[ 37.162711][ T26] audit: type=1800 audit(1555652465.445:27): pid=7589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[ 37.191897][ T26] audit: type=1800 audit(1555652465.445:28): pid=7589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[ 37.781230][ T26] audit: type=1800 audit(1555652466.105:29): pid=7589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0
[ 37.807864][ T26] audit: type=1800 audit(1555652466.105:30): pid=7589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0
Debian GNU/Linux 7 syzkaller ttyS0
Warning: Permanently added '10.128.0.149' (ECDSA) to the list of known hosts.
2019/04/19 05:41:38 parsed 1 programs
2019/04/19 05:41:40 executed programs: 0
syzkaller login: [ 72.315973][ T7755] IPVS: ftp: loaded support on port[0] = 21
[ 72.372583][ T7755] chnl_net:caif_netlink_parms(): no params data found
[ 72.404876][ T7755] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.412342][ T7755] bridge0: port 1(bridge_slave_0) entered disabled state
[ 72.420335][ T7755] device bridge_slave_0 entered promiscuous mode
[ 72.429250][ T7755] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.436585][ T7755] bridge0: port 2(bridge_slave_1) entered disabled state
[ 72.444765][ T7755] device bridge_slave_1 entered promiscuous mode
[ 72.460289][ T7755] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 72.470608][ T7755] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 72.494757][ T7755] team0: Port device team_slave_0 added
[ 72.501352][ T7755] team0: Port device team_slave_1 added
[ 72.556291][ T7755] device hsr_slave_0 entered promiscuous mode
[ 72.604103][ T7755] device hsr_slave_1 entered promiscuous mode
[ 72.663103][ T7755] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.670787][ T7755] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 72.679116][ T7755] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.686377][ T7755] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 72.718030][ T7755] 8021q: adding VLAN 0 to HW filter on device bond0
[ 72.732063][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 72.753040][ T22] bridge0: port 1(bridge_slave_0) entered disabled state
[ 72.761970][ T22] bridge0: port 2(bridge_slave_1) entered disabled state
[ 72.771330][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 72.784311][ T7755] 8021q: adding VLAN 0 to HW filter on device team0
[ 72.805624][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 72.814596][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.821673][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 72.835375][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 72.844486][ T22] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.851543][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 72.871404][ T7755] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 72.882285][ T7755] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 72.897747][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 72.906735][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 72.915579][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 72.925191][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 72.942216][ T7755] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 72.950214][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 72.958637][ T3483] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 73.066245][ T7762]
[ 73.070357][ T7762] ======================================================
[ 73.077547][ T7762] WARNING: possible circular locking dependency detected
[ 73.084702][ T7762] 5.1.0-rc5+ #75 Not tainted
[ 73.089325][ T7762] ------------------------------------------------------
[ 73.097191][ T7762] syz-executor.0/7762 is trying to acquire lock:
[ 73.104527][ T7762] 00000000583aa2cc (&rp->fetch_lock){+.+.}, at: mon_bin_vma_fault+0x73/0x2d0
[ 73.114254][ T7762]
[ 73.114254][ T7762] but task is already holding lock:
[ 73.121712][ T7762] 0000000035adcc40 (&mm->mmap_sem){++++}, at: __mm_populate+0x270/0x380
[ 73.130085][ T7762]
[ 73.130085][ T7762] which lock already depends on the new lock.
