994][ T6847] 1 lock held by syz-executor880/6847: [ 69.772425][ T6847] #0: ffff8880a19214d8 (&ctx->completion_lock){....}-{2:2}, at: io_cqring_overflow_flush+0x814/0xaa0 [ 69.783435][ T6847] [ 69.783435][ T6847] stack backtrace: [ 69.789306][ T6847] CPU: 1 PID: 6847 Comm: syz-executor880 Not tainted 5.8.0-syzkaller #0 [ 69.797605][ T6847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 69.807632][ T6847] Call Trace: [ 69.810902][ T6847] dump_stack+0x18f/0x20d [ 69.815220][ T6847] __lock_acquire.cold+0x115/0x396 [ 69.820306][ T6847] ? lockdep_hardirqs_on_prepare+0x530/0x530 [ 69.826256][ T6847] ? io_wqe_wake_worker+0x1ce/0x6a0 [ 69.831424][ T6847] lock_acquire+0x1f1/0xad0 [ 69.835915][ T6847] ? io_queue_linked_timeout+0x4c/0x200 [ 69.841445][ T6847] ? lock_release+0x8e0/0x8e0 [ 69.846103][ T6847] ? io_wqe_wake_worker+0x276/0x6a0 [ 69.851275][ T6847] ? io_wq_for_each_worker.isra.0+0x370/0x370 [ 69.857312][ T6847] ? lockdep_hardirqs_off+0x89/0xc0 [ 69.862482][ T6847] _raw_spin_lock_irq+0x5b/0x80 [ 69.867307][ T6847] ? io_queue_linked_timeout+0x4c/0x200 [ 69.872823][ T6847] io_queue_linked_timeout+0x4c/0x200 [ 69.878167][ T6847] __io_queue_async_work+0x1f8/0x4c0 [ 69.883437][ T6847] io_commit_cqring+0x456/0x7a0 [ 69.888259][ T6847] io_cqring_overflow_flush+0x5b8/0xaa0 [ 69.893776][ T6847] ? io_timeout_fn+0x3f0/0x3f0 [ 69.898536][ T6847] ? lockdep_hardirqs_on_prepare+0x354/0x530 [ 69.904509][ T6847] ? trace_hardirqs_on+0x5f/0x220 [ 69.909520][ T6847] io_ring_ctx_wait_and_kill+0x30e/0x600 [ 69.915127][ T6847] io_uring_release+0x3e/0x50 [ 69.919830][ T6847] __fput+0x285/0x920 [ 69.923795][ T6847] ? io_ring_ctx_wait_and_kill+0x600/0x600 [ 69.930440][ T6847] task_work_run+0xdd/0x190 [ 69.934917][ T6847] do_exit+0xb7d/0x29f0 [ 69.939040][ T6847] ? mm_update_next_owner+0x7a0/0x7a0 [ 69.944381][ T6847] ? io_submit_sqes+0x2380/0x2380 [ 69.949375][ T6847] ? fput_many+0x2f/0x1a0 [ 69.953676][ T6847] ? lock_is_held_type+0xbb/0xf0 [ 69.958586][ T6847] do_group_exit+0x125/0x310 [ 69.963155][ T6847] __x64_sys_exit_group+0x3a/0x50 [ 69.968150][ T6847] do_syscall_64+0x2d/0x70 [ 69.972556][ T6847] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 69.978419][ T6847] RIP: 0033:0x43f598 [ 69.982278][ T6847] Code: Bad RIP value. [ 69.986349][ T6847] RSP: 002b:00007ffd3a4fbaa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 69.994729][ T6847] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f598 [ 70.002672][ T6847] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 70.010631][ T6847] RBP: 00000000004beda8 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 70.018572][ T6847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 70.026513][ T6847] R13: 00000000006d11a0 R14: 0000000000000000 R15: 0000000000000000