[ 37.162711][ T26] audit: type=1800 audit(1555652465.445:27): pid=7589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 37.191897][ T26] audit: type=1800 audit(1555652465.445:28): pid=7589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 37.781230][ T26] audit: type=1800 audit(1555652466.105:29): pid=7589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 37.807864][ T26] audit: type=1800 audit(1555652466.105:30): pid=7589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.149' (ECDSA) to the list of known hosts. 2019/04/19 05:41:38 parsed 1 programs 2019/04/19 05:41:40 executed programs: 0 syzkaller login: [ 72.315973][ T7755] IPVS: ftp: loaded support on port[0] = 21 [ 72.372583][ T7755] chnl_net:caif_netlink_parms(): no params data found [ 72.404876][ T7755] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.412342][ T7755] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.420335][ T7755] device bridge_slave_0 entered promiscuous mode [ 72.429250][ T7755] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.436585][ T7755] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.444765][ T7755] device bridge_slave_1 entered promiscuous mode [ 72.460289][ T7755] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 72.470608][ T7755] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 72.494757][ T7755] team0: Port device team_slave_0 added [ 72.501352][ T7755] team0: Port device team_slave_1 added [ 72.556291][ T7755] device hsr_slave_0 entered promiscuous mode [ 72.604103][ T7755] device hsr_slave_1 entered promiscuous mode [ 72.663103][ T7755] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.670787][ T7755] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.679116][ T7755] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.686377][ T7755] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.718030][ T7755] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.732063][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.753040][ T22] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.761970][ T22] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.771330][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 72.784311][ T7755] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.805624][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.814596][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.821673][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.835375][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.844486][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.851543][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.871404][ T7755] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 72.882285][ T7755] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 72.897747][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.906735][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 72.915579][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.925191][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.942216][ T7755] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.950214][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 72.958637][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 73.066245][ T7762] [ 73.070357][ T7762] ====================================================== [ 73.077547][ T7762] WARNING: possible circular locking dependency detected [ 73.084702][ T7762] 5.1.0-rc5+ #75 Not tainted [ 73.089325][ T7762] ------------------------------------------------------ [ 73.097191][ T7762] syz-executor.0/7762 is trying to acquire lock: [ 73.104527][ T7762] 00000000583aa2cc (&rp->fetch_lock){+.+.}, at: mon_bin_vma_fault+0x73/0x2d0 [ 73.114254][ T7762] [ 73.114254][ T7762] but task is already holding lock: [ 73.121712][ T7762] 0000000035adcc40 (&mm->mmap_sem){++++}, at: __mm_populate+0x270/0x380 [ 73.130085][ T7762] [ 73.130085][ T7762] which lock already depends on the new lock. [ 73.130085][ T7762] [ 73.143010][ T7762] [ 73.143010][ T7762] the existing dependency chain (in reverse order) is: [ 73.152196][ T7762] [ 73.152196][ T7762] -> #1 (&mm->mmap_sem){++++}: [ 73.159314][ T7762] lock_acquire+0x16f/0x3f0 [ 73.164473][ T7762] __might_fault+0x15e/0x1e0 [ 73.170048][ T7762] _copy_to_user+0x30/0x120 [ 73.176624][ T7762] mon_bin_get_event+0x117/0x450 [ 73.183434][ T7762] mon_bin_ioctl+0xacf/0xc80 [ 73.189212][ T7762] do_vfs_ioctl+0xd6e/0x1390 [ 73.194542][ T7762] ksys_ioctl+0xab/0xd0 [ 73.199312][ T7762] __x64_sys_ioctl+0x73/0xb0 [ 73.205463][ T7762] do_syscall_64+0x103/0x610 [ 73.211247][ T7762] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 73.219096][ T7762] [ 73.219096][ T7762] -> #0 (&rp->fetch_lock){+.+.