[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.21' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 62.256238][ T6864] IPVS: ftp: loaded support on port[0] = 21 [ 62.307326][ T6864] IPVS: ftp: loaded support on port[0] = 21 [ 62.496632][ T349] [ 62.499002][ T349] ====================================================== [ 62.506004][ T349] WARNING: possible circular locking dependency detected [ 62.512996][ T349] 5.9.0-rc2-next-20200828-syzkaller #0 Not tainted [ 62.519495][ T349] ------------------------------------------------------ [ 62.526485][ T349] kworker/u4:6/349 is trying to acquire lock: [ 62.532518][ T349] ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: flush_workqueue+0xe1/0x13e0 [ 62.542255][ T349] [ 62.542255][ T349] but task is already holding lock: [ 62.549589][ T349] ffffffff8a879430 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9b/0xb10 [ 62.558420][ T349] [ 62.558420][ T349] which lock already depends on the new lock. [ 62.558420][ T349] [ 62.568795][ T349] [ 62.568795][ T349] the existing dependency chain (in reverse order) is: [ 62.577789][ T349] [ 62.577789][ T349] -> #3 (pernet_ops_rwsem){++++}-{3:3}: [ 62.585507][ T349] down_write+0x8d/0x150 [ 62.590252][ T349] unregister_netdevice_notifier+0x1e/0x170 [ 62.596652][ T349] bcm_release+0x94/0x750 [ 62.601478][ T349] __sock_release+0xcd/0x280 [ 62.606562][ T349] sock_close+0x18/0x20 [ 62.611212][ T349] __fput+0x285/0x920 [ 62.615687][ T349] task_work_run+0xdd/0x190 [ 62.620700][ T349] exit_to_user_mode_prepare+0x195/0x1c0 [ 62.626852][ T349] syscall_exit_to_user_mode+0x59/0x2b0 [ 62.632896][ T349] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 62.639279][ T349] [ 62.639279][ T349] -> #2 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}: [ 62.647944][ T349] down_write+0x8d/0x150 [ 62.652697][ T349] __sock_release+0x86/0x280 [ 62.657780][ T349] sock_close+0x18/0x20 [ 62.662435][ T349] __fput+0x285/0x920 [ 62.666947][ T349] delayed_fput+0x56/0x70 [ 62.671785][ T349] process_one_work+0x94c/0x1670 [ 62.677217][ T349] worker_thread+0x64c/0x1120 [ 62.682398][ T349] kthread+0x3b5/0x4a0 [ 62.686967][ T349] ret_from_fork+0x1f/0x30 [ 62.691869][ T349] [ 62.691869][ T349] -> #1 ((delayed_fput_work).work){+.+.}-{0:0}: [ 62.700267][ T349] process_one_work+0x8bb/0x1670 [ 62.705699][ T349] worker_thread+0x64c/0x1120 [ 62.710878][ T349] kthread+0x3b5/0x4a0 [ 62.715443][ T349] ret_from_fork+0x1f/0x30 [ 62.720355][ T349] [ 62.720355][ T349] -> #0 ((wq_completion)events){+.+.}-{0:0}: [ 62.728534][ T349] __lock_acquire+0x2a6b/0x5640 [ 62.733880][ T349] lock_acquire+0x1f1/0xad0 [ 62.738876][ T349] flush_workqueue+0x110/0x13e0 [ 62.744219][ T349] tipc_exit_net+0x47/0x2a0 [ 62.749216][ T349] ops_exit_list+0xb0/0x160 [ 62.754218][ T349] cleanup_net+0x4ea/0xb10 [ 62.759128][ T349] process_one_work+0x94c/0x1670 [ 62.764598][ T349] worker_thread+0x64c/0x1120 [ 62.769772][ T349] kthread+0x3b5/0x4a0 [ 62.774372][ T349] ret_from_fork+0x1f/0x30 [ 62.779288][ T349] [ 62.779288][ T349] other