[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 56.449180][ T26] audit: type=1800 audit(1569026987.221:25): pid=8616 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 56.486063][ T26] audit: type=1800 audit(1569026987.221:26): pid=8616 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 56.524982][ T26] audit: type=1800 audit(1569026987.231:27): pid=8616 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.25' (ECDSA) to the list of known hosts. syzkaller login: [ 66.970267][ T8767] IPVS: ftp: loaded support on port[0] = 21 [ 67.025097][ T8767] chnl_net:caif_netlink_parms(): no params data found [ 67.053376][ T8767] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.061058][ T8767] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.069198][ T8767] device bridge_slave_0 entered promiscuous mode [ 67.077022][ T8767] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.084192][ T8767] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.091821][ T8767] device bridge_slave_1 entered promiscuous mode [ 67.107262][ T8767] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.118139][ T8767] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.136304][ T8767] team0: Port device team_slave_0 added [ 67.144315][ T8767] team0: Port device team_slave_1 added [ 67.220391][ T8767] device hsr_slave_0 entered promiscuous mode [ 67.288108][ T8767] device hsr_slave_1 entered promiscuous mode [ 67.375264][ T8767] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.382647][ T8767] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.390555][ T8767] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.397650][ T8767] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.432570][ T8767] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.443951][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 67.463942][ T17] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.472486][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.481622][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 67.492633][ T8767] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.503196][ T3342] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.511744][ T3342] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.518854][ T3342] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.539773][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.548477][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.555510][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.563781][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.573431][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.582194][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready executing program [ 67.590911][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.601692][ T3342] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.612318][ T8767] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.631141][ T8767] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.665564][ T8767] netlink: 80 bytes leftover after parsing attributes in process `syz-executor083'. [ 67.675294][ T8767] netlink: 48 bytes leftover after parsing attributes in process `syz-executor083'. [ 67.687248][ T8767] [ 67.689728][ T8767] ============================= [ 67.694564][ T8767] WARNING: suspicious RCU usage [ 67.699442][ T8767] 5.3.0+ #0 Not tainted [ 67.703586][ T8767] ----------------------------- [ 67.708508][ T8767] include/net/sch_generic.h:492 suspicious rcu_dereference_check() usage! [ 67.717002][ T8767] [ 67.717002][ T8767] other info that might help us debug this: [ 67.717002][ T8767] [ 67.727273][ T8767] [ 67.727273][ T8767] rcu_scheduler_active = 2, debug_locks = 1 [ 67.735359][ T8767] 3 locks held by syz-executor083/8767: [ 67.740948][ T8767] #0: ffffffff88fab240 (rcu_read_lock_bh){....}, at: ip_finish_output2+0x2dc/0x2570 [ 67.750456][ T8767] #1: ffffffff88fab240 (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x20a/0x35b0 [ 67.759870][ T8767] #2: ffff8880a8821500 (&(&sch->q.lock)->rlock){+...