INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.31' (ECDSA) to the list of known hosts. syzkaller login: [ 30.988598] [ 30.990263] ====================================================== [ 30.996559] WARNING: possible circular locking dependency detected [ 31.002858] 4.17.0-rc1+ #12 Not tainted [ 31.006808] ------------------------------------------------------ [ 31.013134] syzkaller981725/4527 is trying to acquire lock: [ 31.018824] 00000000110136c8 (&mm->mmap_sem){++++}, at: __might_fault+0xfb/0x1e0 [ 31.026369] [ 31.026369] but task is already holding lock: [ 31.032319] 00000000e6438626 (sk_lock-AF_INET6){+.+.}, at: do_ipv6_setsockopt.isra.9+0x576/0x4660 [ 31.041329] [ 31.041329] which lock already depends on the new lock. [ 31.041329] [ 31.049641] [ 31.049641] the existing dependency chain (in reverse order) is: [ 31.057250] [ 31.057250] -> #1 (sk_lock-AF_INET6){+.+.}: [ 31.063331] lock_sock_nested+0xd0/0x120 [ 31.067898] tcp_mmap+0x1c7/0x14f0 [ 31.071941] sock_mmap+0x8e/0xc0 [ 31.075814] mmap_region+0xd13/0x1820 [ 31.080122] do_mmap+0xc79/0x11d0 [ 31.084078] vm_mmap_pgoff+0x1fb/0x2a0 [ 31.088470] ksys_mmap_pgoff+0x4c9/0x640 [ 31.093035] __x64_sys_mmap+0xe9/0x1b0 [ 31.097436] do_syscall_64+0x1b1/0x800 [ 31.101834] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.107522] [ 31.107522] -> #0 (&mm->mmap_sem){++++}: [ 31.113063] lock_acquire+0x1dc/0x520 [ 31.117376] __might_fault+0x155/0x1e0 [ 31.121775] _copy_from_user+0x30/0x150 [ 31.126264] do_ipv6_setsockopt.isra.9+0x28fd/0x4660 [ 31.131876] ipv6_setsockopt+0xbd/0x170 [ 31.136362] sctp_setsockopt+0x2da/0x7000 [ 31.141011] sock_common_setsockopt+0x9a/0xe0 [ 31.146012] __sys_setsockopt+0x1bd/0x390 [ 31.150661] __x64_sys_setsockopt+0xbe/0x150 [ 31.155580] do_syscall_64+0x1b1/0x800 [ 31.159972] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.165665] [ 31.165665] other info that might help us debug this: [ 31.165665] [ 31.173793] Possible unsafe locking scenario: [ 31.173793] [ 31.179837] CPU0 CPU1 [ 31.184488] ---- ---- [ 31.189140] lock(sk_lock-AF_INET6); [ 31.192931] lock(&mm->mmap_sem); [ 31.198973] lock(sk_lock-AF_INET6); [ 31.205293] lock(&mm->mmap_sem); [ 31.208814] [ 31.208814] *** DEADLOCK *** [ 31.208814] [ 31.214856] 2 locks held by syzkaller981725/4527: [ 31.219678] #0: 0000000051e96a4c (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 [ 31.226956] #1: 00000000e6438626 (sk_lock-AF_INET6){+.+.}, at: do_ipv6_setsockopt.isra.9+0x576/0x4660 [ 31.236397] [ 31.236397] stack backtrace: [ 31.240883] CPU: 0 PID: 4527 Comm: syzkaller981725 Not tainted 4.17.0-rc1+ #12 [ 31.248230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.257564] Call Trace: [ 31.260141] dump_stack+0x1b9/0x294 [ 31.263751] ? dump_stack_print_info.cold.2+0x52/0x52 [ 31.268927] ? print_lock+0xd1/0xd6 [ 31.272535] ? vprintk_func+0x81/0xe7 [ 31.276318] print_circular_bug.isra.36.cold.54+0x1bd/0x27d [ 31.282020] ? save_trace+0xe0/0x290 [ 31.285724] __lock_acquire+0x343e/0x5140 [ 31.289858] ? kasan_check_read+0x11/0x20 [ 31.293994] ? debug_check_no_locks_freed+0x310/0x310 [ 31.299197] ? debug_check_no_locks_freed+0x310/0x310 [ 31.304390] ? kasan_check_write+0x14/0x20 [ 31.308624] ? __mutex_lock+0x7d9/0x17f0 [ 31.312670] ? lock_downgrade+0x8e0/0x8e0 [ 31.316799] ? mutex_trylock+0x2a0/0x2a0 [ 31.320845] ? kasan_check_read+0x11/0x20 [ 31.324977] ? rcu_is_watching+0x85/0x140 [ 31.329109] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 31.334294] ? find_held_lock+0x36/0x1c0 [ 31.338341] ? graph_lock+0x170/0x170 [ 31.342123] ? graph_lock+0x170/0x170 [ 31.345903] ? graph_lock+0x170/0x170 [ 31.349689] lock_acquire+0x1dc/0x520 [ 31.353486] ? __might_fault+0xfb/0x1e0 [ 31.357459] ? lock_acquire+0x1dc/0x520 [ 31.361434] ? lock_release+0xa10/0xa10 [ 31.365400] ? check_same_owner+0x320/0x320 [ 31.369709] ? mark_held_locks+0xc9/0x160 [ 31.373843] ? __might_sleep+0x95/0x190 [ 31.377802] __might_fault+0x155/0x1e0 [ 31.381668] ? __might_fault+0xfb/0x1e0 [ 31.385626] _copy_from_user+0x30/0x150 [ 31.389594] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 31.394786] do_ipv6_setsockopt.isra.9+0x28fd/0x4660 [ 31.399878] ? do_raw_spin_unlock+0x9e/0x2e0 [ 31.404278] ? ipv6_update_options+0x390/0x390 [ 31.408852] ? debug_check_no_locks_freed+0x310/0x310 [ 31.414026] ? graph_lock+0x170/0x170 [ 31.417810] ? debug_check_no_locks_freed+0x310/0x310 [ 31.422983] ? print_usage_bug+0xc0/0xc0 [ 31.427041] ? lock_downgrade+0x8e0/0x8e0 [ 31.431179] ? mark_held_locks+0xc9/0x160 [ 31.435312] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 31.439897] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 31.444991] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 31.450010] ? pagevec_lru_move_fn+0x1e1/0x270 [ 31.454581] ? get_kernel_page+0x110/0x110 [ 31.458809] ? __lru_cache_add+0x31c/0x440 [ 31.463038] ? __pagevec_lru_add+0x30/0x30 [ 31.467272] ? mem_cgroup_usage+0x420/0x420 [ 31.471575] ? save_stack+0xa9/0xd0 [ 31.475195] ? save_stack+0x43/0xd0 [ 31.478800] ? kasan_kmalloc+0xc4/0xe0 [ 31.482680] ? kasan_slab_alloc+0x12/0x20 [ 31.486817] ? print_usage_bug+0xc0/0xc0 [ 31.490868] ? __handle_mm_fault+0x2d02/0x4310 [ 31.495446] ? handle_mm_fault+0x53a/0xc70 [ 31.499666] ? kasan_check_write+0x14/0x20 [ 31.503885] ipv6_setsockopt+0xbd/0x170 [ 31.507841] ? ipv6_setsockopt+0xbd/0x170 [ 31.511984] sctp_setsockopt+0x2da/0x7000 [ 31.516119] ? mark_held_locks+0xc9/0x160 [ 31.520254] ? page_add_new_anon_rmap+0x3ff/0x850 [ 31.525085] ? sctp_setsockopt_paddr_thresholds+0x560/0x560 [ 31.530781] ? find_held_lock+0x36/0x1c0 [ 31.534827] ? lock_downgrade+0x8e0/0x8e0 [ 31.538958] ? pudp_huge_clear_flush+0x230/0x230 [ 31.543696] ? kasan_check_read+0x11/0x20 [ 31.547824] ? do_raw_spin_unlock+0x9e/0x2e0 [ 31.552223] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 31.556787] ? kasan_check_write+0x14/0x20 [ 31.561003] ? do_raw_spin_lock+0xc1/0x200 [ 31.565222] ? _raw_spin_unlock+0x22/0x30 [ 31.569354] ? do_huge_pmd_anonymous_page+0x48d/0x1cc0 [ 31.574631] ? __thp_get_unmapped_area+0x180/0x180 [ 31.579549] ? debug_check_no_locks_freed+0x310/0x310 [ 31.584722] ? alloc_file+0x24/0x3e0 [ 31.588419] ? sock_alloc_file+0x1f3/0x4e0 [ 31.592633] ? __sys_socket+0x16f/0x250 [ 31.596602] ? do_syscall_64+0x1b1/0x800 [ 31.600645] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.605991] ? debug_mutex_init+0x1c/0x60 [ 31.610122] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 31.615122] ? graph_lock+0x170/0x170 [ 31.618903] ? pud_val+0x80/0xf0 [ 31.622255] ? pmd_val+0xf0/0xf0 [ 31.625605] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 31.631129] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 31.636656] ? __handle_mm_fault+0x93a/0x4310 [ 31.641146] ? vm_insert_mixed_mkwrite+0x40/0x40 [ 31.645895] ? graph_lock+0x170/0x170 [ 31.649678] ? graph_lock+0x170/0x170 [ 31.653458] ? find_held_lock+0x36/0x1c0 [ 31.657503] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 31.663026] ? __fget_light+0x2ef/0x430 [ 31.666989] ? fget_raw+0x20/0x20 [ 31.670428] ? lock_downgrade+0x8e0/0x8e0 [ 31.674560] ? handle_mm_fault+0x8c0/0xc70 [ 31.678784] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 31.684305] ? handle_mm_fault+0x55a/0xc70 [ 31.688524] sock_common_setsockopt+0x9a/0xe0 [ 31.693002] __sys_setsockopt+0x1bd/0x390 [ 31.697130] ? kernel_accept+0x310/0x310 [ 31.701174] ? mm_fault_error+0x380/0x380 [ 31.705305] ? __ia32_sys_fallocate+0xf0/0xf0 [ 31.709782] __x64_sys_setsockopt+0xbe/0x150 [ 31.714186] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 31.719186] do_syscall_64+0x1b1/0x800 [ 31.723063] ? syscall_return_slowpath+0x5c0/0x5c0 [ 31.727977] ? syscall_return_slowpath+0x30f/0x5c0 [ 31.732890] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 31.738411] ? retint_user+0x18/0x18 [ 31.742112] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.746944] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.752115] RIP: 0033:0x43fe59 [ 31.755295] RSP: 002b:00007ffe42754d68 EFLAGS: 00000217 ORIG_RAX: 0000000000000036 [ 31.762984] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fe59 [ 31.770235] RDX: 000000000000002c RSI: 0000000000000029 RDI: 0000000000000004 [ 31.777500] RBP: 00000000006ca018 R08: 0000000000000108 R09: 00000000004002c8 [ 31.784759] R10: 0000000020000180 R11: 0000000000000217 R12: 0000000000401780 [