forked to background, child pid 961 Starting sshd: OK syzkaller syzkaller login: [ 27.692747][ T1060] cgroup: Unknown subsys name 'net' [ 27.814319][ T1060] cgroup: Unknown subsys name 'rlimit' [ 27.959532][ T1068] modprobe (1068) used greatest stack depth: 11752 bytes left [ 30.128521][ T1062] syz-executor.0 (1062) used greatest stack depth: 10896 bytes left Warning: Permanently added '10.128.10.47' (ED25519) to the list of known hosts. 2023/10/15 21:14:48 ignoring optional flag "sandboxArg"="0" 2023/10/15 21:14:48 parsed 1 programs 2023/10/15 21:14:48 executed programs: 0 2023/10/15 21:14:53 executed programs: 4 2023/10/15 21:14:58 executed programs: 12 2023/10/15 21:15:03 executed programs: 20 2023/10/15 21:15:09 executed programs: 29 2023/10/15 21:15:14 executed programs: 36 2023/10/15 21:15:19 executed programs: 43 2023/10/15 21:15:24 executed programs: 49 2023/10/15 21:15:29 executed programs: 55 2023/10/15 21:15:34 executed programs: 61 2023/10/15 21:15:39 executed programs: 67 2023/10/15 21:15:44 executed programs: 73 2023/10/15 21:15:49 executed programs: 79 2023/10/15 21:15:54 executed programs: 86 [ 116.565377][ T2413] [ 116.567736][ T2413] ====================================================== [ 116.574737][ T2413] WARNING: possible circular locking dependency detected [ 116.581729][ T2413] 6.1.58-syzkaller #0 Not tainted [ 116.586723][ T2413] ------------------------------------------------------ [ 116.593740][ T2413] syz-executor.0/2413 is trying to acquire lock: [ 116.600029][ T2413] ffff888110fbb8e0 (&rs->rs_recv_lock){....}-{2:2}, at: rds_wake_sk_sleep+0x17/0x50 [ 116.609371][ T2413] [ 116.609371][ T2413] but task is already holding lock: [ 116.616711][ T2413] ffff888100fdad00 (&rm->m_rs_lock){....}-{2:2}, at: rds_send_remove_from_sock+0x6b/0x300 [ 116.626691][ T2413] [ 116.626691][ T2413] which lock already depends on the new lock. [ 116.626691][ T2413] [ 116.637058][ T2413] [ 116.637058][ T2413] the existing dependency chain (in reverse order) is: [ 116.646133][ T2413] [ 116.646133][ T2413] -> #1 (&rm->m_rs_lock){....}-{2:2}: [ 116.653662][ T2413] _raw_spin_lock_irqsave+0x5d/0x90 [ 116.659382][ T2413] rds_message_put+0x69/0x3b0 [ 116.664554][ T2413] rds_clear_recv_queue+0xab/0xe0 [ 116.670235][ T2413] rds_release+0x50/0x130 [ 116.675279][ T2413] sock_close+0x42/0xd0 [ 116.680015][ T2413] __fput+0xe1/0x210 [ 116.684423][ T2413] task_work_run+0x79/0xa0 [ 116.689590][ T2413] exit_to_user_mode_loop+0xd2/0xe0 [ 116.695272][ T2413] exit_to_user_mode_prepare+0x9a/0xe0 [ 116.701512][ T2413] syscall_exit_to_user_mode+0x5e/0x210 [ 116.707558][ T2413] do_syscall_64+0x49/0x80 [ 116.712557][ T2413] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 116.718945][ T2413] [ 116.718945][ T2413] -> #0 (&rs->rs_recv_lock){....}-{2:2}: [ 116.726806][ T2413] __lock_acquire+0x1464/0x2830 [ 116.732154][ T2413] lock_acquire+0xe3/0x270 [ 116.737224][ T2413] _raw_read_lock_irqsave+0x65/0xa0 [ 116.743005][ T2413] rds_wake_sk_sleep+0x17/0x50 [ 116.748277][ T2413] rds_send_remove_from_sock+0x9e/0x300 [ 116.754309][ T2413] rds_send_path_drop_acked+0x78/0x130 [ 116.760255][ T2413] rds_tcp_write_space+0xb0/0x210 [ 116.765799][ T2413] tcp_check_space+0x17d/0x200 [ 116.771049][ T2413] tcp_rcv_established+0x4e6/0x620 [ 116.776651][ T2413] tcp_v4_do_rcv+0xdb/0x2c0 [ 116.781659][ T2413] __release_sock+0x92/0x120 [ 116.786733][ T2413] release_sock+0x27/0xa0 [ 116.791547][ T2413] rds_send_xmit+0x683/0x970 [ 116.796622][ T2413] rds_sendmsg+0x9ab/0xb30 [ 116.801617][ T2413] ____sys_sendmsg+0x182/0x220 [ 116.806872][ T2413] ___sys_sendmsg+0x28f/0x2d0 [ 116.812120][ T2413] __se_sys_sendmsg+0xf4/0x130 [ 116.817460][ T2413] do_syscall_64+0x3d/0x80 [ 116.822364][ T2413] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 116.828743][ T2413] [ 116.828743][ T2413] other info that might help us debug this: [ 116.828743][ T2413] [ 116.839039][ T2413] Possible unsafe locking scenario: [ 116.839039][ T2413] [ 116.846482][ T2413] CPU0 CPU1 [ 116.851816][ T2413] ---- ---- [ 116.857147][ T2413] lock(&rm->m_rs_lock); [ 116.861441][ T2413] lock(&rs->rs_recv_lock); [ 116.868512][ T2413] lock(&rm->m_rs_lock); [ 116.875414][ T2413] lock(&rs->rs_recv_lock); [ 116.880052][ T2413] [ 116.880052][ T2413] *** DEADLOCK *** [ 116.880052][ T2413] [ 116.888164][ T2413] 3 locks held by syz-executor.0/2413: [ 116.893583][ T2413] #0: ffff888101b9a470 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sock_set_cork+0xe/0x90 [ 116.903436][ T2413] #1: ffff888101b9a6f8 (k-clock-AF_INET){++.-}-{2:2}, at: rds_tcp_write_space+0x1c/0x210 [ 116.913475][ T2413] #2: ffff888100fdad00 (&rm->m_rs_lock){....}-{2:2}, at: rds_send_remove_from_sock+0x6b/0x300 [ 116.923770][ T2413] [ 116.923770][ T2413] stack backtrace: [ 116.929710][ T2413] CPU: 0 PID: 2413 Comm: syz-executor.0 Not tainted 6.1.58-syzkaller #0 [ 116.938090][ T2413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 116.948310][ T2413] Call Trace: [ 116.951575][ T2413] [ 116.954708][ T2413] dump_stack_lvl+0x89/0xd7 [ 116.959264][ T2413] print_circular_bug+0x2c5/0x300 [ 116.964356][ T2413] check_noncircular+0x106/0x110 [ 116.969260][ T2413] __lock_acquire+0x1464/0x2830 [ 116.974082][ T2413] ? debug_check_no_obj_freed+0xc3/0x260 [ 116.979723][ T2413] ? _raw_spin_unlock_irqrestore+0x3f/0xb0 [ 116.985503][ T2413] ? rds_wake_sk_sleep+0x17/0x50 [ 116.990602][ T2413] lock_acquire+0xe3/0x270 [ 116.994987][ T2413] ? rds_wake_sk_sleep+0x17/0x50 [ 116.999922][ T2413] _raw_read_lock_irqsave+0x65/0xa0 [ 117.005098][ T2413] ? rds_wake_sk_sleep+0x17/0x50 [ 117.010002][ T2413] rds_wake_sk_sleep+0x17/0x50 [ 117.014907][ T2413] rds_send_remove_from_sock+0x9e/0x300 [ 117.020514][ T2413] ? lockdep_hardirqs_on+0x94/0xf0 [ 117.025595][ T2413] ? rds_tcp_write_space+0x210/0x210 [ 117.031115][ T2413] rds_send_path_drop_acked+0x78/0x130 [ 117.036715][ T2413] ? datagram_poll+0xe0/0xe0 [ 117.041454][ T2413] rds_tcp_write_space+0xb0/0x210 [ 117.046758][ T2413] tcp_check_space+0x17d/0x200 [ 117.051661][ T2413] tcp_rcv_established+0x4e6/0x620 [ 117.056774][ T2413] tcp_v4_do_rcv+0xdb/0x2c0 [ 117.061241][ T2413] __release_sock+0x92/0x120 [ 117.065836][ T2413] release_sock+0x27/0xa0 [ 117.070487][ T2413] rds_send_xmit+0x683/0x970 [ 117.075163][ T2413] rds_sendmsg+0x9ab/0xb30 [ 117.079544][ T2413] ? aa_sk_perm+0x215/0x290 [ 117.084099][ T2413] ____sys_sendmsg+0x182/0x220 [ 117.089197][ T2413] ___sys_sendmsg+0x28f/0x2d0 [ 117.093851][ T2413] ? preempt_schedule+0x4f/0x60 [ 117.098937][ T2413] __se_sys_sendmsg+0xf4/0x130 [ 117.103677][ T2413] do_syscall_64+0x3d/0x80 [ 117.108069][ T2413] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 117.114060][ T2413] RIP: 0033:0x7f66b9c7c959 [ 117.118527][ T2413] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 117.138447][ T2413] RSP: 002b:00007f66baa6d0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 117.147007][ T2413] RAX: ffffffffffffffda RBX: 00007f66b9d9bf80 RCX: 00007f66b9c7c959 [ 117.155199][ T2413] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 [ 117.163148][ T2413] RBP: 00007f66b9cd8c88 R08: 0000000000000000 R09: 0000000000000000 [ 117.171088][ T2413] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 117.179026][ T2413] R13: 0000000000000006 R14: 00007f66b9d9bf80 R15: 00007ffd7fddd888 [ 117.186966][ T2413] 2023/10/15 21:16:00 executed programs: 95 2023/10/15 21:16:05 executed programs: 101