}: [ 73.226349][ T7762] __lock_acquire+0x239c/0x3fb0 [ 73.231919][ T7762] lock_acquire+0x16f/0x3f0 [ 73.237145][ T7762] __mutex_lock+0xf7/0x1310 [ 73.242372][ T7762] mutex_lock_nested+0x16/0x20 [ 73.248035][ T7762] mon_bin_vma_fault+0x73/0x2d0 [ 73.253747][ T7762] __do_fault+0x116/0x4e0 [ 73.258764][ T7762] __handle_mm_fault+0xf6c/0x3ec0 [ 73.265538][ T7762] handle_mm_fault+0x43f/0xb30 [ 73.271029][ T7762] __get_user_pages+0x7b6/0x1a40 [ 73.276507][ T7762] populate_vma_page_range+0x20d/0x2a0 [ 73.282530][ T7762] __mm_populate+0x204/0x380 [ 73.288213][ T7762] vm_mmap_pgoff+0x213/0x230 [ 73.293569][ T7762] ksys_mmap_pgoff+0x4aa/0x630 [ 73.298966][ T7762] __x64_sys_mmap+0xe9/0x1b0 [ 73.304091][ T7762] do_syscall_64+0x103/0x610 [ 73.309210][ T7762] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 73.316726][ T7762] [ 73.316726][ T7762] other info that might help us debug this: [ 73.316726][ T7762] [ 73.327125][ T7762] Possible unsafe locking scenario: [ 73.327125][ T7762] [ 73.334855][ T7762] CPU0 CPU1 [ 73.340927][ T7762] ---- ---- [ 73.346286][ T7762] lock(&mm->mmap_sem); [ 73.350638][ T7762] lock(&rp->fetch_lock); [ 73.357607][ T7762] lock(&mm->mmap_sem); [ 73.364907][ T7762] lock(&rp->fetch_lock); [ 73.369312][ T7762] [ 73.369312][ T7762] *** DEADLOCK *** [ 73.369312][ T7762] [ 73.377449][ T7762] 1 lock held by syz-executor.0/7762: [ 73.383423][ T7762] #0: 0000000035adcc40 (&mm->mmap_sem){++++}, at: __mm_populate+0x270/0x380 [ 73.392304][ T7762] [ 73.392304][ T7762] stack backtrace: [ 73.398190][ T7762] CPU: 1 PID: 7762 Comm: syz-executor.0 Not tainted 5.1.0-rc5+ #75 [ 73.406730][ T7762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 73.417458][ T7762] Call Trace: [ 73.420939][ T7762] dump_stack+0x172/0x1f0 [ 73.425361][ T7762] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 73.431570][ T7762] check_prev_add.constprop.0+0xf11/0x23c0 [ 73.437393][ T7762] ? check_usage+0x570/0x570 [ 73.442313][ T7762] ? depot_save_stack+0x1de/0x460 [ 73.447759][ T7762] ? graph_lock+0x7b/0x200 [ 73.452224][ T7762] ? __lockdep_reset_lock+0x450/0x450 [ 73.457716][ T7762] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 73.464986][ T7762] __lock_acquire+0x239c/0x3fb0 [ 73.469844][ T7762] ? depot_save_stack+0x1de/0x460 [ 73.474906][ T7762] ? mark_held_locks+0xf0/0xf0 [ 73.479733][ T7762] ? __do_fault+0x2b9/0x4e0 [ 73.484389][ T7762] lock_acquire+0x16f/0x3f0 [ 73.489014][ T7762] ? mon_bin_vma_fault+0x73/0x2d0 [ 73.494032][ T7762] ? mon_bin_vma_fault+0x73/0x2d0 [ 73.499055][ T7762] __mutex_lock+0xf7/0x1310 [ 73.503865][ T7762] ? mon_bin_vma_fault+0x73/0x2d0 [ 73.508969][ T7762] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 73.514600][ T7762] ? mon_bin_vma_fault+0x73/0x2d0 [ 73.519740][ T7762] ? mutex_trylock+0x1e0/0x1e0 [ 73.526173][ T7762] ? ptlock_alloc+0x20/0x70 [ 73.531040][ T7762] ? rcu_read_lock_sched_held+0x110/0x130 [ 73.537072][ T7762] ? kmem_cache_alloc+0x32e/0x6f0 [ 73.542369][ T7762] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 73.549075][ T7762] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 73.555576][ T7762] mutex_lock_nested+0x16/0x20 [ 73.560332][ T7762] ? mutex_lock_nested+0x16/0x20 [ 73.565351][ T7762] mon_bin_vma_fault+0x73/0x2d0 [ 73.570639][ T7762] __do_fault+0x116/0x4e0 [ 73.575398][ T7762] ? mem_cgroup_try_charge_delay+0x6c/0xa0 [ 73.581542][ T7762] __handle_mm_fault+0xf6c/0x3ec0 [ 73.586840][ T7762] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 73.592419][ T7762] ? find_held_lock+0x35/0x130 [ 73.597581][ T7762] ? handle_mm_fault+0x322/0xb30 [ 73.602630][ T7762] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 73.608936][ T7762] ? kasan_check_read+0x11/0x20 [ 73.613913][ T7762] handle_mm_fault+0x43f/0xb30 [ 73.618731][ T7762] __get_user_pages+0x7b6/0x1a40 [ 73.624794][ T7762] ? follow_page_mask+0x19a0/0x19a0 [ 73.630370][ T7762] ? vma_set_page_prot+0x18c/0x240 [ 73.635472][ T7762] ? memset+0x32/0x40 [ 73.639441][ T7762] populate_vma_page_range+0x20d/0x2a0 [ 73.644888][ T7762] __mm_populate+0x204/0x380 [ 73.650467][ T7762] ? populate_vma_page_range+0x2a0/0x2a0 [ 73.656098][ T7762] vm_mmap_pgoff+0x213/0x230 [ 73.660799][ T7762] ? vma_is_stack_for_current+0xd0/0xd0 [ 73.666361][ T7762] ? ksys_dup3+0x3e0/0x3e0 [ 73.671895][ T7762] ? _copy_to_user+0xc9/0x120 [ 73.676571][ T7762] ksys_mmap_pgoff+0x4aa/0x630 [ 73.681332][ T7762] ? find_mergeable_anon_vma+0x2e0/0x2e0 [ 73.686967][ T7762] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 73.692753][ T7762] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 73.700645][ T7762] ? do_syscall_64+0x26/0x610 [ 73.705488][ T7762] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 73.711552][ T7762] __x64_sys_mmap+0xe9/0x1b0 [ 73.716412][ T7762] do_syscall_64+0x103/0x610 [ 73.721620][ T7762] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 73.727829][ T7762] RIP: 0033:0x458c29 [ 73.731718][ T7762] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 73.751814][ T7762] RSP: 002b:00007f2a9e463c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 73.761091][ T7762] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458c29 [ 73.