[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 55.807972][ T26] audit: type=1800 audit(1569318244.789:25): pid=8611 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 55.847378][ T26] audit: type=1800 audit(1569318244.789:26): pid=8611 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 55.898257][ T26] audit: type=1800 audit(1569318244.799:27): pid=8611 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.63' (ECDSA) to the list of known hosts. syzkaller login: [ 64.878913][ T8764] IPVS: ftp: loaded support on port[0] = 21 [ 64.932647][ T8764] chnl_net:caif_netlink_parms(): no params data found [ 64.959910][ T8764] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.967369][ T8764] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.975299][ T8764] device bridge_slave_0 entered promiscuous mode [ 64.983785][ T8764] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.990965][ T8764] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.999104][ T8764] device bridge_slave_1 entered promiscuous mode [ 65.015566][ T8764] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.026487][ T8764] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.045824][ T8764] team0: Port device team_slave_0 added [ 65.053158][ T8764] team0: Port device team_slave_1 added [ 65.099674][ T8764] device hsr_slave_0 entered promiscuous mode [ 65.147855][ T8764] device hsr_slave_1 entered promiscuous mode [ 65.205398][ T8764] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.212567][ T8764] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.220595][ T8764] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.227864][ T8764] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.260307][ T8764] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.274029][ T3010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.284653][ T3010] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.292977][ T3010] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.301222][ T3010] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 65.313089][ T8764] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.323511][ T2930] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 65.332072][ T2930] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.339149][ T2930] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.351899][ T8766] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 65.360293][ T8766] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.367378][ T8766] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.387223][ T8764] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 65.400116][ T8764] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 65.413293][ T2930] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 65.422399][ T2930] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 65.430943][ T2930] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.439637][ T2930] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 65.448701][ T2930] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 65.456327][ T2930] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready executing program [ 65.474374][ T8764] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.508418][ T8764] netlink: 80 bytes leftover after parsing attributes in process `syz-executor122'. [ 65.518038][ T8764] netlink: 48 bytes leftover after parsing attributes in process `syz-executor122'. [ 65.529351][ T8764] [ 65.531757][ T8764] ============================= [ 65.536582][ T8764] WARNING: suspicious RCU usage [ 65.541533][ T8764] 5.3.0+ #0 Not tainted [ 65.545678][ T8764] ----------------------------- [ 65.550575][ T8764] include/net/sch_generic.h:492 suspicious rcu_dereference_check() usage! [ 65.559105][ T8764] [ 65.559105][ T8764] other info that might help us debug this: [ 65.559105][ T8764] [ 65.569375][ T8764] [ 65.569375][ T8764] rcu_scheduler_active = 2, debug_locks = 1 [ 65.577535][ T8764] 3 locks held by syz-executor122/8764: [ 65.583161][ T8764] #0: ffffffff88fab2c0 (rcu_read_lock_bh){....}, at: ip_finish_output2+0x2dc/0x2570 [ 65.592687][ T8764] #1: ffffffff88fab2c0 (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x20a/0x36f0 [ 65.602116][ T8764] #2: ffff88809bec5300 (&(&sch->q.lock)->rlock){+...