[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 56.838789][ T26] audit: type=1800 audit(1568583852.974:25): pid=8702 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 56.885273][ T26] audit: type=1800 audit(1568583852.974:26): pid=8702 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 56.923401][ T26] audit: type=1800 audit(1568583852.974:27): pid=8702 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.95' (ECDSA) to the list of known hosts. syzkaller login: [ 67.201153][ T8855] IPVS: ftp: loaded support on port[0] = 21 [ 67.268486][ T8855] chnl_net:caif_netlink_parms(): no params data found [ 67.295188][ T8855] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.304550][ T8855] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.312663][ T8855] device bridge_slave_0 entered promiscuous mode [ 67.320811][ T8855] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.328276][ T8855] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.336236][ T8855] device bridge_slave_1 entered promiscuous mode [ 67.353347][ T8855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.364260][ T8855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.384203][ T8855] team0: Port device team_slave_0 added [ 67.391723][ T8855] team0: Port device team_slave_1 added [ 67.457986][ T8855] device hsr_slave_0 entered promiscuous mode [ 67.507333][ T8855] device hsr_slave_1 entered promiscuous mode [ 67.584094][ T8855] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.591470][ T8855] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.599375][ T8855] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.606482][ T8855] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.643167][ T8855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.655406][ T8857] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 67.665069][ T8857] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.674538][ T8857] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.683299][ T8857] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 67.696280][ T8855] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.717418][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.726551][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.733890][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.743119][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.752198][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.759444][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.774144][ T8857] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.784093][ T8857] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.795458][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.812342][ T8855] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 67.824085][ T8855] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.836050][ T8857] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready executing program [ 67.844652][ T8857] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.854362][ T8857] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.872648][ T8855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.909525][ T8855] netlink: 80 bytes leftover after parsing attributes in process `syz-executor427'. [ 67.919792][ T8855] netlink: 48 bytes leftover after parsing attributes in process `syz-executor427'. [ 67.931503][ T8855] [ 67.933927][ T8855] ============================= [ 67.938910][ T8855] WARNING: suspicious RCU usage [ 67.943756][ T8855] 5.3.0-rc7+ #0 Not tainted [ 67.948290][ T8855] ----------------------------- [ 67.953139][ T8855] include/net/sch_generic.h:492 suspicious rcu_dereference_check() usage! [ 67.961654][ T8855] [ 67.961654][ T8855] other info that might help us debug this: [ 67.961654][ T8855] [ 67.972080][ T8855] [ 67.972080][ T8855] rcu_scheduler_active = 2, debug_locks = 1 [ 67.980169][ T8855] 3 locks held by syz-executor427/8855: [ 67.985922][ T8855] #0: 00000000b5525c01 (rcu_read_lock_bh){....}, at: ip_finish_output2+0x2dc/0x2570 [ 67.995475][ T8855] #1: 00000000b5525c01 (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x20a/0x3650 [ 68.005213][ T8855] #2: 00000000364bae92 (&(&sch->q.lock)->rlock){+.-.