[ 42.055341][ T26] audit: type=1800 audit(1569220717.960:25): pid=7796 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 42.099288][ T26] audit: type=1800 audit(1569220717.960:26): pid=7796 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 42.126392][ T26] audit: type=1800 audit(1569220717.960:27): pid=7796 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 42.181983][ T26] audit: type=1800 audit(1569220717.960:28): pid=7796 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.212' (ECDSA) to the list of known hosts. syzkaller login: [ 52.267074][ T7947] IPVS: ftp: loaded support on port[0] = 21 [ 52.313495][ T7947] chnl_net:caif_netlink_parms(): no params data found [ 52.336275][ T7947] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.344265][ T7947] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.351971][ T7947] device bridge_slave_0 entered promiscuous mode [ 52.359952][ T7947] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.367121][ T7947] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.375082][ T7947] device bridge_slave_1 entered promiscuous mode [ 52.389536][ T7947] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.400347][ T7947] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.416429][ T7947] team0: Port device team_slave_0 added [ 52.423587][ T7947] team0: Port device team_slave_1 added [ 52.491012][ T7947] device hsr_slave_0 entered promiscuous mode [ 52.560393][ T7947] device hsr_slave_1 entered promiscuous mode [ 52.635736][ T7947] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.642916][ T7947] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.650703][ T7947] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.657861][ T7947] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.685311][ T7947] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.700433][ T7947] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.710580][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 52.718987][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 52.728185][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.736459][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 52.761030][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.770147][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.777208][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.785315][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 52.793861][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 52.802798][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 52.810990][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 52.821720][ T7947] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready executing program [ 52.830284][ T7951] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 52.846206][ T7947] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 52.881989][ T7947] netlink: 80 bytes leftover after parsing attributes in process `syz-executor286'. [ 52.891782][ T7947] netlink: 48 bytes leftover after parsing attributes in process `syz-executor286'. [ 52.902677][ T7947] [ 52.905170][ T7947] ============================= [ 52.910043][ T7947] WARNING: suspicious RCU usage [ 52.914879][ T7947] 5.3.0+ #0 Not tainted [ 52.919025][ T7947] ----------------------------- [ 52.923938][ T7947] ./include/net/sch_generic.h:492 suspicious rcu_dereference_check() usage! [ 52.932637][ T7947] [ 52.932637][ T7947] other info that might help us debug this: [ 52.932637][ T7947] [ 52.942907][ T7947] [ 52.942907][ T7947] rcu_scheduler_active = 2, debug_locks = 1 [ 52.950968][ T7947] 3 locks held by syz-executor286/7947: [ 52.956483][ T7947] #0: ffffffff888d3920 (rcu_read_lock_bh){....}, at: rcu_lock_acquire+0xd/0x40 [ 52.965514][ T7947] #1: ffffffff888d3920 (rcu_read_lock_bh){....}, at: rcu_lock_acquire+0xd/0x40 [ 52.974545][ T7947] #2: ffff8880867bb7c0 (&(&sch->q.lock)->rlock){+...}, at: __dev_queue_xmit+0xdda/0x3010 [ 52.984436][ T7947] [ 52.984436][ T7947] stack backtrace: [ 52.990336][ T7947] CPU: 1 PID: 7947 Comm: syz-executor286 Not tainted 5.3.0+ #0 [ 52.997854][ T7947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 53.007971][ T7947] Call Trace: [ 53.011242][ T7947] dump_stack+0x1d8/0x2f8 [ 53.015557][ T7947] lockdep_rcu_suspicious+0x156/0x1c0 [ 53.020911][ T7947] netem_enqueue+0x1063/0x33c0 [ 53.025657][ T7947] ? do_raw_spin_lock+0xea/0x2d0 [ 53.030577][ T7947] __dev_queue_xmit+0x1121/0x3010 [ 53.035592][ T7947] dev_queue_xmit+0x17/0x20 [ 53.040069][ T7947] neigh_resolve_output+0x60c/0x6b0 [ 53.045251][ T7947] ip_finish_output2+0x13be/0x18d0 [ 53.050336][ T7947] ? rcu_lock_release+0xd/0x30 [ 53.055091][ T7947] __ip_finish_output+0x801/0xa70 [ 53.060616][ T7947] ip_finish_output+0x52/0x1e0 [ 53.065354][ T7947] ? ip_mc_output+0x4c6/0x630 [ 53.070010][ T7947] ip_mc_output+0x4db/0x630 [ 53.074489][ T7947] ip_send_skb+0x126/0x1e0 [ 53.078884][ T7947] udp_send_skb+0x929/0x13b0 [ 53.083719][ T7947] udp_sendmsg+0x2148/0x31b0 [ 53.088283][ T7947] ? ip_do_fragment+0x24d0/0x24d0 [ 53.093285][ T7947] ? register_lock_class+0x99/0xea0 [ 53.098479][ T7947] ? tomoyo_socket_sendmsg_permission+0x210/0x310 [ 53.104970][ T7947] inet_sendmsg+0x147/0x310 [ 53.109455][ T7947] ? security_socket_sendmsg+0xa0/0xd0 [ 53.114978][ T7947] ? inet_send_prepare+0x250/0x250 [ 53.120077][ T7947] ___sys_sendmsg+0x60d/0x910 [ 53.124749][ T7947] ? reacquire_held_locks+0x284/0x540 [ 53.130117][ T7947] ? release_sock+0x179/0x1d0 [ 53.134787][ T7947] ? __local_bh_enable_ip+0x13a/0x240 [ 53.140150][ T7947] ? release_sock+0x179/0x1d0 [ 53.144833][ T7947] ? __fdget+0x156/0x200 [ 53.149179][ T7947] __sys_sendmmsg+0x239/0x470 [ 53.153858][ T7947] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 53.160348][ T7947] ? prepare_exit_to_usermode+0x1f7/0x580 [ 53.166051][ T7947] ? trace_irq_disable_rcuidle+0x23/0x1e0 [ 53.171763][ T7947] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 53.177200][ T7947] ? trace_irq_disable_rcuidle+0x23/0x1e0 [ 53.182896][ T7947] __x64_sys_sendmmsg+0xa0/0xb0 [ 53.187722][ T7947] do_syscall_64+0xf7/0x1c0 [ 53.192208][ T7947] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 53.198076][ T7947] RIP: 0033:0x441b59 [ 53.201948][ T7947] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 53.221717][ T7947] RSP: 002b:00007fff57c4f058 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 53.230119][ T7947] RAX: ffffffffffffffda RBX: 0000315f6576616c RCX: 0000000000441b59 [ 53.238071][ T7947] RDX: 04000000000001a8 RSI: 0000000020007fc0 RDI: 0000000000000005 [ 53.246038][ T7947] RBP: 735f656764697262 R08: 0000000001bbbbbb R09: 0000000001bbbbbb [ 53.254004][ T7947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.261971][ T7947] R13: 00000000004030f0 R14: 0000000000000000 R15: 0000000000000000