}, at: __dev_queue_xmit+0x14b0/0x36f0 [ 65.612150][ T8764] [ 65.612150][ T8764] stack backtrace: [ 65.618077][ T8764] CPU: 0 PID: 8764 Comm: syz-executor122 Not tainted 5.3.0+ #0 [ 65.625601][ T8764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 65.635638][ T8764] Call Trace: [ 65.638951][ T8764] dump_stack+0x172/0x1f0 [ 65.643349][ T8764] lockdep_rcu_suspicious+0x153/0x15d [ 65.648709][ T8764] netem_enqueue+0x1cfb/0x2d80 [ 65.653448][ T8764] ? lock_acquire+0x190/0x410 [ 65.658119][ T8764] ? __dev_queue_xmit+0x14b0/0x36f0 [ 65.663298][ T8764] __dev_queue_xmit+0x157e/0x36f0 [ 65.668311][ T8764] ? __kasan_check_read+0x11/0x20 [ 65.673321][ T8764] ? netdev_core_pick_tx+0x2f0/0x2f0 [ 65.678689][ T8764] ? match_held_lock+0x450/0x510 [ 65.683614][ T8764] ? __ip_finish_output+0x5fc/0xb90 [ 65.688794][ T8764] ? lock_downgrade+0x920/0x920 [ 65.693630][ T8764] ? ip_finish_output2+0x13e2/0x2570 [ 65.698900][ T8764] ? __ip_finish_output+0x5fc/0xb90 [ 65.704073][ T8764] ? ip_finish_output2+0x13e2/0x2570 [ 65.709352][ T8764] dev_queue_xmit+0x18/0x20 [ 65.713842][ T8764] ? dev_queue_xmit+0x18/0x20 [ 65.718509][ T8764] ip_finish_output2+0x1726/0x2570 [ 65.723620][ T8764] ? nf_ct_deliver_cached_events+0x23d/0x6e0 [ 65.729602][ T8764] ? ip_frag_next+0x910/0x910 [ 65.734258][ T8764] ? ip_mc_output+0xb31/0xf40 [ 65.739022][ T8764] __ip_finish_output+0x5fc/0xb90 [ 65.744027][ T8764] ? __ip_finish_output+0x5fc/0xb90 [ 65.749202][ T8764] ? audit_tag_tree+0x5d0/0xef0 [ 65.754030][ T8764] ip_finish_output+0x38/0x1f0 [ 65.758786][ T8764] ip_mc_output+0x292/0xf40 [ 65.763357][ T8764] ? __ip_queue_xmit+0x1be0/0x1be0 [ 65.768456][ T8764] ? __ip_finish_output+0xb90/0xb90 [ 65.773630][ T8764] ? ip_make_skb+0x1b1/0x2c0 [ 65.778208][ T8764] ? ip_reply_glue_bits+0xc0/0xc0 [ 65.783223][ T8764] ip_local_out+0xbb/0x190 [ 65.787626][ T8764] ip_send_skb+0x42/0xf0 [ 65.791858][ T8764] udp_send_skb.isra.0+0x6b2/0x1160 [ 65.797043][ T8764] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 65.803612][ T8764] udp_sendmsg+0x1e96/0x2820 [ 65.808183][ T8764] ? ip_reply_glue_bits+0xc0/0xc0 [ 65.813188][ T8764] ? udp_unicast_rcv_skb.isra.0+0x360/0x360 [ 65.819061][ T8764] ? find_held_lock+0x35/0x130 [ 65.823806][ T8764] ? __might_fault+0x12b/0x1e0 [ 65.828552][ T8764] ? ___might_sleep+0x163/0x2c0 [ 65.833386][ T8764] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 65.838993][ T8764] ? aa_sk_perm+0x288/0x880 [ 65.843473][ T8764] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 65.848998][ T8764] inet_sendmsg+0x9e/0xe0 [ 65.853309][ T8764] ? inet_sendmsg+0x9e/0xe0 [ 65.857786][ T8764] ? inet_send_prepare+0x4f0/0x4f0 [ 65.862876][ T8764] sock_sendmsg+0xd7/0x130 [ 65.867281][ T8764] ___sys_sendmsg+0x3e2/0x920 [ 65.871949][ T8764] ? copy_msghdr_from_user+0x440/0x440 [ 65.877470][ T8764] ? __kasan_check_read+0x11/0x20 [ 65.882538][ T8764] ? __kasan_check_read+0x11/0x20 [ 65.887552][ T8764] ? __lock_acquire+0x1703/0x4e70 [ 65.892564][ T8764] ? mark_held_locks+0xf0/0xf0 [ 65.897310][ T8764] ? __might_fault+0x12b/0x1e0 [ 65.902211][ T8764] ? find_held_lock+0x35/0x130 [ 65.906963][ T8764] ? __might_fault+0x12b/0x1e0 [ 65.911736][ T8764] ? lock_downgrade+0x920/0x920 [ 65.916585][ T8764] ? ___might_sleep+0x163/0x2c0 [ 65.921420][ T8764] __sys_sendmmsg+0x1bf/0x4d0 [ 65.926120][ T8764] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 65.931126][ T8764] ? release_sock+0x156/0x1c0 [ 65.935786][ T8764] ? __sys_connect+0x12d/0x330 [ 65.940538][ T8764] ? __ia32_sys_accept+0xb0/0xb0 [ 65.945485][ T8764] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 65.950925][ T8764] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 65.956359][ T8764] ? do_syscall_64+0x26/0x760 [ 65.961037][ T8764] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 65.967081][ T8764] ? do_syscall_64+0x26/0x760 [ 65.971740][ T8764] __x64_sys_sendmmsg+0x9d/0x100 [ 65.976653][ T8764] do_syscall_64+0xfa/0x760 [ 65.981136][ T8764] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 65.987003][ T8764] RIP: 0033:0x441b59 [ 65.990878][ T8764] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 66.010510][ T8764] RSP: 002b:00007ffcf108e618 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 66.018909][ T8764] RAX: ffffffffffffffda RBX: 0000315f6576616c RCX: 0000000000441b59 [ 66.026872][ T8764] RDX: 04000000000001a8 RSI: 0000000020007fc0 RDI: 0000000000000005 [ 66.034833][ T8764] RBP: 735f656764697262 R08: 0000000001bbbbbb R09: 0000000001bbbbbb [ 66.042784][ T8764] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 66.050734][ T8764] R13: 00000000004030f0 R14: 0000000000000000 R15: 0000000000000000