info that might help us debug this: [ 62.779288][ T349] [ 62.789617][ T349] Chain exists of: [ 62.789617][ T349] (wq_completion)events --> &sb->s_type->i_mutex_key#13 --> pernet_ops_rwsem [ 62.789617][ T349] [ 62.808802][ T349] Possible unsafe locking scenario: [ 62.808802][ T349] [ 62.816224][ T349] CPU0 CPU1 [ 62.821578][ T349] ---- ---- [ 62.826939][ T349] lock(pernet_ops_rwsem); [ 62.831455][ T349] lock(&sb->s_type->i_mutex_key#13); [ 62.839505][ T349] lock(pernet_ops_rwsem); [ 62.846498][ T349] lock((wq_completion)events); [ 62.851408][ T349] [ 62.851408][ T349] *** DEADLOCK *** [ 62.851408][ T349] [ 62.859534][ T349] 3 locks held by kworker/u4:6/349: [ 62.864699][ T349] #0: ffff8880a97b1138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 [ 62.874929][ T349] #1: ffffc900020e7da8 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 [ 62.884812][ T349] #2: ffffffff8a879430 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9b/0xb10 [ 62.894080][ T349] [ 62.894080][ T349] stack backtrace: [ 62.899957][ T349] CPU: 1 PID: 349 Comm: kworker/u4:6 Not tainted 5.9.0-rc2-next-20200828-syzkaller #0 [ 62.909465][ T349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 62.919513][ T349] Workqueue: netns cleanup_net [ 62.924335][ T349] Call Trace: [ 62.927617][ T349] dump_stack+0x18f/0x20d [ 62.931939][ T349] check_noncircular+0x324/0x3e0 [ 62.936853][ T349] ? print_circular_bug+0x3a0/0x3a0 [ 62.942027][ T349] ? find_held_lock+0x2d/0x110 [ 62.946768][ T349] ? free_obj_work+0x590/0x590 [ 62.951519][ T349] ? lock_repin_lock+0x460/0x460 [ 62.956429][ T349] ? mark_lock+0xbc/0x1710 [ 62.960824][ T349] __lock_acquire+0x2a6b/0x5640 [ 62.965680][ T349] ? lockdep_hardirqs_on_prepare+0x530/0x530 [ 62.971636][ T349] ? mark_lock+0xbc/0x1710 [ 62.976040][ T349] ? add_wait_queue_exclusive+0x180/0x180 [ 62.981744][ T349] lock_acquire+0x1f1/0xad0 [ 62.986238][ T349] ? flush_workqueue+0xe1/0x13e0 [ 62.991164][ T349] ? lock_release+0x8e0/0x8e0 [ 62.995828][ T349] ? lockdep_init_map_waits+0x26a/0x8a0 [ 63.001350][ T349] ? lockdep_init_map_waits+0x26a/0x8a0 [ 63.006877][ T349] ? __raw_spin_lock_init+0x34/0x100 [ 63.012139][ T349] flush_workqueue+0x110/0x13e0 [ 63.016974][ T349] ? flush_workqueue+0xe1/0x13e0 [ 63.021897][ T349] ? lock_acquire+0x1f1/0xad0 [ 63.026558][ T349] ? tipc_net_stop+0x3c/0x310 [ 63.031221][ T349] ? find_held_lock+0x2d/0x110 [ 63.035958][ T349] ? max_active_store+0x120/0x120 [ 63.040974][ T349] ? tipc_init_net+0x5c0/0x5c0 [ 63.045720][ T349] tipc_exit_net+0x47/0x2a0 [ 63.050198][ T349] ? tipc_init_net+0x5c0/0x5c0 [ 63.054946][ T349] ops_exit_list+0xb0/0x160 [ 63.059434][ T349] cleanup_net+0x4ea/0xb10 [ 63.063840][ T349] ? ops_free_list.part.0+0x3d0/0x3d0 [ 63.069188][ T349] ? lock_is_held_type+0xbb/0xf0 [ 63.074104][ T349] process_one_work+0x94c/0x1670 [ 63.079034][ T349] ? lock_release+0x8e0/0x8e0 [ 63.083686][ T349] ? pwq_dec_nr_in_flight+0x2d0/0x2d0 [ 63.089031][ T349] ? rwlock_bug.part.0+0x90/0x90 [ 63.093946][ T349] worker_thread+0x64c/0x1120 [ 63.0