[ 73.130085][ T7762]
[ 73.143010][ T7762]
[ 73.143010][ T7762] the existing dependency chain (in reverse order) is:
[ 73.152196][ T7762]
[ 73.152196][ T7762] -> #1 (&mm->mmap_sem){++++}:
[ 73.159314][ T7762] lock_acquire+0x16f/0x3f0
[ 73.164473][ T7762] __might_fault+0x15e/0x1e0
[ 73.170048][ T7762] _copy_to_user+0x30/0x120
[ 73.176624][ T7762] mon_bin_get_event+0x117/0x450
[ 73.183434][ T7762] mon_bin_ioctl+0xacf/0xc80
[ 73.189212][ T7762] do_vfs_ioctl+0xd6e/0x1390
[ 73.194542][ T7762] ksys_ioctl+0xab/0xd0
[ 73.199312][ T7762] __x64_sys_ioctl+0x73/0xb0
[ 73.205463][ T7762] do_syscall_64+0x103/0x610
[ 73.211247][ T7762] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 73.219096][ T7762]
[ 73.219096][ T7762] -> #0 (&rp->fetch_lock){+.+.}:
[ 73.226349][ T7762] __lock_acquire+0x239c/0x3fb0
[ 73.231919][ T7762] lock_acquire+0x16f/0x3f0
[ 73.237145][ T7762] __mutex_lock+0xf7/0x1310
[ 73.242372][ T7762] mutex_lock_nested+0x16/0x20
[ 73.248035][ T7762] mon_bin_vma_fault+0x73/0x2d0
[ 73.253747][ T7762] __do_fault+0x116/0x4e0
[ 73.258764][ T7762] __handle_mm_fault+0xf6c/0x3ec0
[ 73.265538][ T7762] handle_mm_fault+0x43f/0xb30
[ 73.271029][ T7762] __get_user_pages+0x7b6/0x1a40
[ 73.276507][ T7762] populate_vma_page_range+0x20d/0x2a0
[ 73.282530][ T7762] __mm_populate+0x204/0x380
[ 73.288213][ T7762] vm_mmap_pgoff+0x213/0x230
[ 73.293569][ T7762] ksys_mmap_pgoff+0x4aa/0x630
[ 73.298966][ T7762] __x64_sys_mmap+0xe9/0x1b0
[ 73.304091][ T7762] do_syscall_64+0x103/0x610
[ 73.309210][ T7762] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 73.316726][ T7762]
[ 73.316726][ T7762] other info that might help us debug this:
[ 73.316726][ T7762]
[ 73.327125][ T7762] Possible unsafe locking scenario:
[ 73.327125][ T7762]
[ 73.334855][ T7762] CPU0 CPU1
[ 73.340927][ T7762] ---- ----
[ 73.346286][ T7762] lock(&mm->mmap_sem);
[ 73.350638][ T7762] lock(&rp->fetch_lock);
[ 73.357607][ T7762] lock(&mm->mmap_sem);
[ 73.364907][ T7762] lock(&rp->fetch_lock);
[ 73.369312][ T7762]
[ 73.369312][ T7762] *** DEADLOCK ***
[ 73.369312][ T7762]
[ 73.377449][ T7762] 1 lock held by syz-executor.0/7762:
[ 73.383423][ T7762] #0: 0000000035adcc40 (&mm->mmap_sem){++++}, at: __mm_populate+0x270/0x380
[ 73.392304][ T7762]
[ 73.392304][ T7762] stack backtrace:
[ 73.398190][ T7762] CPU: 1 PID: 7762 Comm: syz-executor.0 Not tainted 5.1.0-rc5+ #75
[ 73.406730][ T7762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 73.417458][ T7762] Call Trace:
[ 73.420939][ T7762] dump_stack+0x172/0x1f0
[ 73.425361][ T7762] print_circular_bug.isra.0.cold+0x1cc/0x28f
[ 73.431570][ T7762] check_prev_add.constprop.0+0xf11/0x23c0
[ 73.437393][ T7762] ? check_usage+0x570/0x570
[ 73.442313][ T7762] ? depot_save_stack+0x1de/0x460
[ 73.447759][ T7762] ? graph_lock+0x7b/0x200
[ 73.452224][ T7762] ? __lockdep_reset_lock+0x450/0x450
[ 73.457716][ T7762] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 73.464986][ T7762] __lock_acquire+0x239c/0x3fb0
