[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 88.198234][ T27] audit: type=1800 audit(1582072378.941:25): pid=9595 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 88.226020][ T27] audit: type=1800 audit(1582072378.941:26): pid=9595 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 88.246762][ T27] audit: type=1800 audit(1582072378.941:27): pid=9595 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.43' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 98.148308][ T9748] IPVS: ftp: loaded support on port[0] = 21 [ 98.178461][ T9748] [ 98.180977][ T9748] ====================================================== [ 98.188055][ T9748] WARNING: possible circular locking dependency detected [ 98.195070][ T9748] 5.5.0-syzkaller #0 Not tainted [ 98.200002][ T9748] ------------------------------------------------------ [ 98.207066][ T9748] syz-executor198/9748 is trying to acquire lock: [ 98.213457][ T9748] ffffe8ffffc49158 (&l->lock){....}, at: bpf_lru_push_free+0xe5/0x5b0 [ 98.221604][ T9748] [ 98.221604][ T9748] but task is already holding lock: [ 98.229061][ T9748] ffff88809f6c3b60 (&htab->buckets[i].lock){....}, at: __htab_map_lookup_and_delete_batch+0x617/0x1540 [ 98.240472][ T9748] [ 98.240472][ T9748] which lock already depends on the new lock. [ 98.240472][ T9748] [ 98.250866][ T9748] [ 98.250866][ T9748] the existing dependency chain (in reverse order) is: [ 98.260028][ T9748] [ 98.260028][ T9748] -> #1 (&htab->buckets[i].lock){....}: [ 98.267835][ T9748] _raw_spin_lock_irqsave+0x95/0xcd [ 98.273561][ T9748] htab_lru_map_delete_node+0xce/0x2f0 [ 98.279534][ T9748] __bpf_lru_list_shrink+0xf9/0x470 [ 98.285241][ T9748] bpf_lru_pop_free+0xa9f/0x1670 [ 98.290724][ T9748] prealloc_lru_pop+0x2c/0xa0 [ 98.296003][ T9748] __htab_lru_percpu_map_update_elem+0x67e/0xa90 [ 98.302891][ T9748] bpf_percpu_hash_update+0x16e/0x210 [ 98.308775][ T9748] bpf_map_update_value.isra.0+0x2d7/0x8e0 [ 98.315098][ T9748] __do_sys_bpf+0x3163/0x41e0 [ 98.320286][ T9748] __x64_sys_bpf+0x73/0xb0 [ 98.325218][ T9748] do_syscall_64+0xfa/0x790 [ 98.330228][ T9748] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.336668][ T9748] [ 98.336668][ T9748] -> #0 (&l->lock){....}: [ 98.343225][ T9748] __lock_acquire+0x2596/0x4a00 [ 98.348581][ T9748] lock_acquire+0x190/0x410 [ 98.353596][ T9748] _raw_spin_lock_irqsave+0x95/0xcd [ 98.359349][ T9748] bpf_lru_push_free+0xe5/0x5b0 [ 98.364722][ T9748] __htab_map_lookup_and_delete_batch+0x8d4/0x1540 [ 98.371852][ T9748] htab_lru_percpu_map_lookup_and_delete_batch+0x37/0x40 [ 98.379387][ T9748] bpf_map_do_batch+0x3f5/0x510 [ 98.384760][ T9748] __do_sys_bpf+0x1f7d/0x41e0 [ 98.390067][ T9748] __x64_sys_bpf+0x73/0xb0 [ 98.394999][ T9748] do_syscall_64+0xfa/0x790 [ 98.400187][ T9748] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.406582][ T9748] [ 98.406582][ T9748] other info that might help us debug this: [ 98.406582][ T9748] [ 98.416797][ T9748] Possible unsafe locking scenario: [ 98.416797][ T9748] [ 98.424235][ T9748] CPU0 CPU1 [ 98.429632][ T9748] ---- ---- [ 98.435030][ T9748] lock(&htab->buckets[i].lock); [ 98.440180][ T9748] lock(&l->lock); [ 98.446537][ T9748] lock(&htab->buckets[i].lock); [ 98.454060][ T9748] lock(&l->lock); [ 98.458037][ T9748] [ 98.458037][ T9748] *** DEADLOCK *** [ 98.458037][ T9748] [ 98.466170][ T9748] 2 locks held by syz-executor198/9748: [ 98.471728][ T9748] #0: ffffffff89bac200 (rcu_read_lock){....