[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[ 55.188705][ T26] audit: type=1800 audit(1568793824.126:25): pid=8604 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0
[ 55.226056][ T26] audit: type=1800 audit(1568793824.126:26): pid=8604 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0
[ 55.259019][ T26] audit: type=1800 audit(1568793824.126:27): pid=8604 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Debian GNU/Linux 7 syzkaller ttyS0
Warning: Permanently added '10.128.0.72' (ECDSA) to the list of known hosts.
syzkaller login: [ 63.726519][ T8758] IPVS: ftp: loaded support on port[0] = 21
[ 63.781238][ T8758] chnl_net:caif_netlink_parms(): no params data found
[ 63.806627][ T8758] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.814641][ T8758] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.822448][ T8758] device bridge_slave_0 entered promiscuous mode
[ 63.830577][ T8758] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.837786][ T8758] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.845446][ T8758] device bridge_slave_1 entered promiscuous mode
[ 63.863545][ T8758] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 63.874208][ T8758] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 63.893643][ T8758] team0: Port device team_slave_0 added
[ 63.900870][ T8758] team0: Port device team_slave_1 added
[ 63.968821][ T8758] device hsr_slave_0 entered promiscuous mode
[ 64.027260][ T8758] device hsr_slave_1 entered promiscuous mode
[ 64.105183][ T8758] bridge0: port 2(bridge_slave_1) entered blocking state
[ 64.112508][ T8758] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 64.120410][ T8758] bridge0: port 1(bridge_slave_0) entered blocking state
[ 64.127529][ T8758] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 64.162954][ T8758] 8021q: adding VLAN 0 to HW filter on device bond0
[ 64.173980][ T3516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 64.194314][ T3516] bridge0: port 1(bridge_slave_0) entered disabled state
[ 64.202844][ T3516] bridge0: port 2(bridge_slave_1) entered disabled state
[ 64.212257][ T3516] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 64.223932][ T8758] 8021q: adding VLAN 0 to HW filter on device team0
[ 64.234999][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 64.243878][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 64.251306][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 64.268213][ T3516] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 64.276968][ T3516] bridge0: port 2(bridge_slave_1) entered blocking state
[ 64.284047][ T3516] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 64.294322][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 64.305349][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 64.321971][ T8758] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 64.333351][ T8758] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 64.345973][ T3014] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 64.354812][ T3014] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 64.364670][ T3014] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
executing program
[ 64.373306][ T3014] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 64.391056][ T8758] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 64.428090][ T8758] netlink: 80 bytes leftover after parsing attributes in process `syz-executor236'.
[ 64.437806][ T8758] netlink: 48 bytes leftover after parsing attributes in process `syz-executor236'.
[ 64.458826][ T8758]
[ 64.461394][ T8758] =============================
[ 64.466562][ T8758] WARNING: suspicious RCU usage
[ 64.471489][ T8758] 5.3.0-rc8+ #0 Not tainted
[ 64.475998][ T8758] -----------------------------
[ 64.480925][ T8758] include/net/sch_generic.h:492 suspicious rcu_dereference_check() usage!
[ 64.489453][ T8758]
[ 64.489453][ T8758] other info that might help us debug this:
[ 64.489453][ T8758]
[ 64.499727][ T8758]
[ 64.499727][ T8758] rcu_scheduler_active = 2, debug_locks = 1
[ 64.507835][ T8758] 3 locks held by syz-executor236/8758:
[ 64.513368][ T8758] #0: 0000000047734a2b (rcu_read_lock_bh){....}, at: ip_finish_output2+0x2dc/0x2570
[ 64.523014][ T8758] #1: 0000000047734a2b (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x20a/0x35b0
[ 64.532511][ T8758] #2: 00000000591ce20c (&(&sch->q.lock)->rlock){+...}, at: __dev_queue_xmit+0x14b0/0x35b0
[ 64.542617][ T8758]
[ 64.542617][ T8758] stack backtrace:
[ 64.548590][ T8758] CPU: 1 PID: 8758 Comm: syz-executor236 Not tainted 5.3.0-rc8+ #0
[ 64.556459][ T8758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 64.566502][ T8758] Call Trace:
[ 64.569828][ T8758] dump_stack+0x172/0x1f0
[ 64.574139][ T8758] lockdep_rcu_suspicious+0x153/0x15d
[ 64.579495][ T8758] netem_enqueue+0x1cfb/0x2d80
[ 64.584235][ T8758] ? lock_acquire+0x190/0x410
[ 64.588889][ T8758] ? __dev_queue_xmit+0x14b0/0x35b0
[ 64.594068][ T8758] __dev_queue_xmit+0x157e/0x35b0
[ 64.599089][ T8758] ? __kasan_check_read+0x11/0x20
[ 64.604090][ T8758] ? __lock_acquire+0x1702/0x4c30
[ 64.609095][ T8758] ? netdev_core_pick_tx+0x2f0/0x2f0
[ 64.614357][ T8758] ? match_held_lock+0x500/0x510
[ 64.619271][ T8758] ? __ip_finish_output+0x5fc/0xb90
[ 64.624448][ T8758] ? lock_downgrade+0x920/0x920
[ 64.629274][ T8758] ? ip_finish_output2+0x13e2/0x2570
[ 64.634544][ T8758] ? __ip_finish_output+0x5fc/0xb90
[ 64.639716][ T8758] ? ip_finish_output2+0x13e2/0x2570
[ 64.644992][ T8758] dev_queue_xmit+0x18/0x20
[ 64.649491][ T8758] ? dev_queue_xmit+0x18/0x20
[ 64.654156][ T8758] ip_finish_output2+0x1726/0x2570
[ 64.659246][ T8758] ? nf_ct_deliver_cached_events+0x23d/0x6e0
[ 64.665206][ T8758] ? ip_frag_next+0x910/0x910
[ 64.669861][ T8758] ? ip_mc_output+0xb31/0xf40
[ 64.674524][ T8758] __ip_finish_output+0x5fc/0xb90
[ 64.679527][ T8758] ? __ip_finish_output+0x5fc/0xb90
[ 64.684701][ T8758] ? audit_remove_watch_rule+0x50/0x340
[ 64.690222][ T8758] ip_finish_output+0x38/0x1f0
[ 64.694963][ T8758] ip_mc_output+0x292/0xf40
[ 64.699450][ T8758] ? __ip_queue_xmit+0x1bd0/0x1bd0
[ 64.704540][ T8758] ? __ip_finish_output+0xb90/0xb90
[ 64.709712][ T8758] ? ip_make_skb+0x1b1/0x2c0
[ 64.714276][ T8758] ? ip_reply_glue_bits+0xc0/0xc0
[ 64.719280][ T8758] ip_local_out+0xbb/0x190
[ 64.723674][ T8758] ip_send_skb+0x42/0xf0
[ 64.727895][ T8758] udp_send_skb.isra.0+0x6b2/0x1160
[ 64.733095][ T8758] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 64.739359][ T8758] udp_sendmsg+0x1e96/0x2820
[ 64.743997][ T8758] ? ip_reply_glue_bits+0xc0/0xc0
[ 64.749011][ T8758] ? udp_unicast_rcv_skb.isra.0+0x360/0x360
[ 64.754890][ T8758] ? find_held_lock+0x35/0x130
[ 64.759633][ T8758] ? __might_fault+0x12b/0x1e0
[ 64.764390][ T8758] ? ___might_sleep+0x163/0x280
[ 64.769286][ T8758] ? debug_lockdep_rcu_enabled+0x71/0xa0
[ 64.774948][ T8758] ? aa_sk_perm+0x288/0x880
[ 64.779503][ T8758] ? aa_sock_msg_perm.isra.0+0xba/0x170
[ 64.785033][ T8758] inet_sendmsg+0x9e/0xe0
[ 64.789341][ T8758] ? inet_sendmsg+0x9e/0xe0
[ 64.793819][ T8758] ? inet_send_prepare+0x4f0/0x4f0
[ 64.798921][ T8758] sock_sendmsg+0xd7/0x130
[ 64.803318][ T8758] ___sys_sendmsg+0x3e2/0x920
[ 64.807974][ T8758] ? copy_msghdr_from_user+0x440/0x440
[ 64.813421][ T8758] ? __kasan_check_read+0x11/0x20
[ 64.818426][ T8758] ? __kasan_check_read+0x11/0x20
[ 64.823427][ T8758] ? __lock_acquire+0x1702/0x4c30
[ 64.828448][ T8758] ? mark_held_locks+0xf0/0xf0
[ 64.833299][ T8758] ? __might_fault+0x12b/0x1e0
[ 64.838057][ T8758] ? find_held_lock+0x35/0x130
[ 64.842822][ T8758] ? __might_fault+0x12b/0x1e0
[ 64.847589][ T8758] ? lock_downgrade+0x920/0x920
[ 64.852437][ T8758] ? ___might_sleep+0x163/0x280
[ 64.857265][ T8758] __sys_sendmmsg+0x1bf/0x4d0
[ 64.861923][ T8758] ? __ia32_sys_sendmsg+0xb0/0xb0
[ 64.866945][ T8758] ? release_sock+0x156/0x1c0
[ 64.871609][ T8758] ? __sys_connect+0x12d/0x330
[ 64.876348][ T8758] ? __ia32_sys_accept+0xb0/0xb0
[ 64.881269][ T8758] ? trace_hardirqs_on_thunk+0x1a/0x20
[ 64.886727][ T8758] ? trace_hardirqs_on_thunk+0x1a/0x20
[ 64.892163][ T8758] ? do_syscall_64+0x26/0x6a0
[ 64.896819][ T8758] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 64.902870][ T8758] ? do_syscall_64+0x26/0x6a0
[ 64.907546][ T8758] __x64_sys_sendmmsg+0x9d/0x100
[ 64.912466][ T8758] do_syscall_64+0xfd/0x6a0
[ 64.916951][ T8758] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 64.922822][ T8758] RIP: 0033:0x4422d9
[ 64.926710][ T8758] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
[ 64.946420][ T8758] RSP: 002b:00007ffea3275068 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 64.954806][ T8758] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004422d9
[ 64.962766][ T8758] RDX: 04000000000001a8 RSI: 0000000020007fc0 RDI: 0000000000000005
[ 64.970716][ T8758] RBP: 00007ffea3275090 R08: 0000000000000400 R09: 0000000000000400
[ 64.978666][ T8758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 64.986615][ T8758] R13: 0000000000403870 R14: 0000000000000000 R15: 0000000000000000