}, at: __dev_queue_xmit+0x14b8/0x3650 [ 68.015498][ T8855] [ 68.015498][ T8855] stack backtrace: [ 68.021435][ T8855] CPU: 0 PID: 8855 Comm: syz-executor427 Not tainted 5.3.0-rc7+ #0 [ 68.029511][ T8855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.040588][ T8855] Call Trace: [ 68.043878][ T8855] dump_stack+0x172/0x1f0 [ 68.048202][ T8855] lockdep_rcu_suspicious+0x153/0x15d [ 68.053572][ T8855] netem_enqueue+0x1cfb/0x2d80 [ 68.058323][ T8855] ? lock_acquire+0x190/0x410 [ 68.063090][ T8855] ? __dev_queue_xmit+0x14b8/0x3650 [ 68.068471][ T8855] __dev_queue_xmit+0x15d2/0x3650 [ 68.073580][ T8855] ? __kasan_check_read+0x11/0x20 [ 68.078592][ T8855] ? __lock_acquire+0x1702/0x4c30 [ 68.083614][ T8855] ? netdev_core_pick_tx+0x2f0/0x2f0 [ 68.088899][ T8855] ? match_held_lock+0x4e0/0x510 [ 68.093918][ T8855] ? __ip_finish_output+0x5fc/0xb90 [ 68.099110][ T8855] ? lock_downgrade+0x920/0x920 [ 68.104552][ T8855] ? ip_finish_output2+0x13e2/0x2570 [ 68.109834][ T8855] ? __ip_finish_output+0x5fc/0xb90 [ 68.115015][ T8855] ? ip_finish_output2+0x13e2/0x2570 [ 68.120292][ T8855] dev_queue_xmit+0x18/0x20 [ 68.124780][ T8855] ? dev_queue_xmit+0x18/0x20 [ 68.129584][ T8855] ip_finish_output2+0x1726/0x2570 [ 68.134700][ T8855] ? nf_ct_deliver_cached_events+0x23d/0x6e0 [ 68.140699][ T8855] ? ip_frag_next+0x910/0x910 [ 68.145365][ T8855] ? ip_mc_output+0xb31/0xf40 [ 68.150035][ T8855] __ip_finish_output+0x5fc/0xb90 [ 68.155046][ T8855] ? __ip_finish_output+0x5fc/0xb90 [ 68.160244][ T8855] ? audit_alloc_mark+0x3d0/0x500 [ 68.165272][ T8855] ip_finish_output+0x38/0x1f0 [ 68.170630][ T8855] ip_mc_output+0x292/0xf40 [ 68.175123][ T8855] ? __ip_queue_xmit+0x1bd0/0x1bd0 [ 68.180248][ T8855] ? __ip_finish_output+0xb90/0xb90 [ 68.185653][ T8855] ? ip_make_skb+0x1b1/0x2c0 [ 68.190323][ T8855] ? ip_reply_glue_bits+0xc0/0xc0 [ 68.195336][ T8855] ip_local_out+0xbb/0x190 [ 68.199843][ T8855] ip_send_skb+0x42/0xf0 [ 68.204251][ T8855] udp_send_skb.isra.0+0x6b2/0x1160 [ 68.209447][ T8855] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 68.215683][ T8855] udp_sendmsg+0x1e96/0x2820 [ 68.220377][ T8855] ? ip_reply_glue_bits+0xc0/0xc0 [ 68.225480][ T8855] ? udp_push_pending_frames+0xf0/0xf0 [ 68.230927][ T8855] ? find_held_lock+0x35/0x130 [ 68.235683][ T8855] ? __might_fault+0x12b/0x1e0 [ 68.240454][ T8855] ? ___might_sleep+0x163/0x280 [ 68.245391][ T8855] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 68.251229][ T8855] ? aa_sk_perm+0x288/0x880 [ 68.255812][ T8855] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 68.261352][ T8855] inet_sendmsg+0x9e/0xe0 [ 68.265670][ T8855] ? inet_sendmsg+0x9e/0xe0 [ 68.270162][ T8855] ? inet_send_prepare+0x4f0/0x4f0 [ 68.275267][ T8855] sock_sendmsg+0xd7/0x130 [ 68.279679][ T8855] ___sys_sendmsg+0x3e2/0x920 [ 68.284358][ T8855] ? copy_msghdr_from_user+0x440/0x440 [ 68.289810][ T8855] ? ip_route_output_key_hash+0x224/0x360 [ 68.295790][ T8855] ? __kasan_check_read+0x11/0x20 [ 68.300891][ T8855] ? __lock_acquire+0x1702/0x4c30 [ 68.306012][ T8855] ? mark_held_locks+0xf0/0xf0 [ 68.310852][ T8855] ? __might_fault+0x12b/0x1e0 [ 68.315711][ T8855] ? find_held_lock+0x35/0x130 [ 68.320483][ T8855] ? __might_fault+0x12b/0x1e0 [ 68.325266][ T8855] ? lock_downgrade+0x920/0x920 [ 68.330111][ T8855] ? ___might_sleep+0x163/0x280 [ 68.334950][ T8855] __sys_sendmmsg+0x1bf/0x4d0 [ 68.339703][ T8855] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 68.344719][ T8855] ? release_sock+0x156/0x1c0 [ 68.349593][ T8855] ? __sys_connect+0x12d/0x330 [ 68.354434][ T8855] ? __ia32_sys_accept+0xb0/0xb0 [ 68.359456][ T8855] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 68.364902][ T8855] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 68.370525][ T8855] ? do_syscall_64+0x26/0x6a0 [ 68.375277][ T8855] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 68.381332][ T8855] ? do_syscall_64+0x26/0x6a0 [ 68.386001][ T8855] __x64_sys_sendmmsg+0x9d/0x100 [ 68.390927][ T8855] do_syscall_64+0xfd/0x6a0 [ 68.395422][ T8855] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 68.401399][ T8855] RIP: 0033:0x441b59 [ 68.405283][ T8855] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 68.425225][ T8855] RSP: 002b:00007ffeb08eb168 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 68.433647][ T8855] RAX: ffffffffffffffda RBX: 0000315f6576616c RCX: 0000000000441b59 [ 68.441767][ T8855] RDX: 04000000000001a8 RSI: 0000000020007fc0 RDI: 0000000000000005 [ 68.449890][ T8855] RBP: 735f656764697262 R08: 0000000001bbbbbb R09: 0000000001bbbbbb [ 68.457854][ T8855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.465909][ T8855] R13: 00000000004030f0 R14: 0000000000000000 R15: 0000000000000000