}, at: __htab_map_lookup_and_delete_batch+0x54b/0x1540 [ 98.482531][ T9748] #1: ffff88809f6c3b60 (&htab->buckets[i].lock){....}, at: __htab_map_lookup_and_delete_batch+0x617/0x1540 [ 98.493994][ T9748] [ 98.493994][ T9748] stack backtrace: [ 98.499886][ T9748] CPU: 0 PID: 9748 Comm: syz-executor198 Not tainted 5.5.0-syzkaller #0 [ 98.508195][ T9748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 98.518368][ T9748] Call Trace: [ 98.521687][ T9748] dump_stack+0x197/0x210 [ 98.526014][ T9748] print_circular_bug.isra.0.cold+0x163/0x172 [ 98.532101][ T9748] check_noncircular+0x32e/0x3e0 [ 98.537029][ T9748] ? print_circular_bug.isra.0+0x230/0x230 [ 98.542850][ T9748] ? alloc_list_entry+0xc0/0xc0 [ 98.547690][ T9748] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 98.553923][ T9748] ? find_first_zero_bit+0x9a/0xc0 [ 98.559028][ T9748] __lock_acquire+0x2596/0x4a00 [ 98.563876][ T9748] ? mark_held_locks+0xf0/0xf0 [ 98.568632][ T9748] lock_acquire+0x190/0x410 [ 98.573120][ T9748] ? bpf_lru_push_free+0xe5/0x5b0 [ 98.578184][ T9748] _raw_spin_lock_irqsave+0x95/0xcd [ 98.583378][ T9748] ? bpf_lru_push_free+0xe5/0x5b0 [ 98.588385][ T9748] bpf_lru_push_free+0xe5/0x5b0 [ 98.593227][ T9748] __htab_map_lookup_and_delete_batch+0x8d4/0x1540 [ 98.599787][ T9748] ? __kasan_check_read+0x11/0x20 [ 98.604821][ T9748] ? htab_percpu_map_seq_show_elem+0x490/0x490 [ 98.611011][ T9748] ? htab_percpu_map_lookup_batch+0x40/0x40 [ 98.616940][ T9748] htab_lru_percpu_map_lookup_and_delete_batch+0x37/0x40 [ 98.623956][ T9748] bpf_map_do_batch+0x3f5/0x510 [ 98.628874][ T9748] __do_sys_bpf+0x1f7d/0x41e0 [ 98.633584][ T9748] ? find_held_lock+0x35/0x130 [ 98.638332][ T9748] ? bpf_prog_load+0x1820/0x1820 [ 98.643268][ T9748] ? lock_downgrade+0x920/0x920 [ 98.648215][ T9748] ? handle_mm_fault+0x292/0xa50 [ 98.653141][ T9748] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 98.658638][ T9748] ? do_syscall_64+0x26/0x790 [ 98.663307][ T9748] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.669367][ T9748] ? do_syscall_64+0x26/0x790 [ 98.674028][ T9748] __x64_sys_bpf+0x73/0xb0 [ 98.678438][ T9748] do_syscall_64+0xfa/0x790 [ 98.682923][ T9748] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.688802][ T9748] RIP: 0033:0x440c09 [ 98.692694][ T9748] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 98.712518][ T9748] RSP: 002b:00007fff14512e08 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 98.721445][ T9748] RAX: ffffffffffffffda RBX: 00000000004a2390 RCX: 0000000000440c09 [ 98.729424][ T9748] RDX: 0000000000000038 RSI: 0000000020000100 RDI: 0000000000000019 [ 98.737386][ T9748] RBP: 00000000006cb018 R08: 0000000120080522 R09: 0000000120080522 [ 98.745357][ T9748] R10: 0000000120080522 R11: 0000000000000246 R12: 0000000000402110 [ 98.753309][ T9748] R13: 00000000004021a0 R14: 0000000000000000 R15: 0000000000000000