[ 73.469844][ T7762] ? depot_save_stack+0x1de/0x460
[ 73.474906][ T7762] ? mark_held_locks+0xf0/0xf0
[ 73.479733][ T7762] ? __do_fault+0x2b9/0x4e0
[ 73.484389][ T7762] lock_acquire+0x16f/0x3f0
[ 73.489014][ T7762] ? mon_bin_vma_fault+0x73/0x2d0
[ 73.494032][ T7762] ? mon_bin_vma_fault+0x73/0x2d0
[ 73.499055][ T7762] __mutex_lock+0xf7/0x1310
[ 73.503865][ T7762] ? mon_bin_vma_fault+0x73/0x2d0
[ 73.508969][ T7762] ? fs_reclaim_acquire.part.0+0x30/0x30
[ 73.514600][ T7762] ? mon_bin_vma_fault+0x73/0x2d0
[ 73.519740][ T7762] ? mutex_trylock+0x1e0/0x1e0
[ 73.526173][ T7762] ? ptlock_alloc+0x20/0x70
[ 73.531040][ T7762] ? rcu_read_lock_sched_held+0x110/0x130
[ 73.537072][ T7762] ? kmem_cache_alloc+0x32e/0x6f0
[ 73.542369][ T7762] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 73.549075][ T7762] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20
[ 73.555576][ T7762] mutex_lock_nested+0x16/0x20
[ 73.560332][ T7762] ? mutex_lock_nested+0x16/0x20
[ 73.565351][ T7762] mon_bin_vma_fault+0x73/0x2d0
[ 73.570639][ T7762] __do_fault+0x116/0x4e0
[ 73.575398][ T7762] ? mem_cgroup_try_charge_delay+0x6c/0xa0
[ 73.581542][ T7762] __handle_mm_fault+0xf6c/0x3ec0
[ 73.586840][ T7762] ? vmf_insert_mixed_mkwrite+0x40/0x40
[ 73.592419][ T7762] ? find_held_lock+0x35/0x130
[ 73.597581][ T7762] ? handle_mm_fault+0x322/0xb30
[ 73.602630][ T7762] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 73.608936][ T7762] ? kasan_check_read+0x11/0x20
[ 73.613913][ T7762] handle_mm_fault+0x43f/0xb30
[ 73.618731][ T7762] __get_user_pages+0x7b6/0x1a40
[ 73.624794][ T7762] ? follow_page_mask+0x19a0/0x19a0
[ 73.630370][ T7762] ? vma_set_page_prot+0x18c/0x240
[ 73.635472][ T7762] ? memset+0x32/0x40
[ 73.639441][ T7762] populate_vma_page_range+0x20d/0x2a0
[ 73.644888][ T7762] __mm_populate+0x204/0x380
[ 73.650467][ T7762] ? populate_vma_page_range+0x2a0/0x2a0
[ 73.656098][ T7762] vm_mmap_pgoff+0x213/0x230
[ 73.660799][ T7762] ? vma_is_stack_for_current+0xd0/0xd0
[ 73.666361][ T7762] ? ksys_dup3+0x3e0/0x3e0
[ 73.671895][ T7762] ? _copy_to_user+0xc9/0x120
[ 73.676571][ T7762] ksys_mmap_pgoff+0x4aa/0x630
[ 73.681332][ T7762] ? find_mergeable_anon_vma+0x2e0/0x2e0
[ 73.686967][ T7762] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 73.692753][ T7762] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 73.700645][ T7762] ? do_syscall_64+0x26/0x610
[ 73.705488][ T7762] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 73.711552][ T7762] __x64_sys_mmap+0xe9/0x1b0
[ 73.716412][ T7762] do_syscall_64+0x103/0x610
[ 73.721620][ T7762] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 73.727829][ T7762] RIP: 0033:0x458c29
[ 73.731718][ T7762] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 73.751814][ T7762] RSP: 002b:00007f2a9e463c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[ 73.761091][ T7762] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458c29
[ 73.