}, at: __dev_queue_xmit+0x14b0/0x35b0 [ 67.769894][ T8767] [ 67.769894][ T8767] stack backtrace: [ 67.775768][ T8767] CPU: 1 PID: 8767 Comm: syz-executor083 Not tainted 5.3.0+ #0 [ 67.783285][ T8767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.793319][ T8767] Call Trace: [ 67.796594][ T8767] dump_stack+0x172/0x1f0 [ 67.800920][ T8767] lockdep_rcu_suspicious+0x153/0x15d [ 67.806277][ T8767] netem_enqueue+0x1cfb/0x2d80 [ 67.811020][ T8767] ? lock_acquire+0x190/0x410 [ 67.815677][ T8767] ? __dev_queue_xmit+0x14b0/0x35b0 [ 67.820879][ T8767] __dev_queue_xmit+0x157e/0x35b0 [ 67.825894][ T8767] ? __kasan_check_read+0x11/0x20 [ 67.830899][ T8767] ? netdev_core_pick_tx+0x2f0/0x2f0 [ 67.836161][ T8767] ? find_held_lock+0x10/0x130 [ 67.840916][ T8767] ? __ip_finish_output+0x5fc/0xb90 [ 67.846094][ T8767] ? lock_downgrade+0x920/0x920 [ 67.850922][ T8767] ? ip_finish_output2+0x13e2/0x2570 [ 67.856182][ T8767] ? __ip_finish_output+0x5fc/0xb90 [ 67.861356][ T8767] ? ip_finish_output2+0x13e2/0x2570 [ 67.866623][ T8767] dev_queue_xmit+0x18/0x20 [ 67.871103][ T8767] ? dev_queue_xmit+0x18/0x20 [ 67.875755][ T8767] ip_finish_output2+0x1726/0x2570 [ 67.880844][ T8767] ? nf_ct_deliver_cached_events+0x23d/0x6e0 [ 67.886814][ T8767] ? ip_frag_next+0x910/0x910 [ 67.891479][ T8767] ? ip_mc_output+0xb31/0xf40 [ 67.896135][ T8767] __ip_finish_output+0x5fc/0xb90 [ 67.901137][ T8767] ? __ip_finish_output+0x5fc/0xb90 [ 67.906313][ T8767] ? audit_add_watch+0x110/0xc50 [ 67.911232][ T8767] ip_finish_output+0x38/0x1f0 [ 67.915974][ T8767] ip_mc_output+0x292/0xf40 [ 67.920458][ T8767] ? __ip_queue_xmit+0x1bd0/0x1bd0 [ 67.925548][ T8767] ? __ip_finish_output+0xb90/0xb90 [ 67.930723][ T8767] ? ip_make_skb+0x1b1/0x2c0 [ 67.935289][ T8767] ? ip_reply_glue_bits+0xc0/0xc0 [ 67.940291][ T8767] ip_local_out+0xbb/0x190 [ 67.944687][ T8767] ip_send_skb+0x42/0xf0 [ 67.948908][ T8767] udp_send_skb.isra.0+0x6b2/0x1160 [ 67.954082][ T8767] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 67.960303][ T8767] udp_sendmsg+0x1e96/0x2820 [ 67.964871][ T8767] ? mark_lock+0xc2/0x1220 [ 67.969271][ T8767] ? ip_reply_glue_bits+0xc0/0xc0 [ 67.974278][ T8767] ? udp_unicast_rcv_skb.isra.0+0x360/0x360 [ 67.980150][ T8767] ? __might_fault+0x12b/0x1e0 [ 67.984893][ T8767] ? find_held_lock+0x35/0x130 [ 67.989637][ T8767] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 67.995856][ T8767] ? compat_rw_copy_check_uvector+0x36b/0x4c0 [ 68.001903][ T8767] ? ___might_sleep+0x163/0x280 [ 68.006738][ T8767] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 68.012348][ T8767] ? aa_sk_perm+0x288/0x880 [ 68.016831][ T8767] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 68.023488][ T8767] ? _copy_from_user+0x12c/0x1a0 [ 68.028411][ T8767] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 68.033937][ T8767] inet_sendmsg+0x9e/0xe0 [ 68.038258][ T8767] ? inet_sendmsg+0x9e/0xe0 [ 68.042748][ T8767] ? inet_send_prepare+0x4f0/0x4f0 [ 68.047856][ T8767] sock_sendmsg+0xd7/0x130 [ 68.052252][ T8767] ___sys_sendmsg+0x3e2/0x920 [ 68.056917][ T8767] ? copy_msghdr_from_user+0x440/0x440 [ 68.062354][ T8767] ? __kasan_check_read+0x11/0x20 [ 68.067362][ T8767] ? mark_held_locks+0xf0/0xf0 [ 68.072112][ T8767] ? release_sock+0x20/0x1c0 [ 68.076679][ T8767] ? reacquire_held_locks+0x208/0x520 [ 68.082036][ T8767] ? release_sock+0x156/0x1c0 [ 68.086689][ T8767] ? find_held_lock+0x35/0x130 [ 68.091437][ T8767] ? ieee80211_build_hdr+0x35d8/0x3820 [ 68.096887][ T8767] ? ___might_sleep+0x163/0x280 [ 68.101716][ T8767] __sys_sendmmsg+0x2db/0x4d0 [ 68.106387][ T8767] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 68.111474][ T8767] ? release_sock+0x156/0x1c0 [ 68.116132][ T8767] ? __sys_connect+0x12d/0x330 [ 68.120872][ T8767] ? __ia32_sys_accept+0xb0/0xb0 [ 68.125788][ T8767] ? fput+0x1b/0x20 [ 68.129589][ T8767] ? __compat_sys_setsockopt+0x1c4/0x380 [ 68.135210][ T8767] ? __compat_sys_getsockopt+0x2c0/0x2c0 [ 68.140821][ T8767] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 68.146279][ T8767] ? do_fast_syscall_32+0xd1/0xdb3 [ 68.151371][ T8767] ? entry_SYSENTER_compat+0x70/0x7f [ 68.156654][ T8767] ? do_fast_syscall_32+0xd1/0xdb3 [ 68.161758][ T8767] __ia32_compat_sys_sendmmsg+0x9f/0x100 [ 68.167382][ T8767] do_fast_syscall_32+0x27b/0xdb3 [ 68.172386][ T8767] entry_SYSENTER_compat+0x70/0x7f [ 68.177473][ T8767] RIP: 0023:0xf7fcda29 [ 68.181520][ T8767] Code: b8 80 96 98 00 eb cc 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 68.201113][ T8767] RSP: 002b:00000000ff9305ac EFLAGS: 00000217 ORIG_RAX: 0000000000000159 [ 68.209501][ T8767] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000020007fc0 [ 68.217460][ T8767] RDX: 00000000000001a8 RSI: 0000000000000000 RDI: 0000000000000005 [ 68.225410][ T8767] RBP: 0000000020000200 R08: 0000000000000000 R09: 0000000000000000 [ 68.233358][ T8767] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 68.241308][ T8767] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000